Commit Graph

1383660 Commits

Author SHA1 Message Date
Théo Lebrun
9665aa15ef dt-bindings: net: cdns,macb: allow tsu_clk without tx_clk
Allow providing tsu_clk without a tx_clk as both are optional.

This is about relaxing unneeded constraints. It so happened that in the
past HW that needed a tsu_clk always needed a tx_clk.

Fixes: 4e5b6de1f4 ("dt-bindings: net: cdns,macb: Convert to json-schema")
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Link: https://patch.msgid.link/20250923-macb-fixes-v6-1-772d655cdeb6@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-26 17:54:50 -07:00
Michael S. Tsirkin
439263376c vhost: vringh: Fix copy_to_iter return value check
The return value of copy_to_iter can't be negative, check whether the
copied length is equal to the requested length instead of checking for
negative values.

Cc: zhang jiao <zhangjiao2@cmss.chinamobile.com>
Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 309bba39c9 ("vringh: iterate on iotlb_translate to handle large translations")
Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-26 17:31:35 -07:00
I Viswanath
e9f35294e1 ptp: Add a upper bound on max_vclocks
syzbot reported WARNING in max_vclocks_store.

This occurs when the argument max is too large for kcalloc to handle.

Extend the guard to guard against values that are too large for
kcalloc

Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df
Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
Fixes: 73f37068d5 ("ptp: support ptp physical/virtual clocks conversion")
Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-26 15:30:31 -07:00
I Viswanath
958baf5eae net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
This is the sequence of events that leads to the warning:

rtl8150_start_xmit() {
	netif_stop_queue();
	usb_submit_urb(dev->tx_urb);
}

rtl8150_set_multicast() {
	netif_stop_queue();
	netif_wake_queue();		<-- wakes up TX queue before URB is done
}

rtl8150_start_xmit() {
	netif_stop_queue();
	usb_submit_urb(dev->tx_urb);	<-- double submission
}

rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
calling netif_stop_queue and notif_start_queue as these handle
TX queue synchronization.

The net core function dev_set_rx_mode handles the synchronization
for rtl8150_set_multicast making it safe to remove these locks.

Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Tested-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-26 15:11:37 -07:00
Claudiu Manoil
c35cf24a69 net: enetc: Fix probing error message typo for the ENETCv4 PF driver
Blamed commit wrongly indicates VF error in case of PF probing error.

Fixes: 99100d0d99 ("net: enetc: add preliminary support for i.MX95 ENETC PF")
Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250924082755.1984798-1-wei.fang@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-26 15:09:24 -07:00
Linus Torvalds
4ff71af020 Including fixes from Bluetooth, IPsec and CAN.
No known regressions at this point.
 
 Current release - regressions:
 
   - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
 
 Previous releases - regressions:
 
   - xfrm: fix offloading of cross-family tunnels
 
   - bluetooth: fix several races leading to UaFs
 
   - dsa: lantiq_gswip: fix FDB entries creation for the CPU port
 
   - eth: tun: update napi->skb after XDP process
 
   - eth: mlx: fix UAF in flow counter release
 
 Previous releases - always broken:
 
   - core: forbid FDB status change while nexthop is in a group
 
   - smc: fix warning in smc_rx_splice() when calling get_page()
 
   - can: provide missing ndo_change_mtu(), to prevent buffer overflow.
 
   - eth: i40e: fix VF config validation
 
   - eth: broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmjVKrYSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkttwQAIErYmSE3aGyQ2ps9iDYFzM0BJyE2dZg
 BfZDdpL3PiRJkckltGzQSE4/Lw4ypIIxDuWrXmjbaaMwg7j6Y1hIe1KS81NnptyR
 2slfubXVWsmO6KVl9UHauxnsewCbozTemWI+2bRf6Urc2j8OpAkyHCPWT2NBzFv2
 U7ykcSLGDqrMa0NH3UD+ymmGfpdZe0x9RFzkBTUQIxS/Oo7EgGD3jgY0h85n04C5
 bTTOeWbMopS10L0Ow79xH4MnT4iPenxW7ABRhMwyres4Mm9WA39nP6Iep8VtmCKX
 51xLK4NBvPR0OMipJZj3hD+5RCWsLeGW+AVY3HoMPDSvetxjDlPcLJ1yMW6zP4Qa
 ZwW1OhMTSqSGviJ+9NSb849I+RRLcIs5206dXYfRLTXZl/DTcBvYCcFsh0QohHOa
 OYXarf9wXK2kekNukJY5isqgvNNZWsah4Mvjv4NcjF9xxg9NHQaD0QRI6NyFQAU+
 4OfH1bzCV20hLiUjEI3U5t+EN9gJl5bNloEmHPkgW7NnkRoobjnCRwzTMY+UeF57
 55P4AmD6gAHSSE7ZtaHRLt5ZV4TP7ySYWDEgRCXA/DgtdsQLPUhB4sw6xkz7j1a+
 3k9AeSXu87khyXpqRxI/lPb+xqZ52wPHhlRwDlKD3dLnCd+y+YuT7+dLlvnrPNEF
 pYsu6LF0yTQY
 =M0Pd
 -----END PGP SIGNATURE-----

Merge tag 'net-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from Bluetooth, IPsec and CAN.

  No known regressions at this point.

  Current release - regressions:

   - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI

  Previous releases - regressions:

   - xfrm: fix offloading of cross-family tunnels

   - bluetooth: fix several races leading to UaFs

   - dsa: lantiq_gswip: fix FDB entries creation for the CPU port

   - eth:
       - tun: update napi->skb after XDP process
       - mlx: fix UAF in flow counter release

  Previous releases - always broken:

   - core: forbid FDB status change while nexthop is in a group

   - smc: fix warning in smc_rx_splice() when calling get_page()

   - can: provide missing ndo_change_mtu(), to prevent buffer overflow.

   - eth:
       - i40e: fix VF config validation
       - broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl"

* tag 'net-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (40 commits)
  octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
  net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
  net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
  libie: fix string names for AQ error codes
  net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD
  net/mlx5: HWS, ignore flow level for multi-dest table
  net/mlx5: fs, fix UAF in flow counter release
  selftests: fib_nexthops: Add test cases for FDB status change
  selftests: fib_nexthops: Fix creation of non-FDB nexthops
  nexthop: Forbid FDB status change while nexthop is in a group
  net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
  bnxt_en: correct offset handling for IPv6 destination address
  ptp: document behavior of PTP_STRICT_FLAGS
  broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl
  broadcom: fix support for PTP_PEROUT_DUTY_CYCLE
  Bluetooth: MGMT: Fix possible UAFs
  Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
  Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
  Bluetooth: hci_sync: Fix hci_resume_advertising_sync
  Bluetooth: Fix build after header cleanup
  ...
2025-09-25 08:23:52 -07:00
Linus Torvalds
93a2744561 virtio,vhost: last minute fixes
More small fixes. Most notably this fixes crashes and hangs in
 vhost-net.
 
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmjQcdAPHG1zdEByZWRo
 YXQuY29tAAoJECgfDbjSjVRpXMAH/A2lEeCVLnz15Depf4OK0qbldynTA0epbtc0
 zdjDpyoMZ9qk7oeYl/vZhYQtBTjGXtzTcmHcIJucHA44vGTuRCDuR6tuUeatE6aS
 1NoqhtFc2kzes/gTwkMmnM5woogOfOzLyyiEktP3f/e22srHQfVxYmC5Xr+/NcHy
 3j4yeV9M9PKDuX9UDYHXA0x41z9pu5tkcDtLC9nJLiYuDllrQAs7CvIsqkCiVpG5
 IX2IoESl32egLzuJAtYguBTF+ckJNtg2+qOuXwXfmP/HdU+ygXq8u9iv21pG8897
 nkUwiKN9j9q4Csmhfw8ma3Y4tK7BoomYt4ndnAt1R7M+dkqherA=
 =0APL
 -----END PGP SIGNATURE-----

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

Pull virtio fixes from Michael Tsirkin:
 "virtio,vhost: last minute fixes

  More small fixes. Most notably this fixes crashes and hangs in
  vhost-net"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  MAINTAINERS, mailmap: Update address for Peter Hilber
  virtio_config: clarify output parameters
  uapi: vduse: fix typo in comment
  vhost: Take a reference on the task in struct vhost_task.
  vhost-net: flush batched before enabling notifications
  Revert "vhost/net: Defer TX queue re-enable until after sendmsg"
  vhost-net: unbreak busy polling
  vhost-scsi: fix argument order in tport allocation error message
2025-09-25 08:06:03 -07:00
Dan Carpenter
d9c70e93ec octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node"
and then dereferences it on the next line.  Two lines later, we take
a mutex so I don't think this is an RCU safe region.  Re-order it to do
the dereferences before queuing up the free.

Fixes: 68fbff68db ("octeontx2-pf: Add police action for TC flower")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/aNKCL1jKwK8GRJHh@stanley.mountain
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-25 11:04:34 +02:00
Paolo Abeni
764a47a639 Merge branch 'lantiq_gswip-fixes'
Vladimir Oltean says:

====================
lantiq_gswip fixes

This is a small set of fixes which I believe should be backported for
the lantiq_gswip driver. Daniel Golle asked me to submit them here:
https://lore.kernel.org/netdev/aLiDfrXUbw1O5Vdi@pidgin.makrotopia.org/

As mentioned there, a merge conflict with net-next is expected, due to
the movement of the driver to the 'drivers/net/dsa/lantiq' folder there.
Good luck :-/

Patch 2/2 fixes an old regression and is the minimal fix for that, as
discussed here:
https://lore.kernel.org/netdev/aJfNMLNoi1VOsPrN@pidgin.makrotopia.org/

Patch 1/2 was identified by me through static analysis, and I consider
it to be a serious deficiency. It needs a test tag.
====================

Link: https://patch.msgid.link/20250918072142.894692-1-vladimir.oltean@nxp.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-25 10:29:22 +02:00
Vladimir Oltean
987afe1479 net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
The blamed commit and others in that patch set started the trend
of reusing existing DSA driver API for a new purpose: calling
ds->ops->port_fdb_add() on the CPU port.

