Commit Graph

1368092 Commits

Author SHA1 Message Date
Linus Torvalds
6f2a71a99e bcachefs fixes for 6.16-rc4
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEKnAFLkS8Qha+jvQrE6szbY3KbnYFAmhd/noACgkQE6szbY3K
 bnbZrg/+LSNkiwkPI/RExVcwG9I2hsGOcUUUuRiCEDnI6TI+uMt7hOmRJUt8ahQL
 jArd2m0mdTus10T8Z7SGRIGgGnszrY5RzYK8I6dOP3SKPo0Wngksp1yv19jaxNGr
 t106/I9IP9UJlN4EkmXMKbHEMn9vpYqxkbptYFlvjhBeEKvFFArVb+OOo7O1/mBH
 /Q94Z3wsoJqFN5QedoGSqFoG+LmzCi95GZBEbV1vLld37e6uXhJvmLKDEiLinTEJ
 BiVOYJwPd20lbHjGXHsdAh0CHX3sYQgm2RpTcwFl/aiPLFAbmgSE4JT7ySmZQuPM
 KcxAMbS/Z5vpSmXS4yOivSUoT9J/VwFXGNjzhCTJtixBFTDYRbnFTG4CDsBvJpox
 eZOrpGVyx8yg+CaEcVbgMhqrirt3ySEgnLYDj0HoXMB/tf/ACmOfhFft4/NKc7Or
 mtF5WI0lrkAuPshMDXr/BRfPHxdB18GNuxWOzgMS3dyyvQzeMZsnvg7m9VfeK6OM
 VgthGJEiThtM/ZUS16ZI3YRT72cjcwgxpw8mxSa6A3GM8+mKuJ3Ib3tPl7h7x5wW
 BbNtZOgIiSwgxdbfqfdZQ0upz9iceGL0lr8C82Q3DoP5/NYE5ans3kBcSH5dNbEU
 AULtqLk6850fNW7/foBW9lw3DDgBTcp8ROF/xt3qiPe4MywCt7s=
 =mnLI
 -----END PGP SIGNATURE-----

Merge tag 'bcachefs-2025-06-26' of git://evilpiepirate.org/bcachefs

Pull bcachefs fixes from Kent Overstreet:

 - Lots of small check/repair fixes, primarily in subvol loop and
   directory structure loop (when involving snapshots).

 - Fix a few 6.16 regressions: rare UAF in the foreground allocator path
   when taking a transaction restart from the transaction bump
   allocator, and some small fallout from the change to log the error
   being corrected in the journal when repairing errors, also some
   fallout from the btree node read error logging improvements.

   (Alan, Bharadwaj)

 - New option: journal_rewind

   This lets the entire filesystem be reset to an earlier point in time.

   Note that this is only a disaster recovery tool, and right now there
   are major caveats to using it (discards should be disabled, in
   particular), but it successfully restored the filesystem of one of
   the users who was bit by the subvolume deletion bug and didn't have
   backups. I'll likely be making some changes to the discard path in
   the future to make this a reliable recovery tool.

 - Some new btree iterator tracepoints, for tracking down some
   livelock-ish behaviour we've been seeing in the main data write path.

* tag 'bcachefs-2025-06-26' of git://evilpiepirate.org/bcachefs: (51 commits)
  bcachefs: Plumb correct ip to trans_relock_fail tracepoint
  bcachefs: Ensure we rewind to run recovery passes
  bcachefs: Ensure btree node scan runs before checking for scanned nodes
  bcachefs: btree_root_unreadable_and_scan_found_nothing should not be autofix
  bcachefs: fix bch2_journal_keys_peek_prev_min() underflow
  bcachefs: Use wait_on_allocator() when allocating journal
  bcachefs: Check for bad write buffer key when moving from journal
  bcachefs: Don't unlock the trans if ret doesn't match BCH_ERR_operation_blocked
  bcachefs: Fix range in bch2_lookup_indirect_extent() error path
  bcachefs: fix spurious error_throw
  bcachefs: Add missing bch2_err_class() to fileattr_set()
  bcachefs: Add missing key type checks to check_snapshot_exists()
  bcachefs: Don't log fsck err in the journal if doing repair elsewhere
  bcachefs: Fix *__bch2_trans_subbuf_alloc() error path
  bcachefs: Fix missing newlines before ero
  bcachefs: fix spurious error in read_btree_roots()
  bcachefs: fsck: Fix oops in key_visible_in_snapshot()
  bcachefs: fsck: fix unhandled restart in topology repair
  bcachefs: fsck: Fix check_directory_structure when no check_dirents
  bcachefs: Fix restart handling in btree_node_scrub_work()
  ...
2025-06-26 19:49:12 -07:00
Linus Torvalds
8a20830f2d hid-for-linus-2025062701
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEL65usyKPHcrRDEicpmLzj2vtYEkFAmhdxRsACgkQpmLzj2vt
 YEksLg//Q+4WWsxqkAB3EuHbd+qUG3Qc12oJAf2asOcaizfUtk8JJ2RKVwjMI1Zx
 TNlJDE7kC/l6+pwEHOqWDAbFjgkEMvU639cWzeB9VF4wfW76P8O5fdvjZBgj9SUw
 6lVmM/447NlJ5svf903QgdkumAso9XKy88TswdyqO9BtSxYJH1W4nX57EcCHzhQN
 6cFHMNbvpk+fZlJdRKocVCMJ2Ih7Zk0u4hdGeaYD+/m7H85RaIop59fUhhgr8nf4
 hyb/Wo7wALLLm4k81a1TT9Uq8U89mg4YDXSdUXFi148oZnbo5AEDe0qW3ef3Q/O8
 Rvk2VM8s8CazfHBEJ/a9QJBeEow81xSOp5JNy8Qgz9iPWuuggJWDzt7Y4sFgzmxN
 WIax6UgDaRXZBkPcqctNh5WOv/hrnom0nwW3wtuI93aXGnaZDIXNqqLr+PTLiDEc
 GsAatI6XB4D7/RJ/TxYAzcowlGz7WDSsUHghRzZMTv780sdOBwigTzq8e39aJyse
 SRmm/jcyKJ/T/D7cPy3e1qryvUfd/zi7916jBFcyeV99mNcDTz7iC9+pqAL7bcZa
 /ekM0q3AX2328jBoHKFdKH4cLieZ6f7hQR58uVrc7d9sRc7t/7bkIHJ5mdByNWxr
 lImvzt2ONGhXtWXxArVYqr8kzhI/vehQJsj3NR1f+b147bgpAM4=
 =nHeQ
 -----END PGP SIGNATURE-----

Merge tag 'hid-for-linus-2025062701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID fixes from Jiri Kosina:

 - fix for stalls during suspend/resume cycles with hid-nintendo (Daniel
   J. Ogorchock)

 - memory leak and reference count fixes in hid-wacom and in-appletb-kdb
   (Qasim Ijaz)

 - race condition (leading to kernel crash) fix during device removal in
   hid-wacom (Thomas Zeitlhofer)

 - fix for missed interrupt in intel-thc-hid (Intel-thc-hid:)

 - support for a bunch of new device IDs

* tag 'hid-for-linus-2025062701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
  HID: appletb-kbd: fix "appletb_backlight" backlight device reference counting
  HID: wacom: fix crash in wacom_aes_battery_handler()
  HID: intel-ish-hid: ipc: Add Wildcat Lake PCI device ID
  hid: intel-ish-hid: Use PCI_DEVICE_DATA() macro for ISH device table
  HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
  HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
  HID: input: lower message severity of 'No inputs registered, leaving' to debug
  HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
  HID: Intel-thc-hid: Intel-quicki2c: Enhance QuickI2C reset flow
  HID: nintendo: avoid bluetooth suspend/resume stalls
  HID: wacom: fix kobject reference count leak
  HID: wacom: fix memory leak on sysfs attribute creation failure
  HID: wacom: fix memory leak on kobject creation failure
2025-06-26 17:06:01 -07:00
Linus Torvalds
f02769e7f2 Devicetree fixes for v6.16, part 1:
- Convert altr,uart-1.0 and altr,juart-1.0 to DT schema. These were
   applied for nios2, but never sent upstream.
 
