mirror of
https://github.com/torvalds/linux.git
synced 2026-10-08 03:26:02 +02:00
1b78070aae
1480954 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
1b78070aae |
Including fixes from Bluetooth, IPSec and Netfilter.
Current release - fix to a fix:
- netfilter: ipset: remove need to allocate memory on delete operations
Current release - regressions:
- macb: drop CONFIG_OF #if block, fix build
Previous releases - always broken:
- stream of fixes for SCTP continues
- inet: frags: strip GSO state from fragments before reassembly
- virtio-net: ensure that TCP packets don't overflow gso_segs
- tcp-ao: fix use-after-free of current_key on reconnect to another peer
- page_pool: remove zone/policy GFP flags when allocating XArray entries
- Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
- tls: device: fix out-of-bounds write in tls_append_frag()
- eth: bnxt:
- ring the doorbell when SW USO exits early, avoid packets stuck in Tx
- gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid users
of older NICs seeing non-actionable warning messages
- eth: qede: fix NULL pointer dereference in TPA fragment processing
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmqQojwACgkQMUZtbf5S
Irv2kg//anC58qIya/Tx3BZkpPgtbS+ki0bqb+J0a8axbItgSGEdclVtiLJn/ex0
zz9AR4Pt2DSbSUHPa7nRpdMQ2x7ZmNwNR2zqs1xClgOm5QD/2JAc53Pv81GaEKa4
O4A4TDJZfyTDsk6c0cjI3yz9uMqBt2U6pyAT6JMBIPy7/MgV+as0ETAWQlezL0sF
ZnXVg9tM3hG/8a3M88+/S1VODVJYLMucXS6pD1mqlry01SUj91elEXKiac5vCaHI
DAZaiCOmv4WV3hs7941VijPchLO64L0J+0qjGRpXiPJXQEAn4XU8QX/YNc1njgZH
tmjRWEEtLoBFcLRDUPAK9niuB5F9N3/6nnydLPLu16+exKQuCB8Bh78YHLmlrJIW
utY5ek7GtPOl31M9a5TdEGLUg5wPHSO62FhiBmTiIG4PKQym616TmOHbYJWBqFry
EPNtZ1vEJoPFNOsT1VdeD4DKVBq2UDnj/3fnphUhfvU5z+dEDdIn03+kQykwmVQT
kTuMaW4/zxR3VFjHalsI+4bvhFOEmu+/KZE07aKKm99jssDsewQHGXgYJkCPWQUk
gpnN8IVNw16ex9sfrvqje6/tshiPJJn9y/b/nGt5mq9ofgwXGmpzCPwcDgyzZKQ5
y+zVPJ0/XILHAHOBxdCklim5xiaPDYKdEI+zcEXrx/g6FraZZuI=
=1DXR
-----END PGP SIGNATURE-----
Merge tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from Bluetooth, IPSec and Netfilter.
Current release - fix to a fix:
- netfilter: ipset: remove need to allocate memory on delete operations
Current release - regressions:
- macb: drop CONFIG_OF #if block, fix build
Previous releases - always broken:
- stream of fixes for SCTP continues
- inet: frags: strip GSO state from fragments before reassembly
- virtio-net: ensure that TCP packets don't overflow gso_segs
- tcp-ao: fix use-after-free of current_key on reconnect to another
peer
- page_pool: remove zone/policy GFP flags when allocating XArray
entries
- Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
- tls: device: fix out-of-bounds write in tls_append_frag()
- eth: bnxt:
- ring the doorbell when SW USO exits early, avoid packets stuck
in Tx
- gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid
users of older NICs seeing non-actionable warning messages
- eth: qede: fix NULL pointer dereference in TPA fragment processing"
* tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits)
inet: frags: strip GSO state from fragments before reassembly
net/sched: sch_htb: limit htb_classify inner-class filter hops
selftests/net: packetdrill: add tcp_urg_ptr_retransmit
tcp: fix corruption of urgent data on multi-segment retransmit
usb: atm: usbatm: fix invalid ci_range initialization
net: fec: only stop PTP if it was initialized
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
net: dsa: mxl862xx: enable assisted learning on CPU port
net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
net: stmmac: drop gso_enabled_types and rely on netdev features
net: stmmac: selftests: Don't test flow control for small rx fifos
net: stmmac: selftests: Account for the UC filter list for filtering tests
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
net: stmmac: selftests: Check multiple MMC counters
selftests: net: Fix slow configurations in big_tcp_tunnels.sh
selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh
...
|
||
|
Jakub Kicinski
|
4a9d62a877 |
netfilter pull request 26-08-27
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEjF9xRqF1emXiQiqU1w0aZmrPKyEFAmqQRZIACgkQ1w0aZmrP
KyGDXw/9G1jVJaet7bUaiAkQRIFgyarOE7VZXtUcKpxXfRBBghWfyEN3AO9VTuVj
/tQBwZUGWZnSrBOaLlTS95xD7A3TX+iQ9aMagiH6tVXGDRq3tQFxZim4BP7drdl8
R6DV1VwwHHQSeb3vMTcXPCK/W1RtMrhdkJOe8olxHp7KAfrnJl7YANdwT508PAh3
D4Wn0NWQrneEfwe31p7weMQy+w9sh5qSPb3petdwI7an9gCwhiovEtkF0X0EfkbK
OMorNc/dx56cabwI+U0y2LGn+4lJTz8U5+Z9S/KI1+x/vo1pkeeyEN5jdq9Jcuf/
Y7q08n1DbBrbbXehfe0u22ttVaENarf7SJhduw4nEOw4oIngfET/FNMbcfsj1uw4
CvRwL5hV+waI2taOdw4M1MJh0W3qU/IN+dhhigcseAacneoGULOWT9+rynNM/yKe
cfxmtFU7TFbp9L9tX6/NR1rs6Bv7oAFv98sjsGsdyhxsIZONm/KhX+CYNKfkOZmV
o8x198CR68Vb+aQTJFL6wJuX9lntMoXjazBYKQxGnzoShywsIKnOKHkvcRMofyT0
pgzXxlt9W94fnWmxwLoCdhedQjipb0GwG4pSm425nLz8GHOX+Gh+2oFayfzC6kvB
Gj41ozdfM1VQ0SI6fRr+GA2zQNIBzAQTtwT9y6VVK10ZFyR0fwU=
=Wak/
-----END PGP SIGNATURE-----
Merge tag 'nf-26-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says:
====================
Netfilter fixes for net
The following patchset contains Netfilter fixes for net:
1) Use DEBUG_NET_WARN_ON_ONCE() instead of WARN_ON() from the tproxy
datapath, a recent bug found a way to reach WARN_ON from datapath
due to insufficient validation of xt_TPROTO checkentry.
From Fernando F. Mancera.
2) Similar to previous patch to replace WARN_ON_ONCE by
DEBUG_NET_WARN_ON_ONCE() for connlimit. Not known issue, but
since this patch has been around for a while, let's merge it.
Also from Fernando.
3) Move nf_tables harware offload commit path after chain blob
and audit to reduce chances of leaving the hardware in
inconsistent state.
4) Add missing vzeroupper to nf_tables pipapo AVX2 to address
performace degradation to later user of SSE code,
from Eric Biggers.
5) Remove pr_debug() in x_tables extensions, a recent bogus found a
way to print a unsanitized string in xt_IDLETIMER, many of these
pr_debug() calls are there for historical reasons.
6) Use pr_info_ratelimited() in x_tables .checkentry.
7) Fix an imbalance in module refcount due to incorrect override
expression logic with sets. Remove unnecessary clone in control
plane, use the existing expressions provided by set or dynset
expression. Release override expressions only.
8) Tigthen nf_tables device name removal, it is possible to remove
prefix strings with exact device name. From Fernando F. Mancera.
9) Set on the set dead bit earlier, otherwise it is possible to
call .commit on deleted sets. This also addresses the
re-introduction of a bug.
* tag 'nf-26-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
netfilter: nf_tables: remove leftover set_update_list
netfilter: nf_tables: set on dead bit when performing early element removal
netfilter: nf_tables: skip double clone set expressions on element insert
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
netfilter: x_tables: remove pr_debug
netfilter: nft_set_pipapo_avx2: add missing vzeroupper
netfilter: nf_tables: move hardware offload step after building the chain blob
netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count limit
netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks
====================
Link: https://patch.msgid.link/20260827141733.423453-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||
|
Linus Torvalds
|
3ba13f5e71 |
Devicetree fixes for v7.3, part 1:
- Fix possible out-of-bounds access in of_alias_scan() - Fix refcount leak in of_irq_get_affinity() - Add Qualcomm SPMI PMIC haptics input which is already referenced -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEktVUI4SxYhzZyEuo+vtdtY28YcMFAmqQfDwACgkQ+vtdtY28 YcNnZA//TU5OaPuR+cqEdxGUagr1kDhjwfKkOde2h6d1b73f8FWL3r6/vM1ThKVK e0RVIcFg39ZYHoNMGUp/LSZUTy8jWUpGbTCCivszPvvFfocLwv9k/FU5LDFtpInl jBA02byU4GLWSgDi1DOTaok17HfM6PtFKlilqk/NYGP7WnajknCe+45WglHMMWg/ SXNZeLGQXC7OZtuqgzqNJqWWzeT+8V0Xl+M8tZk4zljghGkXo0vJ4c7TPNRGY5Gh e9NPtTyMjJL7y92jKUWb5JTX8W8Wu+uttq6e8q38gkO9lcK0iNVKU5zZNKRMhrlC 7500fS9IG5BLV5Fu1eJ8s+LLlBMim1QUjZW9N6+577kVXFi5mfrBkqI5xzUZcn5f p5zdyJUT9PeLAVXBotC3ZwWxrKqr6e41OXmSjdch4WoyXVmgcVi0qBgO+fVc92au Csfj7/Z/B0jC5YuVQu9qJshXeeCQuTJLluL+/t4jNykSmdjc5cw4Kvom9yrvmlDv yBYObHu7cLaRzPd6y7qq2BMk7eEztF7ebQj75SantdYT94NJQq9zaSoQc7vA3w5R GiLNu0+K6ZHKoGjn32gIJhvgMq/xK//XXFkK+dKqRZD5s4nZ5oNSR8rj19P4JRo8 LM+hi5f3f5Xpi7efgXmQGRR0eKyOHV/7oTm5o/BapeuAgaJuEqA= =5Xnn -----END PGP SIGNATURE----- Merge tag 'devicetree-fixes-for-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix possible out-of-bounds access in of_alias_scan() - Fix refcount leak in of_irq_get_affinity() - Add Qualcomm SPMI PMIC haptics input which is already referenced * tag 'devicetree-fixes-for-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of: fix out-of-bounds read in of_alias_scan() stem parser of/irq: Fix device node refcount leak in of_irq_get_affinity() dt-bindings: input: Add Qualcomm SPMI PMIC haptics |
||
|
Xinyang Ge
|
d5dc1e69fd |
inet: frags: strip GSO state from fragments before reassembly
A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off. inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first fragment's skb as the head of the reassembled datagram, including its shinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments on frag_list with whatever linear/paged layout they arrived with. After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the reassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and the next software segmentation point - udp_rcv_segment() on local delivery, validate_xmit_skb(), or the ip_finish_output_gso() slow path - hands it to skb_segment(). skb_segment()'s frag_list walk assumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to a tap by an unprivileged user in its own userns are enough: kernel BUG at net/core/skbuff.c:4899! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2 RIP: 0010:skb_segment+0x20ca/0x48b0 Call Trace: <TASK> __udp_gso_segment+0x29a/0x27d0 udp4_ufo_fragment+0x458/0x6c0 inet_gso_segment+0x429/0x1340 skb_mac_gso_segment+0x233/0x4f0 __skb_gso_segment+0x308/0x660 udp_queue_rcv_skb+0x440/0xad0 udp_unicast_rcv_skb+0xc7/0x2c0 udp_rcv+0x16ce/0x2260 ip_protocol_deliver_rcu+0x197/0x2d0 ip_local_deliver+0x430/0x690 ip_rcv+0x16f/0x1f0 __netif_receive_skb_one_core+0x15e/0x1c0 __netif_receive_skb+0x1e/0x110 netif_receive_skb+0xf6/0x5c0 tun_rx_batched.isra.0+0x3ab/0x790 tun_get_user+0x17c3/0x3550 tun_chr_write_iter+0xba/0x1b0 vfs_write+0x646/0x1130 </TASK> Kernel panic - not syncing: Fatal exception in interrupt This runs with BH disabled, so it is a panic rather than an oops. The same is reachable with CAP_NET_RAW in a netns where a defrag point precedes a GSO point, and from a guest whose VMM forwards virtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by commit |
||
|
Jamal Hadi Salim
|
729c4896ab |
net/sched: sch_htb: limit htb_classify inner-class filter hops
htb_classify() follows each filter-selected inner class by switching
to cl->filter_list, but never bounds the number of hops. A filter on
an inner class can point back to itself or to another inner class that
points back, creating an infinite loop in the packet classification
path with the qdisc lock held and BH disabled — a soft lockup / panic
from a single packet.