The lantiq_gswip driver was not prepared to handle that, as can be seen
from the many errors that Daniel presents in the logs:

[  174.050000] gswip 1e108000.switch: port 2 failed to add fa:aa:72:f4:8b:1e vid 1 to fdb: -22
[  174.060000] gswip 1e108000.switch lan2: entered promiscuous mode
[  174.070000] gswip 1e108000.switch: port 2 failed to add 00:01:02:03:04:02 vid 0 to fdb: -22
[  174.090000] gswip 1e108000.switch: port 2 failed to add 00:01:02:03:04:02 vid 1 to fdb: -22
[  174.090000] gswip 1e108000.switch: port 2 failed to delete fa:aa:72:f4:8b:1e vid 1 from fdb: -2

The errors are because gswip_port_fdb() wants to get a handle to the
bridge that originated these FDB events, to associate it with a FID.
Absolutely honourable purpose, however this only works for user ports.

To get the bridge that generated an FDB entry for the CPU port, one
would need to look at the db.bridge.dev argument. But this was
introduced in commit c26933639b ("net: dsa: request drivers to perform
FDB isolation"), first appeared in v5.18, and when the blamed commit was
introduced in v5.14, no such API existed.

So the core DSA feature was introduced way too soon for lantiq_gswip.
Not acting on these host FDB entries and suppressing any errors has no
other negative effect, and practically returns us to not supporting the
host filtering feature at all - peacefully, this time.

Fixes: 10fae4ac89 ("net: dsa: include bridge addresses which are local in the host fdb list")
Reported-by: Daniel Golle <daniel@makrotopia.org>
Closes: https://lore.kernel.org/netdev/aJfNMLNoi1VOsPrN@pidgin.makrotopia.org/
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20250918072142.894692-3-vladimir.oltean@nxp.com
Tested-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-25 10:29:18 +02:00
Vladimir Oltean
c0054b25e2 net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
A port added to a "single port bridge" operates as standalone, and this
is mutually exclusive to being part of a Linux bridge. In fact,
gswip_port_bridge_join() calls gswip_add_single_port_br() with
add=false, i.e. removes the port from the "single port bridge" to enable
autonomous forwarding.

The blamed commit seems to have incorrectly thought that ds->ops->port_enable()
is called one time per port, during the setup phase of the switch.

However, it is actually called during the ndo_open() implementation of
DSA user ports, which is to say that this sequence of events:

1. ip link set swp0 down
2. ip link add br0 type bridge
3. ip link set swp0 master br0
4. ip link set swp0 up

would cause swp0 to join back the "single port bridge" which step 3 had
just removed it from.

The correct DSA hook for one-time actions per port at switch init time
is ds->ops->port_setup(). This is what seems to match the coder's
intention; also see the comment at the beginning of the file:

