)]}' { "log": [ { "commit": "014d795c73837ea2339a4ea8e8f82c6e959b845d", "tree": "f021c691fd100c2dc4bcaf1760bb4a5ccc8179f2", "parents": [ "a72690652227ef7a5031268568f178bd3eee5585" ], "author": { "name": "Ayush Yaduvanshi", "email": "ayush37735@gmail.com", "time": "Fri Sep 25 05:32:44 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 18:26:50 2026 -0700" }, "message": "idpf: fix kernel-doc parameter descriptions\n\nRemove stale @vport parameter descriptions from\n\nidpf_rx_desc_rel_all() and idpf_vport_queue_grp_rel_all().\n\nSigned-off-by: Ayush Yaduvanshi \u003cayush37735@gmail.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nLink: https://patch.msgid.link/20260925000244.72480-1-ayush37735@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a72690652227ef7a5031268568f178bd3eee5585", "tree": "45e45e846266b0631e7b7fd4612ec21663006e0d", "parents": [ "4a0f98a164f7d049f337a1a17579f402707a460e" ], "author": { "name": "Ayush Yaduvanshi", "email": "ayush37735@gmail.com", "time": "Fri Sep 25 04:51:38 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 18:26:36 2026 -0700" }, "message": "ice: dpll: fix kernel-doc parameter descriptions\n\nRemove stale @count and @cgu parameter descriptions from\nice_dpll_init_fwnode_pins() and ice_dpll_init_pins_e825().\n\nSigned-off-by: Ayush Yaduvanshi \u003cayush37735@gmail.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nLink: https://patch.msgid.link/20260924232138.69492-1-ayush37735@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4a0f98a164f7d049f337a1a17579f402707a460e", "tree": "1bae0c4a358cc09f73cb2794ae89a34650637ba0", "parents": [ "83cfac9d70cbc502c763f6ef259fb18f9d27081f", "863da457b407f84beb8d60f8d13384e2b13e2b13" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 18:14:52 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 18:14:53 2026 -0700" }, "message": "Merge branch \u0027dpll-fix-llm-nit-picks-from-the-spec-scan\u0027\n\nJakub Kicinski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ndpll: fix LLM nit picks from the spec scan\n\nFix issues found by an LLM scan of the Netlink spec for DPLL.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260924231211.568213-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "863da457b407f84beb8d60f8d13384e2b13e2b13", "tree": "1bae0c4a358cc09f73cb2794ae89a34650637ba0", "parents": [ "398f802dba0108e37c4070096a7a223f11d0babb" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 16:12:11 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 18:14:50 2026 -0700" }, "message": "netlink: specs: dpll: drop the reference to DPLL_MODE_DETACHED\n\nThe lock-status doc tells userspace that DPLL_LOCK_STATUS_UNLOCKED\ncan be forced by setting DPLL_A_MODE to DPLL_MODE_DETACHED.\nBut no such value has been defined so far. enum dpll_mode has only\nMANUAL and AUTOMATIC. Let\u0027s make sure the doc reflects current\nreality.\n\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nLink: https://patch.msgid.link/20260924231211.568213-4-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "398f802dba0108e37c4070096a7a223f11d0babb", "tree": "70b27d29f9714006498746de992776803d3691b0", "parents": [ "7f92b7f381ffa83800bba6d535ac36a764f3abeb" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 16:12:10 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 18:14:50 2026 -0700" }, "message": "netlink: specs: dpll: declare pad in the nests which carry 64-bit values\n\nPads need to be propagated to subsets if they are used.\nOtherwise Python YNL can fail with:\n\n YnlException: Space \u0027frequency-range\u0027 has no attribute with value \u00274\u0027\n\nThis affects only platforms which care about alignment\nso not much real impact.\n\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nLink: https://patch.msgid.link/20260924231211.568213-3-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7f92b7f381ffa83800bba6d535ac36a764f3abeb", "tree": "e3a3a5977b8b6067d93f36334123a0114dd8a272", "parents": [ "83cfac9d70cbc502c763f6ef259fb18f9d27081f" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 16:12:09 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 18:14:50 2026 -0700" }, "message": "dpll: do not truncate the requested pin frequency before checking it\n\nDPLL_A_PIN_FREQUENCY is a u64 on the wire and dpll_pin_freq_set() keeps it\nas one, but dpll_pin_is_freq_supported() takes a u32 while the ranges it\ncompares against are u64. The supported-frequency check therefore only\nlooks at the low 32 bits, and the full value is what reaches the driver.\n\nNothing is hitting this today. Reaching it at all needs a pin-set above\nU32_MAX, which no sane caller sends, and the outcome is mild: a pin\nadvertising 10 kHz accepts 0x1_0000_2710, ice narrows it straight back to\n10 kHz in ice_dpll_pin_freq_set(), so the hardware still ends up on an\nadvertised frequency and only the \"frequency is not supported by the\ndevice\" rejection goes missing. The other direction - a legitimate request\nabove U32_MAX wrapping out of the pin\u0027s range - needs a driver advertising\nsuch a range, and none does; zl3073x_pin_check_freq() refuses one outright.\n\nSo this is types rather than a live bug. Widen the check to match the\nattribute, the ranges and the driver callback instead of adding a U32_MAX\nrejection, so that the second case stays right if such a driver appears.\ndpll_pin_esync_set() already keeps u64 throughout its equivalent loop.\n\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nLink: https://patch.msgid.link/20260924231211.568213-2-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "83cfac9d70cbc502c763f6ef259fb18f9d27081f", "tree": "e7537a90d02e1a61e110e2980f3f759ce7913176", "parents": [ "3c21842f999a27962b34d685b7153d936c21a339" ], "author": { "name": "Rouven Czerwinski", "email": "rouven.czerwinski@linaro.org", "time": "Thu Sep 24 12:48:18 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 18:12:38 2026 -0700" }, "message": "net: phy: mxl-gpy: add 2.5G for MXL86211C\n\nThe MXL86211C also supports 2.5G via 2500BASEX, switch the config init\nto indicate support for that mode. Datasheet checks indicate that the\n2.5G speed indication is the same between GPY211 \u0026 MXL86211C.\n\nThe same should be true for MXL86252 \u0026 MXL86282, those are not modified\nfor a lack of testing hardware.\n\nWith this change 2.5G negotiates correctly with a Mikrotik\nCRS310-8G+2S+IN.\n\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Rouven Czerwinski \u003crouven.czerwinski@linaro.org\u003e\nLink: https://patch.msgid.link/20260924-mainline-rouven-mxl2g5-v2-1-fc8367a4c3ad@linaro.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3c21842f999a27962b34d685b7153d936c21a339", "tree": "70f39ffb3bd24329be724622d15da943ea18ad7a", "parents": [ "5ccac2330debbd96bf6b886cae93bbb8207e4735" ], "author": { "name": "Subbaraya Sundeep", "email": "sbhatta@marvell.com", "time": "Wed Sep 23 09:05:00 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 18:11:06 2026 -0700" }, "message": "octeontx2-af: nix: Log TX scheduler queue validation failures\n\nEmit logs when is_valid_txschq() rejects a scheduler queue\nmapping so misconfigured TX scheduler allocations are easier to\ndiagnose.\n\nSigned-off-by: Subbaraya Sundeep \u003csbhatta@marvell.com\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260923033500.1752732-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5ccac2330debbd96bf6b886cae93bbb8207e4735", "tree": "dadd6fea002a7ad688015b4489201babf49e9176", "parents": [ "ab61766635328afe458ef61fa953a72bd765e559" ], "author": { "name": "Sunny Tiwari", "email": "sunnytiwari@google.com", "time": "Thu Sep 24 06:26:11 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 18:09:46 2026 -0700" }, "message": "net/rds: replace tasklets with workqueue\n\nConvert the deprecated send and receive completion tasklets in\nnet/rds/ib to BH work items queued on system_bh_wq.\n\nIn rds_ib_conn_path_shutdown(), replace tasklet_kill() with\ndisable_work_sync(), and call enable_work() after destroying the CQs so\nthe work items can be used again when the connection reconnects.\n\nSigned-off-by: Sunny Tiwari \u003csunnytiwari@google.com\u003e\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20cbfc32678019daadd3c67fd75262b8264aa180.1790178801.git.sunnytiwari@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ab61766635328afe458ef61fa953a72bd765e559", "tree": "56b6f0f4b14f48c3f24f249f3b72daacb3767702", "parents": [ "179a6d5b2265964b1353838256b4839471bd6fa9", "7ca3702d40d9ba2de7876abc03b116ca0e9f5264" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:45:35 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:45:35 2026 -0700" }, "message": "Merge branch \u0027net-macb-rework-hardware-timestamp-configuration\u0027\n\nKim Wooseok via says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: macb: Rework hardware timestamp configuration\n\nThis started with two problems I found while using PTP hardware\ntimestamping on a Raspberry Pi 5. A rejected RX filter could still\nchange the TX one-step setting, and the PTPv1 Sync and Delay_Req filters\nreturned success without enabling RX timestamps.