Bound the traversal with a hop counter and drop the packet with a
rate-limited warning once the bound is exceeded. The counter is
incremented at the point the inner filter chain is picked up, after the
TC_ACT_* switch has consumed the classifier verdict, so a terminal
TC_ACT_QUEUED/STOLEN/TRAP on the last permitted chain still sets *qerr
to __NET_XMIT_STOLEN and the packet is not charged as a drop by this
qdisc or its parent.
The bound is TC_HTB_MAXDEPTH, taken from HTB's own parameters rather than
from the qdisc hierarchy depth limit. Class levels run from 0 to
TC_HTB_MAXDEPTH - 1, so a traversal that strictly descends in level can
take at most TC_HTB_MAXDEPTH hops. That descent is what a sane
configuration does, but it is assumed here rather than enforced:
htb_find() resolves a classid against every class in the qdisc, so a
filter may equally select a sibling or an ancestor. The normal
root -> inner -> leaf path takes a single hop, so the bound does not
affect legitimate classification.
htb_classify() can now return NULL irrespective of CONFIG_NET_CLS_ACT,
whereas previously every NULL return sat inside that ifdef. The NULL
handler in htb_enqueue() therefore cannot stay conditional either, so
drop the ifdef around it. This matches hfsc_enqueue(), which has always
handled a NULL class unconditionally. Without it, a kernel built
without actions would dereference a NULL class instead of dropping.
Conditions to recreate the bug:
- CONFIG_NET_SCHED, CONFIG_NET_SCH_HTB, CONFIG_NET_CLS_U32,
CONFIG_LOCKUP_DETECTOR.
- Create an HTB qdisc on a device (e.g. lo), add an inner class
1:1 with a leaf child 1:10, install a root u32 filter selecting
1:1, and an inner-class u32 filter on 1:1 also selecting 1:1.
- Send one packet (ping). On the unfixed kernel the classify loop
spins with the qdisc lock held; with softlockup_panic=1 it panics.
- Reachable from unprivileged user via unshare -Urn (CAP_NET_ADMIN).
Fixes:
|
||
|
Jiayuan Chen
|
6a7e91f890 |
selftests/net: packetdrill: add tcp_urg_ptr_retransmit
Drive a connection into urgent mode and force a multi-segment retransmit, checking that each retransmitted segment keeps its own urg_ptr. The test asserts the fixed behaviour: the hole is retransmitted as two independent skbs, each with its own urg_ptr (5001 and 4001) and no PSH. An unpatched kernel instead sends one super-skb whose GSO split copies urg_ptr onto the second segment and also sets PSH there, so on an unpatched kernel the mismatch shows up on the PSH bit (actual P.U ... urg 5001) before the urg_ptr: tcp_urg_ptr_retransmit.pkt:63: live packet field tcp_psh: expected: 0 (0x0) vs actual: 1 (0x1) script packet: .U 1001:2001(1000) ack 1 actual packet: P.U 1001:2001(1000) ack 1 win 1050 After the fix the retransmit carries a per-segment urg_ptr and the test passes. Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260826141145.67823-2-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Jiayuan Chen
|
ce2b807f42 |
tcp: fix corruption of urgent data on multi-segment retransmit
On the normal xmit path, while in urgent mode we refuse to build a
multi-segment TSO packet, so every segment gets its own urg_ptr:
/* tcp_write_xmit() */
limit = mss_now;
if (tso_segs > 1 && !tcp_urg_mode(tp))
limit = tcp_mss_split_point(...);
The retransmit path has no such guard. __tcp_retransmit_skb() builds a
segs > 1 skb and hands it to the GSO layer, which only advances th->seq
per segment and copies urg_ptr verbatim:
/* __tcp_retransmit_skb() */
len = cur_mss * segs; /* segs > 1, no urg_mode check */
...
/* tcp_gso_segment(): bumps seq only, urg_ptr is copied */
urg_ptr is an offset from the segment's own seq, so a copied value points
at a different place on each segment. The receiver rebuilds the absolute
urgent seq as seg.seq + urg_ptr, so it walks a moving urgent point instead
of the one OOB byte:
seg1 seq 1 urg_ptr 5001 -> urgent @ 5001 (ok)
seg2 seq 1001 urg_ptr 5001 -> urgent @ 6001 (wrong, +MSS)
seg3 seq 2001 urg_ptr 5001 -> urgent @ 7001 (wrong, +2*MSS)
The real OOB byte is never pointed at, so the receiver stops splicing it
out and delivers it as normal in-band data, corrupting the stream.
Guard the retransmit length like the xmit path: keep segs = 1 while in
urgent mode.
Fixes:
|
||
|
Deepanshu Kartikey
|
a60fd8c6db |
usb: atm: usbatm: fix invalid ci_range initialization
syzbot reported a shift-out-of-bounds in __vcc_connect():
UBSAN: shift-out-of-bounds in net/atm/common.c:382:32
shift exponent -1 is negative
CPU: 0 UID: 0 PID: 5987 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
__ubsan_handle_shift_out_of_bounds+0x36d/0x400 lib/ubsan.c:494
__vcc_connect+0x14b4/0x19c0 net/atm/common.c:382
vcc_connect+0x328/0x8f0 net/atm/common.c:498
pvc_bind+0x272/0x380 net/atm/pvc.c:52
__sys_bind+0x2e3/0x410 net/socket.c:1976
__x64_sys_bind+0x7a/0x90 net/socket.c:1979
...
ATM device ci_range fields (vpi_bits and vci_bits) represent the
number of bits supported for VPI and VCI addressing on the device.
net/atm/common.c directly uses these fields as bit shift counts:
vpi >> dev->ci_range.vpi_bits
vci >> dev->ci_range.vci_bits
1 << vcc->dev->ci_range.vpi_bits
1 << vcc->dev->ci_range.vci_bits
usbatm_atm_init() sets ci_range.vpi_bits and ci_range.vci_bits to
ATM_CI_MAX (-1), which is defined in <uapi/linux/atmdev.h> as a
sentinel value for userspace ATM_SETCIRANGE requests, not a valid bit
count. Shifting by -1 is undefined behavior and triggers UBSAN
warnings.
ATM UNI cell headers allow up to 8 bits for VPI (0..255) and 16 bits
for VCI (0..65535). Initialize vpi_bits to 8 and vci_bits to 16, as
done by solos-pci.
Fixes:
|
||
|
bui duc phuc
|
dd890ae292 |
net: fec: only stop PTP if it was initialized
fec_ptp_init() is only called when fep->bufdesc_ex is available.
However, fec_probe() unconditionally calls fec_ptp_stop() on the
failed_init path, and fec_drv_remove() unconditionally calls
fec_ptp_stop() during device removal.
Check fep->bufdesc_ex before calling fec_ptp_stop() in both paths
to avoid stopping PTP when it was not initialized.
Fixes:
|
||
|
Eric Dumazet
|
23c53269f2 |
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read
in slip_receive_buf() when racing against tty hangup.
tty_ldisc_hangup() calls ld->ops->hangup() while holding only
a read lock on tty->ldisc_sem (via tty_ldisc_ref()).
Because slip_hangup() simply called slip_close(), it ran concurrently
with reader functions such as slip_receive_buf().
slip_close() unregisters and frees the net device and its private
struct slip, causing concurrent reader threads in slip_receive_buf()
to dereference freed memory.
Line discipline close() is already guaranteed to be called under
the write lock of tty->ldisc_sem during hangup processing
(in tty_ldisc_reinit() or tty_ldisc_kill()).
Remove slip_hangup() so teardown is serialized cleanly by slip_close().
Fixes:
|
||
|
Linus Torvalds
|
9bb34313d9 |
spi: Fixes for v7.3
A couple of fixes that came in during the merge window, Geert fixed an uninitialised data bug in the amlogic-spisg driver which could crash and in the Loongson driver Li Jun hooked up the existing suspend operations more fully to fix hibernation. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmqQOiIACgkQJNaLcl1U h9Ctqgf/Z4nnPtUfZlh7ecod1NscPzlH/49BCTEK1+P17tP7c76FIKEM2ZBoJU7j MTJ6YkUzXkAp5uEyodLPqQiC6lr6XKTNGwO3Al4Mz4toLMbHdnKrb5xZHClmkyFh LjHcvHijZL17Gt72fa4He6UtGx0y0mZBEnbiOkQA3Z4eMgHrL3Knw8i8xmz7sqoU K5vbgkHFgv5o75WhCQRzNakDMlssq8e8Xy2U+sxLsepJoTVbFg4RT6l0S+7iHPrk 05F/50dPbT/bd/jkFSji5ynpoLPEtBOle/vBLwbxwWzk0AOIxx2xhFVwXK6QEAMk 7zmTsceKe0wWcQW+rRKi+d6SMFPxMQ== =IW97 -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.3-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of fixes that came in during the merge window: Geert fixed an uninitialised data bug in the amlogic-spisg driver which could crash and in the Loongson driver Li Jun hooked up the existing suspend operations more fully to fix hibernation" * tag 'spi-fix-v7.3-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: loongson: pm: add .freeze .poweroff .thaw .restore spi: amlogic-spisg: Make sure clk_init_data is fully initialized |
||
|
Norbert Szetei
|
50e5c6605c |
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under
br->multicast_lock before stopping a VLAN's multicast context. That is
the teardown handshake: lockless readers gate on the flag through
br_multicast_ctx_should_use() -> br_multicast_ctx_vlan_disabled(), so
once it is cleared under the lock no reader can arm the context again.