 - Fix extra '/' in fsl,ls1028a-reset '$id' path
 
 - Fix warnings in ti,sn65dsi83 schema due to unnecessary $ref.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEktVUI4SxYhzZyEuo+vtdtY28YcMFAmhdmYoACgkQ+vtdtY28
 YcOU+g/+Ol5gEbeyXo+KmkOWD0Rc6Rt0iO124KUENefvgGuKjfGOCXjM0Pk0CiyL
 RLxfjJA9KQVxBPaaE9+iwLr/5ffuM56lJJb1Ak4DzY/E5jlh8qXu0nCZeJoAh+jR
 IHTl1uko3hAjAl/k4Lkk+6vTi/6AsXRWbdcB6KcvijVy4WO7HOySe0hdBq/2UAad
 5xrQbtLHoapmKx/q94wTeGMoF3V8kw+LxxF/N3jA9krkDoZhrc5EFk43b7DlW6op
 330av//1DdKAGajSW0ZedV5zAog5wfnKCfrX0mUxwypMWaTOeZqMl52QbT5G8ALR
 AyHLCOt/WZaMGRq5d3iN1SKaOKRo5pvaTjufv94zahnQTGJnbTBK96FL2csdEEdC
 9xpRWZMrOHJDR/tEYPO+8zeAq321MB3z9exHMV/E5kTXo25k/66YaFj2JR+UPikk
 8v3arrVYaJ0n/X5+PtD2vYlYu9gXiDCbdwBEjcixRB+k2nlBLARWU1LWUWcZ0OKL
 sWeFcg6dpNKUPihfDu6Es5vnMoG93760s2aq+X4/SjQFlO1W3+TulNjIGedIcbdz
 moXt9bNQugQNdHdO2+w3ZgvWrmPjQVZSpKDKocpl60MmOwN0q6ARonVlQVIb1XMu
 A/qkHXO/2QxfVs69WoiwNP+qxIWtZYH+6byoODQMy49CL9FAccY=
 =ppJ5
 -----END PGP SIGNATURE-----

Merge tag 'devicetree-fixes-for-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

Pull devicetree fixes from Rob Herring:

 - Convert altr,uart-1.0 and altr,juart-1.0 to DT schema. These were
   applied for nios2, but never sent upstream.

 - Fix extra '/' in fsl,ls1028a-reset '$id' path

 - Fix warnings in ti,sn65dsi83 schema due to unnecessary $ref.

* tag 'devicetree-fixes-for-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
  dt-bindings: serial: Convert altr,uart-1.0 to DT schema
  dt-bindings: serial: Convert altr,juart-1.0 to DT schema
  dt-bindings: soc: fsl,ls1028a-reset: Drop extra "/" in $id
  dt-bindings: drm/bridge: ti-sn65dsi83: drop $ref to fix lvds-vod* warnings
2025-06-26 12:26:39 -07:00
Linus Torvalds
e34a79b96a Including fixes from bluetooth and wireless.
Current release - regressions:
 
   - bridge: fix use-after-free during router port configuration
 
 Current release - new code bugs:
 
   - eth: wangxun: fix the creation of page_pool
 
 Previous releases - regressions:
 
   - netpoll: initialize UDP checksum field before checksumming
 
   - wifi: mac80211: finish link init before RCU publish
 
   - bluetooth: fix use-after-free in vhci_flush()
 
   - eth: ionic: fix DMA mapping test
 
   - eth: bnxt: properly flush XDP redirect lists
 
 Previous releases - always broken:
 
   - netlink: specs: enforce strict naming of properties
 
   - unix: don't leave consecutive consumed OOB skbs.
 
   - vsock: fix linux/vm_sockets.h userspace compilation errors
 
   - selftests: fix TCP packet checksum
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmhdIbESHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkB70P/21uclzfzXS9Ijlata4aFjBtRB0Ebvat
 FqHZaB6ldVceRZYG4vb2FVoQawi5Ex6Aju4fgS0y34KDiwAA7wkmTVMbmSHOxPuy
 5oHDPilUv4T1cbiMBU7/BncT0XFwgA1pDsD8OBQtAB0ghSCidKdmberWZXeEW4Va
 J65Crdf8VLBgUb/enowRUA/TJ0SfZouAC/N+GmqfewxHCXM0a0JwJ9Kp1UjcTpEz
 7JifBHJbepa3mCCqHlXcJP87Q7soMz/V0o3B6IVm75MjgmR5I/BTiBKvsWurNqLZ
 AUtTy4icVOr6gSFmGjeiDH2OT6silF2JwqrR+ajNKNvgWJOOxFjEY+fy3RrRYLBD
 WLXkO20AdRsl77CdiDQkHl8Y3R88aeils7AnZVwJ91QjcDRfnRbr5U57bdCrxAGv
 ZJR9jWnFrTyC7UZeil7LMf/f09mb8jQqxKwKQAvO5tLgUh9TEaqlveapLHSUdN67
 ZyMZpzF5hGfslGf3Gc6tl324NkAtZB7bfAhTG8FyEIZqeOBYcL2Drr9dBLgAVTmS
 tTjgsoEQVGxLcDz6y5HK5kScTM5WnZybWBkGKRLl4/n5pU05SkMxjXmSr/nTpB2F
 CxVEjmutbfM/1tiClXCiHLLmV5DguAUV4Dz01/uiaOLjbxQb8NBzPDmRK9TNrfqh
 KFDQro/JEcdH
 =ywOM
 -----END PGP SIGNATURE-----

Merge tag 'net-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from bluetooth and wireless.

  Current release - regressions:

   - bridge: fix use-after-free during router port configuration

  Current release - new code bugs:

   - eth: wangxun: fix the creation of page_pool

  Previous releases - regressions:

   - netpoll: initialize UDP checksum field before checksumming

   - wifi: mac80211: finish link init before RCU publish

   - bluetooth: fix use-after-free in vhci_flush()

   - eth:
      - ionic: fix DMA mapping test
      - bnxt: properly flush XDP redirect lists

  Previous releases - always broken:

   - netlink: specs: enforce strict naming of properties

   - unix: don't leave consecutive consumed OOB skbs.

   - vsock: fix linux/vm_sockets.h userspace compilation errors

   - selftests: fix TCP packet checksum"

* tag 'net-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (38 commits)
  net: libwx: fix the creation of page_pool
  net: selftests: fix TCP packet checksum
  atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
  netlink: specs: enforce strict naming of properties
  netlink: specs: tc: replace underscores with dashes in names
  netlink: specs: rt-link: replace underscores with dashes in names
  netlink: specs: mptcp: replace underscores with dashes in names
  netlink: specs: ovs_flow: replace underscores with dashes in names
  netlink: specs: devlink: replace underscores with dashes in names
  netlink: specs: dpll: replace underscores with dashes in names
  netlink: specs: ethtool: replace underscores with dashes in names
  netlink: specs: fou: replace underscores with dashes in names
  netlink: specs: nfsd: replace underscores with dashes in names
  net: enetc: Correct endianness handling in _enetc_rd_reg64
  atm: idt77252: Add missing `dma_map_error()`
  bnxt: properly flush XDP redirect lists
  vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
  wifi: mac80211: finish link init before RCU publish
  wifi: iwlwifi: mvm: assume '1' as the default mac_config_cmd version
  selftest: af_unix: Add tests for -ECONNRESET.
  ...
2025-06-26 09:13:27 -07:00
Jiawen Wu
85720e04d9 net: libwx: fix the creation of page_pool
'rx_ring->size' means the count of ring descriptors multiplied by the
size of one descriptor. When increasing the count of ring descriptors,
it may exceed the limit of pool size.

[ 864.209610] page_pool_create_percpu() gave up with errno -7
[ 864.209613] txgbe 0000:11:00.0: Page pool creation failed: -7

Fix to set the pool_size to the count of ring descriptors.