\n\nThis series reworks gem_set_hwtst() to validate the whole request before\nprogramming the hardware. It calculates the settings locally, then\nupdates the registers and saved configuration under bp-\u003elock. With the\nregister writes now in the setter, the two helpers are no longer needed.\n\nThe remaining patches use the existing ALL fallback for the specific\nPTPv1 filters and clear SRTSM when switching away from a PTPv2 filter.\nEach change is kept in its own patch.\n\nFor v1, I compared the old and new behavior on the Pi 5. When I\nrequested a TX mode change together with an invalid RX filter, the\npatched driver rejected the request without changing the saved settings\nor NCR. I also checked transitions between PTPv2 RX and the other\nreceive filters. SRTSM followed the selected RX filter without changing\nunrelated NCR bits.\n\nFor the PTPv1 filters, I checked the effect by sending Sync and Delay_Req\npackets over Ethernet. Before the change, the packets arrived without\nhardware timestamps. With the patches, the driver returned ALL and I\ncould read the hardware timestamps from the received packets. PTPv2\nmulticast reception continued to provide hardware timestamps, and\nselecting NONE disabled timestamping. I ran these tests with the changes\nbackported to the Pi\u0027s existing Linux 6.18.46 RT kernel.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260923-macb-hwtstamp-rework-v2-0-75c909b2676d@khu.ac.kr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7ca3702d40d9ba2de7876abc03b116ca0e9f5264", "tree": "56b6f0f4b14f48c3f24f249f3b72daacb3767702", "parents": [ "059a5a238c22c11e29e55fe6908e4b73cb763ad5" ], "author": { "name": "Kim Wooseok", "email": "5mghybrid@khu.ac.kr", "time": "Wed Sep 23 18:13:27 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:45:35 2026 -0700" }, "message": "net: macb: Clear SRTSM outside PTPv2 receive filters\n\nA PTPv2 receive filter sets NCR.SRTSM, but switching to NONE, ALL or a\nPTPv1 filter leaves it set. As a result, selecting the same filter can\nproduce a different register setting depending on whether PTPv2 was\nused before.\n\nUpdate SRTSM whenever the RX filter changes, setting it only for PTPv2.\nSwitching away from PTPv2 then clears the old setting, so the bit follows\nthe currently selected filter.\n\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Théo Lebrun \u003ctheo.lebrun@bootlin.com\u003e\nTested-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nSigned-off-by: Kim Wooseok \u003c5mghybrid@khu.ac.kr\u003e\nLink: https://patch.msgid.link/20260923-macb-hwtstamp-rework-v2-3-75c909b2676d@khu.ac.kr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "059a5a238c22c11e29e55fe6908e4b73cb763ad5", "tree": "23e1d447efb03955afbf6ac84141c1f0aea2ec7e", "parents": [ "381cb968fa89bccbb20c324f0793eeced9fdbad4" ], "author": { "name": "Kim Wooseok", "email": "5mghybrid@khu.ac.kr", "time": "Wed Sep 23 18:13:26 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:45:32 2026 -0700" }, "message": "net: macb: Enable RX timestamping for specific PTPv1 filters\n\nSelecting a PTPv1 Sync or Delay_Req filter in gem_set_hwtst() returns\nsuccess, but leaves rx_bd_control at its initial value of\nTSTAMP_DISABLED. The requested filter therefore appears to have been\napplied, even though received packets have no hardware timestamps.\n\nThe PTPv1 event case already enables timestamping for all frames, so\nuse that path for Sync and Delay_Req as well. This enables timestamping\nfor both requests and returns HWTSTAMP_FILTER_ALL to tell the caller\nwhich filter was actually applied.\n\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Théo Lebrun \u003ctheo.lebrun@bootlin.com\u003e\nTested-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nSigned-off-by: Kim Wooseok \u003c5mghybrid@khu.ac.kr\u003e\nLink: https://patch.msgid.link/20260923-macb-hwtstamp-rework-v2-2-75c909b2676d@khu.ac.kr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "381cb968fa89bccbb20c324f0793eeced9fdbad4", "tree": "b09f160a006a0290612b960fa9ee9139fea157d0", "parents": [ "179a6d5b2265964b1353838256b4839471bd6fa9" ], "author": { "name": "Kim Wooseok", "email": "5mghybrid@khu.ac.kr", "time": "Wed Sep 23 18:13:25 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:45:29 2026 -0700" }, "message": "net: macb: Preserve timestamp settings on rejected requests\n\ngem_set_hwtst() can reject a request after changing the TX one-step\nsetting, because it programs the TX mode before checking the RX\nfilter. The call returns -ERANGE, but the hardware may no longer match\nthe cached configuration.\n\nValidate both settings first and keep the adjusted RX filter local\nuntil validation succeeds. Then apply the register settings and update\nthe configuration. A rejected request now leaves the hardware, the\ncaller\u0027s settings and the cached configuration unchanged.\n\nProtect the NCR read-modify-write with bp-\u003elock, keeping the descriptor\nwrites and cache update in the same section. With the register writes\nnow in the setter, remove gem_ptp_set_one_step_sync() and\ngem_ptp_set_ts_mode().\n\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Théo Lebrun \u003ctheo.lebrun@bootlin.com\u003e\nTested-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nSigned-off-by: Kim Wooseok \u003c5mghybrid@khu.ac.kr\u003e\nLink: https://patch.msgid.link/20260923-macb-hwtstamp-rework-v2-1-75c909b2676d@khu.ac.kr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "179a6d5b2265964b1353838256b4839471bd6fa9", "tree": "15abd10dfde5a08b204ca177fcd1bb3821663955", "parents": [ "a0dfaa3ecdce8119514806ead63f2eedc778421a", "7bfc50171800304c6e68968ff252889cde791f26" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:38:22 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:38:22 2026 -0700" }, "message": "Merge branch \u0027ch9200-stop-ignoring-the-register-write-errors\u0027\n\nSergey Shtylyov says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nch9200: stop ignoring the register write errors\n\nThe successful register writes, done via the USB control requests, seem\nvital for the normal functioning of the device, however the driver tends\nto completely ignore the register write errors, even though it could well\npropagate the errors from its bind() method. Additionally, it masks any\nUSB errors returned by usb_control_msg(), pretending that the call was\nsuccessful. Let\u0027s stop doing all that and see how it goes... :-)\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260923201440.36966-1-s.shtylyov@auroraos.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7bfc50171800304c6e68968ff252889cde791f26", "tree": "15abd10dfde5a08b204ca177fcd1bb3821663955", "parents": [ "52c895f638fedaa91cce71224a7810ce889517f0" ], "author": { "name": "Sergey Shtylyov", "email": "s.shtylyov@auroraos.dev", "time": "Wed Sep 23 23:14:39 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:38:19 2026 -0700" }, "message": "ch9200: do return USB errors from control_write()\n\nCompared with control_read(), control_write() looks really strange:\nit ignores any errors returned by usb_control_msg(), always returning\n0 instead, despite overriding a positive result of usb_control_msg()\n(indicating short transfer) to -EINVAL before doing that. Drop that\ndubious *return* and propagate USB errors to the callers...\n\nSigned-off-by: Sergey Shtylyov \u003cs.shtylyov@auroraos.dev\u003e\nLink: https://patch.msgid.link/20260923201440.36966-3-s.shtylyov@auroraos.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "52c895f638fedaa91cce71224a7810ce889517f0", "tree": "e6f1fa9ed378b51bb659ffb4aa5b22e38fc59009", "parents": [ "a0dfaa3ecdce8119514806ead63f2eedc778421a" ], "author": { "name": "Sergey Shtylyov", "email": "s.shtylyov@auroraos.dev", "time": "Wed Sep 23 23:14:38 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:38:15 2026 -0700" }, "message": "ch9200: return error on failed register writes in ch9200_bind()\n\nThe successful register writes, done via the USB control requests in\ncontrol_write(), seem vital for the normal functioning of the device,\nhowever the driver\u0027s bind() method ignores error codes returned from\ncontrol_write(). Do bail out of ch9200_bind() on failed writes...\n\nSigned-off-by: Sergey Shtylyov \u003cs.shtylyov@auroraos.dev\u003e\nLink: https://patch.msgid.link/20260923201440.36966-2-s.shtylyov@auroraos.