For a master VLAN the handshake never runs. __vlan_del() clears
BRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so
br_multicast_toggle_one_vlan(masterv, false) returns early on
!br_vlan_is_brentry(vlan): the flag stays set and br->multicast_lock is
never taken. br_vlan_put_master() then drains the context in
br_multicast_ctx_deinit() and frees the VLAN through call_rcu(), while a
reader still inside rcu_read_lock() sees the context as enabled and
re-arms it. The port and port-VLAN branch of the function has no
br_vlan_is_brentry() test and flips the flag under br->multicast_lock,
so it is not affected.
The reader is the bridge transmit path. For a master VLAN
br_multicast_rcv() selects brmctx = &vlan->br_mcast_ctx with
pmctx = NULL, so IGMP sent to the bridge device re-arms the context's
timers after br_multicast_ctx_deinit() has already stopped them.
BUG: KASAN: slab-use-after-free in detach_if_pending+0x412/0x4a0
Write of size 8 at addr ffff88810ac39918 by task brmc/601
__mod_timer+0x51a/0xc50
br_multicast_host_join+0x25b/0x390
__br_multicast_add_group+0x468/0x530
br_ip4_multicast_add_group+0x1a0/0x260
br_multicast_rcv+0x2cda/0x61e0
br_dev_xmit+0x6c4/0x1540
Allocated by task 610:
br_vlan_add+0x111/0xb40
br_vlan_info+0x370/0x3e0
Freed by task 0:
kfree+0x1a7/0x4f0
rcu_core+0x7dc/0x10a0
Only test br_vlan_is_brentry() when enabling, like the
br_multicast_ctx_vlan_global_disabled() test next to it. Disabling then
always clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before
br_multicast_ctx_deinit() drains the context.
Fixes:
|
||
|
Linus Torvalds
|
6253a29206 |
regulator: Fix for v7.3
One fix here, for a race condition on startup in the tps65185 driver which is seen on actual boards - we need a delay after waking the chip before it is ready to talk to the host. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmqQOSwACgkQJNaLcl1U h9CrAAf9H7s1Nw5yB4SDI2TghqmY14G0Sr3EL4ajk0TnUEK6jGfsBVrjDeMMCCoI i/KIq2hSzCmguRJIeJbkAd1iOX3oLuQFZZelalDuMxe0jv96Nr4XjJegabqPpB2O iZzpR3mep3oST4SOj5BfjpifvgNdr1WkC1c/cR49+vd735UXUmw4YxNFA8iow5zL if77jZDvUOk9bOeGP4JXtV9WbGSjLeD5eTQopT0E7oiy5Fym+fc1alVht1nj0ylI YK/3DbVINxz3NoXV0VOYNIv92jAH8I7Pitw154D62tQLqvnD0Nzn8lMKj9lbTsz1 TKHkh6nDyn96Oq3uauFb5JjTMHx1oQ== =k/VH -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.3-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One fix here, for a race condition on startup in the tps65185 driver which is seen on actual boards - we need a delay after waking the chip before it is ready to talk to the host" * tag 'regulator-fix-v7.3-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: tps65185: wait for the IC to wake before the first I2C access |
||
|
Linus Torvalds
|
7cec13314d |
dma-mapping fix for Linux 7.3
- integer overflow fix for kernel cmdline parser for DMA contiguous initialization code (Alexander Graf) -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCapAQqwAKCRCJp1EFxbsS RCScAQDLf7mcAq6YoJQ2YnUetzda+eGO9vvFPuNlmj5RdSfcgwD+L/+rSV17P7Sc d11981LdKsEnKWJMrZhRbWzI/Q+bnw0= =Owsi -----END PGP SIGNATURE----- Merge tag 'dma-mapping-7.3-2026-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fix from Marek Szyprowski: - integer overflow fix for kernel cmdline parser for DMA contiguous initialization code (Alexander Graf) * tag 'dma-mapping-7.3-2026-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-contiguous: fix truncation of numa_cma / cma_pernuma sizes >= 2G |
||
|
Jamal Hadi Salim
|
8f735d6438 |
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
qdisc_get_stab() accepts a user-supplied size table, and
__qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through the
overhead, the size-table data (u16), and size_log (up to
STAB_SIZE_LOG_MAX). A crafted stab can therefore set qdisc_pkt_len()
to ~1 GiB for an ordinary skb. Per-flow deficit schedulers such as
DRR and ETS replenish one quantum per loop iteration; with a tiny
quantum (1) they spin billions of times under the qdisc lock,
producing a soft lockup / RCU stall as illustrated by vega@nebusec.ai.
Cap the final qdisc_pkt_len() to QDISC_PKT_LEN_MAX so the size-table
amplification cannot drive deficit schedulers into an unbounded loop.
A legitimate size table (e.g. qfq's overhead 999999999, which is
handled by dropping) is still accepted.
Introduce cap QDISC_PKT_LEN_MAX (1 << 20) = 1 MiB which is well above
any legitimate single-skb wire length: the largest current skb->len
is GSO_MAX_SIZE (524280), and an ATM-style size table (53/48 cell tax)
amplifies that to ~578 KB, both comfortably below 1 MiB. At the same
time, 1 MiB bounds the deficit refill loop to ~1M iterations per
packet with quantum=1, which completes in a few milliseconds well
under the demonstrated softlockup threshold (~10^9 iterations).
Conditions to recreate the bug:
- CONFIG_NET_SCHED=y, CONFIG_NET_SCH_DRR=y (or CONFIG_NET_SCH_ETS=y).
- Attach a DRR (or ETS) root qdisc with a crafted TCA_STAB that
amplifies qdisc_pkt_len to ~1 GiB (e.g. size_log=15, data=[32768]).
- Add a class with a tiny quantum of 1 and send one small packet; the
deficit loop spins billions of times under the qdisc lock and trips
the softlockup detector (panic with kernel.softlockup_panic=1).
- Reachable as root or from an unprivileged user in a fresh user+net
namespace (unshare -Urn) with namespace-local CAP_NET_ADMIN.
Fixes:
|
||
|
Edoardo Pinci
|
88c71cc0ad |
net: dsa: mxl862xx: enable assisted learning on CPU port
The MxL862xx driver enables FDB isolation but does not enable assisted
learning on the CPU port. Consequently, MAC addresses learned through a
physical switch port are not updated in hardware when the corresponding
station moves to a foreign bridge port, such as a Wi-Fi interface.
The stale hardware FDB entry continues directing return traffic toward
the original physical port. Traffic entering that same port is then
filtered instead of being forwarded to the CPU and software bridge. This
causes downstream unicast traffic, including DHCP OFFER and ACK packets,
to disappear after a client roams to a local wireless interface. The
client eventually considers the connection unusable and disconnects.
Enable assisted CPU-port learning so DSA installs foreign bridge FDB
entries on the CPU port. This keeps the hardware FDB synchronized with
the software bridge and allows return traffic to reach locally attached
Wi-Fi clients after roaming.
Tested on a BPI R4 PRO with a MxL862xx switch and a BE14000 WiFi interface.