 * At the initialization the driver allocates one bridge table entry for
   ~~~~~~~~~~~~~~~~~~~~~
 * each switch port which is used when the port is used without an
 * explicit bridge.

Fixes: 8206e0ce96 ("net: dsa: lantiq: Add VLAN unaware bridge offloading")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20250918072142.894692-2-vladimir.oltean@nxp.com
Tested-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-25 10:29:18 +02:00
Linus Torvalds
bf40f4b877 Probes fixes for v6.17-rc7
- fprobe: Even if there is a memory allocation failure, try to remove
   the addresses recorded until then from the filter. Previously we
   just skip it.
 - tracing: dynevent: Add a missing lockdown check on dynevent. This
   dynevent is the interface for all probe events. Thus if there is no
   check, any probe events can be added after lock down the tracefs.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmjUl5obHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8b4x4H/05k/zgZGXHEZizE+Zzx
 tS8kikesEcnlTv1F4goYVvMzcUpBpfTgjFEJQPSyEHNUcWtWYAlGSWZnQLfzmrr/
 2qHEXCVXk+jjp9kwTwvpWioLaU51tGC5tkFD+G4WQdgNZaOsejgXR1UEKum80g0p
 cuYYvwEKq3o6Vas+yrMQpJbxiu0CLcxY0EJwULlZrdAzdECifn11lCyUHTNevF7/
 3Xb8sAR7Xxd+PGhvYk9RPzosocXQ5Kb0zvyWr64njDNTstGxkpamwQ8Z0GUd1L1Z
 nnqm+BfU6kdYOtggiNewyFm1r7K383zIf708z2ySUBJKm2YrE4Jl19tCK5Q5PbcG
 puY=
 =+z7x
 -----END PGP SIGNATURE-----

Merge tag 'probes-fixes-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull probes fixes from Masami Hiramatsu:

 - fprobe: Even if there is a memory allocation failure, try to remove
   the addresses recorded until then from the filter. Previously we just
   skipped it.

 - tracing: dynevent: Add a missing lockdown check on dynevent. This
   dynevent is the interface for all probe events. Thus if there is no
   check, any probe events can be added after lock down the tracefs.

* tag 'probes-fixes-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing: dynevent: Add a missing lockdown check on dynevent
  tracing: fprobe: Fix to remove recorded module addresses from filter
2025-09-24 19:17:07 -07:00
Jacob Keller
b7e32ae666 libie: fix string names for AQ error codes
The LIBIE_AQ_STR macro() introduced by commit 5feaa7a07b ("libie: add
adminq helper for converting err to str") is used in order to generate
strings for printing human readable error codes. Its definition is missing
the separating underscore ('_') character which makes the resulting strings
difficult to read. Additionally, the string won't match the source code,
preventing search tools from working properly.

Add the missing underscore character, fixing the error string names.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Fixes: 5feaa7a07b ("libie: add adminq helper for converting err to str")
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Link: https://patch.msgid.link/20250923205657.846759-1-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-24 16:58:54 -07:00
Eric Biggers
d0ca0df179 crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
Commit 1b34cbbf4f ("crypto: af_alg - Disallow concurrent writes in
af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of
type u32.

However, some assignments to these fields, specifically 'more' and
'merge', assign values greater than 1.  These relied on C's implicit
conversion to bool, such that zero becomes false and nonzero becomes
true.

With a 1-bit bitfields of type u32 instead, mod 2 of the value is taken
instead, resulting in 0 being assigned in some cases when 1 was intended.

Fix this by restoring the bool type.

Fixes: 1b34cbbf4f ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-09-24 14:43:32 -07:00
Linus Torvalds
ea78c19081 soc: fixes for 6.17, part 3
There are a few minor code fixes for tegra firmware, i.MX firmware and the
 eyeq reset controller, and a MAINTAINERS update as Alyssa Rosenzweig moves
 on to non-kernel projects. The other changes are all for devicetree files:
 
  - Multiple Marvell Armada SoCs need changes to fix PCIe, audio and SATA
  - A socfpga board fails to probe the ethernet phy
  - The two temperature sensors on i.MX8MP are swapped
  - Allwinner devicetree files cause build-time warnings
  - Two Rockchip based boards need corrections for headphone detection
    and SPI flash
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmjUXWcACgkQmmx57+YA
 GNno4g//ZcWBmmkSEHlbbHzD9uMXdXGF/NyNWr/O+9f+uOEnmZ/RCxvNl7rGU8aq
 5Mu6QlrgFiPRoDjqU1eHrd+Bya43M6TdOpYf3boM9tgd9wYuE7vLWUUF6BRV/x7D
 SuNQfWMk0JwwDgYAltLs5mB+tKqxNnEDLdDQiV28UtES/aNsDAs5Z3pCeBAbbMC/
 dkZzg/QvpKEIDBUEA9+24ShYelM5EerQsJJbCJbrM8j5/fJFGWmQ2Z2QPkvVVLIh
 8UM6EL0xxa4emDHQJnmgkSbAi5UhPkttiDVl9aRmAfcvxUhGUzrBUu9Gj4ypEdiF
 9haGz+qz5rpz0LS5eNzBGPaaiUTRlx6PvCcpuJhkJKHyFjQDj+eruX7LMjsFptlz
 My1yS7J2LlDEpQOwIs8cQSnB6pV3eeol7DVM7PewbocbcSP1zgYcu+MYZc3QbJbH
 KdG6glkzbBWl5Nhur4KBVpv8HmsV8521WJQiyuH4MmjOUlHVVljsx6JVjvythw78
 n8nNHcwNIqpZRL2bYAaDT/uhtvPz3dgIU17Xl/s21Av3Wwru1GqNt/dMgMy6Ent5
 +1lriby47DCP69g0joy82Eb3Jf8KkAYatDmUEr31kZA66cVPzmrEGX6QioqGcMs5
 3XDF+JuAN3MzqGw4oZfPH5tLzYYUNr8g6F1A4CA5rlSDYiU81Rg=
 =bxeQ
 -----END PGP SIGNATURE-----

Merge tag 'soc-fixes-6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC fixes from Arnd Bergmann:
 "There are a few minor code fixes for tegra firmware, i.MX firmware
  and the eyeq reset controller, and a MAINTAINERS update as Alyssa
  Rosenzweig moves on to non-kernel projects.

  The other changes are all for devicetree files:

   - Multiple Marvell Armada SoCs need changes to fix PCIe, audio and
     SATA

   - A socfpga board fails to probe the ethernet phy

   - The two temperature sensors on i.MX8MP are swapped

   - Allwinner devicetree files cause build-time warnings

   - Two Rockchip based boards need corrections for headphone detection
     and SPI flash"

* tag 'soc-fixes-6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  MAINTAINERS: remove Alyssa Rosenzweig
  firmware: tegra: Do not warn on missing memory-region property
  arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports
  arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes
  arm64: dts: marvell: cn913x-solidrun: fix sata ports status
  ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
  arm64: dts: imx8mp: Correct thermal sensor index
  ARM: imx: Kconfig: Adjust select after renamed config option
  firmware: imx: Add stub functions for SCMI CPU API
  firmware: imx: Add stub functions for SCMI LMM API
  firmware: imx: Add stub functions for SCMI MISC API
  riscv: dts: allwinner: rename devterm i2c-gpio node to comply with binding
  arm64: dts: rockchip: Fix the headphone detection on the orangepi 5
  arm64: dts: rockchip: Add vcc supply for SPI Flash on NanoPC-T6
  ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
  reset: eyeq: fix OF node leak
  ARM64: dts: mcbin: fix SATA ports on Macchiatobin
  ARM: dts: armada-370-db: Fix stereo audio input routing on Armada 370
  ARM: dts: allwinner: Minor whitespace cleanup
2025-09-24 14:37:44 -07:00
Linus Torvalds
4ea5af0859 Power management fix for 6.17
Fix a locking issue in the cpufreq core introduced recently and
 caught by lockdep (Christian Loehle).
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmjT1lESHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1dSsH/A7OtNoxf41xUXKBuHyJ/4x5vWVkOEBs
 /yrjUicK3FCXsL5ZNkO0RfjA+blB9SHYpAuJFWKabXMVoMtL4K7ygHJrB5Oi+1/t
 E927jCVg5YLndhkembWUgb2rpTzAfTKkYXKrjc7PR3dkebWeOeovU72RDOtl7MFw
 r0phhcrYamjCV3GbxN1kwl6J3SfKTpBzWF/4eUBLfega7jDUpIEA6d9NQnQvyAnG
 tlPdH9xy9WrIv7H6S3AOLmqgLgrJtYXY1r+FHVGCC7w0EjHDHOoYiI8U0+HIbGNc
 75N0+JYhMzdkrg6kcZ8LyiiOxiWrwvZ/tGR2Mox5zjCstV/lktxdBDg=
 =Hhlz
 -----END PGP SIGNATURE-----

Merge tag 'pm-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fix from Rafael Rafael:
 "Fix a locking issue in the cpufreq core introduced recently and caught
  by lockdep (Christian Loehle)"

* tag 'pm-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq: Initialize cpufreq-based invariance before subsys
2025-09-24 11:14:53 -07:00
Linus Torvalds
74c7cc79aa for-6.17-rc7-tag
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmjTbXwACgkQxWXV+ddt
 WDtj1g//ZYTmnaJi16hS7yD2XkX0ZWZi/fFGj6y0/y4GdUG7kE4ZO8ujyZjssVvk
 UGVNyrv6zbWLh2z+QioBMDPMsFDGT4gBrBSsT8SP2VtMD+G6ElAxYq2raDU9Wsw6
 IY86UhrnWx7RFYLbpY2YrK0F6G4UhNkwz4S8brftxFGOVF5hmfCD+5mSpfCOOnoG
 iK6/p0G1Kf1pIwuSl4d0bl33ruTN/5r/pQZwfguWFLwVJnagE4/a0Y6DGY9B2YO5
 xEFuVCv26Im/XRz9HlcZC1VbWEwSyMlNdmvhONsFCWyPkwsguFyPBTOKZO4em6fK
 P3QgW6vjLTwBgcLflsrcezEbmmdeQ82REQil0NpuM8x9NcD649ecHpmwDqY/2aUw
 XH8bIDqhekeoV/sDVkGegaWMDxJizTHCZTdhokcIMRR+wbLVRgFmAHBmFjR392SC
 7APzgCbzLzjECSQuv1KviceTW+JQMiERoSdAIFUtumRoa0wDkR+5y6ve6Um9Z0Ze
 KXHdtH2hcsw1qat1i3DCk91F91f0fxP73aE/driCwPlAdWpHwIGFTPg0hGM/Tca3
 YSKeS+cDt0LGSJKE8iB3LQrE6Nj5kAOwvMsM4SvFgHfRndjiZv5rilzkj59S6NGu
 qcH03hIZgBPCjtjKAJG6qfe9Krd/yy19Mq18/4Jn1XhlQahCY/8=
 =sOwE
 -----END PGP SIGNATURE-----

Merge tag 'for-6.17-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fix from David Sterba:
 "One more regression fix for a problem in zoned mode: mounting would
  fail if the number of open and active zones reached a common limit
  that didn't use to be checked"

* tag 'for-6.17-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: zoned: don't fail mount needlessly due to too many active zones
2025-09-24 11:09:09 -07:00
Linus Torvalds
fd7d927587 two ksmbd server fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmjS5kMACgkQiiy9cAdy