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a0dfaa3ecdce8119514806ead63f2eedc778421a", "tree": "cf44d28990ea7936c43deec8106296f3e627c5b7", "parents": [ "0fd5dfa99cfc7555fe7eb034136e0bad12c5e2c1" ], "author": { "name": "Patryk Biel", "email": "pbiel7@gmail.com", "time": "Wed Sep 23 18:14:12 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:35:07 2026 -0700" }, "message": "net: pcs: lynx: enable autonegotiation for 10g-qxgmii and usxgmii\n\nThe Lynx PCS setup for 10g-qxgmii and usxgmii programs the\nUSXGMII replicator advertisement, but does not explicitly enable and\nrestart in-band autonegotiation or program the replicator link timers.\n\nThis leaves the PCS dependent on firmware or bootloader state. Systems\nwhich do not get the USXGMII replicator preconfigured before Linux may\ntherefore fail to negotiate the link correctly.\n\nAfter programming the USXGMII device ability, configure the replicator\nBMCR with reset, autonegotiation enable and autonegotiation restart. Also\nprogram the replicator link timer registers using the value returned by\nphylink_get_link_timer_ns().\n\nCo-developed-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Patryk Biel \u003cpbiel7@gmail.com\u003e\nReviewed-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nLink: https://patch.msgid.link/20260923-b4-fix-pcs-lynx-an-v4-1-3f7927606d12@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0fd5dfa99cfc7555fe7eb034136e0bad12c5e2c1", "tree": "27cecf0611e2e2b40156cfb41561d0c6845f0614", "parents": [ "e0edf25f141a7acc03748902bcb43974bd885353" ], "author": { "name": "Marek Behún", "email": "kabel@kernel.org", "time": "Thu Sep 24 13:50:55 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:22:41 2026 -0700" }, "message": "net: sfp: ignore LOS also on Hisense GPON modules\n\nSimilar to commit 87d126852158467a (\"net: sfp: improve Huawei MA5671a\nfixup\"), in order to be able to communicate with the module for\nconfiguration even if the fiber is not connected, apply also the\nsfp_fixup_ignore_los() fixup to the following SFP modules:\n\n Hisense-Leox LXT-010S-H\n Hisense ZNID-GPON-2311NA\n HSGQ HSGQ-XPON-Stick\n\nNote: tested only on the Hisense-Leox LXT-010S-H module, but applying to\nall three modules, since they were all added in the same\ncommit 95aca8602ef70ffd (\"net: sfp: add quirks for Hisense and HSGQ GPON\nONT SFP modules\"), which says they are all based on the same chipset\nRealtek RTL960x.\n\nSigned-off-by: Marek Behún \u003ckabel@kernel.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260924115055.196631-1-kabel@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e0edf25f141a7acc03748902bcb43974bd885353", "tree": "ca56b1f598e1edc67178c3e12e5ccf5f7c902011", "parents": [ "4a2e500fcd62d5cec48082b93238f0e33faef9fb" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Thu Sep 24 08:18:41 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:21:02 2026 -0700" }, "message": "net/sched: cls_flower: exact-match ERSPAN key when no mask supplied\n\nCommit 292207809486 (\"net: sched: fix erspan_opt settings in cls_flower\")\nremoved the unconditional memset of the erspan_metadata mask in\nfl_set_erspan_opt(). On the mask-parse pass, when userspace supplies the\nencap option key but no mask (TCA_FLOWER_KEY_ENC_OPTS without\nTCA_FLOWER_KEY_ENC_OPTS_MASK), the !depth early return leaves the mask\nzeroed -- a wildcard. A filter keyed on an ERSPAN index (v1), or dir/hwid\n(v2), then matches every ERSPAN packet\u0027s values instead of exact-matching.\n\nDefault the match fields on the no-mask path the same way the with-mask\nbranches default them: v1 index to 0xff, v2 dir and hwid to their\nexact-match masks. The union cannot just be memset to 0xff -- that would\nre-mask the overlapping timestamp/sgt bytes of the v2 header that the\ncommit deliberately left to 0.\n\nA mask and a key that declare different ERSPAN versions describe different\nunion layouts, so the mask would silently wildcard the key\u0027s matched\nfields. Reject that combination. Have fl_set_erspan_opt() report the\nparsed key\u0027s version back through a u8 pointer so the mask pass uses it\nwithout re-reading the union.\n\nThis is a follow-up to commit fee10655709c (\"net/sched: cls_flower:\nvalidate mask pointer after nla_next()\").\n\nConditions to recreate the bug: add an ERSPAN encap-opts flower filter\nwith a key but no mask (raw netlink, TCA_FLOWER_KEY_ENC_OPTS present,\nTCA_FLOWER_KEY_ENC_OPTS_MASK absent); dump the filter and observe the\nmatch mask is zero (wildcard) instead of exact for the supplied fields.\nFor the mismatch case, pair a v1 key with a v2 mask (or vice versa) and\nobserve the request is accepted with a mask of the other version.\n\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826025123.62758-1-ljp1205831794@gmail.com\nLink: https://lore.kernel.org/netdev/20260826025123.62758-1-ljp1205831794@gmail.com/\nReported-by: Sashiko (nipa) \u003csashiko-bot@kernel.org\u003e\nLink: https://lore.kernel.org/netdev/179003833955.2160803.1077681716391858800@kernel.org/\nSuggested-by: Xin Long \u003clucien.xin@gmail.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/QDISC-4CSL.v2.20260924114800@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4a2e500fcd62d5cec48082b93238f0e33faef9fb", "tree": "227daba8d58c9aba6987fbe2a005af996d00e7ec", "parents": [ "23d937de306d428ee2a459b250ae891c8795fb00", "4b8fbb875a5411ff81a937245af8d4361b8a7ce4" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:15:25 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:15:26 2026 -0700" }, "message": "Merge branch \u0027net-dsa-motorcomm-add-serdes-pcs\u0027\n\nDavid Yang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: dsa: motorcomm: Add SerDes PCS\n\nRework chip_info to tell SERDES ports from xMII ones, identify the port type\nat runtime from the pad configuration, and add a phylink PCS driver for the\ninternal SerDes, so that the link of SERDES ports can be established through\nin-band negotiation instead of a fixed configuration.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260923021945.2203368-1-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4b8fbb875a5411ff81a937245af8d4361b8a7ce4", "tree": "227daba8d58c9aba6987fbe2a005af996d00e7ec", "parents": [ "b9eca1c2be7fe50f677d69fd8239859c13b50996" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Wed Sep 23 10:19:40 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:15:24 2026 -0700" }, "message": "net: dsa: motorcomm: Add SerDes PCS\n\nSupport in-band negotiation of the SerDes ports.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260923021945.2203368-9-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b9eca1c2be7fe50f677d69fd8239859c13b50996", "tree": "09cb5b32c1356f6e0b1ade8ed0682c4ee1f04ee5", "parents": [ "c9996cf718ec3f880ccb32cda0510cb0d822219a" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Wed Sep 23 10:19:39 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:15:23 2026 -0700" }, "message": "net: dsa: motorcomm: Split MDIO bus module\n\nSplit it in order to be used in other modules.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260923021945.2203368-8-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c9996cf718ec3f880ccb32cda0510cb0d822219a", "tree": "33fb038258f2f2e87e6cb534371dc853f68caea3", "parents": [ "5423f892f1294a61a6406a625338f4698c352d26" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Wed Sep 23 10:19:38 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:15:23 2026 -0700" }, "message": "net: dsa: motorcomm: Hoist port_to_priv helper into chip.h\n\nyt921x_poll_mib() open-codes the same container_of_const() expression\nthat leds.c defines as to_yt921x_priv(). Move the macro to chip.h as\nyt921x_port_to_priv() so both files use one definition.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260923021945.2203368-7-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5423f892f1294a61a6406a625338f4698c352d26", "tree": "45b959c1f235e5021c570f1b1d3330b2f646e0a7", "parents": [ "be5cdff08903f64eb95b386db17258f5c9251601" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Wed Sep 23 10:19:37 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:15:23 2026 -0700" }, "message": "net: dsa: motorcomm: Introduce yt921x_speed\n\nFIELD_PREP values cannot be used as case labels. Introduce enum for\nfuture use.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260923021945.2203368-6-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "be5cdff08903f64eb95b386db17258f5c9251601", "tree": "ca3e678a119f78c8d3a412092d56901d6698872b", "parents": [ "07b60e1bf4a1e41b4def32882f9ad6fa002682fb" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Wed Sep 23 10:19:36 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:15:23 2026 -0700" }, "message": "net: dsa: motorcomm: Fix register bit field names\n\nReview and fix the incorrectness in the bit field names. No functional\nchange.