- Without patch, wired uplink on lan6 port (mxl path)
Wifi clients connect but roam away not getting DHCP offers
- Without patch, wired uplink on wan port (no mxl path)
Wifi clients connect and roam successfully
- With this patch, uplink on lan6 (mxl path)
Wifi clients connect and roam successfully
Fixes:
|
||
|
Pascal Kneuper
|
23680bf5f8 |
net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
Since the RX path was converted to zero-copy, the page pool page is handed to the stack directly as the skb head, and the offset the DMA engine writes at is what determines the alignment of the packet headers. Before the conversion the payload was copied into an skb obtained from napi_alloc_skb(), which reserves NET_SKB_PAD + NET_IP_ALIGN. The conversion moved the headroom into stmmac_rx_offset() but did not carry over NET_IP_ALIGN, so on architectures where NET_IP_ALIGN is 2 the IP header now lands misaligned: 64 (NET_SKB_PAD) + 14 (ethernet) + 20 (IP) = 98 Same for the XDP branch: 256 (XDP_PACKET_HEADROOM) + 14 (ethernet) + 20 (IP) = 290 On ARM32 this is fatal, because ldm and ldrd trap on unaligned addresses even when CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is set. Any received echo request panics the machine, e.g: Unhandled fault: alignment exception (0x001) at 0x81873062 Internal error: : 1 [#1] SMP ARM Hardware name: Altera SOCFPGA Arria10 PC is at icmp_echo+0x38/0xa8 LR is at icmp_rcv+0x22c/0x370 Call trace: icmp_echo from icmp_rcv+0x22c/0x370 icmp_rcv from ip_protocol_deliver_rcu+0x2c/0x224 ip_protocol_deliver_rcu from ip_local_deliver+0xc8/0x1a0 ip_local_deliver from ip_sublist_rcv_finish+0x3c/0x50 ip_sublist_rcv_finish from ip_list_rcv_finish+0x110/0x118 ip_list_rcv_finish from ip_list_rcv+0xc8/0xdc ip_list_rcv from __netif_receive_skb_list_core+0x170/0x1c0 ... napi_complete_done from stmmac_napi_poll_rx+0xcb0/0x1030 Code: e24dd068 e59020a0 e28dc010 e0822001 (e8920003) Kernel panic - not syncing: Fatal exception in interrupt The faulting instruction is the ldm of *icmp_hdr(skb) in icmp_echo(). Fix by adding NET_IP_ALIGN back to the RX offset, which restores the alignment the stack used to get. Note that commit |
||
|
Linus Torvalds
|
f7e3f4d9f4 |
Backlight for v7.3
- New Support & Features
- Silergy SY7758: Add driver for the 6-channel high-efficiency LED driver
- Improvements & Fixes
- Awinic AW99706: Fix device tree property names to match the binding, consistently
validate all property values, and honor the core blank state in `update_status()`
- Kinetic KTD2801: Add missing dependency on `GPIOLIB` in Kconfig
- Qualcomm WLED: Remove redundant `dev_err()` calls
- Cleanups & Refactoring
- Core: Use `sysfs_emit()` instead of `sprintf()` in sysfs show callbacks
- Maintainers: Update Junjie Cao's email address for the Awinic AW99706 driver
- Device Tree Binding Updates
- Marvell 88PM860X: Add missing bracket in the example
- Silergy SY7758: Document the 6-channel high-efficiency LED driver
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmqPE2oACgkQUa+KL4f8
d2FmPA//dBm/TLnut7WnXl7gksJzn0HfvrMvEVAFBn1pfNOZapoXkspGkCQJpSrs
5Y2jg+DlYehBK9SgRB/1T+nRimti5JgBRrUGB28AzXQk4WmkPcLrFREuXDweTZJZ
HuAxMyEIBVFAfgQhvc7RiyWJtP6E4t0hqc98PQUzSG+duGLsUbb/cvhPlCTJTAxO
WET9WOxwW9IhdA110N4rnDfio5sTD4hH4iE4hlXuQsBJFTpZzf+fsDWA8IPONmUR
K4/9LK58QSES0SWnle9maZ4ibwePYaaPH5PQWtCIilhlddqpYAh/Xtl4N4mOFEiK
FKdbZN/NBWeVbhj/Hpjxutyjvk5dF7mz2/DwuO2xKLpWppg1eGzfG5b4hW+fUPW2
txmQcRN6Kazlskg0BCeIC6TOvEQeRmrR2OICh758ptRC/rfTG2pvV8rt7PzVplEp
WPNbu/iRl+hzwrTssREwIeOQ1mLPRGhuXUnlB9nNX/AhcMVCoBgkdwA8Tf6ZPPIN
dKTDshrJ4jjVuenBcjTA6WnLCcqywAtYpZfH8YSZafgDgK8BjtW6dapGFvP4XOLz
Bnic9yJZpKelcuwOm2uj9cgbwenoAcrj9yr00iqgXrBPMEhVvkg9xbJUh+8D6yF0
Vz/AjzlYcwEwpMbfHewyA2B50zu+BfjDiM6mTu0C8n50BYEx71s=
=8Tc7
-----END PGP SIGNATURE-----
Merge tag 'backlight-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight
Pull backlight updates from Lee Jones:
"New Support & Features:
- Silergy SY7758: Add driver for the 6-channel high-efficiency LED
driver
Improvements & Fixes
- Awinic AW99706: Fix device tree property names to match the
binding, consistently validate all property values, and honor the
core blank state in `update_status()`
- Kinetic KTD2801: Add missing dependency on `GPIOLIB` in Kconfig
- Qualcomm WLED: Remove redundant `dev_err()` calls
Cleanups & Refactoring
- Core: Use `sysfs_emit()` instead of `sprintf()` in sysfs show
callbacks
- Maintainers: Update Junjie Cao's email address for the Awinic
AW99706 driver
Device Tree Binding Updates
- Marvell 88PM860X: Add missing bracket in the example
- Silergy SY7758: Document the 6-channel high-efficiency LED driver"
* tag 'backlight-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
backlight: Use sysfs_emit() instead of sprintf()
backlight: qcom-wled: Remove redundant dev_err()
backlight: ktd2801: Fix unmet dependency on GPIOLIB
backlight: aw99706: Honor the core blank state in update_status()
backlight: aw99706: Validate all DT property values consistently
backlight: aw99706: Fix DT property names to match binding
dt-bindings: backlight: 88pm860x: Add missing bracket
MAINTAINERS: Update my email address for the AW99706 backlight driver
backlight: Add SY7758 6-channel High Efficiency LED Driver support
dt-bindings: leds: backlight: Document the SY7758 6-channel High Efficiency LED Driver
|
||
|
Linus Torvalds
|
7cc2726d48 |
LEDs for v7.3
- New Support & Features
- Core: Extend netdev trigger speeds up to 100G.
- PWM Multicolor: Introduce default-intensity property.
- Analog Devices LTC3220: Add support for 18 channel LED driver.
- NXP PCA963x: Add multicolor LED class support.
- Improvements & Fixes
- GPIO: Clear error pointers for skipped LEDs.
- Broadcom BCM63138: Use %pe to print pinctrl error instead of %ld.
- ISSI IS31FL319x: Modernize device registration by using fwnode APIs.
- NXP PCA9532: Fix inverted GPIO output polarity.
- NXP PCA9532: Fix phantom device registration on missing hardware.
- STMicroelectronics ST1202: Correct and extend hw_pattern documentation.
- STMicroelectronics ST1202: Fix channel disable logic on zero brightness and ensure
brightness changes are applied in active mode.
- STMicroelectronics ST1202: Fix hardware pattern sequence programming, validate inputs,
and correct pattern duration calculations.
- STMicroelectronics ST1202: Validate LED reg property against channel count.
- TI LP5860: Fix a potential double-unlock during device initialization and fix error
handling path by using devm_mutex_init().
- Cleanups & Refactoring
- GPIO: Make legacy gpiolib interface optional.
- Device Tree Binding Updates
- Core: Add default-intensity property.
- Core: Document "gpio" trigger.
- Analog Devices LTC3220: Add DT binding for LTC3220 18 channel LED Driver.
- Broadcom BCM6358: Convert to DT schema.
- LaCie NS2: Convert to DT schema.
- NXP PCA963x: Add multicolor LED support.
- NXP PCA963x: Fix reg maximum for pca9635.
- TI TPS65217: Convert backlight bindings to DT schema.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmqPE1kACgkQUa+KL4f8
d2G/sA/+JvJYo1XzwrV4+exEg62y083pNJgT+sfjXDkfq2wJ0Vqapms5DB1/8WW6
KjWMO3om6IUW2Ao9Z8MU7R01fyssfylm0nlVZnrqJz/taLTyaV0/c31E2+QdZsBF
0hWp+SfhMHOJHxLHRQl2uGDerx/je/b0WrxlZGmgRuNcIBm/RGp/MJR0yf6F3pNc
LWExdXOD9ugG03BB2JzlEuIuHSgWwIxgNtm5v9Fv4gRTZRA9VWccDuMRHgH21Bwk
pOP3gDBtxZmDUFWW+FE2ODdTZPXNwJ6u2dMpynuQs/IcM5TSBqsAmPlbF41cmLMC
N3iMkf5BDBgkDCatjwzYadBCo8siHuNLvSLUghH0maX37cPQ1PoN28T8wD9nHVEJ
SreF29nwXbzg31N2cD8e3McxqzY0VfYiDRK1ztjqXuN8RXweTIF4MUiFgHlcb+va
LWONWbvLPZW+gu3knDAzSoMtBFPcH1obU99wxyYSpDHmjU7XIvKNzxBjNEYBupe3
8+RizuDAoFIZaTz7omBccmF/NMLHqsr0l8oyL67V29FYp4nyZemyRmLE6N0vE0Zn
vWBECaS8kwQwPKUxgreNObaviooreytgeC9H4KOcsLfEcHqKMYTDAOk5Y7SAVUtp
6KC7CE/6nZK9bAsL97Qzww15mkEqT34ne7wYEg5RiPPo15VBToM=
=Tm6g
-----END PGP SIGNATURE-----
Merge tag 'leds-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds
Pull LED updates from Lee Jones:
"New Support & Features:
- Core: Extend netdev trigger speeds up to 100G
- PWM Multicolor: Introduce default-intensity property
- Analog Devices LTC3220: Add support for 18 channel LED driver
- NXP PCA963x: Add multicolor LED class support
Improvements & Fixes:
- GPIO: Clear error pointers for skipped LEDs
- Broadcom BCM63138: Use %pe to print pinctrl error instead of %ld
- ISSI IS31FL319x: Modernize device registration by using fwnode APIs
- NXP PCA9532: Fix inverted GPIO output polarity
- NXP PCA9532: Fix phantom device registration on missing hardware
- STMicroelectronics ST1202: Correct and extend hw_pattern
documentation
- STMicroelectronics ST1202: Fix channel disable logic on zero
brightness and ensure brightness changes are applied in active mode
- STMicroelectronics ST1202: Fix hardware pattern sequence
programming, validate inputs, and correct pattern duration
calculations
- STMicroelectronics ST1202: Validate LED reg property against
channel count
- TI LP5860: Fix a potential double-unlock during device
initialization and fix error handling path by using
devm_mutex_init()
Cleanups & Refactoring:
- GPIO: Make legacy gpiolib interface optional
Device Tree Binding Updates:
- Core: Add default-intensity property
- Core: Document "gpio" trigger
- Analog Devices LTC3220: Add DT binding for LTC3220 18 channel LED
driver
- Broadcom BCM6358: Convert to DT schema
- LaCie NS2: Convert to DT schema
- NXP PCA963x: Add multicolor LED support
- NXP PCA963x: Fix reg maximum for pca9635
- TI TPS65217: Convert backlight bindings to DT schema"
* tag 'leds-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (29 commits)
leds: is31fl319x: Modernize registration
dt-bindings: leds: lacie,ns2-leds: Convert to DT schema
leds: pca963x: Add multicolor LED class support
dt-bindings: leds: nxp,pca963x: Add multicolor LED support
dt-bindings: leds: nxp,pca963x: Fix reg maximum for pca9635
leds: gpio: Clear error pointers for skipped LEDs
dt-bindings: leds: backlight: Convert TPS65217 to DT schema
leds: pca9532: Fix phantom device registration on missing hardware
leds: gpio: Make legacy gpiolib interface optional
leds: bcm63138: Use %pe to print pinctrl error instead of %ld
dt-bindings: leds: Add default-intensity property
leds: ltc3220: Add Support for LTC3220 18 channel LED Driver
dt-bindings: leds: Add LTC3220 18 channel LED Driver
dt-bindings: leds: bcm6358: Convert to DT schema
dt-bindings: leds: Document "gpio" trigger
leds: st1202: Correct and extend hw_pattern documentation
leds: st1202: Validate LED reg property against channel count
leds: st1202: Disable channel when brightness is set to zero
leds: st1202: Fix brightness having no effect while pattern mode is active
leds: st1202: Fix spurious pattern sequence start in setup
...
|
||
|
Lorenzo Bianconi
|
9c24a504a3 |
net: stmmac: drop gso_enabled_types and rely on netdev features
The gso_enabled_types field is used by stmmac_xmit() to decide whether a
GSO skb should be passed to stmmac_tso_xmit(). It is updated in
stmmac_set_features() based solely on NETIF_F_TSO, so disabling IPv4
TSO while keeping IPv6 TSO (NETIF_F_TSO6) enabled zeroes the mask. As a
result IPv6 GSO frames, which the networking stack still generates since
NETIF_F_TSO6 is enabled, fall through to the non-TSO xmit path where
they are not handled.
The networking stack already manages the GSO logic: a GSO skb is only
delivered to the driver when the matching offload feature (NETIF_F_TSO,
NETIF_F_TSO6 or NETIF_F_GSO_UDP_L4) is enabled, otherwise the frame is
segmented in software before reaching ndo_start_xmit().
stmmac_features_check() also validates each GSO frame against the TSO
hardware constraints and falls back to software GSO when they are not met.