 T1E0cgv/WiAATn7ZGuC4VPOspOqaNDxj6ASA9OPU5rHugkEI6+hh6Jo0YoACg8ZT
 LiCm3ymrl05ZDCpYThuKWZ83EFgdFZADqkiVTKOgPM9IIBVV/NwPzOk4Snk8qC1a
 KFWJHHEYrPHVpbzWTVM1KftnsPBVj62lYJcc94fgBB9azH6gR+wVJBxZGUMkaNYJ
 m7Zqk4cdYAg/HAo5GqLwFRNkIIcFnm5L5cRelTMC2b3MYuAFAz2L7zl5B+VrdC73
 0hvfWx5V2YJnY5j+wP+8vzlyIFQuKO1AOl9sk4o6R/9XPEEDIJe5XenrG9grSDMD
 jqX01RBVKOVOP2qSx4PNEBsvIrx9tx2oyorIGLdRq6tjEax9GiKKV0xye82IFoAh
 CHmC+qQo04WBzCTzj1oyj2sAEp4HHK9+Swu9GIsWGXpdpzTFydnks0DrI93OpF6l
 Yth2LwEtmpAJVxbDYamnP4GfwwQKYDeRPpFi3a09w8bDtUjGJk5Z6p1J9BmiscwO
 TueN7wup
 =kC8N
 -----END PGP SIGNATURE-----

Merge tag '6.17-rc7-ksmbd-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - free_transport fix for disconnect races

 - minor delayed work fix

* tag '6.17-rc7-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
  smb: server: use disable_work_sync in transport_rdma.c
  smb: server: don't use delayed_work for post_recv_credits_work
2025-09-24 10:44:50 -07:00
Masami Hiramatsu (Google)
456c32e3c4 tracing: dynevent: Add a missing lockdown check on dynevent
Since dynamic_events interface on tracefs is compatible with
kprobe_events and uprobe_events, it should also check the lockdown
status and reject if it is set.

Link: https://lore.kernel.org/all/175824455687.45175.3734166065458520748.stgit@devnote2/

Fixes: 17911ff38a ("tracing: Add locked_down checks to the open calls of files created for tracefs")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
2025-09-25 00:22:46 +09:00
Masami Hiramatsu (Google)
c539feff3c tracing: fprobe: Fix to remove recorded module addresses from filter
Even if there is a memory allocation failure in fprobe_addr_list_add(),
there is a partial list of module addresses. So remove the recorded
addresses from filter if exists.
This also removes the redundant ret local variable.

Fixes: a3dc2983ca ("tracing: fprobe: Cleanup fprobe hash when module unloading")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Reviewed-by: Menglong Dong <menglong8.dong@gmail.com>
2025-09-24 23:18:26 +09:00
Jakub Kicinski
181d981b14 Merge branch 'mlx5-misc-fixes-2025-09-22'
Tariq Toukan says:

====================
mlx5 misc fixes 2025-09-22

This patchset provides misc bug fixes from the team to the mlx5 Eth
and core drivers.
====================

Link: https://patch.msgid.link/1758525094-816583-1-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-23 17:17:32 -07:00
Carolina Jubran
6d0477d0d0 net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD
Include MLX5E_FEC_RS_544_514_INTERLEAVED_QUAD in the FEC RS stats
handling. This addresses a gap introduced when adding support for
200G/lane link modes.

Fixes: 4e343c11ef ("net/mlx5e: Support FEC settings for 200G per lane link modes")
Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Yael Chemla <ychemla@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1758525094-816583-4-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-23 17:17:30 -07:00
Yevgeny Kliteynik
efb877cf27 net/mlx5: HWS, ignore flow level for multi-dest table
When HWS creates multi-dest FW table and adds rules to
forward to other tables, ignore the flow level enforcement
in FW, because HWS is responsible for table levels.

This fixes the following error:

  mlx5_core 0000:08:00.0: mlx5_cmd_out_err:818:(pid 192306):
     SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed,
     status bad parameter(0x3), syndrome (0x6ae84c), err(-22)

Fixes: 504e536d90 ("net/mlx5: HWS, added actions handling")
Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1758525094-816583-3-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-23 17:17:30 -07:00
Moshe Shemesh
6043819e70 net/mlx5: fs, fix UAF in flow counter release
Fix a kernel trace [1] caused by releasing an HWS action of a local flow
counter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and
mutex were not initialized and the counter struct could already be freed
when deleting the rule.

Fix it by adding the missing initializations and adding refcount for the
local flow counter struct.

[1] Kernel log:
 Call Trace:
  <TASK>
  dump_stack_lvl+0x34/0x48
  mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]
  mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]
  mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]
  mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]
  del_hw_fte+0x1ce/0x260 [mlx5_core]
  mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]
  ? ttwu_queue_wakelist+0xf4/0x110
  mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]
  uverbs_free_flow+0x20/0x50 [ib_uverbs]
  destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]
  uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]
  uobj_destroy+0x3c/0x80 [ib_uverbs]
  ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]
  ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]
  ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]
  ? do_tty_write+0x1a9/0x270
  ? file_tty_write.constprop.0+0x98/0xc0
  ? new_sync_write+0xfc/0x190
  ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]
  __x64_sys_ioctl+0x87/0xc0
  do_syscall_64+0x59/0x90

Fixes: b581f42669 ("net/mlx5: fs, manage flow counters HWS action sharing by refcount")
Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1758525094-816583-2-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-23 17:17:30 -07:00
Jakub Kicinski
0efdfbba2e Merge branch 'nexthop-various-fixes'
Ido Schimmel says:

====================
nexthop: Various fixes

Patch #1 fixes a NPD that was recently reported by syzbot.

Patch #2 fixes an issue in the existing FIB nexthop selftest.

Patch #3 extends the selftest with test cases for the bug that was fixed
in the first patch.
====================

Link: https://patch.msgid.link/20250921150824.149157-1-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-23 17:01:09 -07:00
Ido Schimmel
00af023d90 selftests: fib_nexthops: Add test cases for FDB status change
Add the following test cases for both IPv4 and IPv6:

* Can change from FDB nexthop to non-FDB nexthop and vice versa.
* Can change FDB nexthop address while in a group.
* Cannot change from FDB nexthop to non-FDB nexthop and vice versa while
  in a group.

Output without "nexthop: Forbid FDB status change while nexthop is in a
group":

 # ./fib_nexthops.sh -t "ipv6_fdb_grp_fcnal ipv4_fdb_grp_fcnal"

 IPv6 fdb groups functional
 --------------------------
 [...]
 TEST: Replace FDB nexthop to non-FDB nexthop                        [ OK ]
 TEST: Replace non-FDB nexthop to FDB nexthop                        [ OK ]
 TEST: Replace FDB nexthop address while in a group                  [ OK ]
 TEST: Replace FDB nexthop to non-FDB nexthop while in a group       [FAIL]
 TEST: Replace non-FDB nexthop to FDB nexthop while in a group       [FAIL]
 [...]

 IPv4 fdb groups functional
 --------------------------
 [...]
 TEST: Replace FDB nexthop to non-FDB nexthop                        [ OK ]
 TEST: Replace non-FDB nexthop to FDB nexthop                        [ OK ]
 TEST: Replace FDB nexthop address while in a group                  [ OK ]
 TEST: Replace FDB nexthop to non-FDB nexthop while in a group       [FAIL]
 TEST: Replace non-FDB nexthop to FDB nexthop while in a group       [FAIL]
 [...]

 Tests passed:  36
 Tests failed:   4
 Tests skipped:  0

Output with "nexthop: Forbid FDB status change while nexthop is in a
group":

 # ./fib_nexthops.sh -t "ipv6_fdb_grp_fcnal ipv4_fdb_grp_fcnal"

 IPv6 fdb groups functional
 --------------------------
 [...]
 TEST: Replace FDB nexthop to non-FDB nexthop                        [ OK ]
 TEST: Replace non-FDB nexthop to FDB nexthop                        [ OK ]
 TEST: Replace FDB nexthop address while in a group                  [ OK ]
 TEST: Replace FDB nexthop to non-FDB nexthop while in a group       [ OK ]
 TEST: Replace non-FDB nexthop to FDB nexthop while in a group       [ OK ]
 [...]

 IPv4 fdb groups functional
 --------------------------
 [...]
 TEST: Replace FDB nexthop to non-FDB nexthop                        [ OK ]
 TEST: Replace non-FDB nexthop to FDB nexthop                        [ OK ]
 TEST: Replace FDB nexthop address while in a group                  [ OK ]
 TEST: Replace FDB nexthop to non-FDB nexthop while in a group       [ OK ]
 TEST: Replace non-FDB nexthop to FDB nexthop while in a group       [ OK ]
 [...]

 Tests passed:  40
 Tests failed:   0
 Tests skipped:  0

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250921150824.149157-4-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-23 17:01:05 -07:00
Ido Schimmel
c29913109c selftests: fib_nexthops: Fix creation of non-FDB nexthops
The test creates non-FDB nexthops without a nexthop device which leads
to the expected failure, but for the wrong reason:

 # ./fib_nexthops.sh -t "ipv6_fdb_grp_fcnal ipv4_fdb_grp_fcnal" -v

 IPv6 fdb groups functional
 --------------------------
 [...]
 COMMAND: ip -netns me-nRsN3E nexthop add id 63 via 2001:db8:91::4
 Error: Device attribute required for non-blackhole and non-fdb nexthops.
 COMMAND: ip -netns me-nRsN3E nexthop add id 64 via 2001:db8:91::5
 Error: Device attribute required for non-blackhole and non-fdb nexthops.
 COMMAND: ip -netns me-nRsN3E nexthop add id 103 group 63/64 fdb
 Error: Invalid nexthop id.
 TEST: Fdb Nexthop group with non-fdb nexthops                       [ OK ]
 [...]