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260923021945.2203368-5-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "07b60e1bf4a1e41b4def32882f9ad6fa002682fb", "tree": "8af6cacb9ef1698d9190270b3e20f37423ad0d3f", "parents": [ "605597aff80348308e8145817b840a4bc50db85f" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Wed Sep 23 10:19:35 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:15:23 2026 -0700" }, "message": "net: dsa: motorcomm: Identify port type at runtime\n\nThe yt921x_port_is_internal/external() macros hardcoded the port layout:\nthey treat ports 8 and 9 as external on every chip and count the dummy\nports as internal.\n\nIdentify the actual port capabilities using chip info and track\nconfiguration of external ports (although only SerDes is supported now).\nThis is a hardening and cleanup step ahead of the SerDes PCS support, no\nbehavior changes intended.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260923021945.2203368-4-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "605597aff80348308e8145817b840a4bc50db85f", "tree": "cb5fa4e154413a3ee0c82ab5f89ea3a0b6483b84", "parents": [ "b6d2762919bc803542e4ce4bfb42d0205475b9d5" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Wed Sep 23 10:19:34 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:15:23 2026 -0700" }, "message": "net: dsa: motorcomm: Split xMII and SERDES port masks\n\nReplace external_mask with xmii_mask and serdes_mask, and advertise the\ninterface modes it actually supports.\n\nAlso move struct yt921x_info into chip.h for future use.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260923021945.2203368-3-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b6d2762919bc803542e4ce4bfb42d0205475b9d5", "tree": "b1c0e10c289c81af56ab9f6928f5dfb95c391a42", "parents": [ "23d937de306d428ee2a459b250ae891c8795fb00" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Wed Sep 23 10:19:33 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 17:15:22 2026 -0700" }, "message": "net: dsa: motorcomm: Remove YT921X_PORT_MASK_* macros\n\nRemove YT921X_PORT_MASK_* macros since they are only thin wrappers\naround BIT() and GENMASK() and are not used in other places (plain BIT()\nand GENMASK() are used there). No functional change.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260923021945.2203368-2-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "23d937de306d428ee2a459b250ae891c8795fb00", "tree": "3716edcdae643eaaa3030ec0a22e962d46dedfba", "parents": [ "a529f9258da5cbfe6d313651ceabda23892e5027", "f342b1208f8df6c6b4c45d0702e6f150357d0143" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:56:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:58:26 2026 -0700" }, "message": "Merge branch \u0027net-macb-1000base-x-on-internal-pcs\u0027\n\nNathan Whitehorn says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: macb: 1000BASE-X on internal PCS\n\nThis series adds support for 1000BASE-X autonegotiation to the Cadence macb\ndriver when using the MAC-internal PCS. The existing driver code is oriented\ntoward the PCS being used with an on-board SGMII PHY, so uses Cisco\nSGMII-style autonegotiation exclusively and does not anticipate e.g. link\nstate changes arising from fiber attach/detach events since the SGMII endpoint\nis permanently attached in such cases. The first patch changes the driver\nto monitor the PCS\u0027s link by polling, following the approach used currently\nby this driver for fixed links when the PCS is enabled since the driver\ndoes not currently monitor PCS link state otherwise and this had not come up\nwith permanently-attached SGMII PHYs that report link state out of band.\nThe second extends the existing SGMII autonegotiation code to also support\n1000BASE-X autonegotiation.\n\nTested on Microchip PolarFire SoC with a variety of SFPs (copper, fiber, GPON)\nattached to the I/O Bank-5 PCS lines.\n\nThanks to Charles Perry, Andrew Lunn, Paolo Abeni, Théo Lebrun, and\nJakub Kicinski for helpful suggestions and discussion on this patch series.\nAs a brief summary of that discussion, there are a few areas near this patch\nthat are existing non-idealities in the macb driver, in particular that it uses\npolling to monitor link-state with the internal PCS and the driver does not\ncurrently have support for using the link-state change interrupt. The\nintention is to address this in a later patch that would remove polling from\nboth this case and the fixed-link one. Other discussion in earlier rounds\nof the patches was related to handling some ZynqMP-specific code that is\nrelated to specific SGMII-only hardware that is not relevant in the 1000BASE-X\ncase.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260922151429.23272-1-nwhitehorn@pa.msu.edu\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f342b1208f8df6c6b4c45d0702e6f150357d0143", "tree": "3716edcdae643eaaa3030ec0a22e962d46dedfba", "parents": [ "456a389f594a1a46a2913cf082579a9ceec481eb" ], "author": { "name": "Nathan Whitehorn", "email": "nwhitehorn@pa.msu.edu", "time": "Tue Sep 22 11:09:25 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:58:18 2026 -0700" }, "message": "net: macb: add support for 1000BASE-X autonegotiation to PCS\n\nThe current PCS code unconditionally uses SGMII autonegotiation, though\nthe hardware supports both SGMII and 1000BASE-X modes. Decouple the\nchoice of PCS enablement from use of the SGMII mode when running at\ngigabit rates and announce to phylink that 1000BASE-X is a supported\noperating mode. This enables direct attachment of the PCS to e.g. an\nSFP.\n\nThe 1000BASE-X code in phylink also sometimes calls the autonegotiation\nrestart method, so add an implementation of autonegotiation restart and\nmake sure that pcs_config() signals to phylink when the AN advertisement\nhas changed.\n\nSigned-off-by: Nathan Whitehorn \u003cnwhitehorn@pa.msu.edu\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260922151429.23272-3-nwhitehorn@pa.msu.edu\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "456a389f594a1a46a2913cf082579a9ceec481eb", "tree": "898897a5df47d805e2203aa134d11a4264f3b485", "parents": [ "a529f9258da5cbfe6d313651ceabda23892e5027" ], "author": { "name": "Nathan Whitehorn", "email": "nwhitehorn@pa.msu.edu", "time": "Tue Sep 22 11:09:24 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:56:22 2026 -0700" }, "message": "net: macb: Poll for link state changes when using the internal PCS.\n\nWhen used with an offboard transceiver (e.g. an SFP), link state needs\nto be measured at the PCS rather than an onboard PHY. Poll the link\nstate when the PCS is active to allow the kernel to detect link state\nchanges in this case.\n\nSigned-off-by: Nathan Whitehorn \u003cnwhitehorn@pa.msu.edu\u003e\nReviewed-by: Théo Lebrun \u003ctheo.lebrun@bootlin.com\u003e\nLink: https://patch.msgid.link/20260922151429.23272-2-nwhitehorn@pa.msu.edu\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a529f9258da5cbfe6d313651ceabda23892e5027", "tree": "fae898c141eb679ef3e8ad384ce274a9b38a41e2", "parents": [ "e3a46dde23983e349d15948d98d204b4bc335298" ], "author": { "name": "Yibo Tan", "email": "lhfff@tju.edu.cn", "time": "Tue Sep 22 19:36:01 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:49:13 2026 -0700" }, "message": "ptp: idt82p33: Stop PTP work producers before teardown\n\nidt82p33_ptp_clock_unregister_all() cancels each channel\u0027s adjtime work\nbefore unregistering its PTP clock. An adjustment callback already in\nprogress can schedule that work after cancellation returns. Device\nremoval then frees the channel while its delayed work remains queued,\ncausing a use-after-free.\n\nMark the device as stopping under its lock before draining work. Reject\nnew adjustment and EXTS requests, clear the EXTS polling mask, and\nsynchronously drain the EXTS and channel adjustment work before the\ndevice storage is released.\n\nWith an i2c-stub device and kprobe-controlled callback timing, three\nruns of the unmodified driver reported KASAN use-after-free after\nunbind. Three runs with this change completed without a kernel\ndiagnostic. No physical IDT82P33 device was tested.\n\nCc: stable+noautosel@kernel.org # untested fix to a driver init path race\nSigned-off-by: Yibo Tan \u003clhfff@tju.edu.cn\u003e\nLink: https://patch.msgid.link/20260922113601.855416-1-lhfff@tju.