Drop the gso_enabled_types field and rely on skb_is_gso() in
stmmac_xmit() instead, which correctly routes IPv6 GSO frames to the TSO
path when NETIF_F_TSO is disabled. This also removes the data race
between stmmac_set_gso_types(), called from the feature-set path, and
the lockless read of gso_enabled_types in stmmac_xmit().
Fixes:
|
||
|
Jakub Kicinski
|
6fe66698b9 |
Merge branch 'net-stmmac-more-selftest-related-fixes'
Maxime Chevallier says: ==================== net: stmmac: More selftest related fixes This series addresses some (but not all) issues found while running the ethtool selftest on various stmmac platforms. As a reminder, ethtool selftest are run with 'ethtool -t ethX', and for stmmac the goal is to test hardware features and bugs from the IP integration in the platform. I've been running this on : - Altera CycloneV (dwmac-socfpga, dwmac1000 IP, v3.70a) - NXP imx8mp (dwmac-imx, dwmac4, v5.10a) - Allwinner H2S (dwmac-sun8i, dwmac1000) - Amlogic S905X3 (dwmac-meson8b, dwmac1000, v3.70a) - STM32mp157a (dwmac-stm32, dwmac4, v4.20a) - SiFive JH7110 (dwmac-starfive, dwmac4, v5.20) Here's the results before this series, noting that some bugs were already fixed, some are ongoing (cf. the IP proto patch here [1]) [1] : https://lore.kernel.org/netdev/20260825211748.360935-1-maxime.chevallier@bootlin.com/ Tests are OK if return is 0 or -95 (-EOPNOTSUPP), tests are KO otherwise Test imx socfpga sun8i meson8b stm32 starfive MAC Loopback 0 0 0 0 0 0 MMC Counters 0 0 -95 -22 0 -22 EEE -95 -95 -95 -95 -95 -95 Hash Filter MC 0 0 -95 0 0 0 Perfect Filter UC 0 0 0 0 0 0 MC Filter 0 0 -95 0 0 0 UC Filter 0 0 -95 -22 0 0 Flow Control -110 0 -110 0 0 -110 RSS -95 -95 -95 -95 -95 -95 VLAN Filtering -110 -95 -95 -95 -110 -110 VLAN Filtering (perf) -110 -95 -95 -95 -110 -110 Double VLAN Filter -110 -95 -95 -95 -110 -110 Double VLAN Filter (perf) -110 -95 -95 -95 -110 -110 Flexible RX Parser 0 -95 -95 -95 -95 -95 SA Insertion (desc) 0 -95 -95 -95 0 0 SA Replacement (desc) 0 -95 -95 -95 0 0 SA Insertion (reg 0 -95 -95 -95 0 0 SA Replacement (reg) 0 -95 -95 -95 0 0 VLAN TX Insertion -110 -95 -95 -95 -110 -110 SVLAN TX Insertion -110 -95 -95 -95 -110 -95 L3 DA Filtering 0 -95 -95 -95 -95 -95 L3 SA Filtering 0 -95 -95 -95 -95 -95 L4 DA TCP Filtering 0 -95 -95 -95 -95 -95 L4 SA TCP Filtering 0 -95 -95 -95 -95 -95 L4 DA UDP Filtering 0 -95 -95 -95 -95 -95 L4 SA UDP Filtering 0 -95 -95 -95 -95 -95 ARP Offload -95 -95 -95 -95 -110 -110 Jumbo Frame 0 0 0 0 0 0 Multichannel Jumbo 0 -95 -95 -95 -95 -95 Split Header -95 -95 -95 -95 -95 -95 TBS (ETF Scheduler) -95 -95 -95 -95 -95 -95 So, only sogfpga is all OK (in all fairness, it doesn't support much) Several issues : - MMC test failing on starfive and meson8b, solved by patch 1 MMC counters maintained by the MAC are optional, which one is implemented depends on how the IP is synthesized. On starfive and meson8b, the counter used by the selftest to validate the MMC counters feature isn't implemented. Solved by adding other counters in the validation step, kinda fragile as this doesn't guarantee this will work on all platforms. - Flow control test failing on starfive, imx8mp, sun8i, solved by patch 6 Turns out these platforms actually never emit any Pause frame, as they don't have enough room in their per-queue RX Fifo. They do correctly process RX Pause frames. The fix isn't to change the advertised pauseparams, as the pause negotiation process based on MAC capabilities doesn't allow us to say we "just" support RX pause, so let's just not run the Pause tests if the RX fifo is too small. - UC filter failing on meson8b, fixed by patches 2,3,4 and 5 This one is quite the rabbit hole, and is a combination of multiple issues. - Unicast filtering uses the same filter (perfect filter) to allow the primary MAC address and the secondary addresses (dev->uc) to flow through the interface. That means if we have say 64 slots in the perfect filter, only 63 can be used for the dev->uc list, as the first entry stores the MAC address. If the filter is full, we switch to UC promisc mode, were we let all UC frames flow. There's an off-by-one error in dwmac1000, dwmac4 and dwxgmac2. - The selftest itself needs an empty slot in the filter, so it has to check that sizeof(dev->uc) is $number_of_slots - 2 (one for primary MAC, one for the test). There's an off-by-two error in the selftest. - This leads to an interesting finding (not addressed by this series) : The size of the perfect filter isn't reported by the HW, so it comes from firmware (snps,perfect-filter-entries). A lot of platforms don't specify that in DT (e.g. imx8mp doesn't, it has 128 entries but the driver thinks there's only 1...). I've reached out to Synopsys to see if there's some sane default we could use on dwmac4, if anyone has a dwmac4 databook I'd appreciate if you could look this up, as I don't have access to them, I'm not a vendor... Otherwise, we'll have to patch all the .dtsi if we want to avoid going in UC promisc as soon as we add an entry in dev->uc. After this series, socfpga, starfive and sun8i are all OK :) Some issues are still out there, the VLAN filtering and tagging fails on imx8mp and stm32 (so, dwmac4) butI haven't got there yet. ARP offload doesn't work on stm32mp157a and starfive JH7110 either. ==================== Link: https://patch.msgid.link/20260826140500.616466-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Maxime Chevallier
|
96e8cb5527 |
net: stmmac: selftests: Don't test flow control for small rx fifos
On dwmac1000, dwmac4 and dwxgmac, we only emit pause frames if there's
at least 4096 bytes in each queue's fifo.
The phylink mac capabilities are still MAC_ASYM_PAUSE | MAC_SYM_PAUSE as
otherwise we won't be able to negotiate 'rx on' pause. ASYM only will
prevent negotiating 'rx off tx on', while SYM only doesn't really
matche the reality (not symmetric if we can only do RX pause).
Fixes:
|
||
|
Maxime Chevallier
|
cd8c3b2752 |
net: stmmac: selftests: Account for the UC filter list for filtering tests
On dwmac, one of the Unicast filter entries is used to store the local
HW addr. This means that we have to use promisc mode for any kind of
unicast filtering if we only have one slot in our unicast filter.
The number of slots available depends on how the IP is integrated, and
we can't autodiscover how many of these slots we have available, so
the DT property snps,perfect-filter-entries can be used to specify how
many are available.
Most IP variants default to 1 if this isn't specified, which is the case
for the amlogic variants (in this case, S905X3).
The stmmac selftests for UC filtering look if we have enough slots in
the filter to store the dev->uc list, but doesn't account for the
device's own MAC address. The dev->uc list's size we get with
netdev_uc_count() also doesn't account for the HW addr.
As the selftest only requires one available slot, in the case of
single-slot platforms, that means we erroneously consider we have enough
room for the test, when we actually don't, and the filtering test fails.
Fixes:
|
||
|
Maxime Chevallier
|
2739d6f9a2 |
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
The same filter slots are used to store the main MAC address as well as
the address for the unicast filter. Let's account for that when deciding
whether or not to use promisc when programming the UC list in hardware.
Fixes:
|
||
|
Maxime Chevallier
|
82187f42c0 |
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
The same filter slots are used to store the main MAC address as well as
the address for the unicast filter. Let's account for that when deciding
whether or not to use promisc when programming the UC list in hardware.
Fixes:
|
||
|
Maxime Chevallier
|
9698b6da37 |
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
The same filter slots are used to store the main MAC address as well as
the address for the unicast filter. Let's account for that when deciding
whether or not to use promisc when programming the UC list in hardware.
Fixes:
|
||
|
Maxime Chevallier
|
d29b399150 |
net: stmmac: selftests: Check multiple MMC counters
The MMC counters report MAC statistics. Multiple counters can be
enabled when the IP is integrated, however there's no way to know
exactly which ones. Un-implemented counters seem to report 0.
It was found that on StarFive JH7110 and Amlogic SM1, the counter that's
used by the selftest (mmc_tx_framecount_g) isn't implemented, triggering
an MMC selftest failure.
Both the above SoCs seem to implement mmc_rx_framecount_gb, let's use
this counter as well for MMC counter validation.
Note that this doesn't guarantee that we won't encounter the same issue
again if another IP implements yet another set of counters that don't
include that new one.
If the game of whack-a-mole with implemented counters becomes too hard to
maintain, we may simply consider removing the MMC selftest entirely.
Fixes:
|
||
|
Linus Torvalds
|
79b4f3baae |
MFD for v7.3
- New Support & Features
- MediaTek MT6397: Add mt6323 AUXADC support.
- MediaTek MT6397: Add mt6323 EFUSE support.
- Spreadtrum SC27xx: Add SC2730 regulator cell.
- Improvements & Fixes
- Apple SMC: Fix key count endianness annotation.
- Azoteq IQS62x: Reject zero-length firmware records.
- ChromeOS EC: Introduce cros_ec_read_features helper and read features during
probe to catch transfer errors.
- Cirrus Logic CS42L43: Fix regmap defaults ordering.
- Cirrus Logic CS42L43: Remove redundant NULL checks on SoundWire.
- Congatec Board Controller: Fix teardown ordering in cgbc_remove().
- HP iPAQ Micro: Fix out-of-bounds stack read in ipaq_micro_str.
- Marvell 88PM886: Initialize the battery page.
- QNAP MCU: Keep the reply buffer alive past a command timeout.
- RAVE SP: Validate received frame payload lengths.
- Silicon Labs Si476x: Drop duplicate NULL checks.
- Silicon Labs Si476x: Modernize GPIO handling.
- Silicon Motion SM501: Fix potential memory leaks during remove.
- UCB1x00: Convert Assabet gpio-keys to use software nodes and register software
node for GPIO controller.
- Viperboard: Fix native fields type in structures as little-endian.
- Viperboard: Remove redundant NULL check before kfree().
- X-Powers AXP20x: Preserve other control bits when powering off.