 IPv4 fdb groups functional
 --------------------------
 [...]
 COMMAND: ip -netns me-nRsN3E nexthop add id 14 via 172.16.1.2
 Error: Device attribute required for non-blackhole and non-fdb nexthops.
 COMMAND: ip -netns me-nRsN3E nexthop add id 15 via 172.16.1.3
 Error: Device attribute required for non-blackhole and non-fdb nexthops.
 COMMAND: ip -netns me-nRsN3E nexthop add id 103 group 14/15 fdb
 Error: Invalid nexthop id.
 TEST: Fdb Nexthop group with non-fdb nexthops                       [ OK ]

 COMMAND: ip -netns me-nRsN3E nexthop add id 16 via 172.16.1.2 fdb
 COMMAND: ip -netns me-nRsN3E nexthop add id 17 via 172.16.1.3 fdb
 COMMAND: ip -netns me-nRsN3E nexthop add id 104 group 14/15
 Error: Invalid nexthop id.
 TEST: Non-Fdb Nexthop group with fdb nexthops                       [ OK ]
 [...]
 COMMAND: ip -netns me-0dlhyd ro add 172.16.0.0/22 nhid 15
 Error: Nexthop id does not exist.
 TEST: Route add with fdb nexthop                                    [ OK ]

In addition, as can be seen in the above output, a couple of IPv4 test
cases used the non-FDB nexthops (14 and 15) when they intended to use
the FDB nexthops (16 and 17). These test cases only passed because
failure was expected, but they failed for the wrong reason.

Fix the test to create the non-FDB nexthops with a nexthop device and
adjust the IPv4 test cases to use the FDB nexthops instead of the
non-FDB nexthops.

Output after the fix:

 # ./fib_nexthops.sh -t "ipv6_fdb_grp_fcnal ipv4_fdb_grp_fcnal" -v

 IPv6 fdb groups functional
 --------------------------
 [...]
 COMMAND: ip -netns me-lNzfHP nexthop add id 63 via 2001:db8:91::4 dev veth1
 COMMAND: ip -netns me-lNzfHP nexthop add id 64 via 2001:db8:91::5 dev veth1
 COMMAND: ip -netns me-lNzfHP nexthop add id 103 group 63/64 fdb
 Error: FDB nexthop group can only have fdb nexthops.
 TEST: Fdb Nexthop group with non-fdb nexthops                       [ OK ]
 [...]

 IPv4 fdb groups functional
 --------------------------
 [...]
 COMMAND: ip -netns me-lNzfHP nexthop add id 14 via 172.16.1.2 dev veth1
 COMMAND: ip -netns me-lNzfHP nexthop add id 15 via 172.16.1.3 dev veth1
 COMMAND: ip -netns me-lNzfHP nexthop add id 103 group 14/15 fdb
 Error: FDB nexthop group can only have fdb nexthops.
 TEST: Fdb Nexthop group with non-fdb nexthops                       [ OK ]

 COMMAND: ip -netns me-lNzfHP nexthop add id 16 via 172.16.1.2 fdb
 COMMAND: ip -netns me-lNzfHP nexthop add id 17 via 172.16.1.3 fdb
 COMMAND: ip -netns me-lNzfHP nexthop add id 104 group 16/17
 Error: Non FDB nexthop group cannot have fdb nexthops.
 TEST: Non-Fdb Nexthop group with fdb nexthops                       [ OK ]
 [...]
 COMMAND: ip -netns me-lNzfHP ro add 172.16.0.0/22 nhid 16
 Error: Route cannot point to a fdb nexthop.
 TEST: Route add with fdb nexthop                                    [ OK ]
 [...]
 Tests passed:  30
 Tests failed:   0
 Tests skipped:  0

Fixes: 0534c5489c ("selftests: net: add fdb nexthop tests")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250921150824.149157-3-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-23 17:01:05 -07:00
Ido Schimmel
390b3a300d nexthop: Forbid FDB status change while nexthop is in a group
The kernel forbids the creation of non-FDB nexthop groups with FDB
nexthops:

 # ip nexthop add id 1 via 192.0.2.1 fdb
 # ip nexthop add id 2 group 1
 Error: Non FDB nexthop group cannot have fdb nexthops.

And vice versa:

 # ip nexthop add id 3 via 192.0.2.2 dev dummy1
 # ip nexthop add id 4 group 3 fdb
 Error: FDB nexthop group can only have fdb nexthops.

However, as long as no routes are pointing to a non-FDB nexthop group,
the kernel allows changing the type of a nexthop from FDB to non-FDB and
vice versa:

 # ip nexthop add id 5 via 192.0.2.2 dev dummy1
 # ip nexthop add id 6 group 5
 # ip nexthop replace id 5 via 192.0.2.2 fdb
 # echo $?
 0

This configuration is invalid and can result in a NPD [1] since FDB
nexthops are not associated with a nexthop device:

 # ip route add 198.51.100.1/32 nhid 6
 # ping 198.51.100.1

Fix by preventing nexthop FDB status change while the nexthop is in a
group:

 # ip nexthop add id 7 via 192.0.2.2 dev dummy1
 # ip nexthop add id 8 group 7
 # ip nexthop replace id 7 via 192.0.2.2 fdb
 Error: Cannot change nexthop FDB status while in a group.

[1]
BUG: kernel NULL pointer dereference, address: 00000000000003c0
[...]
Oops: Oops: 0000 [#1] SMP
CPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014
RIP: 0010:fib_lookup_good_nhc+0x1e/0x80
[...]
Call Trace:
 <TASK>
 fib_table_lookup+0x541/0x650
 ip_route_output_key_hash_rcu+0x2ea/0x970
 ip_route_output_key_hash+0x55/0x80
 __ip4_datagram_connect+0x250/0x330
 udp_connect+0x2b/0x60
 __sys_connect+0x9c/0xd0
 __x64_sys_connect+0x18/0x20
 do_syscall_64+0xa4/0x2a0
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Fixes: 38428d6871 ("nexthop: support for fdb ecmp nexthops")
Reported-by: syzbot+6596516dd2b635ba2350@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68c9a4d2.050a0220.3c6139.0e63.GAE@google.com/
Tested-by: syzbot+6596516dd2b635ba2350@syzkaller.appspotmail.com
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250921150824.149157-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-23 17:01:05 -07:00
Jason Baron
ca9f9cdc4d net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
Currently, alloc_skb_with_frags() will only fill (MAX_SKB_FRAGS - 1)
slots. I think it should use all MAX_SKB_FRAGS slots, as callers of
alloc_skb_with_frags() will size their allocation of frags based
on MAX_SKB_FRAGS.

This issue was discovered via a test patch that sets 'order' to 0
in alloc_skb_with_frags(), which effectively tests/simulates high
fragmentation. In this case sendmsg() on unix sockets will fail every
time for large allocations. If the PAGE_SIZE is 4K, then data_len will
request 68K or 17 pages, but alloc_skb_with_frags() can only allocate
64K in this case or 16 pages.

Fixes: 09c2c90705 ("net: allow alloc_skb_with_frags() to allocate bigger packets")
Signed-off-by: Jason Baron <jbaron@akamai.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250922191957.2855612-1-jbaron@akamai.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-23 16:51:26 -07:00
Jakub Kicinski
16d93558e1 linux-can-fixes-for-6.17-20250923
-----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEn/sM2K9nqF/8FWzzDHRl3/mQkZwFAmjSTPsTHG1rbEBwZW5n
 dXRyb25peC5kZQAKCRAMdGXf+ZCRnDOfB/4id/Fio0JP6Uw0otlL8E/QlRh6L92N
 tkdkrOtDO/cvxqBviiCHQjvjfqmTn/PMglpfRxfwBO7FHhrXBXiWB889/ojqvRGP
 +KT0v/+z/sGsXmHjXvvax9QHbO7lH2E9GUtObaUYtDjI8ID3hnCIYJ5m33yclLJP
 araLAhVQaVuwqgE8THkntKkHn3K8I/jDGaJyA+erPL4S725hcZv5bAY3p7plS1jc
 tuvdXNmumc31KVK2l04zHG5iTxSh8Qzx6n0yrYyfJ7kp2iwl+ahuIRvst8ZeOPl4
 4ic6rMTIR1ylvy+e+CRIdSI/hkgT8JC3G3cHwl1bzSAXnwOUV43TXMBF
 =czyt
 -----END PGP SIGNATURE-----

Merge tag 'linux-can-fixes-for-6.17-20250923' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can

Marc Kleine-Budde says:

====================
pull-request: can 2025-09-23

The 1st patch is by Chen Yufeng and fixes a potential NULL pointer
deref in the hi311x driver.

Duy Nguyen contributes a patch for the rcar_canfd driver to fix the
controller mode setting.

The next 4 patches are by Vincent Mailhol and populate the
ndo_change_mtu(( callback in the etas_es58x, hi311x, sun4i_can and
mcba_usb driver to prevent buffer overflows.

Stéphane Grosjean's patch for the peak_usb driver fixes a
shift-out-of-bounds issue.

* tag 'linux-can-fixes-for-6.17-20250923' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:
  can: peak_usb: fix shift-out-of-bounds issue
  can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
  can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
  can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
  can: rcar_canfd: Fix controller mode setting
  can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled
====================

Link: https://patch.msgid.link/20250923073427.493034-1-mkl@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-23 16:42:42 -07:00
Arnd Bergmann
13923775d5 firmware: tegra: Fixes for v6.17
This contains a simple patch to avoid a warning in the case where the
 optional memory-region property is missing.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmjNIXEACgkQ3SOs138+
 s6EQzRAAmo1gPlr/w+C5IftwgWJdaeYkuOj+43KWf/9dAoGMazGvxAIk8QF4XdK1
 GSRI1sikQDZnJdMMvnmFJNaedsKv/JeQ4Rdlx0jztzdez9iSxB8PgXwZhVC1DY0T
 flXyFmMASfrIJqNnDtuFfFOAPaqMKagnlxs1EcoIxAM9sTCZSA1TZQKJfDpj49x/
 bzuiaci5LjA6bfT1jocWcgzON6IOWQQxiV4UUjITSEiOlW+hzdhmi8H1oBlE4wTZ
 sSIAhVepVnCxjmshSDFMWw26r/5p+MKMdCmklbtMpuRvTZyL4IxO5Lv09CptdaBp
 TiZPMnJTlnXVIIWbkuS68G/77D/9UVWzaxHXaaMK7GQtabfe0+MuvrKLvmn3B5ex
 OvX7SaWMW3kF+lnEZ5UkEubDBfhnSZHvptbUo91leAYOGN7rNB+c0uIZfe+LHzAa
 mipV3SPLl1dJbiNwvnblNTspW60mqlM8P/n8etkVzTD/IJGDq5QoruDvfZWBndHc
 pfocgl2kxw+wpRf3T69ywI/zDEcR3AgdvxBLHrlv2Xe3aDkM9EVfu2rts5YWSRTn
 dX1zCMe0owNfEMhuBlHyy61/XGodTRKeA9hl1hxVQRrT5Zg3FAbEcZyOBSABWpwa
 AydhLY1qJlJatoZQ1NMwyLEINMwi0xoOKZVkrMYprX4BZzgwErM=
 =nx7Q
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmjTBF8ACgkQmmx57+YA
 GNmBihAAsc8cz/+GgFJVljYQJBkSW2r970J2yZ018KHDbKJ/6iSDp0vIkLq17oDM
 UkByIGi3ZgxNhKYz6JBuqo6PP53G2IoZAaeqXcxzCsrdX7b8VK1SzAF4UDw3t950
 K8ZN4Pl9vGNj9HymqeCQxENqYMHbLoV9HF+zz8piwVyTK26LidJY9/5OXMG38KXo
 31ObixUpn2ViHtaxKD3fUA0krF67pNySoNb1LL1Lg7nIqR1Fr3lbqlVX1oZG2KOS