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e3a46dde23983e349d15948d98d204b4bc335298", "tree": "ee01e159725b3f6993a991bfe0f2cc345d464693", "parents": [ "cee5db680df2b2dcd8cbbb274eb8a8e48ae6ab47", "2b240cfc6de4a6ca7779323e0f1ffdf0d7f99add" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:30 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:31 2026 -0700" }, "message": "Merge branch \u0027ravb-add-gptp-support-for-gen4\u0027\n\nNiklas Söderlund says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nravb: Add gPTP support for Gen4\n\nThis series is the second part cleaning up how PTP timer support is\nimplemented on R-Car Gen4. Currently there is partial support for it\nin some of the Ethernet devices that can use it, but not all.\n\nOn Gen2 and Gen3 each RAVB instance have it\u0027s own private PTP clock as\npart of the RAVB register space. For this reason the PTP functionally\nwas implemented directly in the RAVB driver. For Gen4 however there is\na system-wide PTP clock shared by all RAVB instances, and on some Gen4\nplatforms with other Ethernet devices.\n\nThe RAVB Gen4 driver currently advertise PTP support to user-space, but\nthe support is in fact completely broken. It tries to use RAVB private\nPTP clock, which do not exist on Gen4.\n\nFurther more the PTP clock behaved slightly different on Gen2 and Gen3.\nThese differences have been handled by adding platform specific flags\ninside the driver.\n\nThe usage of these flags have grown organically and been extended all\nover the driver as it gained new features. Adding a new third set of\nflags for Gen4 would be messy and add to the confusion.\n\nTherefore patches 1/10 thru 8/10 refactors the usage of the PTP flags\ninto optional callbacks and untangles the usage. This allows adding Gen4\nsupport easy as it can just implement it\u0027s own set of Gen4 specific\ncallbacks without altering the driver logic.\n\nPatch 9/10 is a small DT binding addition adding an optional phandle to\nlink a RAVB device to the external PTP clock. Ideally this property\nshould be mandatory, but for backward comp ability is is made optional.\nIf the phandle is not set, or the PTP clock not enabled, the RAVB driver\nwill continue to faction as before, but no longer advertise PTP support\nto user space.\n\nFinally patch 10/10 adds the Gen4 specific PTP callbacks which allows\nthe driver to use the external PTP clock.\n\nFor part one of this work see [1]. The two series are independent of\neach other but both are needed before a third series liking the RAVB to\nthe PTP clock in the platforms device tree. I will hold posting the\nthird series until all dependencies are merged. For this reason there\nis no user of the new renesas,gptp device tree property added in this\nseries.\n\nThe work is tested on both Gen3 and Gen4 R-Car devices (with [1] and\nappropriate DTS). I do however not have access to any Gen2 device where\nthe RAVB IP is wired to a MAC, so the small rework of the flags for Gen2\nto callbacks have only been compiled tested. If anybody have a RZ device\nwhere RAVB is wired and uses the Gen2 method of starting/stopping the\nPTP timer together with the DMAC please test this.\n\n[1] https://lore.kernel.org/20260803095232.3527111-1-niklas.soderlund+renesas@ragnatech.se/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260921175037.4084310-1-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2b240cfc6de4a6ca7779323e0f1ffdf0d7f99add", "tree": "ee01e159725b3f6993a991bfe0f2cc345d464693", "parents": [ "ef488a9da66d0f9fb296ffdbaa2bbb1602e65496" ], "author": { "name": "Niklas Söderlund", "email": "niklas.soderlund+renesas@ragnatech.se", "time": "Mon Sep 21 19:50:37 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:28 2026 -0700" }, "message": "net: ethernet: ravb: Add gPTP support for Gen4\n\nWhile driver advertises gPTP support on Gen4 platforms it is in fact\ncompletely broken. On R-Car Gen4 devices the RAVB module have no\ninternal gPTP clock as generations before it. Instead it utilizes a\nsystem-wide gPTP clock.\n\nThis change utilizes the refactoring of the RAVB gPTP code to add\nsupport for a system-wide clock and stops the Gen4 devices trying to use\nthe non-existing internal gPTP clock.\n\nTo remain backward compatible the ptp-timer property is optional.If not\npresent, or not enabled, the RAVB driver will no longer advertise gPTP\nsupport to user-space.\n\nSigned-off-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nReviewed-by: Sergey Shtylyov \u003csergei.shtylyov@gmail.com\u003e\nLink: https://patch.msgid.link/20260921175037.4084310-11-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ef488a9da66d0f9fb296ffdbaa2bbb1602e65496", "tree": "3de22618ed7cf8da30465851973310dfc6ad0d64", "parents": [ "931770c1995f6fa188f488700c22ad99fff1abfe" ], "author": { "name": "Niklas Söderlund", "email": "niklas.soderlund+renesas@ragnatech.se", "time": "Mon Sep 21 19:50:36 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:27 2026 -0700" }, "message": "dt-bindings: net: renesas,etheravb: Add optional gPTP phandle for Gen4\n\nThe RAVB module on Gen4 have no gPTP clock as part of the RAVB module\nitself, instead it relies on an external system wide gPTP clock. The\ngPTP clock is shared with RTSN on V4H and RSWITCH on S4.\n\nAdd an optional phandle so that the RAVB driver can find and use the\ngPTP clock. Ideally this should have been a mandatory property but for\nbackward compatible it is optional. The RAVB module is capable of\nfunctioning without it, but can in such cases not provided PTP\nfunctionality.\n\nSigned-off-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nReviewed-by: Sergey Shtylyov \u003csergei.shtylyov@gmail.com\u003e\nReviewed-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260921175037.4084310-10-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "931770c1995f6fa188f488700c22ad99fff1abfe", "tree": "b5b1f79a05543241377aa9ccf95dfefefacf09ee", "parents": [ "9a85f9dfbc3f6fea346044fecf0a0c637a4ad213" ], "author": { "name": "Niklas Söderlund", "email": "niklas.soderlund+renesas@ragnatech.se", "time": "Mon Sep 21 19:50:35 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:27 2026 -0700" }, "message": "net: ethernet: ravb: Add callback for gPTP clock index\n\nPrepare for adding Gen4 support which have an optional external gPTP\nclock. Add a callback to get the clock index and use it to determine if\nthe device shall report gPTP support.\n\nSigned-off-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nReviewed-by: Sergey Shtylyov \u003csergei.shtylyov@gmail.com\u003e\nLink: https://patch.msgid.link/20260921175037.4084310-9-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9a85f9dfbc3f6fea346044fecf0a0c637a4ad213", "tree": "79ad0bc1679407e71b48543b4869491990b19e45", "parents": [ "14bf0091dd0d47204f761125d65b102bebcb6001" ], "author": { "name": "Niklas Söderlund", "email": "niklas.soderlund+renesas@ragnatech.se", "time": "Mon Sep 21 19:50:34 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:27 2026 -0700" }, "message": "net: ethernet: ravb: Add callback for gPTP probe\n\nDifferent generations of the RAVB IP have different needs when it probes\nthe gPTP timer clock. Add a callback in the PTP information to allow\neach generation to probe its own way.\n\nWith this the last gPTP specific flag (gptp_ref_clk) can be removed.\nHowever the primary motivation for the change is to prepare for Gen4\nsupport, which compared to other generations with gPTP support does not\nhave the clock as part of the IP itself.\n\nGen4 will not need to compute GTI value as it have nowhere to write it,\nas the gPTP clock is external. For this reason move the computation of\nit into the newly gPTP probe specific callbacks for the RAVB IP\u0027s that\nsupport it.\n\nSigned-off-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nReviewed-by: Sergey Shtylyov \u003csergei.shtylyov@gmail.com\u003e\nLink: https://patch.msgid.link/20260921175037.4084310-8-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "14bf0091dd0d47204f761125d65b102bebcb6001", "tree": "ed54d0205d1495489c271123acc4794874e3b288", "parents": [ "121cc8a3acf8d8e31daec4e564eff32e39c00446" ], "author": { "name": "Niklas Söderlund", "email": "niklas.soderlund+renesas@ragnatech.se", "time": "Mon Sep 21 19:50:33 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:26 2026 -0700" }, "message": "net: ethernet: ravb: Replace gPTP flags with callbacks\n\nPrepare for adding Gen4 support which will add a third and new way to\ninteract with the gPTP clock by replacing the flags for Gen2 behavior\n(info-\u003egptp) and Gen3 behavior (info-\u003eccc_gac) with callbacks.\n\nThis will make adding Gen4 support cleaner as the code will not have \"if\nelse if else\" sprinkled all over to handle each generations special\ncases.