- Cleanups & Refactoring
- Core: Drop unused assignment of spi_device_id driver data.
- Core: Initialize spi_device_id arrays using member names.
- Core: Unify style of spi_device_id arrays.
- Maintainers: Add Intel LPSS section to follow the changes.
- Maintainers: Add a mailing list entry to MFD.
- Cirrus Logic CS42L43: Format sdw_device_id table.
- Cirrus Logic CS42L43: Use new SoundWire enumeration helper.
- ROHM PMIC: Factor out power button registration and convert gpio-keys to use
software nodes.
- ST-Ericsson DB8500: Fold dbx500 header into db8500.
- Device Tree Binding Updates
- Core: Add techvision vendor prefix.
- Marvell 88PM886: Allow vbus regulator.
- MediaTek MT8195 SCP: Add support for MT8189 SoC.
- Qualcomm SPMI PMIC: Document PMG1110.
- Qualcomm SPMI PMIC: Document haptics device.
- Qualcomm TCSR: Add compatible for Hawi and Maili SoCs.
- Qualcomm TCSR: Add compatible for Shikra.
- Qualcomm TCSR: Document the IPQ9650 TCSR block.
- STMicroelectronics STMPE: Fix typo st,stmpe601 (should be st,stmpe610).
- Syscon: Add ESWIN EIC7700 compatible.
- Syscon: Allow syscon compatible for Loongson-2K0300 chip id.
- Syscon: Disallow simple-bus with syscon.
- Syscon: Drop custom select for older dtschema.
- TI OMAP USBHS TLL: Convert to DT schema.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmqPE0EACgkQUa+KL4f8
d2EwsA/6Ah511L+E+sH3PMz9/9ZR7F6b4xXx+YI0WuiWANNNEdxkkIiq6smdCQI9
oS//iJBdMigdKzjllIwnAHTcfatZE+3A6qCroM0pnxsQejDdAR0BP2VA4b7QMGg0
ey44e5CYZgRorh9oOTtsjE/jL4sNZK6AgyZab0gZ3Q/A5qubLRiSaphHfpfCej+q
RC3W2m3jbQSge5iNy8iIg41PH4fHcjpRNM/UxT6UVexxBWiJ6i9yiNYdfb4joCuG
Oh4Rr4TfnoN8yIuoA8WRngYejpV5ZGGnwXwTDl47WPvoJiMeWSnpQU0u/fSJARqm
YAMtZ+GLjSfj60SgCu6HR8AyH9q5U54pNdBiCSQ/7fGhYJwq9WS/XDjr+Xaj0+ku
g4veatMTMaNdwJr0RAViw1RAOA97cAqfgOADnlAJM/tzvGw0VjIxdrbciywUXB2A
At26ibT6WQX/I/fPSJqmwieEYiueikZfvuLFYAeSrLQ4GWGGgq3Aj4k1LtOVLEP3
y3Pt4rkxJQxW3EDKseaZYsyR7EbU3PnJFTsAY0/p1XiDSeiM4d0IIi7dZQiQygg4
3XwmqE8ODxetHna+dPXr0ooaU9UIaaT1X5AyOr6t6Tp/n0Yq50F1PpjBCS2nLAYk
JdkgfFBMWlkOZcCTgLYMKNSnmWZihUxb0zfDaOMCe4HUoqc1WLA=
=92XF
-----END PGP SIGNATURE-----
Merge tag 'mfd-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd
Pull MFD updates from Lee Jones:
"New Support & Features:
- MediaTek MT6397: Add mt6323 AUXADC support
- MediaTek MT6397: Add mt6323 EFUSE support
- Spreadtrum SC27xx: Add SC2730 regulator cell
Improvements & Fixes:
- Apple SMC: Fix key count endianness annotation
- Azoteq IQS62x: Reject zero-length firmware records
- ChromeOS EC: Introduce cros_ec_read_features helper and read
features during probe to catch transfer errors
- Cirrus Logic CS42L43: Fix regmap defaults ordering
- Cirrus Logic CS42L43: Remove redundant NULL checks on SoundWire
- Congatec Board Controller: Fix teardown ordering in cgbc_remove()
- HP iPAQ Micro: Fix out-of-bounds stack read in ipaq_micro_str
- Marvell 88PM886: Initialize the battery page
- QNAP MCU: Keep the reply buffer alive past a command timeout
- RAVE SP: Validate received frame payload lengths
- Silicon Labs Si476x: Drop duplicate NULL checks
- Silicon Labs Si476x: Modernize GPIO handling
- Silicon Motion SM501: Fix potential memory leaks during remove
- UCB1x00: Convert Assabet gpio-keys to use software nodes and
register software node for GPIO controller
- Viperboard: Fix native fields type in structures as little-endian
- Viperboard: Remove redundant NULL check before kfree()
- X-Powers AXP20x: Preserve other control bits when powering off
Cleanups & Refactoring:
- Core: Drop unused assignment of spi_device_id driver data
- Core: Initialize spi_device_id arrays using member names
- Core: Unify style of spi_device_id arrays
- Maintainers: Add Intel LPSS section to follow the changes
- Maintainers: Add a mailing list entry to MFD
- Cirrus Logic CS42L43: Format sdw_device_id table
- Cirrus Logic CS42L43: Use new SoundWire enumeration helper
- ROHM PMIC: Factor out power button registration and convert
gpio-keys to use software nodes
- ST-Ericsson DB8500: Fold dbx500 header into db8500
Device Tree Binding Updates:
- Core: Add techvision vendor prefix
- Marvell 88PM886: Allow vbus regulator
- MediaTek MT8195 SCP: Add support for MT8189 SoC
- Qualcomm SPMI PMIC: Document PMG1110
- Qualcomm SPMI PMIC: Document haptics device
- Qualcomm TCSR: Add compatible for Hawi and Maili SoCs
- Qualcomm TCSR: Add compatible for Shikra
- Qualcomm TCSR: Document the IPQ9650 TCSR block
- STMicroelectronics STMPE: Fix typo st,stmpe601 (should be
st,stmpe610)
- Syscon: Add ESWIN EIC7700 compatible
- Syscon: Allow syscon compatible for Loongson-2K0300 chip id
- Syscon: Disallow simple-bus with syscon
- Syscon: Drop custom select for older dtschema
- TI OMAP USBHS TLL: Convert to DT schema"
* tag 'mfd-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (45 commits)
mfd: cs42l43: Fix regmap defaults ordering
dt-bindings: mfd: syscon: Allow syscon compatible for Loongson-2K0300 chip id
dt-bindings: mfd: syscon: Add ESWIN EIC7700 compatible
mfd: qnap-mcu: keep the reply buffer alive past a command timeout
dt-bindings: mfd: qcom,tcsr: Document the IPQ9650 TCSR block
mfd: macsmc: Fix key count endianness annotation
dt-bindings: mfd: qcom,spmi-pmic: Document haptics device
mfd: iqs62x: Reject zero-length firmware records
mfd: rave-sp: validate received frame payload lengths
mfd: sm501: Fix potential memory leaks during remove
mfd: viperboard: Fix native fields type in structures as little-endian
mfd: si476x-i2c: Get rid of duplicate NULL checks
dt-bindings: mfd: Convert OMAP USB TLL to DT schema
mfd: cgbc: Fix teardown ordering in cgbc_remove()
mfd: mt6397-core: Add mt6323 AUXADC support
dt-bindings: mfd: qcom,tcsr: Add compatible for Hawi and Maili SoCs
mfd: rohm: Factor out power button registration
mfd: ucb1x00: Convert Assabet gpio-keys to use software nodes
mfd: ucb1x00: Register software node for GPIO controller
mfd: cs42l43: Tidy up formatting on sdw_device_id table
...