 8rt3viPz5swx/4rZqVSZBkPwOz14WZNspw6jEOY55bXWRvTgqvSRa9vY1oYDt5EM
 TVwCgGzLlqzVpq3u9jY5AJA1N0YsVFh4R+W6S52b2FZsNJ0ditsiBPURV6RdtqRF
 /BqMhRH1aL/L8HvlfmByl17YNsxxR4znefQeTNqRss8n+xz1sjLZIihkcpQ2xdSX
 qO9QF32qSNqXoBaZ2TxBDBzDtzuNXdHOpZdnkmruCIdXYTIpJyRSSMOjDIYoN+O8
 PUj+BNpX1sauIaXaa43HgJeFmVsxHw+tZAHet2ViZCrEY1jPgE2b3VxQ8MQSvdtj
 IXtbjAQCvIjSCcRMLdajhXff3HXXi2eeHsk0jXh/MWh9MJv+LIw1uizATMN8LKqD
 Q8OGJtiZtTrMbTWId9hDQspTNakUUDLzXj00lAeq38wU+Q+Ruis=
 =veO/
 -----END PGP SIGNATURE-----

Merge tag 'tegra-for-6.17-firmware-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes

firmware: tegra: Fixes for v6.17

This contains a simple patch to avoid a warning in the case where the
optional memory-region property is missing.

* tag 'tegra-for-6.17-firmware-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
  firmware: tegra: Do not warn on missing memory-region property

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-09-23 22:34:35 +02:00
Arnd Bergmann
6866b78566 Another missing supply and a wrong headphone gpio level.
-----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmjMiVUQHGhlaWtvQHNu
 dGVjaC5kZQAKCRDzpnnJnNEdgcRXB/994AOVcP5KR5Xtl9De+9IcQBAaGouGIHG7
 w7DDB0yRo4YFNK2bE1u7q3ap/jpbQAezv85xkGkh4+RwxolYDW7KI7FjYyuNEC0n
 C6dqgzPV/zb0xuBbuAV8z9UYqb/Fu7tWXp/cGr4TmUpSzJdXByOuuefnJjuu0vOR
 wAeOLfplI+s8aEMaLaB1d5Huz0IlRS27eyOAjE07NKHsuVtDqZ0voO8S+QTd/7W+
 cUZo0BTAuitRWItAKRq1Bxv12jEnkvkGnw8l+iDbQwS2nRJ2NuPJ+/GQUFn53qPP
 ZjGFnOMiduJ20WbxXUHSmZfKOH7O8Dz+UQEWYfBfyLcQZ73M3ffB
 =cBeN
 -----END PGP SIGNATURE-----

Merge tag 'v6.17-rockchip-dtsfixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes

Another missing supply and a wrong headphone gpio level.

* tag 'v6.17-rockchip-dtsfixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
  arm64: dts: rockchip: Fix the headphone detection on the orangepi 5
  arm64: dts: rockchip: Add vcc supply for SPI Flash on NanoPC-T6
2025-09-23 22:32:48 +02:00
Arnd Bergmann
ea38dfdd38 Apple SoC fixes for 6.17
Just a single commit that drops Alyssa from MAINTAINERS at her own wish
 and adds here to .get_maintainer.ignore
 
 Signed-off-by: Sven Peter <sven@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS3vz815OHsEaWy0u9EEX0kKnUe6QUCaMxbiAAKCRBEEX0kKnUe
 6fOnAQCawd2qReWEUKhZS3TgzGMDe+eTDKgD0hrxmNIO4fAt2wD/dUrCGu47oBcb
 +ZyFX4MvanPwcQ6uYbqBHJJjvkUHeQ4=
 =qCvY
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmjTA7EACgkQmmx57+YA
 GNnVOg//bXQ0kr4hSHHSTvugSua48nMrBnGC0bWuV5cgl/Y6Q54brxD3YkmgVqr0
 E+kbGOzO11O4qOk6K0cMVVxA7vKJhS3i+ymQsIXiJuDtOOSQebzjoSzUmHemuTk9
 XBRXxRl871s40KggiRCVcVhl8A2bXjeHvBrh7ZG4uteoQf5emLnVkxszlKpY4YZ9
 F41sWHmoEiDcXpLI2sTKDKVfUGvUKAFxO2dJwg9dKSWPiNfgMTQTu+8YM7xKtLam
 8P385BSjW2q7WHcnuRW4WMd09QBK/Eko7FoQVsenLbRiQ2R1pwSCswKU0vcMsKAb
 Kkvgf6crv5/4UOc3yT0F3NN60lQ6yEEmraQzegvPtHeyiJu6H4K6+oYDfUwX0NtD
 ktddC5MONEx5BPgLJLHtIYNhRM5mV+rG1x6PIXsFef/XJueePHHno94K4UmuQY9v
 6iQg23tJ1AEaU4AU70WMVVrM8eH5h2ez0yaBSCwtxi9o2i41/w/sgWeQQeAHQOg8
 +ThRO796/uLsWQ4gtZlyKAoV/hdRNGRAViJMUYUtrnj75BTAqBxYbGwVsDFZ6Wwu
 FTYF+DxRDTwNaXhuwyXbwK2hIyZMGj8087lW059taUQ6YGMY9AJsj2eKgMcNwAPz
 aZk2MV5KOqDtyS2Nf19IayL+iwEcNIL1XBXNrU5GyQDgZ4NLI08=
 =uZPz
 -----END PGP SIGNATURE-----

Merge tag 'apple-soc-fixes-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into arm/fixes

Apple SoC fixes for 6.17

Just a single commit that drops Alyssa from MAINTAINERS at her own wish
and adds here to .get_maintainer.ignore

Signed-off-by: Sven Peter <sven@kernel.org>

* tag 'apple-soc-fixes-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux:
  MAINTAINERS: remove Alyssa Rosenzweig

Link: https://lore.kernel.org/r/20250918192241.29374-1-sven@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-09-23 22:31:44 +02:00
Arnd Bergmann
5eba504bb2 Allwinner fixes for 6.17
Two device tree style cleanups from the device tree maintainers.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCgAsFiEE2nN1m/hhnkhOWjtHOJpUIZwPJDAFAmjK4l0OHHdlbnNAY3Np
 ZS5vcmcACgkQOJpUIZwPJDAdNxAAyr4rjXOMg5hNdhoAJYHoB8OtfzXBfPNk7gSH
 n5EIZqJsH4yUBHY/ULrCeePRXb9RczsrV6vSucRT2RnejUhMf8XXDHSY9GO5KJZV
 muhGpHGeijVDi1MgGdUKA3TOE7HFGMDHwHOhn0kxZFpUIl5uLzQGhhzH4yVg9RDU
 s6xqyeTAg3LQmSwS7wJIcT2W26+Ggj0KeqDb5II5UfWKgxcib9oo/WjzEGNpVOYr
 FqoDbboF/K9pHTaJGdUMJnKL6Fu647owc+uwL4UJFlS8jdKtQ10/bysdIZ41hvjr
 bZvfxTFz7UvnGeWbzulMs8nVl4ifPGsJEPpe17gZ9E111TpZqClJAHeJNt4ajKZ/
 Wx8QOZr2qsfnEl34U9IixUUdfsdTvWWSRduJOet+kj9FCPBOPw9sX4eshOZVT3uV
 OcZeLlVgUTUI9QH2yWUDb0s9m4evSv+QZF2jAl6zADw7OCO2mkLOc1/2dhJFMc0X
 88Q/wGiB1bD94Su5VNwAp6afcopMNYeXuZfRTTJ3mexOQ5S2akpiLDE41y+SQb9p
 uUcc4DDHlZZzKLe6wFMbbqSROUq/LqSPOBa8OGBOblgGZeVtIsyO6Kg7NFdJ30Ij
 +qvst6ny1wbohQf5D1F23DWCCDnIPFf0X+GAJ1JzR4eW2HPASYrE7refV9uds+hC
 s32yPxQ=
 =VlZ3
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmjTA4EACgkQmmx57+YA
 GNng4g//Ug+NDzj217MjXMNogJkc/MZoJh7QJuW6YiH7++XykJ9RH4drbXvYDm/K
 dYP9u39j4ZUtrL8CJe1YxOOQxHXKG6IK69FMqRDiGQcWFBWsVZprAlEFRnMluM5J
 b/Pq78fFZhJjL9absM2oFkz0Se0a9MzIxvDJYKO+WeLqxKIwRBdaGzhEuiejmemC
 lupZbE/kh05gY1i8oGy5njbSjoFSVkftkNbRpYbUXErpclppFV53DEv393Zg7SSI
 EQuzeDY8NFC7KBGBvaJvSdOOeW9VRugVhWUvU+SEqeSQbdZc/LuQmYmfHS50W8np
 7KQ/5znXQXr8JBUmh/GkxTTFYCiZdOA21r3/8hBiku0144ZBsw+x5sBOhUOW2eQg
 l+l+xZzDnP586mPJz/MbluiV5l4ibup060HN8Ws8zJfi4jUkOeKCMUDIUAC1UrJb
 xaQilNilTN/2UgeRFCztq3IOP/lLPRlA+gPy7Kozn3I3Zk5nhKd+MpBd1kIpv/WD
 Nteskf00YC1R656j+3Of7OywoTXeotmUm/R6Byihxf8qcU4Euo4bgTcLNfdknDvN
 gEi3yW1gj/rqO7ZxVhr9KIY/wMexwlXGZsanjFfgRZpepc+k+PJ4xkP1jVqYIIcN
 0F953PgnJD8vfP66CI8HsArYTek7zEzkeu5meBE/WDg1ZFIlcuM=
 =pWOK
 -----END PGP SIGNATURE-----

Merge tag 'sunxi-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes

Allwinner fixes for 6.17

Two device tree style cleanups from the device tree maintainers.

* tag 'sunxi-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  riscv: dts: allwinner: rename devterm i2c-gpio node to comply with binding
  ARM: dts: allwinner: Minor whitespace cleanup

Link: https://lore.kernel.org/r/aMrsUfkTWx8g3bJ7@wens.tw
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-09-23 22:30:57 +02:00
Johannes Thumshirn
53de7ee4e2 btrfs: zoned: don't fail mount needlessly due to too many active zones
Previously BTRFS did not look at a device's reported max_open_zones limit,
but starting with commit 04147d8394 ("btrfs: zoned: limit active zones
to max_open_zones"), zoned BTRFS limited the number of concurrently used
block-groups to the number of max_open_zones a device reported, if it
hadn't already reported a number of max_active_zones.

Starting with commit 04147d8394 the number of open zones is treated the
same way as active zones. But this leads to mount failures on filesystems
which have been used before 04147d8394 because too many zones are in an
open state.

Ignore the new limitations on these filesystems, so zones can be finished
or evacuated.

Reported-by: Yuwei Han <hrx@bupt.moe>
Link: https://lore.kernel.org/all/2F48A90AF7DDF380+1790bcfd-cb6f-456b-870d-7982f21b5eae@bupt.moe/
Fixes: 04147d8394 ("btrfs: zoned: limit active zones to max_open_zones")
Reviewed-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23 11:22:21 +02:00
Alok Tiwari
3d3aa9472c bnxt_en: correct offset handling for IPv6 destination address
In bnxt_tc_parse_pedit(), the code incorrectly writes IPv6
destination values to the source address field (saddr) when
processing pedit offsets within the destination address range.

This patch corrects the assignment to use daddr instead of saddr,
ensuring that pedit operations on IPv6 destination addresses are
applied correctly.

Fixes: 9b9eb518e3 ("bnxt_en: Add support for NAT(L3/L4 rewrite)")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Link: https://patch.msgid.link/20250920121157.351921-1-alok.a.tiwari@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-22 17:56:39 -07:00
Jakub Kicinski
a461b2fe3e ipsec-2025-09-22
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEH7ZpcWbFyOOp6OJbrB3Eaf9PW7cFAmjQ9iUACgkQrB3Eaf9P
 W7d6YRAAmuvXOc5oJQys4gBz0ha/Nq9gHTXEwRp73cB8lle3Lq1OS4PiTqkSlTmC
 i30n5jW6p5T9cBC6gngXBSxA7Onljz77MFqXox9REkYR3Zd0ulJ6JjRGo/jBnFcw
 pJRVnFsES1iFHO8Rs2Wop2Y1DnusWIM6UqSjGrQloaT52BI++Fy6LdsHfMFU+CSo
 vPW2msvd00QHeOZmm8N7eUC556Zpw2rJu7sHD+LkImQjDQUbvAlqq6GnAngh8JLw
 nUgZroas1MvBwbk4Et3nxqvZImf6MvWvEzShEmntbs4EvfMOBFCWy5k2AONnaFRE
 NjhH46V2NwjeH1JC7TN6TOS17ryfM05V36oFjFMwjmkEJWZ4LFL8ink+Loh2oREH
 FDvSxzSapZOu7ki/Ac6wdblJw2qumktegg4Zdtvvew15u1c0InpJiUrli01OnRwf
 uF5bj3lGH797Xpiiq+bD79YVQSFUJ8nwJOO3PnvUsdeYrHmn08aJLvYTL3HZ3/V7
 9kZJKDNeJR11Pz+dcltXvIL+AHADtb60dZ93X7vjsPPPMrKk383l7Mi6nzlVG6Cc
 27QQzvW/WXZ5dCScMv/YPzyDU91cxCYjoO2HBNtKVlntR1UiOMLuP35zAsvf8Oy0
 J5LjWVvOA2fR4G3QfaDO02emkIy3RiQOSsfLMcmBe/tqNXiS6Dc=
 =hVxI
 -----END PGP SIGNATURE-----

Merge tag 'ipsec-2025-09-22' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

Steffen Klassert says:

====================
pull request (net): ipsec 2025-09-22

1) Fix 0 assignment for SPIs. 0 is not a valid SPI,
   it means no SPI assigned.

2) Fix offloading for inter address family tunnels.

* tag 'ipsec-2025-09-22' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
  xfrm: fix offloading of cross-family tunnels
  xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
====================

Link: https://patch.msgid.link/20250922073512.62703-1-steffen.klassert@secunet.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-22 17:02:22 -07:00
Jakub Kicinski
91fc61775c Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue
Tony Nguyen says:

====================
i40e: virtchnl improvements

Przemek Kitszel says:

Improvements hardening PF-VF communication for i40e driver.
This patchset targets several issues that can cause undefined behavior
or be exploited in some other way.

* '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:
  i40e: improve VF MAC filters accounting
  i40e: add mask to apply valid bits for itr_idx
  i40e: add max boundary check for VF filters
  i40e: fix validation of VF state in get resources
  i40e: fix input validation logic for action_meta
  i40e: fix idx validation in config queues msg
  i40e: fix idx validation in i40e_validate_queue_map
  i40e: add validation for ring_len param
====================

Link: https://patch.msgid.link/20250919184959.656681-1-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-22 16:53:44 -07:00
Jakub Kicinski
3491bb7dae bluetooth pull request for net:
- Fix build after header cleanup
  - hci_sync: Fix hci_resume_advertising_sync
  - hci_event: Fix UAF in hci_conn_tx_dequeue
  - hci_event: Fix UAF in hci_acl_create_conn_sync
  - MGMT: Fix possible UAFs
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCgA3FiEE7E6oRXp8w05ovYr/9JCA4xAyCykFAmjRXfcZHGx1aXoudm9u
 LmRlbnR6QGludGVsLmNvbQAKCRD0kIDjEDILKVlUEAChTgP6uzK27ElzIMVbvInU
 ayCQwy1ox4twzde8AuMl+iliYL35YRuJBQyQseXI4//E7IF7FS0ke9fwYRT0MHTT
 RclNmCC95oVKcSAoAsq0JgbTk6Dy49KmHF2fJ64J1I4aiJcYR9cgWnvPs4tIReOL
 yq3iqKuy6Zw5PubbwySa+4449q0C1dKicqNWNfLylym8YlMpMnsn2g//pao9O7Wb
 DpNte9zUNXC3Ranud25hnY+nY8DwQ6EVmcLOSyFWWbNaoXjmOfaJKDfI0vxo8Vpc
 7IsW+1VpWrQKGJOuUsVGgk04OwShIO+wOYcD7gQUmHiZ9EFGXpwSZ3D5Et7ijjzP
 PmlGWf0YLz88PIB6q8qguILkQl0OogTFC+QBdiA2L7JgacjAwVv5+x9NVYbHjlii
 T53yvJGYYgM9pI4YOUT6RxIu07Os+QgeNhpRHAM5gRu1ze4XuZMB5qRNj/DyoDUB
 9CZYaSBBcy1xHi326KXe7FR+LgxZa6TBA4HbkV0KySB69J8BTuKITnkXiOs7NHMc
 U52LVsCQQ1gYHjw7+ms2lRLDXckMpVn9OBJdgtfQRVbcTyCEBQzYKgavf12CbyPe
 1Pg/gAsb54inkUt7lgCm4y289Bl7WpmLJwDdGPyIbWxenIkixRk9F2g3++ea+sYL
 xnifX1J901af52PL2NKfgg==
 =dTFT
 -----END PGP SIGNATURE-----

Merge tag 'for-net-2025-09-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - Fix build after header cleanup
 - hci_sync: Fix hci_resume_advertising_sync
 - hci_event: Fix UAF in hci_conn_tx_dequeue
 - hci_event: Fix UAF in hci_acl_create_conn_sync
 - MGMT: Fix possible UAFs

* tag 'for-net-2025-09-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: MGMT: Fix possible UAFs
  Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
  Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
  Bluetooth: hci_sync: Fix hci_resume_advertising_sync
  Bluetooth: Fix build after header cleanup
====================

Link: https://patch.msgid.link/20250922143315.3007176-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-22 12:29:54 -07:00
Jakub Kicinski
207b45e853 Merge branch 'broadcom-report-the-supported-flags-for-ancillary-features'
Jacob Keller says:

====================
broadcom: report the supported flags for ancillary features

James Clark reported off list that the broadcom PHY PTP driver was
incorrectly handling PTP_EXTTS_REQUEST and PTP_PEROUT_REQUEST ioctls since
the conversion to the .supported_*_flags fields. This series fixes the
driver to correctly report its flags through the .supported_perout_flags
and .supported_extts_flags fields. It also contains an update to comment
the behavior of the PTP_STRICT_FLAGS being always enabled for
PTP_EXTTS_REQUEST2.

I plan to follow up this series with some improvements to the PTP
documentation better explaining each flag and the expectation of the driver
APIs.
====================

Link: https://patch.msgid.link/20250918-jk-fix-bcm-phy-supported-flags-v1-0-747b60407c9c@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-22 11:36:33 -07:00
Jacob Keller
cd875625b4 ptp: document behavior of PTP_STRICT_FLAGS
Commit 6138e687c7 ("ptp: Introduce strict checking of external time stamp
options.") added the PTP_STRICT_FLAGS to the set of flags supported for the
external timestamp request ioctl.

It is only supported by PTP_EXTTS_REQUEST2, as it was introduced the
introduction of the new ioctls. Further, the kernel has always set this
flag for PTP_EXTTS_REQUEST2 regardless of whether or not the user requested
the behavior.

This effectively means that the flag is not useful for userspace. If the
user issues a PTP_EXTTS_REQUEST ioctl, the flag is ignored due to not being
supported on the old ioctl. If the user issues a PTP_EXTTS_REQUEST2 ioctl,
the flag will be set by the kernel regardless of whether the user set the
flag in their structure.

Add a comment documenting this behavior in the uAPI header file.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Tested-by: James Clark <jjc@jclark.com>
Link: https://patch.msgid.link/20250918-jk-fix-bcm-phy-supported-flags-v1-3-747b60407c9c@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-22 11:36:30 -07:00
Jacob Keller
3200fdd402 broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl
Commit 7c571ac57d ("net: ptp: introduce .supported_extts_flags to
ptp_clock_info") modified the PTP core kernel logic to validate the
supported flags for the PTP_EXTTS_REQUEST ioctls, rather than relying on
each individual driver correctly checking its flags.

The bcm_ptp_enable() function implements support for PTP_CLK_REQ_EXTTS, but
does not check the flags, and does not forward the request structure into
bcm_ptp_extts_locked().

When originally converting the bcm-phy-ptp.c code, it was unclear what
edges the hardware actually timestamped. Thus, no flags were initialized in
the .supported_extts_flags field. This results in the kernel automatically
rejecting all userspace requests for the PTP_EXTTS_REQUEST2 ioctl.

This occurs because the PTP_STRICT_FLAGS is always assumed when operating
under PTP_EXTTS_REQUEST2. This has been the case since the flags
introduction by commit 6138e687c7 ("ptp: Introduce strict checking of
external time stamp options.").

The bcm-phy-ptp.c logic never properly supported strict flag validation,
as it previously ignored all flags including both PTP_STRICT_FLAGS and the
PTP_FALLING_EDGE and PTP_RISING_EDGE flags.

Reports from users in the field prove that the hardware timestamps the
rising edge. Encode this in the .supported_extts_flags field. This
re-enables support for the PTP_EXTTS_REQUEST2 ioctl.

Reported-by: James Clark <jjc@jclark.com>
Fixes: 7c571ac57d ("net: ptp: introduce .supported_extts_flags to ptp_clock_info")
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Tested-by: James Clark <jjc@jclark.com>
Link: https://patch.msgid.link/20250918-jk-fix-bcm-phy-supported-flags-v1-2-747b60407c9c@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-22 11:36:30 -07:00
Jacob Keller
6e6c88d856 broadcom: fix support for PTP_PEROUT_DUTY_CYCLE
The bcm_ptp_perout_locked() function has support for handling
PTP_PEROUT_DUTY_CYCLE, but its not listed in the supported_perout_flags.
Attempts to use the duty cycle support will be rejected since commit
d9f3e9ecc4 ("net: ptp: introduce .supported_perout_flags to
ptp_clock_info"), as this flag accidentally missed while doing the
conversion.

Drop the unnecessary supported flags check from the bcm_ptp_perout_locked()
function and correctly set the supported_perout_flags. This fixes use of
the PTP_PEROUT_DUTY_CYCLE support for the broadcom driver.

Reported-by: James Clark <jjc@jclark.com>
Fixes: d9f3e9ecc4 ("net: ptp: introduce .supported_perout_flags to ptp_clock_info")
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Tested-by: James Clark <jjc@jclark.com>
Link: https://patch.msgid.link/20250918-jk-fix-bcm-phy-supported-flags-v1-1-747b60407c9c@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-22 11:36:30 -07:00
Linus Torvalds
cec1e6e5d1 sched_ext: Fixes for v6.17-rc7
This contains a fix for sched_ext idle CPU selection that likely fixes
 a substantial performance regression.
 
 The scx_bpf_select_cpu_dfl/and() kfuncs were incorrectly detecting all
 tasks as migration-disabled when called outside ops.select_cpu(), causing
 them to always return -EBUSY instead of finding idle CPUs. The fix properly
 distinguishes between genuinely migration-disabled tasks vs. the current
 task whose migration is temporarily disabled by BPF execution.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaNF8hQ4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGYhsAPwNeMGqniyewfciL6q+9Yjnxudn+bCzntvTidY/
 EbV3vgD9GPily3kjKhuPBGIq5hnyiV1DsmmCTIu8vaj7RB4uYw8=
 =k2RU
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-6.17-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext fix from jun Heo:
 "This contains a fix for sched_ext idle CPU selection that likely fixes
  a substantial performance regression.

  The scx_bpf_select_cpu_dfl/and() kfuncs were incorrectly detecting all
  tasks as migration-disabled when called outside ops.select_cpu(),
  causing them to always return -EBUSY instead of finding idle CPUs.

  The fix properly distinguishes between genuinely migration-disabled
  tasks vs. the current task whose migration is temporarily disabled by
  BPF execution"

* tag 'sched_ext-for-6.17-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  sched_ext: idle: Handle migration-disabled tasks in BPF code
2025-09-22 11:28:52 -07:00
Linus Torvalds
d4c7fccfa7 iommufd 6.17 second rc pull
Two user triggerable UAFs:
 
 - Possible race UAF setting up mmaps
 