Fixes: 850b971110 ("net: libwx: Allocate Rx and Tx resources")
Cc: stable@vger.kernel.org
Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Mina Almasry <almasrymina@google.com>
Link: https://patch.msgid.link/434C72BFB40E350A+20250625023924.21821-1-jiawenwu@trustnetic.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-26 11:02:23 +02:00
Jakub Kicinski
8d89661a36 net: selftests: fix TCP packet checksum
The length in the pseudo header should be the length of the L3 payload
AKA the L4 header+payload. The selftest code builds the packet from
the lower layers up, so all the headers are pushed already when it
constructs L4. We need to subtract the lower layer headers from skb->len.

Fixes: 3e1e58d64c ("net: add generic selftest support")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Gerhard Engleder <gerhard@engleder-embedded.com>
Reported-by: Oleksij Rempel <o.rempel@pengutronix.de>
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/20250624183258.3377740-1-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-26 10:50:49 +02:00
Linus Torvalds
ee88bddf7f bpf-fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmhcdnsACgkQ6rmadz2v
 bTqkRA//f024qEkYGrnnkRk1ZoOuKWk7DEUvw/J+us9dhPvJABmUHL3ZuMmDp1D/
 EgGWAMg1q8tsXvlnAR4mV25T1DLpfMmo6hzwZgVeGl3X9YqTCPbgBONRr6F1HXP4
 OXHnm9vHVcki8z0vPIUHsAbudp0PrXx9lSUssT3kCoZuV0xeQKTznvUS9HwGC8vP
 ex59XrkNaUeEyVozsa0YFHtT57NAH/77QSj1A5HC/x0u9SJroao18ct3b/5t7QdQ
 N4hcc/GH+xoGDyXPFYFlst9kXmYwCpz26w8bCpBY5x0Red+LhkvHwRv6KM1Czl3J
 f9da+S2qbetqeiGJwg8/lNLnHQcgqUifYu5lr35ijpxf7Qgyw0jbT+Cy2kd68GcC
 J0GCminZep+bsKARriq9+ZBcm282xBTfzBN4936HTxC6zh41J+jdbOC62Gw+pXju
 9EJwQmY59KPUyDKz5mUm48NmY4g7Zcvk2y7kCaiD5Np+WR1eFbWT7v6eAchA+JRi
 tRfTR5eqSS17GybfrPntto2aoydEC2rPublMTu2OT3bjJe2WPf4aFZaGmOoQZwX2
 97sa0hpMSbf4zS7h1mqHQ9y3p9qvXTwzWikm1fjFeukvb53GiRYxax5LutpePxEU
 OFHREy4InWHdCet0Irr8u44UbrAkxiNUYBD5KLQO/ZUlrMmsrBI=
 =Buaz
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:

 - Fix use-after-free in libbpf when map is resized (Adin Scannell)

 - Fix verifier assumptions about 2nd argument of bpf_sysctl_get_name
   (Jerome Marchand)

 - Fix verifier assumption of nullness of d_inode in dentry (Song Liu)

 - Fix global starvation of LRU map (Willem de Bruijn)

 - Fix potential NULL dereference in btf_dump__free (Yuan Chen)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  selftests/bpf: adapt one more case in test_lru_map to the new target_free
  libbpf: Fix possible use-after-free for externs
  selftests/bpf: Convert test_sysctl to prog_tests
  bpf: Specify access type of bpf_sysctl_get_name args
  libbpf: Fix null pointer dereference in btf_dump__free on allocation failure
  bpf: Adjust free target to avoid global starvation of LRU map
  bpf: Mark dentry->d_inode as trusted_or_null
2025-06-25 21:09:02 -07:00
Kent Overstreet
ef6fac0f9e bcachefs: Plumb correct ip to trans_relock_fail tracepoint
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-26 00:01:16 -04:00
Kent Overstreet
64b6a788bd bcachefs: Ensure we rewind to run recovery passes
Fix a 6.16 regression from the recovery pass rework, which introduced a
bug where calling bch2_run_explicit_recovery_pass() would only return
the error code to rewind recovery for the first call that scheduled that
recovery pass.

If the error code from the first call was swallowed (because it was
called by an asynchronous codepath), subsequent calls would go "ok, this
pass is already marked as needing to run" and return 0.

Fixing this ensures that check_topology bails out to run btree_node_scan
before doing any repair.

Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-26 00:01:16 -04:00
Kent Overstreet
3e72acb78b bcachefs: Ensure btree node scan runs before checking for scanned nodes
Previously, calling bch2_btree_has_scanned_nodes() when btree node
scan hadn't actually run would erroniously return false - causing us to
think a btree was entirely gone.

This fixes a 6.16 regression from moving the scheduling of btree node
scan out of bch2_btree_lost_data() (fixing the bug where we'd schedule
it persistently in the superblock) and only scheduling it when
check_toploogy() is asking for scanned btree nodes.

Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-26 00:01:16 -04:00
Kent Overstreet
1dcea07810 bcachefs: btree_root_unreadable_and_scan_found_nothing should not be autofix
Autofix is specified in btree_gc.c if it's not an important btree.

Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-26 00:01:16 -04:00
Linus Torvalds
c5c2a8b497 Several mount-related fixes
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQQqUNBr3gm4hGXdBJlZ7Krx/gZQ6wUCaFx0bQAKCRBZ7Krx/gZQ
 63yTAQC4NS7qopT8BQGn3aM+t8YjYo36BTeSRcSy4hVEAFrEJAD/WyW5Dcy1lWZR
 S8g8rqRimsCepwxqTinYJlS7H8S56ws=
 =CmGc
 -----END PGP SIGNATURE-----

Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull mount fixes from Al Viro:
 "Several mount-related fixes"

* tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  userns and mnt_idmap leak in open_tree_attr(2)
  attach_recursive_mnt(): do not lock the covering tree when sliding something under it
  replace collect_mounts()/drop_collected_mounts() with a safer variant
2025-06-25 20:48:48 -07:00
Kuniyuki Iwashima
a433791aea atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
syzbot reported a warning below during atm_dev_register(). [0]

Before creating a new device and procfs/sysfs for it, atm_dev_register()
looks up a duplicated device by __atm_dev_lookup().  These operations are
done under atm_dev_mutex.

However, when removing a device in atm_dev_deregister(), it releases the
mutex just after removing the device from the list that __atm_dev_lookup()
iterates over.

So, there will be a small race window where the device does not exist on
the device list but procfs/sysfs are still not removed, triggering the
splat.

Let's hold the mutex until procfs/sysfs are removed in
atm_dev_deregister().

[0]:
proc_dir_entry 'atm/atmtcp:0' already registered
WARNING: CPU: 0 PID: 5919 at fs/proc/generic.c:377 proc_register+0x455/0x5f0 fs/proc/generic.c:377
Modules linked in:
CPU: 0 UID: 0 PID: 5919 Comm: syz-executor284 Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:proc_register+0x455/0x5f0 fs/proc/generic.c:377
Code: 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 a2 01 00 00 48 8b 44 24 10 48 c7 c7 20 c0 c2 8b 48 8b b0 d8 00 00 00 e8 0c 02 1c ff 90 <0f> 0b 90 90 48 c7 c7 80 f2 82 8e e8 0b de 23 09 48 8b 4c 24 28 48
RSP: 0018:ffffc9000466fa30 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817ae248
RDX: ffff888026280000 RSI: ffffffff817ae255 RDI: 0000000000000001
RBP: ffff8880232bed48 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888076ed2140
R13: dffffc0000000000 R14: ffff888078a61340 R15: ffffed100edda444
FS:  00007f38b3b0c6c0(0000) GS:ffff888124753000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f38b3bdf953 CR3: 0000000076d58000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 proc_create_data+0xbe/0x110 fs/proc/generic.c:585
 atm_proc_dev_register+0x112/0x1e0 net/atm/proc.c:361
 atm_dev_register+0x46d/0x890 net/atm/resources.c:113
 atmtcp_create+0x77/0x210 drivers/atm/atmtcp.c:369
 atmtcp_attach drivers/atm/atmtcp.c:403 [inline]
 atmtcp_ioctl+0x2f9/0xd60 drivers/atm/atmtcp.c:464
 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159
 sock_do_ioctl+0x115/0x280 net/socket.c:1190
 sock_ioctl+0x227/0x6b0 net/socket.c:1311
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f38b3b74459
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f38b3b0c198 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f38b3bfe318 RCX: 00007f38b3b74459
RDX: 0000000000000000 RSI: 0000000000006180 RDI: 0000000000000005
RBP: 00007f38b3bfe310 R08: 65732f636f72702f R09: 65732f636f72702f
R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f38b3bcb0ac
R13: 00007f38b3b0c1a0 R14: 0000200000000200 R15: 00007f38b3bcb03b
 </TASK>