|
||
|
Linus Torvalds
|
18fbf5151d |
mm.git review status for linus..mm-stable
Everything: Total patches: 171 Reviews/patch: 1.83 Reviewed rate: 82% Excluding selftests: Total patches: 149 Reviews/patch: 1.77 Reviewed rate: 80% Excluding selftests and maple_tree: Total patches: 129 Reviews/patch: 1.99 Reviewed rate: 89% Summary of patch series in this merge: - "mm/rmap: index MAP_PRIVATE file-backed folios by anonymous pgoff" (Lorenzo Stoakes): Index MAP_PRIVATE file-backed folios by their anonymous page offset to resolve confusion around reverse mapping for zeroed and CoW'd file-backed memory. Use this new VMA anonymous page offset tracking to eliminate index conflicts and lay the foundation for scalable CoW performance improvements. - "promote mapped executable folios after first usage for MGLRU" (Baolin Wang): Make MGLRU's protection of mapped executable file folios more reliable. Follow the classical LRU's logic, promoting mapped executable file folios after their first usage to give executable code a better chance to stay in memory and improve workload performance. - "mm: vmscan: fix node reclaim ignoring swappiness parameter" (Ridong Chen): Fix per-node proactive reclaim interface's ignoring the swappiness parameter when CONFIG_MEMCG is disabled by consolidating sc_swappiness() into a single function that checks proactive_swappiness regardless of kernel configuration. - "mm/vmscan: reduce lru_lock contention via vmstat-derived scan-balance cost" (Usama Arif): Reduce lru_lock contention in the reclaim path by deriving scan-balance costs from vmstat counters rather than lock-acquired producer updates. Read and decay these cost signals on the reclaim side under a dedicated per-lruvec lock, reducing total LRU lock wait time by over 60% without impacting scan throughput. - "zram: fix zram issues reported by sashiko" (Sergey Senozhatsky): Fix two low-risk zram bugs which Sashiko spotted in drive-by review. - "Honor XA_FLAGS_ACCOUNT in xas_split_alloc() and charge to folio's memcg" (Zi Yan): Fix xas_split_alloc() by enabling target folio memcg charging during splits and adding the missing __GFP_ACCOUNT flag for proper XArray node memory accounting. - "selftests/mm: use pattern matching in .gitignore" (Pratyush Mallick): Replace hardcoded binary names in selftests/mm/.gitignore with a generic pattern-matching rule to automatically ignore generated test files and avoid manual updates when adding new tests. - "mm/page_ext: remove pgdat_page_ext_init()" (Sang-Heon Jeon): Make the incompatibility between FLATMEM and NUMA explicit in mm/Kconfig and remove the unused pgdat_page_ext_init() function. - "zram: fix zstd error paths and add parameter validation" (Haoqin Huang): Clean up zram compression backends by removing redundant error cleanup, adding parameter and dictionary validation, auto-prefixing algorithm error logs, and resetting parameters prior to reinitialization. - "zram: fix stale scan bounds after reinitialization" (Longlong Xia): Prevent out-of-bounds slot accesses during concurrent zram resets by moving table scan bound calculations under dev_lock in writeback_store() and read_block_state(). - "add anon mTHP collapse test cases" (Baolin Wang): Extend selftests helper functions to support arbitrary page orders and add new test cases and options for mTHP collapse in khugepaged. - "selftests/mm: Handle unsupported and transient test conditions" (Muhammad Usama Anjum): Update MM selftests to report a SKIP status instead of a failure when required kernel or filesystem features are unsupported, while adding retry logic for transient page migration errors. - "mm/zswap: Fixes and improves the zswap shrink" (Hao Jia): Fix the missing zswap global shrinker when CONFIG_MEMCG is disabled and extend shrink_memcg() to support batch writeback for improved writeback efficiency. - "alloc_tag: introduce IOCTL-based filtering for MAP" (Suren Baghdasaryan): Introduce an IOCTL-based binary interface for memory allocation profiling that enables kernel-side filtering before per-CPU counter aggregation. This eliminates the text-parsing overhead of /proc/allocinfo and provides up to a 20x speedup by transferring only filtered allocation data to userspace. - "better block swap batching and a different take on swap_ops v5" (Christoph Hellwig): Refactor block swap I/O to use swap_iocb for batching instead of single-bio requests and rebase the swap_ops interface, achieving faster swap throughput during kernel builds. - "mm: kmemleak: reduce transient false positives by confirming leaks" (Catalin Marinas): Reduce false-positive kmemleak reports by combining two kmemleak enhancements that add a second confirmation scan and a configurable minimum unreferenced scan count module parameter. - "mm: kmemleak: default min_unref_scans to 2 for verbose kernels" (Breno Leitao): Auto-scanning kernels can generate false-positive memory leak reports on single scans, so this patch defaults min_unref_scans to 2 when CONFIG_DEBUG_KMEMLEAK_VERBOSE is enabled to require a second confirming scan. - "swap_ops updates" (Christoph Hellwig): Batching I/O for synchronous swap devices causes performance regressions and filesystem-based swap suffers from double-indirection overhead. This series resolves both issues by reintroducing per-folio writes for synchronous swap and allowing filesystems to directly export their own swap_ops. - "mm/khugepaged: several cleanups" (Nico Pache): khugepaged accumulated redundant state-checking patterns and outdated comments following mTHP integration. Introduce dedicated helpers for PTE validation and event counting while refreshing the internal documentation. - "maple_tree: lock checking and clean ups" (Liam Howlett): Syzbot reports incorrectly blame memory management exit paths for locking bugs, maple tree erase operations risk allocation failures without gfp flags and internal documentation lacks clarity. Improve lock error detection, update docs, fix race and allocation edge cases and optimize erase allocations using a fallback to GFP_KERNEL | GFP_NOFAIL. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCao9nJQAKCRDdBJ7gKXxA jk/9AQDlfevYJuSJmzAI8bt8ISG+/TfXMtIZC/MdbHqtQVYWPQD8Cvm3DUZsdGB/ Gloq/HBFuMPgE8p2pwUIthdgnTPNvAc= =c+Nb -----END PGP SIGNATURE----- Merge tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: - "mm/rmap: index MAP_PRIVATE file-backed folios by anonymous pgoff" (Lorenzo Stoakes) Index MAP_PRIVATE file-backed folios by their anonymous page offset to resolve confusion around reverse mapping for zeroed and CoW'd file-backed memory. Use this new VMA anonymous page offset tracking to eliminate index conflicts and lay the foundation for scalable CoW performance improvements. - "promote mapped executable folios after first usage for MGLRU" (Baolin Wang) Make MGLRU's protection of mapped executable file folios more reliable. Follow the classical LRU's logic, promoting mapped executable file folios after their first usage to give executable code a better chance to stay in memory and improve workload performance. - "mm: vmscan: fix node reclaim ignoring swappiness parameter" (Ridong Chen) Fix per-node proactive reclaim interface's ignoring the swappiness parameter when CONFIG_MEMCG is disabled by consolidating sc_swappiness() into a single function that checks proactive_swappiness regardless of kernel configuration. - "mm/vmscan: reduce lru_lock contention via vmstat-derived scan-balance cost" (Usama Arif) Reduce lru_lock contention in the reclaim path by deriving scan-balance costs from vmstat counters rather than lock-acquired producer updates. Read and decay these cost signals on the reclaim side under a dedicated per-lruvec lock, reducing total LRU lock wait time by over 60% without impacting scan throughput. - "zram: fix zram issues reported by sashiko" (Sergey Senozhatsky) Fix two low-risk zram bugs which Sashiko spotted in drive-by review. - "Honor XA_FLAGS_ACCOUNT in xas_split_alloc() and charge to folio's memcg" (Zi Yan) Fix xas_split_alloc() by enabling target folio memcg charging during splits and adding the missing __GFP_ACCOUNT flag for proper XArray node memory accounting. - "selftests/mm: use pattern matching in .gitignore" (Pratyush Mallick) Replace hardcoded binary names in selftests/mm/.gitignore with a generic pattern-matching rule to automatically ignore generated test files and avoid manual updates when adding new tests. - "mm/page_ext: remove pgdat_page_ext_init()" (Sang-Heon Jeon) Make the incompatibility between FLATMEM and NUMA explicit in mm/Kconfig and remove the unused pgdat_page_ext_init() function. - "zram: fix zstd error paths and add parameter validation" (Haoqin Huang) Clean up zram compression backends by removing redundant error cleanup, adding parameter and dictionary validation, auto-prefixing algorithm error logs, and resetting parameters prior to reinitialization. - "zram: fix stale scan bounds after reinitialization" (Longlong Xia) Prevent out-of-bounds slot accesses during concurrent zram resets by moving table scan bound calculations under dev_lock in writeback_store() and read_block_state(). - "add anon mTHP collapse test cases" (Baolin Wang) Extend selftests helper functions to support arbitrary page orders and add new test cases and options for mTHP collapse in khugepaged. - "selftests/mm: Handle unsupported and transient test conditions" (Muhammad Usama Anjum) Update MM selftests to report a SKIP status instead of a failure when required kernel or filesystem features are unsupported, while adding retry logic for transient page migration errors. - "mm/zswap: Fixes and improves the zswap shrink" (Hao Jia) Fix the missing zswap global shrinker when CONFIG_MEMCG is disabled and extend shrink_memcg() to support batch writeback for improved writeback efficiency. - "alloc_tag: introduce IOCTL-based filtering for MAP" (Suren Baghdasaryan) Introduce an IOCTL-based binary interface for memory allocation profiling that enables kernel-side filtering before per-CPU counter aggregation. This eliminates the text-parsing overhead of /proc/allocinfo and provides up to a 20x speedup by transferring only filtered allocation data to userspace. - "better block swap batching and a different take on swap_ops v5" (Christoph Hellwig) Refactor block swap I/O to use swap_iocb for batching instead of single-bio requests and rebase the swap_ops interface, achieving faster swap throughput during kernel builds. - "mm: kmemleak: reduce transient false positives by confirming leaks" (Catalin Marinas) Reduce false-positive kmemleak reports by combining two kmemleak enhancements that add a second confirmation scan and a configurable minimum unreferenced scan count module parameter. - "mm: kmemleak: default min_unref_scans to 2 for verbose kernels" (Breno Leitao) Auto-scanning kernels can generate false-positive memory leak reports on single scans, so this patch defaults min_unref_scans to 2 when CONFIG_DEBUG_KMEMLEAK_VERBOSE is enabled to require a second confirming scan. - "swap_ops updates" (Christoph Hellwig) Batching I/O for synchronous swap devices causes performance regressions and filesystem-based swap suffers from double-indirection overhead. This series resolves both issues by reintroducing per-folio writes for synchronous swap and allowing filesystems to directly export their own swap_ops. - "mm/khugepaged: several cleanups" (Nico Pache) khugepaged accumulated redundant state-checking patterns and outdated comments following mTHP integration. Introduce dedicated helpers for PTE validation and event counting while refreshing the internal documentation. - "maple_tree: lock checking and clean ups" (Liam Howlett) Syzbot reports incorrectly blame memory management exit paths for locking bugs, maple tree erase operations risk allocation failures without gfp flags and internal documentation lacks clarity. Improve lock error detection, update docs, fix race and allocation edge cases and optimize erase allocations using a fallback to GFP_KERNEL | GFP_NOFAIL. * tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (172 commits) selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC memcg: move LRU size accounting on reparenting instead of copying it mm/vmscan: fix comment logic in balance_pgdat maple_tree: add helper mas_make_walkable() maple_tree: avoid extra gap calculation maple_tree: fix argument name in header maple_tree: change two GFP flags in tests maple_tree: document erase and allocations better maple_tree: avoid mas_erase() and mtree_erase() failures maple_tree: document that erase may use GFP_KERNEL for allocations maple_tree: catch race in mas_alloc_cyclic() maple_tree: add bulk parent set helper maple_tree: micro optimisation of mas_wr_store_type() maple_tree: optimise mas_wr_node_store() when not in rcu mode maple_tree: use prefetched value in mas_wr_store_type() maple_tree: clarify comments on mas_nomem() maple_tree: drop MAPLE_ALLOC_SLOTS maple_tree: drop dead code from mas_extend_spanning_null() maple_tree: documentation fix maple_tree: add write lock checking with lockdep sequence numbers ... |
||
|
Jakub Kicinski
|
e2a6641e3b |
Merge branch 'improve-stability-of-big_tcp_tunnels-sh-selftest'
Alice Mikityanska says: ==================== Improve stability of big_tcp_tunnels.sh selftest This series addresses flakiness of big_tcp_tunnels.sh discussed at: https://lore.kernel.org/netdev/349c582c-73e3-468c-91cd-ad6cc3562700@app.fastmail.com/ Lower the thresholds to avoid failures like this (number of packets below the threshold): https://netdev-ctrl.bots.linux.dev/logview.html?f=/logs/vmksft/net-dbg/results/754376/28-big-tcp-tunnels-sh/stdout Tweak tcp_min_tso_segs and initcwnd to avoid failures like this (BIG TCP doesn't kick in in slow configurations): https://netdev-ctrl.bots.linux.dev/logview.html?f=/logs/vmksft/net-dbg/results/751124/21-big-tcp-tunnels-sh/stdout v2 changes: Use $KSFT_MACHINE_SLOW instead of probing kernel config. v1: https://lore.kernel.org/netdev/20260814194124.3102581-1-alice.kernel@fastmail.im/ ==================== Link: https://patch.msgid.link/20260822120308.1165200-1-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Alice Mikityanska
|
1d62b83fb7 |
selftests: net: Fix slow configurations in big_tcp_tunnels.sh
The combination of checksum offload disabled (that causes software GSO)
and a debug kernel is inherently slow. Depending on the CPU power and
load, RTT may increase, limiting sk_pacing_rate, so tcp_tso_autosize
caps SKBs at around 40 segments, and zero BIG TCP packets are produced.
Increase sysctl net.ipv4.tcp_min_tso_segs and set a bigger initial value
of CWND in these configurations to force BIG TCP.