 - Syzkaller found UAF when erroring an file descriptor creation ioctl due
   to the fput() work queue.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaNFXCgAKCRCFwuHvBreF
 YXoFAP9xzBDOVp64CJBY8cD/URaQc8t55b8uJCYgxbDesQa4iAEAxTX9gdZ7Lr6Z
 THwdY00LI040gBHUxIZOaXNeOhuPIg8=
 =DQIy
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

Pull iommufd fixes from Jason Gunthorpe:
 "Fix two user triggerable use-after-free issues:

   - Possible race UAF setting up mmaps

   - Syzkaller found UAF when erroring an file descriptor creation ioctl
     due to the fput() work queue"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommufd/selftest: Update the fail_nth limit
  iommufd: WARN if an object is aborted with an elevated refcount
  iommufd: Fix race during abort for file descriptors
  iommufd: Fix refcounting race during mmap
2025-09-22 11:16:14 -07:00
Linus Torvalds
b183f251e2 RDMA v6.17 second rc pull request
- Fix mlx5 devx event delivery to userspace for certain kinds of SRQs
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaNFT/AAKCRCFwuHvBreF
 YcafAP9bA38Qg5N2FZVUdKHRFx1diKVmh2Icp2zDqFmR/mhpSAD/enXPK3FLnQrx
 hwB/2b/xn5yWjOllWAokjwaFoZ49zgA=
 =dG5k
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fix from Jason Gunthorpe:
 "Just a one line change, was expecting more rc stuff, but it has been
  quiet.

   - Fix mlx5 devx event delivery to userspace for certain kinds of SRQs"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
2025-09-22 11:12:29 -07:00
Linus Torvalds
32d27cf535 hid-for-linus-2025092201
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEL65usyKPHcrRDEicpmLzj2vtYEkFAmjREAsACgkQpmLzj2vt
 YEk3cQ/9EJXVKCOlENyjAVd/Lu1tG8iRL181l4nlnkXkUKWG1//Qq+5g9qU1ycpy
 V21mYHzgriJ6fA1lH/UKgw2Ayq2QA2Rqe3TDCdzdwi8bRvPEvGxH+zmaickuZHpl
 Zi+LT17xW3SZtNRXKMDp5/Feb85quOQSuo+HXrql14jl3sF5nAF9BfOwvTb/UHel
 YzL3mAtwyDF90Ijhl/uLQaSeblHG3LOnCy3OPE7XyyOOXW3VQvXuEp5mA9Cac18J
 A0zcIYlR+wUj3yobjLe7xU27HKUe01a3WMGt3FfrStQK4HQFl1Rg6I66piBbqd4/
 oroP78A8tfVJf1ruGadcvj7IuRg9tSTHZVowRDx+5TeRywWFBBGIrmBfy3WiMmGA
 M/78ADQvcExOOY0kZBCXD3aJShpoS7gL0f35fKoC8yKhgyHC+GKOQwQz1kX2ub2Z
 oRdnb1GItQ4wDvLH8yyJahMYWhuVv/R7ITABAs8Nb68yMO0yS5aMVFeW2kzZ0eM2
 5yM0XtTzKWNSMi525+CEZDy53cNkrThhgC72UhSHmgnEtlcfgYZ0Gd9j6tSF2KEJ
 FVIUu0o4DV303IJmx5euLOrwY/vHgr3Qw4bH2qIxw32CocgPabYcn6IAd5aynCrB
 MmRqpMu/SOAPStBFYNSUk/CJvLlGImUAGe5m99daGTZxWjHRZ30=
 =Jiyj
 -----END PGP SIGNATURE-----

Merge tag 'hid-for-linus-2025092201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID fixes from Jiri Kosina:

 - work data memory corruption fix in amd_sfh (Basavaraj Natikar)

 - fix for regression in cp2112 where setting a GPIO value would always
   fail (Sébastien Szymanski)

 - fix for regression in hid-lenovo causing driver to fail on non-ACPI
   systems (Janne Grunau)

 - a couple device ID additions and tiny device-specific quirks

* tag 'hid-for-linus-2025092201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: amd_sfh: Add sync across amd sfh work functions
  HID: asus: add support for missing PX series fn keys
  HID: cp2112: fix setter callbacks return value
  HID: lenovo: Use KEY_PERFORMANCE instead of ACPI's platform_profile
  HID: intel-thc-hid: intel-quickspi: Add WCL Device IDs
  HID: intel-thc-hid: intel-quicki2c: Add WCL Device IDs
2025-09-22 11:01:37 -07:00
Linus Torvalds
33468b56f4 Pin control fixes for v6.17:
These are two small driver fixes for the Airhoa driver.
 
 - Correct a PHY LED mux value so the PHY LED will
   blink as it should.
 
 - Fix the MDIO function bitmasks, working around a
   HW bug to force-enable the MDIO pins.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmjRBrkACgkQQRCzN7AZ
 XXOK9Q//WYo/Jm6KETEwWAlEEKOTr3h+FnUox6giOOItXbJhJ1iqLzTLIhMsJHK5
 2uEEFxtHAuNu01cNPYUkIfgqCpYEyA1xK7/gtRV+IWeFt4IiVDCMtyCCiUMzKV4k
 OgeMO7Scqvm61qrvOu/+WF1kc+lsGZ3dJPoBLq1C6Dn67Y0SNegICCJh6YPPis4J
 lEpx4PqZiqDYOMuy/r9tuAKFqOlP4Q9BhsXzLH+hC1V2kd7/7/hqWx3i+WFADDNP
 1Q+GQYqqqR1yLhZq+tsJ2TcdAP04cx9mWuxeclIQrqQPxyeoFz4ua2K8s1TFUDu6
 f3Gw7UAtCLJjx3O1G/Ji0MccrpUBr8IWdJloKHsiREuogzk4zdRT/6czBEZywM/G
 HJ0EHrWNZa7RExxmfGG05/21YBHAAavfxF4klboxpfTcECXbCuJqJPq8IUe7EKwx
 rXdkWTFxJhEMX3VL2BlTccIXZ4BjX9IokuLT3FYIaww4AXAOMhz8Jx2G8PnlfOeg
 xVGDyVbmUzaO4SKcFfR7VvCXIxlk9F4keouG9cmxrNFbjgSSt24sab5QLdNujzdT
 gTaFswHZ6P2rtqctcCbQN2XeK9qvPBOWvZv6ea9rxvMvsO5+7wC5Us/z4VFCmPvB
 NFqNL+lNZ6HJgrlAtqkQPiqYRNdePUud7OsomPxIO5QnM2TEIkc=
 =nbM0
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:
 "Two small driver fixes for the Airhoa driver:

   - Correct a PHY LED mux value so the PHY LED will blink as it should

   - Fix the MDIO function bitmasks, working around a HW bug to
     force-enable the MDIO pins"

* tag 'pinctrl-v6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: airoha: fix wrong MDIO function bitmaks
  pinctrl: airoha: fix wrong PHY LED mux value for LED1 GPIO46
2025-09-22 10:52:34 -07:00
Andrea Righi
55ed11b181 sched_ext: idle: Handle migration-disabled tasks in BPF code
When scx_bpf_select_cpu_dfl()/and() kfuncs are invoked outside of
ops.select_cpu() we can't rely on @p->migration_disabled to determine if
migration is disabled for the task @p.

In fact, migration is always disabled for the current task while running
BPF code: __bpf_prog_enter() disables migration and __bpf_prog_exit()
re-enables it.

To handle this, when @p->migration_disabled == 1, check whether @p is
the current task. If so, migration was not disabled before entering the
callback, otherwise migration was disabled.

This ensures correct idle CPU selection in all cases. The behavior of
ops.select_cpu() remains unchanged, because this callback is never
invoked for the current task and migration-disabled tasks are always
excluded.

Example: without this change scx_bpf_select_cpu_and() called from
ops.enqueue() always returns -EBUSY; with this change applied, it
correctly returns idle CPUs.

Fixes: 06efc9fe0b ("sched_ext: idle: Handle migration-disabled tasks in idle selection")
Cc: stable@vger.kernel.org # v6.16+
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Acked-by: Changwoo Min <changwoo@igalia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-09-22 06:24:44 -10:00
Luiz Augusto von Dentz
302a1f674c Bluetooth: MGMT: Fix possible UAFs
This attemps to fix possible UAFs caused by struct mgmt_pending being
freed while still being processed like in the following trace, in order
to fix mgmt_pending_valid is introduce and use to check if the
mgmt_pending hasn't been removed from the pending list, on the complete
callbacks it is used to check and in addtion remove the cmd from the list
while holding mgmt_pending_lock to avoid TOCTOU problems since if the cmd
is left on the list it can still be accessed and freed.

BUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223
Read of size 8 at addr ffff8880709d4dc0 by task kworker/u11:0/55

CPU: 0 UID: 0 PID: 55 Comm: kworker/u11:0 Not tainted 6.16.4 #2 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xca/0x240 mm/kasan/report.c:482
 kasan_report+0x118/0x150 mm/kasan/report.c:595
 mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223
 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
 kthread+0x711/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 12210:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c:269
 mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296
 __add_adv_patterns_monitor+0x130/0x200 net/bluetooth/mgmt.c:5247
 add_adv_patterns_monitor+0x214/0x360 net/bluetooth/mgmt.c:5364
 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719
 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg+0x219/0x270 net/socket.c:729
 sock_write_iter+0x258/0x330 net/socket.c:1133
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x5c9/0xb30 fs/read_write.c:686
 ksys_write+0x145/0x250 fs/read_write.c:738
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 12221:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2381 [inline]
 slab_free mm/slub.c:4648 [inline]
 kfree+0x18e/0x440 mm/slub.c:4847
 mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline]
 mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257
 __mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444
 hci_dev_close_sync+0x754/0x1330 net/bluetooth/hci_sync.c:5290
 hci_dev_do_close net/bluetooth/hci_core.c:501 [inline]
 hci_dev_close+0x108/0x200 net/bluetooth/hci_core.c:526
 sock_do_ioctl+0xd9/0x300 net/socket.c:1192
 sock_ioctl+0x576/0x790 net/socket.c:1313
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: cf75ad8b41 ("Bluetooth: hci_sync: Convert MGMT_SET_POWERED")
Fixes: 2bd1b23761 ("Bluetooth: hci_sync: Convert MGMT_OP_SET_DISCOVERABLE to use cmd_sync")
Fixes: f056a65783 ("Bluetooth: hci_sync: Convert MGMT_OP_SET_CONNECTABLE to use cmd_sync")
Fixes: 3244845c63 ("Bluetooth: hci_sync: Convert MGMT_OP_SSP")
Fixes: d81a494c43 ("Bluetooth: hci_sync: Convert MGMT_OP_SET_LE")
Fixes: b338d91703 ("Bluetooth: Implement support for Mesh")
Fixes: 6f6ff38a1e ("Bluetooth: hci_sync: Convert MGMT_OP_SET_LOCAL_NAME")
Fixes: 71efbb08b5 ("Bluetooth: hci_sync: Convert MGMT_OP_SET_PHY_CONFIGURATION")
Fixes: b747a83690 ("Bluetooth: hci_sync: Refactor add Adv Monitor")
Fixes: abfeea476c ("Bluetooth: hci_sync: Convert MGMT_OP_START_DISCOVERY")
Fixes: 26ac4c56f0 ("Bluetooth: hci_sync: Convert MGMT_OP_SET_ADVERTISING")
Reported-by: cen zhang <zzzccc427@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-09-22 10:30:00 -04:00