Fixes: 64bf69ddff ("[ATM]: deregistration removes device from atm_devs list immediately")
Reported-by: syzbot+8bd335d2ad3b93e80715@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/685316de.050a0220.216029.0087.GAE@google.com/
Tested-by: syzbot+8bd335d2ad3b93e80715@syzkaller.appspotmail.com
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250624214505.570679-1-kuni1840@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 16:43:39 -07:00
Jakub Kicinski
9186c43c1f Merge branch 'netlink-specs-enforce-strict-naming-of-properties'
Jakub Kicinski says:

====================
netlink: specs: enforce strict naming of properties

I got annoyed once again by the name properties in the ethtool spec
which use underscore instead of dash. I previously assumed that there
is a lot of such properties in the specs so fixing them now would
be near impossible. On a closer look, however, I only found 22
(rough grep suggests we have ~4.8k names in the specs, so bad ones
are just 0.46%).

Add a regex to the JSON schema to enforce the naming, fix the few
bad names. I was hoping we could start enforcing this from newer
families, but there's no correlation between the protocol and the
number of errors. If anything classic netlink has more recently
added specs so it has fewer errors.

The regex is just for name properties which will end up visible
to the user (in Python or YNL CLI). I left the c-name properties
alone, those don't matter as much. C codegen rewrites them, anyway.

I'm not updating the spec for genetlink-c. Looks like it has no
users, new families use genetlink, all old ones need genetlink-legacy.
If these patches are merged I will remove genetlink-c completely
in net-next.
====================

Link: https://patch.msgid.link/20250624211002.3475021-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:36:31 -07:00
Jakub Kicinski
af852f1f1c netlink: specs: enforce strict naming of properties
Add a regexp to make sure all names which may end up being visible
to the user consist of lower case characters, numbers and dashes.
Underscores keep sneaking into the specs, which is not visible
in the C code but makes the Python and alike inconsistent.

Note that starting with a number is okay, as in C the full
name will include the family name.

For legacy families we can't enforce the naming in the family
name or the multicast group names, as these are part of the
binary uAPI of the kernel.

For classic netlink we need to allow capital letters in names
of struct members. TC has some structs with capitalized members.

Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Link: https://patch.msgid.link/20250624211002.3475021-11-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:36:28 -07:00
Jakub Kicinski
eef0eaeca7 netlink: specs: tc: replace underscores with dashes in names
We're trying to add a strict regexp for the name format in the spec.
Underscores will not be allowed, dashes should be used instead.
This makes no difference to C (codegen, if used, replaces special
chars in names) but it gives more uniform naming in Python.

Fixes: a1bcfde836 ("doc/netlink/specs: Add a spec for tc")
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Link: https://patch.msgid.link/20250624211002.3475021-10-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:36:28 -07:00
Jakub Kicinski
8d7e211ea9 netlink: specs: rt-link: replace underscores with dashes in names
We're trying to add a strict regexp for the name format in the spec.
Underscores will not be allowed, dashes should be used instead.
This makes no difference to C (codegen, if used, replaces special
chars in names) but it gives more uniform naming in Python.

Fixes: b2f63d904e ("doc/netlink: Add spec for rt link messages")
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Link: https://patch.msgid.link/20250624211002.3475021-9-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:36:28 -07:00
Jakub Kicinski
9e6dd4c256 netlink: specs: mptcp: replace underscores with dashes in names
We're trying to add a strict regexp for the name format in the spec.
Underscores will not be allowed, dashes should be used instead.
This makes no difference to C (codegen, if used, replaces special
chars in names) but it gives more uniform naming in Python.

Fixes: bc8aeb2045 ("Documentation: netlink: add a YAML spec for mptcp")
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20250624211002.3475021-8-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:36:28 -07:00
Jakub Kicinski
e40d3d0931 netlink: specs: ovs_flow: replace underscores with dashes in names
We're trying to add a strict regexp for the name format in the spec.
Underscores will not be allowed, dashes should be used instead.
This makes no difference to C (codegen, if used, replaces special
chars in names) but it gives more uniform naming in Python.

Fixes: 93b230b549 ("netlink: specs: add ynl spec for ovs_flow")
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Reviewed-by: Eelco Chaudron <echaudro@redhat.com>
Link: https://patch.msgid.link/20250624211002.3475021-7-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:36:28 -07:00
Jakub Kicinski
9407680945 netlink: specs: devlink: replace underscores with dashes in names
We're trying to add a strict regexp for the name format in the spec.
Underscores will not be allowed, dashes should be used instead.
This makes no difference to C (codegen, if used, replaces special
chars in names) but it gives more uniform naming in Python.

Fixes: 429ac62114 ("devlink: define enum for attr types of dynamic attributes")
Fixes: f2f9dd164d ("netlink: specs: devlink: add the remaining command to generate complete split_ops")
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Link: https://patch.msgid.link/20250624211002.3475021-6-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:36:28 -07:00
Jakub Kicinski
354592f19c netlink: specs: dpll: replace underscores with dashes in names
We're trying to add a strict regexp for the name format in the spec.
Underscores will not be allowed, dashes should be used instead.
This makes no difference to C (codegen, if used, replaces special
chars in names) but it gives more uniform naming in Python.

Fixes: 3badff3a25 ("dpll: spec: Add Netlink spec in YAML")
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Link: https://patch.msgid.link/20250624211002.3475021-5-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:36:27 -07:00
Jakub Kicinski
07caaf875c netlink: specs: ethtool: replace underscores with dashes in names
We're trying to add a strict regexp for the name format in the spec.
Underscores will not be allowed, dashes should be used instead.
This makes no difference to C (codegen replaces special chars in names)
but gives more uniform naming in Python.

Fixes: 13e59344fb ("net: ethtool: add support for symmetric-xor RSS hash")
Fixes: 46fb3ba95b ("ethtool: Add an interface for flashing transceiver modules' firmware")
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Link: https://patch.msgid.link/20250624211002.3475021-4-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:36:27 -07:00
Jakub Kicinski
791a9ed0a4 netlink: specs: fou: replace underscores with dashes in names
We're trying to add a strict regexp for the name format in the spec.
Underscores will not be allowed, dashes should be used instead.
This makes no difference to C (codegen, if used, replaces special
chars in names) but it gives more uniform naming in Python.

Fixes: 4eb77b4ecd ("netlink: add a proto specification for FOU")
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Link: https://patch.msgid.link/20250624211002.3475021-3-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:36:27 -07:00
Jakub Kicinski
2434ccb94d netlink: specs: nfsd: replace underscores with dashes in names
We're trying to add a strict regexp for the name format in the spec.
Underscores will not be allowed, dashes should be used instead.
This makes no difference to C (codegen, if used, replaces special
chars in names) but it gives more uniform naming in Python.

Fixes: 13727f85b4 ("NFSD: introduce netlink stubs")
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20250624211002.3475021-2-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:36:27 -07:00
Simon Horman
7b515f35a9 net: enetc: Correct endianness handling in _enetc_rd_reg64
enetc_hw.h provides two versions of _enetc_rd_reg64.
One which simply calls ioread64() when available.
And another that composes the 64-bit result from ioread32() calls.

In the second case the code appears to assume that each ioread32() call
returns a little-endian value. However both the shift and logical or
used to compose the return value would not work correctly on big endian
systems if this were the case. Moreover, this is inconsistent with the
first case where the return value of ioread64() is assumed to be in host
byte order.