Fixes:
|
||
|
Alice Mikityanska
|
f7d0400bd3 |
selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh
With checksum offload disabled, much fewer BIG TCP packets are generated
due to overall loss of throughput. Use a separate threshold in these
tests, which is 1/10 of the threshold set for the rest of tests.
Fixes:
|
||
|
Alice Mikityanska
|
bb42c16f48 |
selftests: net: Lower threshold on debug kernels for big_tcp_tunnels.sh
Debug kernels on upstream CI runners run slower and generate fewer BIG
TCP packets, making the test flaky on upstream CI runners. Lower the
default threshold for those kernels.
Fixes:
|
||
|
Alice Mikityanska
|
dc170da334 |
selftests: net: Wait for netserver to launch
Use wait_local_port_listen after starting netserver in
big_tcp_tunnels.sh to ensure it's listening when the test starts.
Fixes:
|
||
|
Daniel Pawlik
|
6fe7e31a45 |
net: airoha: npu: fix missing streaming DMA mask
The driver calls dma_set_coherent_mask() but never dma_set_mask(),
leaving the streaming DMA mask at the bus default. On the non-coherent
EN7581 platform (Cortex-A53), this causes the NPU mailbox to hang
after approximately 41 calls when using streaming DMA mappings.
Replace dma_set_coherent_mask() with dma_set_mask_and_coherent() to
set both the streaming and coherent DMA masks, matching standard
driver practice.
Fixes:
|
||
|
Abdurrahman Hussain
|
5bb01c657f |
of: fix out-of-bounds read in of_alias_scan() stem parser
The stem parser tests isdigit(*(end - 1)) before checking end > start
and so reads one byte before the property name when the name is empty
or all digits. Check the bound first.
Fixes:
|
||
|
Pablo Neira Ayuso
|
fc04229727 |
netfilter: nf_tables: remove leftover set_update_list
This list has been moved to per-netns, remove onstack list which is not
used anymore.
Fixes:
|
||
|
Pablo Neira Ayuso
|
132a02beb4 |
netfilter: nf_tables: set on dead bit when performing early element removal
.commit call for sets is skipped if set->dead flag is set on, but this flag is set on later in the commit path. This also reintroduces the bug fixed in commit |
||
|
Pablo Neira Ayuso
|
43559058d2 |
netfilter: nf_tables: skip double clone set expressions on element insert
Both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This results in a double clone, once to clone the template set expressions then another clone on the new element. Add a flag to annotate if userspace provides a override expression (ie. expression of the same type of the set but different configuration), otherwise borrow the existing expression from the set. Add conditionals to release expression iif they represent an override. Use this new override_exprs flag to dump the dynset expression override to userspace. This simplifies the existing logic and it also fixes a bug with the connlimit expression which results in a module refcount imbalance WARNING splat when resorting on the default set expressions. Fixes: |
||
|
Pablo Neira Ayuso
|
793d9eda48 |
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
Several xtables extension still use pr_err() or pr_info() without
ratelimit.
For xt_cgroup, while at this, remove redundant "xt_cgroup:" prefix
since pr_fmt is already set on.
Fixes:
|
||
|
Pablo Neira Ayuso
|
f43358489d |
netfilter: x_tables: remove pr_debug
Remove pr_debug() for these xtables extensions, these have no use these days. Still, turn pr_debug() into pr_info_ratelimited() in the .checkentry path since this helps provide a hint via dmesg in legacy iptables. Exception is xt_IDLETIMER in the module init path, where pr_err() is used. Add missing pr_fmt() definition in xt_REDIRECT, xt_NETMAP and xt_MASQUERADE. Add missing \n to several pr_debug() that were translated to use pr_info_ratelimited(). Link: https://patch.msgid.link/cover.1786933680.git.rakukuip@gmail.com/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
||
|
Eric Biggers
|
55dd20f0f4 |
netfilter: nft_set_pipapo_avx2: add missing vzeroupper
Since pipapo_get_avx2() uses YMM registers, execute vzeroupper before
returning from it. This is needed to avoid degrading the performance of
any later SSE code that may happen to be executed.
Fixes:
|
||
|
Pablo Neira Ayuso
|
b1881d362e |
netfilter: nf_tables: move hardware offload step after building the chain blob
Allocate the chain blob before the ruleset offload to reduce chances of
entering an inconsistent state where the offloaded ruleset in the nic
and the software ruleset differ.
Fixes:
|
||
|
Paolo Abeni
|
81eb1867e0 |
Merge branch 'guard-against-gso_segs-overflows'
Alice Mikityanska says: ==================== Guard against gso_segs overflows This series is a follow-up on the discussion: https://lore.kernel.org/netdev/CAD0BsJWzSr2zduf5v3mVC4zd=Lj6ZAoC+V42-VBdg42aDY8XXw@mail.gmail.com/T/#m1e22fca273c36cc8844e516505d3251cc1418fea skb_segment is patched to avoid possible overflows in partial GSO. The primary possible source of too many GSO segments is also addressed: virtio-net clamps gso_size to >=8 in TCP, as suggested by Eric. v2: https://lore.kernel.org/netdev/20260813174613.2920246-1-alice.kernel@fastmail.im/ v1: https://lore.kernel.org/netdev/20260723155145.158572-1-alice.kernel@fastmail.im/ ==================== Link: https://patch.msgid.link/20260822120117.1163423-1-alice.kernel@fastmail.im Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Alice Mikityanska
|
0b13256ce3 |
net: Guard for gso_segs overflow in skb_segment
skb_segment calculates 32-bit partial_segs as len / gso_size, and then assigns it to the 16-bit gso_segs field. The division might overflow in some edge cases where the SKB is BIG TCP (65536 <= len <= 8*65535), and gso_size < TCP_MIN_GSO_SIZE = 8. While normally this can't happen due to TCP_MIN_GSO_SIZE, an AF_PACKET PACKET_VNET_HDR socket could generate such a malformed packet until the previous patch. Blocking malformed virtio_net packets was implemented in the previous patch, but this patch clamps partial_segs in skb_segment itself for more generic robustness. Should len / gso_size happen to be bigger than 65535 in partial GSO, skb_segment will now just produce more than two output SKBs, all of which will be valid with gso_segs <= 65535. In order to catch possible other cases of too many partial_segs, add a DEBUG_NET_WARN_ON_ONCE when len / gso_size happens to be too big. Signed-off-by: Alice Mikityanska <alice@isovalent.com> Link: https://patch.msgid.link/20260822120117.1163423-3-alice.kernel@fastmail.im Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Alice Mikityanska
|
c27c449d45 |
virtio-net: Ensure that TCP packets don't overflow gso_segs
The user can specify any gso_size in a packet crafted with an AF_PACKET
PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the
same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user
crafts a packet with gso_size < 8, there is a risk for partial GSO to
overflow the 16-bit gso_segs field when dividing the SKB length by
gso_size.
Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep
gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly
tested at tools/testing/selftests/net/tun.c:649.
Fixes:
|
||
|
Fernando Fernandez Mancera
|
9b4ab1f3fe |
netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count limit
Replace WARN_ON_ONCE with DEBUG_NET_WARN_ON_ONCE in __nf_conncount_add. The function handles count limit breaches safely by returning -EOVERFLOW, so a production backtrace is not needed. This prevents unnecessary system panics when panic_on_warn=1 is enabled in production systems. Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
||
|
Fernando Fernandez Mancera
|
1f0391aea8 |
netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks
Replace WARN_ON calls with DEBUG_NET_WARN_ON_ONCE in the default switch blocks of nf_tproxy_get_sock_v4 and v6. Unsupported transport protocols are already safely handled by returning a NULL socket pointer. This prevents unnecessary system panics when panic_on_warn=1 is enabled in production systems. Link: https://patch.msgid.link/cover.1786968834.git.zhilinz@nebusec.ai/ Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
||
|
Aleksandr Khromov
|
2c4e7c42d7 |
slip: fix use-after-free in sl_sync()
slip_devs[] stores bare net_device pointers and takes no reference on
them. sl_sync() and sl_alloc() walk that table from slip_open() under
rtnl_lock(), while an entry is dropped by sl_free_netdev(), which
sl_setup() installs as dev->priv_destructor.
priv_destructor is called from netdev_run_todo(), which deliberately
runs with the RTNL semaphore released so that it can sleep while waiting
for the device refcount to drop:
/* Snapshot list, allow later requests */
list_replace_init(&net_todo_list, &list);
__rtnl_unlock();
...
if (dev->priv_destructor)
dev->priv_destructor(dev); /* slip_devs[i] = NULL */
if (dev->needs_free_netdev)
free_netdev(dev);
...
/* Free network device */
kobject_put(&dev->dev.kobj);
So rtnl_lock() does not serialise slip_open() against the teardown at
all. sl_sync() can load slip_devs[i] while the entry is still published
and dereference it after netdev_run_todo() has run the destructor and
released the device:
CPU0 (slip_open) CPU1 (slip_close)
unregister_netdev()
rtnl_unlock()
netdev_run_todo()
__rtnl_unlock()
rtnl_lock()
sl_sync()
dev = slip_devs[i]
priv_destructor(dev)
slip_devs[i] = NULL
kobject_put(&dev->dev.kobj)
/* dev is freed */
sl = netdev_priv(dev)
if (sl->tty || sl->leased) /* use-after-free */
BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline]
BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806
Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506
CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
sl_sync drivers/net/slip/slip.c:730 [inline]
slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806
tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433
tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564
tiocsetd drivers/tty/tty_io.c:2428 [inline]
tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712
Allocated by task 6502:
alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719
sl_alloc drivers/net/slip/slip.c:756 [inline]
slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817
tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433
tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564
Freed by task 6497:
device_release+0xa2/0x240 drivers/base/core.c:2507
kobject_put+0x179/0x280 lib/kobject.c:729
netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509
slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906
tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456
tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614
tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782
tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860
Commit
|
||
|
Maxime Chevallier
|
9a56a27e60 |
net: stmmac: selftests: Pass the IP proto mask in the TC selftest
The stmmac TC filtering rules have recently gained sanity checks to make
sure the passed keys and their respective masks are aligned with the HW
filtering abilities.
The stmmac selftests failed to pass the mask in the match data for L4
filtering tests, and are now failing consistently with -EINVAL :
$ ethtool -t eth1
[...]
23. L4 DA TCP Filtering -22
24. L4 SA TCP Filtering -22
25. L4 DA UDP Filtering -22
26. L4 SA UDP Filtering -22
Let's pass the ip_proto mask in the l4 filtering tests match data. Found
on imx8mp, which now have passing L4 tests :
$ ethtool -t eth1
[...]
23. L4 DA TCP Filtering 0
24. L4 SA TCP Filtering 0
25. L4 DA UDP Filtering 0
26. L4 SA UDP Filtering 0
While at it, initialize the masks and keys to avoid re-using whatever
was on the stack.
Fixes:
|