\n\nSigned-off-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nReviewed-by: Sergey Shtylyov \u003csergei.shtylyov@gmail.com\u003e\nLink: https://patch.msgid.link/20260921175037.4084310-7-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "121cc8a3acf8d8e31daec4e564eff32e39c00446", "tree": "28307f5f53b126b2775d5a9da95eabacc163b091", "parents": [ "b784f9ed2e3bcc1f632401307057e47f71d4d7ef" ], "author": { "name": "Niklas Söderlund", "email": "niklas.soderlund+renesas@ragnatech.se", "time": "Mon Sep 21 19:50:32 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:26 2026 -0700" }, "message": "net: ethernet: ravb: Propagate error from ptp_clock_register()\n\nIf the PTP clock registration failed the error is silently ignored.\nBefore reworking all callers of ravb_ptp_init() handle and propagate the\nerror so it can be used.\n\nLink: https://sashiko.dev/#/patchset/20260610102432.3538432-2-niklas.soderlund+renesas@ragnatech.se?part\u003d1\nSigned-off-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nReviewed-by: Sergey Shtylyov \u003csergei.shtylyov@gmail.com\u003e\nLink: https://patch.msgid.link/20260921175037.4084310-6-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b784f9ed2e3bcc1f632401307057e47f71d4d7ef", "tree": "91b30c6f5e5c0e1426bb06bff63fc8893029fe92", "parents": [ "b9c1216c01560c2603af4c3ca42755ead3cdb4de" ], "author": { "name": "Niklas Söderlund", "email": "niklas.soderlund+renesas@ragnatech.se", "time": "Mon Sep 21 19:50:31 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:26 2026 -0700" }, "message": "net: ethernet: ravb: Remove redundant argument to ravb_ptp_init()\n\nThere is no need to explicitly pass the struct platform_device pointer\nto ravb_ptp_init(), it can retrieve it directly from the private data\nstructure.\n\nSigned-off-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nReviewed-by: Sergey Shtylyov \u003csergei.shtylyov@gmail.com\u003e\nLink: https://patch.msgid.link/20260921175037.4084310-5-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b9c1216c01560c2603af4c3ca42755ead3cdb4de", "tree": "b5675de59b81983237e5ed99a2f8bc55eeb265e8", "parents": [ "d9519789d0989ab47355b30fe1bc35f2c327e6dc" ], "author": { "name": "Niklas Söderlund", "email": "niklas.soderlund+renesas@ragnatech.se", "time": "Mon Sep 21 19:50:30 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:25 2026 -0700" }, "message": "net: ethernet: ravb: Simplify gPTP start and stop\n\nFor devices that do not support the gPTP clock in config mode the\nsomewhat oddly named flag gptp is set, compared to devices that do\nsupport the gPTP clock in config and operation mode where the flag\nccc_gac is set instead. The two flags are mutually exclusive.\n\nFor the gptp-flag devices (Gen2) the clock is tied to the AVB-DMAC, when\nit is stopped so is the gPTP clock. For ccc_gac-flag devices (Gen3) the\ngPTP clock is available whenever the ndev is open.\n\nPrepare to add Gen4 support which will add a third way by cleaning the\nGen2 and Gen3 cases up a bit.\n\nFold the gptp-flag start and stop calls into ravb_dmac_init() and\nravb_stop_dma(), which start and stop the AVB-DMAC. There are no\nfunctional change as all call sites to the construct:\n\n if (info-\u003egptp)\n ravb_ptp_init(ndev, priv-\u003epdev);\n\nare always just after a call to into ravb_dmac_init() and all call sites\nto the construct:\n\n if (info-\u003egptp)\n ravb_ptp_stop(ndev);\n\nare always directly followed by a call to ravb_stop_dma().\n\nThere are two special cases where the calling construct covers both the\ngptp-flag and info-\u003eccc_gac devices, one for start and one for stop. The\ncondition that it is preceded by a call to ravb_dmac_init(), or followed\nby a call to ravb_stop_dma() are however true for them too. Reworked the\ntwo special cases to drop the check of info-\u003egptp.\n\nThe end result is that the gPTP clock will be started or stopped for the\ngptp-flag devices in tandem with the AVB-DMAC, while the info-\u003eccc_gac\ndevices will be controlled, as before, when the ndev is opened or\nclosed.\n\nSigned-off-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nReviewed-by: Sergey Shtylyov \u003csergei.shtylyov@gmail.com\u003e\nLink: https://patch.msgid.link/20260921175037.4084310-4-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d9519789d0989ab47355b30fe1bc35f2c327e6dc", "tree": "7d5682e5bfb50c4b169260362ec3cc3531f47572", "parents": [ "e8bfdd91469c9668d11427a30f8ba0396f9aa92e" ], "author": { "name": "Niklas Söderlund", "email": "niklas.soderlund+renesas@ragnatech.se", "time": "Mon Sep 21 19:50:29 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:25 2026 -0700" }, "message": "net: ethernet: ravb: Move programming of gPTP timer interval\n\nCommit f384ab481cab (\"net: ravb: Split GTI computation and set\noperations\") broke apart the operations of computing the timer interval\nand programming of it. However it kept the programming of the interval\nin the RAVB main logic.\n\nHaving split the two apart this can be improved further by moving the\nprogramming to the gPTP initialization function, as the first action of\nthe gPTP init function is to wait for the timer interval programming to\nbe acknowledge by the hardware.\n\nAs an added bonus the interaction with the gPTP registers for the\nprogramming can then also be done while holding the gPTP registers lock.\n\nSigned-off-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nReviewed-by: Sergey Shtylyov \u003csergei.shtylyov@gmail.com\u003e\nLink: https://patch.msgid.link/20260921175037.4084310-3-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e8bfdd91469c9668d11427a30f8ba0396f9aa92e", "tree": "893adaa329bfff6af74195ceca40f0beb28ad2f2", "parents": [ "cee5db680df2b2dcd8cbbb274eb8a8e48ae6ab47" ], "author": { "name": "Niklas Söderlund", "email": "niklas.soderlund+renesas@ragnatech.se", "time": "Mon Sep 21 19:50:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:38:24 2026 -0700" }, "message": "net: ethernet: ravb: Remove gPTP control from WoL setup and restore\n\nSince commit a6a85ba36fd0 (\"net: ravb: Move PTP initialization in the\ndriver\u0027s ndo_open API for ccc_gac platorms\") the gPTP clock (if\nsupported) is stopped and started by opening and closing the ndev.\n\nThis makes the special case to stop and start it when resuming from WoL\nredundant. As the ndev will always be closed and re-opened when\nresuming the system.\n\nSigned-off-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nReviewed-by: Sergey Shtylyov \u003csergei.shtylyov@gmail.com\u003e\nLink: https://patch.msgid.link/20260921175037.4084310-2-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cee5db680df2b2dcd8cbbb274eb8a8e48ae6ab47", "tree": "ad4290aa6c847ac73f5cd516cc042ed395989af6", "parents": [ "42a9fb3382fc2573e92f41d203b095d9a372cfc9", "c8103dd8b9b4e0aa599d4ccdfeffb57eb88b5590" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:29:57 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:29:57 2026 -0700" }, "message": "Merge branch \u0027net-ethtool-make-netdev_rss_key_fill-spread-flows-over-all-queues\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: ethtool: make netdev_rss_key_fill() spread flows over all queues\n\nnetdev_rss_key_fill() hands drivers a uniformly random key. Because the\nToeplitz hash is linear over GF(2), a random key is singular for a given\nheader field and queue count with probability 1/2: flows differing only\nin the low order bits of that field (such as a burst of consecutive\nephemeral ports) then cannot reach all RX queues. On one affected 16-queue\nhost, only 4 queues received traffic until the key was replaced.\n\nPatch 1 synchronizes proc_do_rss_key() with netdev_rss_key_fill() using an\nsmp_wmb()/smp_rmb() pair and a boolean flag so readers of\n/proc/sys/net/core/netdev_rss_key print zero bytes until the key is fully\npopulated.\n\nPatch 2 keeps the key random but constrains 1008 of its 2048 bits so that,\nat every 16-bit aligned position and for every power-of-two queue count up\nto 256, consecutive values of a field ending there visit every queue once.\nApplying the fixup on the 16-bit grid covers standard 2-tuple/4-tuple\nhashes as well as encapsulated or bitmap-selected layouts (such as PSP\ninner TCP ports at byte 78) without enumerating them in the core. The\nfixup is a bijection onto the set of valid keys, and redraws in the ~1 in\n5 case where two 32-bit windows a multiple of 8 bits apart alias.\n\nPatch 3 adds RSS key, indirection table, and flow-hash reporting to\nnetdevsim so the selftest can exercise both the host key and ethtool\nnetlink RSS reporting in a virtual machine without hardware.\n\nPatch 4 adds a selftest under tools/testing/selftests/drivers/net/rss_key.py\nchecking /proc/sys/net/core/netdev_rss_key and the live RSS key,\nindirection table, and flow-hash layouts reported by a device via ethtool\nnetlink.