It appears that the correct approach is for both versions to treat the
return value of ioread*() functions as being in host byte order. And
this patch corrects the ioread32()-based version to do so.

This is a bug but would only manifest on big endian systems
that make use of the ioread32-based implementation of _enetc_rd_reg64.
While all in-tree users of this driver are little endian and
make use of the ioread64-based implementation of _enetc_rd_reg64.
Thus, no in-tree user of this driver is affected by this bug.

Flagged by Sparse.
Compile tested only.

Fixes: 16eb4c85c9 ("enetc: Add ethtool statistics")
Closes: https://lore.kernel.org/all/AM9PR04MB850500D3FC24FE23DEFCEA158879A@AM9PR04MB8505.eurprd04.prod.outlook.com/
Signed-off-by: Simon Horman <horms@kernel.org>
Reviewed-by: Wei Fang <wei.fang@nxp.com>
Link: https://patch.msgid.link/20250624-etnetc-le-v1-1-a73a95d96e4e@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:33:02 -07:00
Thomas Fourier
c489096335 atm: idt77252: Add missing dma_map_error()
The DMA map functions can fail and should be tested for errors.

Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250624064148.12815-3-fourier.thomas@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 15:28:57 -07:00
Willem de Bruijn
5e9388f798 selftests/bpf: adapt one more case in test_lru_map to the new target_free
The below commit that updated BPF_MAP_TYPE_LRU_HASH free target,
also updated tools/testing/selftests/bpf/test_lru_map to match.

But that missed one case that passes with 4 cores, but fails at
higher cpu counts.

Update test_lru_sanity3 to also adjust its expectation of target_free.

This time tested with 1, 4, 16, 64 and 384 cpu count.

Fixes: d4adf1c9ee ("bpf: Adjust free target to avoid global starvation of LRU map")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20250625210412.2732970-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-06-25 15:19:36 -07:00
Adin Scannell
fa6f092cc0 libbpf: Fix possible use-after-free for externs
The `name` field in `obj->externs` points into the BTF data at initial
open time. However, some functions may invalidate this after opening and
before loading (e.g. `bpf_map__set_value_size`), which results in
pointers into freed memory and undefined behavior.

The simplest solution is to simply `strdup` these strings, similar to
the `essent_name`, and free them at the same time.

In order to test this path, the `global_map_resize` BPF selftest is
modified slightly to ensure the presence of an extern, which causes this
test to fail prior to the fix. Given there isn't an obvious API or error
to test against, I opted to add this to the existing test as an aspect
of the resizing feature rather than duplicate the test.

Fixes: 9d0a23313b ("libbpf: Add capability for resizing datasec maps")
Signed-off-by: Adin Scannell <amscanne@meta.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250625050215.2777374-1-amscanne@meta.com
2025-06-25 12:28:58 -07:00
Linus Torvalds
c4dce0c094 spi: Fix for v6.16
One fix here, for a runtime PM underflow when removing the Cadence
 QuadSPI driver.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmhcRJwACgkQJNaLcl1U
 h9AYvQf9FnhR4jscljVcNb4T9poRcIgMdTzHSY1Y0Y6VavnUjX6oY+aQ3Z2GRZOd
 B79tRwYlZdOLAAw3mtQoxy+PBuuszFLU2pVnB1MD8j4kR7obPY3dAc9swgwtdWWN
 0OMnPRDIOoSdLUsgr8Yoedp6/nhDlsMirGxObPQ9BSGs2Jw9yKBGVLqFUwVFI9UQ
 iky+g2VFetBK5MVFhh2GsMbCJDnYRy6xx4egEwWxLlwD7Y2HtVH2gsDEJGlkuq8j
 HRX++UCSVuDE0y+Oejy+yfi4ujLOPZgJ9pED40kviK4hECJrS13/D6Da+nHCtt0S
 IID5P9uYDPWrje/B3gs9zaU4MyZW2A==
 =GcqT
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fix from Mark Brown:
 "One fix for a runtime PM underflow when removing the Cadence QuadSPI
  driver"

* tag 'spi-fix-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: spi-cadence-quadspi: Fix pm runtime unbalance
2025-06-25 11:54:04 -07:00
Linus Torvalds
92ca6c498a SCSI fixes on 20250625
ixes all in drivers.  ufs and megaraid_sas are small and obvious.  The
 large diffstat in fnic comes from two pieces: 1 the addition of quite
 a bit of logging (no change to function) and the reworking of the
 timeout allocation path for the two conditions that can occur
 simultaneously to prevent reusing the same abort frame and then both
 trying to free it.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCaFvomyYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishT7SAPwJGbsT
 mdT2sqfnrFNEsXVE3wKnvOTNYi2mnXoc2Z7/pQEAj1KVXg8UgW/K4yPwx+utLDZW
 M+u7fIXkRcbdxjqXwk8=
 =Xfh8
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Fixes all in drivers.

  ufs and megaraid_sas are small and obvious.

  The large diffstat in fnic comes from two pieces: the addition of
  quite a bit of logging (no change to function) and the reworking of
  the timeout allocation path for the two conditions that can occur
  simultaneously to prevent reusing the same abort frame and then both
  trying to free it"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: fnic: Fix missing DMA mapping error in fnic_send_frame()
  scsi: fnic: Set appropriate logging level for log message
  scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths
  scsi: fnic: Turn off FDMI ACTIVE flags on link down
  scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out
  scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
  scsi: megaraid_sas: Fix invalid node index
2025-06-25 11:20:14 -07:00
Linus Torvalds
2dca89df0d Just a few fixes:
- fix FP registers in seccomp mode
  - prevent duplicate devices in VFIO support
  - don't ignore errors in UBD thread start
  - reduce stack use with clang 19
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmhb5+cACgkQ10qiO8sP
 aACBSQ/+ObgcvoB5wEWoc4fWdR7OVysfRMwBKjP6YiKWVVIhISl5VV4ODhaulQCG
 QBt0pYBqmfljZosQ6vkmNm4wNm03Si/aF9pcFuVqP/HjioOWKglt5FH1PqUcTXQs
 sJTDZI4u4+uTqwZ2cD3nZjS2uUV2PjfYmX93Ni48OdoB8nefIKRKwFGHAkPb/34i
 0x58dr8ci1RAlSpQaOu8n7BdII3wp8EehsHDGBf49L1hDbhTsPLOnCllGZE8R+Uf
 SFGH/MTK5kVeo/Rfxa5m2znidUlSQ//XcdNDxcWZo7/ZuyebrilxdiSClpkXCdOb
 fTsHR/RtTo/s/gQOn2vvezv+njt9jmnNcHZXJaG844gPn0Q530KuUTLLHccIHY5s
 ITMkZU0Gf/OgTZJ78z1+fQfSm9Wop9T7b6+5RCS4IZSasPOfJVwycEGnALN1+s9N
 iCFPQXMsMQY38KDgOTse+wF0lcIbtpxfWTTkfr1IDVVk3PBzMyaa7n774aOLXAhE
 J0Dc2+DimrgRXJg/UF6KxWMTVL3V1BaRbxhQvHgiU+PT+nKdQKWoPuO4QkuD5ZBK
 cllS/uZp1M5C9Zn4Zyr2F8BsoUJw5liZfyeUXZGs6UoqWXMMQSu5WSurZaBLTh+J
 XzKJSZUZJhkEWHIcLSFpYeSrBFjcrthZlTXX+aHXQ36KDjziKcY=
 =wwuV
 -----END PGP SIGNATURE-----

Merge tag 'uml-for-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux

Pull UML fixes from Johannes Berg:

 - fix FP registers in seccomp mode

 - prevent duplicate devices in VFIO support

 - don't ignore errors in UBD thread start

 - reduce stack use with clang 19

* tag 'uml-for-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux:
  um: vector: Reduce stack usage in vector_eth_configure()
  um: Use correct data source in fpregs_legacy_set()
  um: vfio: Prevent duplicate device assignments
  um: ubd: Add missing error check in start_io_thread()
2025-06-25 11:13:31 -07:00
Jakub Kicinski
010c40c1f5 Just a few fixes:
- iwlegacy: work around large stack with clang/kasan
  - mac80211: fix integer overflow
  - mac80211: fix link struct init vs. RCU publish
  - iwlwifi: fix warning on IFF_UP
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmhb4zAACgkQ10qiO8sP
 aAAJMA/+KBq3/uvXAv7Mxtg2YTvmzKMs/Zsk3Uh1yCijsm6K9/yMkcuvyRDs9n+M
 yobTGwlNKsg+xZmwKM6vT2TwFN4cJhFsz9pL/QQ7M6k4ZARv6MkIgXxhJ5504trv
 ufsea2iCN2xHQ7Y81SNFjtZwckMPhS1Cgs7OdjOkP8GJPDsTXrdTNSZZh69l3XX1
 RG0Fp98RhPnONmzj+ewj3leVMwJlCyAdzqx1B3Hk1tJQojUtkmwg1F+bpAifYBLs
 arORBtkL4cVYXcYkoBJ+WFLMztooAaqo4Oal8s4zl5/VubjCb30+mBFRQytD9ldD
 gp2gqY6Y1BAiCZKBxjAwRvG743CBPEBD7tHUDtS4cbPPChjMKWXrakWkLGjTDv50
 wYnb9EsPKt03L353vaQ/BHW2m88ebxIYiaSVUY+animRvadpFihzT2fF9P+0/eHi
 zU2AFlmF0bS74OtjyOVXSSin0pTmBEHDIRfqBdw/szGhMqBdHDq+qPb2H2TJnfZy
 eec1MS0td8MYN9SV9xPac+4EqUbOHDlQ4fVD3rCn74+wESQp7HUnSJOgobB6cOJg
 N3tao+n/K8kYxdaCplqAeWMD3bFSYs9oz404K3wOeO85lHz+lB581j6as8zJ86cL
 nJVLEflnDCQHnxFCEMHeV/1q/GjIU7Xv5+rwDpfMEY3hx0jH1d8=
 =6koP
 -----END PGP SIGNATURE-----

Merge tag 'wireless-2025-06-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Just a few fixes:
 - iwlegacy: work around large stack with clang/kasan
 - mac80211: fix integer overflow
 - mac80211: fix link struct init vs. RCU publish
 - iwlwifi: fix warning on IFF_UP

* tag 'wireless-2025-06-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: mac80211: finish link init before RCU publish
  wifi: iwlwifi: mvm: assume '1' as the default mac_config_cmd version
  wifi: mac80211: fix beacon interval calculation overflow
  wifi: iwlegacy: work around excessive stack usage on clang/kasan
====================

Link: https://patch.msgid.link/20250625115433.41381-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-25 10:26:16 -07:00
Johannes Berg
95b922dd04 iwlwifi-fixes: fix failure in interface up
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQQM3A3Pv7vbm9vtjWbacY7uyt+OfQUCaFuK9AAKCRDacY7uyt+O
 fepSAP9S+wWfAOq2fMWg71q2BAxntUpOiSCmZ2HjwAKz/BaKGAD+PjkKnQr6lh6K
 u0WHrOFqel+lIyfolOqSQu4Q7UK3Ego=
 =SXwl
 -----END PGP SIGNATURE-----

Merge tag 'iwlwifi-fixes-2025-06-25' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next

Miri Korenblit says:
====================
iwlwifi-fixes: fix failure in interface up
====================

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-06-25 10:20:03 +02:00
Tiwei Bie
2d65fc13be um: vector: Reduce stack usage in vector_eth_configure()
When compiling with clang (19.1.7), initializing *vp using a compound
literal may result in excessive stack usage. Fix it by initializing the
required fields of *vp individually.

Without this patch:

$ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0
...
0x0000000000000540 vector_eth_configure [vector_kern.o]:1472
...

With this patch:

$ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0
...
0x0000000000000540 vector_eth_configure [vector_kern.o]:208
...

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202506221017.WtB7Usua-lkp@intel.com/
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Link: https://patch.msgid.link/20250623110829.314864-1-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-06-25 09:28:17 +02:00
Tiwei Bie
8948941276 um: Use correct data source in fpregs_legacy_set()
Read from the buffer pointed to by 'from' instead of '&buf', as
'buf' contains no valid data when 'ubuf' is NULL.

Fixes: b1e1bd2e69 ("um: Add helper functions to get/set state for SECCOMP")
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Link: https://patch.msgid.link/20250606124428.148164-5-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-06-25 09:26:33 +02:00
Tiwei Bie
bc4e2ae081 um: vfio: Prevent duplicate device assignments
Ensure devices are assigned only once. Reject subsequent requests
for duplicate assignments.

Fixes: a0e2cb6a90 ("um: Add VFIO-based virtual PCI driver")
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Link: https://patch.msgid.link/20250606124428.148164-4-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-06-25 09:26:06 +02:00
Tiwei Bie
c55c7a85e0 um: ubd: Add missing error check in start_io_thread()
The subsequent call to os_set_fd_block() overwrites the previous
return value. OR the two return values together to fix it.

Fixes: f88f0bdfc3 ("um: UBD Improvements")
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Link: https://patch.msgid.link/20250606124428.148164-2-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-06-25 09:25:49 +02:00
Yan Zhai
9caca6ac0e bnxt: properly flush XDP redirect lists
We encountered following crash when testing a XDP_REDIRECT feature
in production:

[56251.579676] list_add corruption. next->prev should be prev (ffff93120dd40f30), but was ffffb301ef3a6740. (next=ffff93120dd
40f30).
[56251.601413] ------------[ cut here ]------------
[56251.611357] kernel BUG at lib/list_debug.c:29!
[56251.621082] Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
[56251.632073] CPU: 111 UID: 0 PID: 0 Comm: swapper/111 Kdump: loaded Tainted: P           O       6.12.33-cloudflare-2025.6.
3 #1
[56251.653155] Tainted: [P]=PROPRIETARY_MODULE, [O]=OOT_MODULE
[56251.663877] Hardware name: MiTAC GC68B-B8032-G11P6-GPU/S8032GM-HE-CFR, BIOS V7.020.B10-sig 01/22/2025
[56251.682626] RIP: 0010:__list_add_valid_or_report+0x4b/0xa0
[56251.693203] Code: 0e 48 c7 c7 68 e7 d9 97 e8 42 16 fe ff 0f 0b 48 8b 52 08 48 39 c2 74 14 48 89 f1 48 c7 c7 90 e7 d9 97 48
 89 c6 e8 25 16 fe ff <0f> 0b 4c 8b 02 49 39 f0 74 14 48 89 d1 48 c7 c7 e8 e7 d9 97 4c 89
[56251.725811] RSP: 0018:ffff93120dd40b80 EFLAGS: 00010246
[56251.736094] RAX: 0000000000000075 RBX: ffffb301e6bba9d8 RCX: 0000000000000000
[56251.748260] RDX: 0000000000000000 RSI: ffff9149afda0b80 RDI: ffff9149afda0b80
[56251.760349] RBP: ffff9131e49c8000 R08: 0000000000000000 R09: ffff93120dd40a18
[56251.772382] R10: ffff9159cf2ce1a8 R11: 0000000000000003 R12: ffff911a80850000
[56251.784364] R13: ffff93120fbc7000 R14: 0000000000000010 R15: ffff9139e7510e40
[56251.796278] FS:  0000000000000000(0000) GS:ffff9149afd80000(0000) knlGS:0000000000000000
[56251.809133] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[56251.819561] CR2: 00007f5e85e6f300 CR3: 00000038b85e2006 CR4: 0000000000770ef0
[56251.831365] PKRU: 55555554
[56251.838653] Call Trace:
[56251.845560]  <IRQ>
[56251.851943]  cpu_map_enqueue.cold+0x5/0xa
[56251.860243]  xdp_do_redirect+0x2d9/0x480
[56251.868388]  bnxt_rx_xdp+0x1d8/0x4c0 [bnxt_en]
[56251.877028]  bnxt_rx_pkt+0x5f7/0x19b0 [bnxt_en]
[56251.885665]  ? cpu_max_write+0x1e/0x100
[56251.893510]  ? srso_alias_return_thunk+0x5/0xfbef5
[56251.902276]  __bnxt_poll_work+0x190/0x340 [bnxt_en]
[56251.911058]  bnxt_poll+0xab/0x1b0 [bnxt_en]
[56251.919041]  ? srso_alias_return_thunk+0x5/0xfbef5
[56251.927568]  ? srso_alias_return_thunk+0x5/0xfbef5
[56251.935958]  ? srso_alias_return_thunk+0x5/0xfbef5
[56251.944250]  __napi_poll+0x2b/0x160
[56251.951155]  bpf_trampoline_6442548651+0x79/0x123
[56251.959262]  __napi_poll+0x5/0x160
[56251.966037]  net_rx_action+0x3d2/0x880
[56251.973133]  ? srso_alias_return_thunk+0x5/0xfbef5
[56251.981265]  ? srso_alias_return_thunk+0x5/0xfbef5
[56251.989262]  ? __hrtimer_run_queues+0x162/0x2a0
[56251.996967]  ? srso_alias_return_thunk+0x5/0xfbef5
[56252.004875]  ? srso_alias_return_thunk+0x5/0xfbef5
[56252.012673]  ? bnxt_msix+0x62/0x70 [bnxt_en]
[56252.019903]  handle_softirqs+0xcf/0x270
[56252.026650]  irq_exit_rcu+0x67/0x90
[56252.032933]  common_interrupt+0x85/0xa0
[56252.039498]  </IRQ>
[56252.044246]  <TASK>
[56252.048935]  asm_common_interrupt+0x26/0x40
[56252.055727] RIP: 0010:cpuidle_enter_state+0xb8/0x420
[56252.063305] Code: dc 01 00 00 e8 f9 79 3b ff e8 64 f7 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 a5 32 3a ff 45 84 ff 0f 85 ae
 01 00 00 fb 45 85 f6 <0f> 88 88 01 00 00 48 8b 04 24 49 63 ce 4c 89 ea 48 6b f1 68 48 29
[56252.088911] RSP: 0018:ffff93120c97fe98 EFLAGS: 00000202
[56252.096912] RAX: ffff9149afd80000 RBX: ffff9141d3a72800 RCX: 0000000000000000
[56252.106844] RDX: 00003329176c6b98 RSI: ffffffe36db3fdc7 RDI: 0000000000000000
[56252.116733] RBP: 0000000000000002 R08: 0000000000000002 R09: 000000000000004e
[56252.126652] R10: ffff9149afdb30c4 R11: 071c71c71c71c71c R12: ffffffff985ff860
[56252.136637] R13: 00003329176c6b98 R14: 0000000000000002 R15: 0000000000000000
[56252.146667]  ? cpuidle_enter_state+0xab/0x420
[56252.153909]  cpuidle_enter+0x2d/0x40
[56252.160360]  do_idle+0x176/0x1c0
[56252.166456]  cpu_startup_entry+0x29/0x30
[56252.173248]  start_secondary+0xf7/0x100
[56252.179941]  common_startup_64+0x13e/0x141
[56252.186886]  </TASK>

From the crash dump, we found that the cpu_map_flush_list inside
redirect info is partially corrupted: its list_head->next points to
itself, but list_head->prev points to a valid list of unflushed bq
entries.

This turned out to be a result of missed XDP flush on redirect lists. By
digging in the actual source code, we found that
commit 7f0a168b04 ("bnxt_en: Add completion ring pointer in TX and RX
ring structures") incorrectly overwrites the event mask for XDP_REDIRECT
in bnxt_rx_xdp. We can stably reproduce this crash by returning XDP_TX
and XDP_REDIRECT randomly for incoming packets in a naive XDP program.
Properly propagate the XDP_REDIRECT events back fixes the crash.

Fixes: a7559bc8c1 ("bnxt: support transmit and free of aggregation buffers")
Tested-by: Andrew Rzeznik <arzeznik@cloudflare.com>
Signed-off-by: Yan Zhai <yan@cloudflare.com>
Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
Link: https://patch.msgid.link/aFl7jpCNzscumuN2@debian.debian
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-24 17:56:54 -07:00
Linus Torvalds
7595b66ae9 selinux/stable-6.16 PR 20250624
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmhbPQcUHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXNwaA//VNF5wWWsUdTzX9THvylI18EjRwY0
 A4FjifBYUb2Rb9KesZ40UXqqDyItHrLP1vpPuc6K6m1nYU5R1p4pnlX0RL7sXHum
 KoDJIf1P4EbFxvcr3VvyfXVC0ibeAVhIb7ZvU8Kx6x2sWSCWroE1Rh/tzk1vHE19
 zIqyEOEp3qg4mP4GNBWDmBxv3+Xy4784roW+bf2lHXbyAuacb28Qwc6bCwU39Yt9
 2jBxLP7ACOMWk5mOG5+Koj+CD7FYD7AO8e5NuKY1bQ484z6EEOUKAUXNiYYrQAmF
 aPg0CQ1T4ufJzehdAH8diHSTTFYi1fYVvdYFApUgydyYlhQP29epSU8U9oAFjdnu
 PZdYI5DoISrAWFEf7WU5G5qeAfqvkgo3uNNsEpNRR7vJQzguCctmOxr87W78ISQr
 XJZQ4EAutieVP5Nv0r3kCc95LWpc+rI6kEcFOTD01clMZcDQoR9Wikcg8gmORxHn
 TdeTdOn5TU9CjsBJ1kyZhBTB+RWEYkP8mkwTIX4Q+MLKH5Hy7q+/jAjxh6S+ryzq
 yk7a4ytzaH1vIXq1DFUEGIxwJhrWKlZxHroS2BU6rIm9waftz4brYKa0rS1EllAi
 ILStzgBEuUOQv77eCxgBtcU+7KTGttQm94RMom+E+WNpU/Ectm6PwHlwhyZd5ke/
 Z+uqUufaHe098lg=
 =6VNx
 -----END PGP SIGNATURE-----

Merge tag 'selinux-pr-20250624' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux

Pull selinux fix from Paul Moore:
 "Another small SELinux patch to fix a problem seen by the dracut-ng
  folks during early boot when SELinux is enabled, but the policy has
  yet to be loaded"

* tag 'selinux-pr-20250624' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: change security_compute_sid to return the ssid or tsid on match
2025-06-24 17:20:43 -07:00
Stefano Garzarella
22bbc1dcd0 vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
If a userspace application just include <linux/vm_sockets.h> will fail
to build with the following errors:

    /usr/include/linux/vm_sockets.h:182:39: error: invalid application of ‘sizeof’ to incomplete type ‘struct sockaddr’
      182 |         unsigned char svm_zero[sizeof(struct sockaddr) -
          |                                       ^~~~~~
    /usr/include/linux/vm_sockets.h:183:39: error: ‘sa_family_t’ undeclared here (not in a function)
      183 |                                sizeof(sa_family_t) -
          |

Include <sys/socket.h> for userspace (guarded by ifndef __KERNEL__)
where `struct sockaddr` and `sa_family_t` are defined.
We already do something similar in <linux/mptcp.h> and <linux/if.h>.

Fixes: d021c34405 ("VSOCK: Introduce VM Sockets")
Reported-by: Daan De Meyer <daan.j.demeyer@gmail.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20250623100053.40979-1-sgarzare@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-24 17:12:59 -07:00
Kent Overstreet
1f8aede70d bcachefs: fix bch2_journal_keys_peek_prev_min() underflow
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-24 18:58:18 -04:00
Kent Overstreet
f5109c201c bcachefs: Use wait_on_allocator() when allocating journal
wait_on_allocator() emits debug info when we hang trying to allocate.

Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-24 18:16:01 -04:00
Kent Overstreet
865ad1dbf1 bcachefs: Check for bad write buffer key when moving from journal
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-24 15:48:00 -04:00
Alan Huang
5c4acbc8ce bcachefs: Don't unlock the trans if ret doesn't match BCH_ERR_operation_blocked
Reported-by: syzbot+d540192e763531d307ff@syzkaller.appspotmail.com
Signed-off-by: Alan Huang <mmpgouride@gmail.com>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-24 15:46:59 -04:00
Khairul Anuar Romli
b07f349d18
spi: spi-cadence-quadspi: Fix pm runtime unbalance
Having PM put sync in remove function is causing PM underflow during
remove operation. This is caused by the function, runtime_pm_get_sync,
not being called anywhere during the op. Ensure that calls to
pm_runtime_enable()/pm_runtime_disable() and
pm_runtime_get_sync()/pm_runtime_put_sync() match.

echo 108d2000.spi > /sys/bus/platform/drivers/cadence-qspi/unbind
[   49.644256] Deleting MTD partitions on "108d2000.spi.0":
[   49.649575] Deleting u-boot MTD partition
[   49.684087] Deleting root MTD partition
[   49.724188] cadence-qspi 108d2000.spi: Runtime PM usage count underflow!

Continuous bind/unbind will result in an "Unbalanced pm_runtime_enable" error.
Subsequent unbind attempts will return a "No such device" error, while bind
attempts will return a "Resource temporarily unavailable" error.

[   47.592434] cadence-qspi 108d2000.spi: Runtime PM usage count underflow!
[   49.592233] cadence-qspi 108d2000.spi: detected FIFO depth (1024) different from config (128)
[   53.232309] cadence-qspi 108d2000.spi: Runtime PM usage count underflow!
[   55.828550] cadence-qspi 108d2000.spi: detected FIFO depth (1024) different from config (128)
[   57.940627] cadence-qspi 108d2000.spi: Runtime PM usage count underflow!
[   59.912490] cadence-qspi 108d2000.spi: detected FIFO depth (1024) different from config (128)
[   61.876243] cadence-qspi 108d2000.spi: Runtime PM usage count underflow!
[   61.883000] platform 108d2000.spi: Unbalanced pm_runtime_enable!
[  532.012270] cadence-qspi 108d2000.spi: probe with driver cadence-qspi failed1

Also, change clk_disable_unprepare() to clk_disable() since continuous
bind and unbind operations will trigger a warning indicating that the clock is
already unprepared.

Fixes: 4892b374c9 ("mtd: spi-nor: cadence-quadspi: Add runtime PM support")
cc: stable@vger.kernel.org # 6.6+
Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
Link: https://patch.msgid.link/4e7a4b8aba300e629b45a04f90bddf665fbdb335.1749601877.git.khairul.anuar.romli@altera.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-06-24 16:40:31 +01:00
Al Viro
0748e553df userns and mnt_idmap leak in open_tree_attr(2)
Once want_mount_setattr() has returned a positive, it does require
finish_mount_kattr() to release ->mnt_userns.  Failing do_mount_setattr()
does not change that.

As the result, we can end up leaking userns and possibly mnt_idmap as
well.

Fixes: c4a16820d9 ("fs: add open_tree_attr()")
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2025-06-24 10:25:04 -04:00
Johannes Berg
d87c3ca0f8 wifi: mac80211: finish link init before RCU publish
Since the link/conf pointers can be accessed without any
protection other than RCU, make sure the data is actually
set up before publishing the structures.

Fixes: b2e8434f18 ("wifi: mac80211: set up/tear down client vif links properly")
Link: https://patch.msgid.link/20250624130749.9a308b713c74.I4a80f5eead112a38730939ea591d2e275c721256@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-06-24 15:16:43 +02:00
Paolo Abeni
1fd26729e0 bluetooth pull request for net:
- L2CAP: Fix L2CAP MTU negotiation
  - hci_core: Fix use-after-free in vhci_flush()
  - btintel_pcie: Fix potential race condition in firmware download
  - hci_qca: fix unable to load the BT driver
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCgA3FiEE7E6oRXp8w05ovYr/9JCA4xAyCykFAmhZhnIZHGx1aXoudm9u
 LmRlbnR6QGludGVsLmNvbQAKCRD0kIDjEDILKZX6EACeRMlkRoRe7oUKqfpXw+R+
 RLdYvvco2LVSIwaMq664kHQWAbNcSj2okXcbJqPTXjHR1CZhaFGp6Rufgi1kz363
 r19Ym4eGL2ZN9JlQwSDJqbWMrXxCo5tB4ymNof3yW+2ZPRurqDJDwCjcnhikfG14
 v8ZOQRxDJOJdPSyqtW75qgFNv9Szekg272ZeLjAK/6XSqMpiPzyLsN4TJdij2Wf6
 Ie02w368TQkmJMHly37QE24hDkyZ/UuR0lmTyB0bTCAiDwnTya8oWEUPRwa5I1+S
 1FubHOBUGlx907bEJXZkBow98sCsChg/PNGqO0dsoJD/GJo4U6lUX1Lb/6qWNL+d
 T6PcDLMKRrDcY9ZgPAqSq7sYvzPGjaw+JWTN01okr5mVoVEsh8XDLhEQYPKJ8NzU
 TJy6FHXtZyGuqw21VD9+VbGrOFJMNYUVhUxQZidAaxQbqE7Vgl59Hj08Z6zGad26
 hE8srBlGH7PcJN+DSXX9coYP11bSWVgXKLgmXgtPF3jVYQOch+Vxhcz3kIGSIZe1
 W5qFfJhurHjdFEop6IRAXOJUeZWL8/YEcQJbFcS3Z2pfGAitY438Y18tvHibcvbc
 7c/DMt7586qh1VbQSz0Gf8IeUuXMlAXlVaIYTKTtlURuo1w8+f+cz/PowtSKIjum
 J1N/Jf+1DzCVPO2tazdd1w==
 =vb9E
 -----END PGP SIGNATURE-----

Merge tag 'for-net-2025-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - L2CAP: Fix L2CAP MTU negotiation
 - hci_core: Fix use-after-free in vhci_flush()
 - btintel_pcie: Fix potential race condition in firmware download
 - hci_qca: fix unable to load the BT driver

* tag 'for-net-2025-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: hci_core: Fix use-after-free in vhci_flush()
  driver: bluetooth: hci_qca:fix unable to load the BT driver
  Bluetooth: L2CAP: Fix L2CAP MTU negotiation
  Bluetooth: btintel_pcie: Fix potential race condition in firmware download
====================

Link: https://patch.msgid.link/20250623165405.227619-1-luiz.dentz@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-24 12:40:54 +02:00
Miri Korenblit
93598167dc wifi: iwlwifi: mvm: assume '1' as the default mac_config_cmd version
Unfortunately, FWs of some devices don't have the version of the
iwl_mac_config_cmd defined in the TLVs. We send 0 as the 'def argument
to  iwl_fw_lookup_cmd_ver, so for such FWs, the return value will be 0,
leading to a warning, and to not sending the command.

Fix this by assuming that the default version is 1.

Fixes: 83f3ac2848 ("wifi: iwlwifi: Fix incorrect logic on cmd_ver range checking")
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20250624071427.2662621-1-miriam.rachel.korenblit@intel.com
2025-06-24 11:34:26 +03:00
Paolo Abeni
c3f429388c Merge branch 'af_unix-fix-two-oob-issues'
Kuniyuki Iwashima says:

====================
af_unix: Fix two OOB issues.

From: Kuniyuki Iwashima <kuniyu@google.com>

Recently, two issues are reported regarding MSG_OOB.

Patch 1 fixes issues that happen when multiple consumed OOB
skbs are placed consecutively in the recv queue.

Patch 2 fixes an inconsistent behaviour that close()ing a socket
with a consumed OOB skb at the head of the recv queue triggers
-ECONNRESET on the peer's recv().

v1: https://lore.kernel.org/netdev/20250618043453.281247-1-kuni1840@gmail.com/
====================

Link: https://patch.msgid.link/20250619041457.1132791-1-kuni1840@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-24 10:10:09 +02:00