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260922163458.3900996-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c8103dd8b9b4e0aa599d4ccdfeffb57eb88b5590", "tree": "ad4290aa6c847ac73f5cd516cc042ed395989af6", "parents": [ "5fd4208098be11251c062e41fef9d81b78277264" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 22 16:34:58 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:28:55 2026 -0700" }, "message": "selftests: drivers: net: check the host and device RSS keys\n\nAdd a selftest under tools/testing/selftests/drivers/net/rss_key.py\nchecking both the host RSS key (/proc/sys/net/core/netdev_rss_key) and\nthe RSS key, indirection table, and flow-hash layouts reported by a\ndevice over ethtool netlink.\n\nWhen invoked without NETIF, NetDrvEnv creates a 4-queue netdevsim device,\nwhich calls netdev_rss_key_fill() and allows exercising both the host key\nand the netlink RSS reporting path in a virtual machine without special\nhardware. When invoked with NETIF, it checks the key and indirection\ntable of that interface.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260922163458.3900996-5-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5fd4208098be11251c062e41fef9d81b78277264", "tree": "03c10f206f0dce7fd4226c1a3928d6d8fca46a43", "parents": [ "898d431abd2578281bd3bb7db0970bc2de7a24c5" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 22 16:34:57 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:28:55 2026 -0700" }, "message": "netdevsim: support reporting RSS key, indirection table, and flow hash fields\n\nInitialize a per-device RSS key in nsim_ethtool_init() using\nnetdev_rss_key_fill() and wire up get_rxfh_key_size, get_rxfh_indir_size,\nget_rxfh, and get_rxfh_fields on nsim_ethtool_ops.\n\nThis allows RSS selftests under tools/testing/selftests/drivers/net/ to\nexercise both /proc/sys/net/core/netdev_rss_key and ethtool netlink RSS\nreporting against netdevsim without requiring physical hardware.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260922163458.3900996-4-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "898d431abd2578281bd3bb7db0970bc2de7a24c5", "tree": "5568c3a2a44c6f5c47c6ffdf0da972b73579ca39", "parents": [ "9396e37c4860822fbc354fa438bb18e1437e0c9c" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 22 16:34:56 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:28:54 2026 -0700" }, "message": "net: ethtool: generate RSS keys that spread flows over all queues\n\nnetdev_rss_key_fill() returns a key made of uniformly random bytes. That\nis not enough, because the Toeplitz hash is linear over GF(2).\n\nWalking the hash input MSB first, each set bit contributes a 32-bit\nsliding window of the key, and hardware indexes the indirection table with\nthe low order bits of the result. Only the tail of each window therefore\nreaches the queue index:\n\n v(i) \u003d key bits [i + 32 - q .. i + 31]\n\nwith q \u003d log2(number of RX queues). Consecutive input bits give windows\noverlapping in q - 1 positions, so the q vectors belonging to the q lowest\nbits of a header field form a Toeplitz matrix built from 2 * q - 1 key\nbits, rather than q * q independent ones. Over GF(2) a random Toeplitz\nmatrix is singular with probability exactly 1/2, whatever its size.\n\nWhen it is singular, flows differing only in the low order bits of that\nfield cannot reach all the queues. This is not theoretical: a burst of\nconnections draws ephemeral ports from a narrow range, and on one affected\nhost only 4 of the 16 RX queues received any traffic at all, until its key\nwas replaced.\n\nKeep drawing the key at random, since it is a secret that stops a remote\nattacker from steering flows onto a single queue, but force the handful of\nbits that decide this. Writing d[t] for key bit (lsb + 31 - t), where lsb\nis the position of the least significant bit of a field in the hash input,\nthe matrices of all the q values up to 8 are non singular if and only if\n\n d[2 * i] \u003d 1 ^ d[i] ^ d[i + 1] ^ ... ^ d[2 * i - 1]\n\nThe odd positions stay free, so this is a one pass fixup rather than a\nsearch. It is in fact a bijection from those free positions onto the set\nof the values having the property, so the key stays uniformly distributed\nover that set and the whole cost is 8 bits of entropy per position.\nSearching for such a key by rejection would not have been an option: a\nfreshly drawn one has the property everywhere with probability 2^-1008.\n\nApply this at every 16-bit aligned position of the key, rather than at the\noffsets of the 2-tuple and 4-tuple layouts only. The core does not get to\nknow what a given NIC hashes. Hardware may select the bytes it feeds to\nToeplitz out of a header window with a bitmap, and hash an encapsulated\nheader: for PSP over UDP over IPv6 it can pick the outer addresses and the\ninner TCP ports, which sit 78 bytes into the frame and read key bits well\npast the 40 bytes an IPv6 4-tuple needs. Hashed fields are 16 bits wide at\nthe smallest and are not expected to straddle that grid, so covering the\ngrid covers the layouts that were never written down, at no cost in code.\n\nThis spends 8 bits of entropy per position, 1008 bits out of the 2048 bits\nof netdev_rss_key, leaving 1040 bits. 8 is also the largest usable bound,\nas each q constrains 2 * q - 1 bits and anything larger would make the\nranges of two adjacent positions overlap.\n\nWhat the fixup leaves behind is visible structure: 8 of every 16 bits are\nderived from the 8 others, so a 16-bit aligned word of the key takes only\n2^8 values and about 27 of the 128 words of netdev_rss_key duplicate\nanother one. That much is forced rather than an artefact of this\nimplementation, 1040 bits spread over 128 words being a little over 8 bits\neach, but it has one consequence worth removing. Two 32-bit windows a\nwhole number of words apart now collide with probability 2^-16 instead of\n2^-32, and two input bits reading the same window are indistinguishable to\nthe hash, since flipping both of them leaves it unchanged. Over 500 keys,\n23% of them had such a pair, where a uniformly random key has one with\nprobability 2^-11.\n\nSo draw another key when that happens. Four out of five pass. Which\ndistances to look at follows from where the structure is: covering the\nmultiples of 16 leaves 1.2e-3 expected colliding pairs per key, still 2.6\ntimes the 4.6e-4 of a plain random key, and almost all of that excess sits\nat a distance of 8 modulo 16. Covering every multiple of 8 brings the total\ndown to 4.2e-4, below what a plain random key gives over all distances, and\nwithin a few percent of the 4.0e-4 it gives over the distances that are\nleft.\n\nTwo windows a multiple of 8 bits apart are two windows at the same offset\nmodulo 8, so this is a handful of pairwise sweeps rather than one pass over\nthe key per distance. DO_ONCE() runs the generator under a spinlock with\nhard IRQs disabled, so keep the windows of a class in an array rather than\nrecomputing both sides of every pair: 116 us instead of 254 us for the\nworst case, a 2048-bit key with no collision anywhere, at a cost of 512\nbytes of stack.\n\nThe shared key is fixed up once and every driver prefix inherits both\nproperties. Move netdev_rss_key and netdev_rss_key_fill() from\nnet/ethtool/ioctl.c to net/ethtool/common.c, and move the netdev_rss_key\ndeclaration out of include/linux/netdevice.h into net/core/dev.h.\n\nChecked against an independent Toeplitz implementation: for every 16-bit\naligned position and every q in 1..8, an aligned block of 2^q consecutive\nvalues of a field ending there lands on the 2^q queues exactly once each.\nOver 20 random keys that is 20160 checks, which 50.1% of plain random keys\nfail and none of the generated keys do, for an average of 502 rewritten\nbits out of 2048.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260922163458.3900996-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9396e37c4860822fbc354fa438bb18e1437e0c9c", "tree": "6835fb0704ed337bdbaf443a8db6fc6246f34fff", "parents": [ "42a9fb3382fc2573e92f41d203b095d9a372cfc9" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 22 16:34:55 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 25 16:28:54 2026 -0700" }, "message": "net: synchronize proc_do_rss_key() with netdev_rss_key_fill()\n\nproc_do_rss_key() reads netdev_rss_key[] without synchronization, so a\nconcurrent reader of /proc/sys/net/core/netdev_rss_key can observe a\npartially populated key while netdev_rss_key_fill() is initializing it.\n\nPublish a boolean flag after an smp_wmb() once netdev_rss_key_fill() has\npopulated netdev_rss_key[], and pair it with an smp_rmb() in\nproc_do_rss_key(), printing zero bytes until the flag is set.\n\nFixes: 960fb622f851 (\"net: provide a per host RSS key generic infrastructure\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260922163458.3900996-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "42a9fb3382fc2573e92f41d203b095d9a372cfc9", "tree": "95998fb7f38c20a8a313e2cc0ed775f4c167cdb9", "parents": [ "161ea2d4f2a7e784f14b5b0548fcef3e05fc34f8", "f2c53ea949c5048f96b3dbb5a5ee7131ce4ff2de" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 17 14:24:32 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 13:32:50 2026 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nCross-merge networking fixes after downstream PR (net-7.3-rc5).\n\nConflicts:\n\ndrivers/net/mdio/mdio-realtek-rtl9300.c\n 89a8a1eef2d44 (\"net: mdio: realtek-rtl9300: fix RTL931x C22 extended page selection\")\n cc3cb8db1eef9 (\"net: mdio: realtek-rtl9300: Add page tracking\")\nhttps://lore.kernel.org/arUZOqy73bE2pp0w@sirena.org.uk\n\nnet/8021q/vlan_dev.c\n cd5dd68267c4 (\"vlan: ensure sufficient headroom in vlan_dev_hard_header()\")\n ca6ff8dd70eb (\"vlan: annotate data-races in vlan_dev_priv fields\")\n\nAdjacent changes:\n\nnet/ipv6/ip6_gre.c\n dd47bcf279f1 (\"ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().\")\n cce829e2aa1d (\"ip6_gre: Protect ip6gre_net.tunnels[][] with mutex.\")\n\ndrivers/net/ethernet/meta/fbnic/fbnic_txrx.c\n b5d9e9d4d0c1 (\"eth: fbnic: use the Rx queue napi pointer to find the napi vector\")\n c0aca269ec07 (\"eth: fbnic: Make Rx completion coalescing configurable\")\n\ndrivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c\n d68acbf93531 (\"net: stmmac: selftests: Support running selftests on DSA conduits\")\n 85ca3292d7a3 (\"net: stmmac: Remove ARP offload code\")\n\ndrivers/net/ethernet/wangxun/libwx/wx_hw.c\n 3173cba11701 (\"net: libwx: fix races in Tx timestamp handling\")\n 7042c8c193e5 (\"net: libwx: rename wx_pf_flags to wx_flags\")\n\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f2c53ea949c5048f96b3dbb5a5ee7131ce4ff2de", "tree": "dd635091fe8fde9c898b9e9a1a4c51e49d6161df", "parents": [ "415f2044228cc8b948dc04e079aaa86a4d1aa1d3", "fc6d80eb504458d6416b75a94188b268c95c6533" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 11:45:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 11:45:33 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Bluetooth, NFC and Netfilter.\n\n Every week in this release is record-setting for number of posted\n patches. It doesn\u0027t seem like we\u0027re creating any regressions with all\n these fixes, three \u0027Fixes\u0027 tags here point to 7.2 commits but none are\n true regression fixes. We\u0027re trying to keep the count down,\n nonetheless.\n\n Previous releases - regressions:\n\n - net: don\u0027t require the hwtstamp NDOs when a PHY provides\n timestamping\n\n - ipv6: fix dst leak for uncached routes\n\n - vrf: stop corrupting skb-\u003ecsum when capturing CHECKSUM_COMPLETE\n packets\n\n Previous releases - always broken:\n\n - packet: use ubuf_info completion for TX_RING packets\n\n - arp: terminate device name before lookup\n\n - ipv6: do not let ipv6_find_hdr() return an offset past the packet\n end\n\n - udp: remove a disconnected socket from the 4-tuple hash table\n\n - sctp: discard the rest of the packet on a stale-cookie error\n\n - eth: mlx5: Bridge, fix remaining switchdev ownership gaps on merged\n eswitch\"\n\n[ And lots of other random network driver fixes ]\n\n* tag \u0027net-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (189 commits)\n tcp: prevent collapsing skbs across boundary in rtx queue\n vlan: ensure sufficient headroom in vlan_dev_hard_header()\n net/sched: sch_teql: fix shadowed err in __teql_resolve()\n bridge: check llc_mac_hdr_init() return value in br_send_bpdu()\n llc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n llc: reserve device headroom for allocated frames\n gve: DQO: reject TSO packets with an out of range MSS\n gve: fix TX drop when GSO MSS is too small for hw\n gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n net: flush skb_defer_nodes in dev_cpu_dead()\n net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails\n af_packet: fix integer overflow in prb_calc_retire_blk_tmo()\n tipc: Fix a data race on mon-\u003epeer_cnt in mon_timeout()\n net: phy: intel-xway: workaround 100BASE-TX Link-Up issue\n net/smc: fix UAF on lgr list traversal in smcr_port_err()\n net/rds: size a connection\u0027s path set by the transport it ends up with\n nfp: hold IPsec RX state under the XArray lock\n net: ena: fix MMIO read buffer leak on probe failure\n net: ena: fix PHC cleanup on probe failure\n net/sched: act_ct: fix helper UAF due to extensions realloc\n ...\n" }, { "commit": "fc6d80eb504458d6416b75a94188b268c95c6533", "tree": "5487970b2bfe7b6d0737e3c7059af732ca493d41", "parents": [ "1078a38344a852eefafcc61c42dcc333b53c7478" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Thu Sep 24 11:44:12 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:03:42 2026 -0700" }, "message": "tcp: prevent collapsing skbs across boundary in rtx queue\n\ntcp_write_collapse_fence() sets TCP_SKB_CB(skb)-\u003eeor \u003d 1 on\ntcp_write_queue_tail(sk) to prevent skbs queued after a switch to\ndevice encryption from being collapsed into earlier skbs.\n\nThe fence is a no-op if all earlier data has already been transmitted\nwhen the switch happens: sk-\u003esk_write_queue is empty. The not yet\nacknowledged earlier skbs wait in sk-\u003etcp_rtx_queue with eor 0.\n\nOn a subsequent retransmit or SACK shift, tcp_retrans_try_collapse() or\ntcp_shift_skb_data() can then merge an skb queued after the switch into\none queued before it.\n\nBoth users of the fence are affected:\n\n- psp: devices only encrypt skbs with skb-\u003edecrypted set. The merged skb\n keeps decrypted \u003d 0 from the earlier skb, so merged data sent after\n psp_sock_assoc_set_tx() is retransmitted in cleartext.\n\n- tls device offload: the merged skb straddles the start marker set in\n tls_set_device_offload(). The software fallback (fill_sg_in() returns\n -EINVAL) and the mlx5, nfp and funeth drivers cannot handle such an\n skb and drop it. Every retransmit rebuilds the same skb, so the\n connection stalls.\n\nFix this in two places, for defense in depth:\n\n1. Fall back to tcp_rtx_queue_tail(sk) in tcp_write_collapse_fence()\n when tcp_write_queue_tail(sk) is NULL.\n\n2. Check !skb_cmp_decrypted(to, from) in tcp_skb_can_collapse(), as\n tcp_skb_can_collapse_rx() does on receive. skb_shift(), which both\n collapse paths call, already has a DEBUG_NET_WARN_ON_ONCE() for this\n condition.\n\nFixes: e8f69799810c (\"net/tls: Add generic NIC offload infrastructure\")\nCc: stable@vger.kernel.org\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nLink: https://patch.msgid.link/20260924154427.953800-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1078a38344a852eefafcc61c42dcc333b53c7478", "tree": "cf29dc84fc6d0c1cbece69f4e01f183a8db49ae2", "parents": [ "72b5b9a28b996e09b8b5b944370c79851bb68f52", "cd5dd68267c4238795fadaf02b3575ca3f8a6500" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:01:03 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:01:04 2026 -0700" }, "message": "Merge branch \u0027vlan-ensure-sufficient-headroom-in-vlan_dev_hard_header\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nvlan: ensure sufficient headroom in vlan_dev_hard_header()\n\nCallers that only reserve ETH_HLEN or less, or skbs allocated before\ndynamic device/headroom changes (such as toggling VLAN_FLAG_REORDER_HDR\nor bonding/team switching slaves), can reach vlan_dev_hard_header() with\ninsufficient headroom and trigger skb_under_panic().\n\nWhen vlan_dev_hard_header() returns -ENOMEM upon skb_cow_head() failure,\na few callers of dev_hard_header() / llc_mac_hdr_init() had pre-existing\nerror-handling bugs:\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260924082951.1599377-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cd5dd68267c4238795fadaf02b3575ca3f8a6500", "tree": "cf29dc84fc6d0c1cbece69f4e01f183a8db49ae2", "parents": [ "907b978e82cb4c1c245fc2985bb27c5d5c88c8f6" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:51 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "vlan: ensure sufficient headroom in vlan_dev_hard_header()\n\nCallers that only reserve ETH_HLEN or less (such as llc_alloc_frame()),\nor skbs allocated before dynamic device/headroom changes (e.g. toggling\nVLAN_FLAG_REORDER_HDR or bonding/team switching slaves), can reach\nvlan_dev_hard_header() with insufficient headroom and trigger\nskb_under_panic().\n\nUse skb_cow_head() in vlan_dev_hard_header() when VLAN_FLAG_REORDER_HDR\nis not set to ensure sufficient headroom for the VLAN header(s) and the\nunderlying device hard header.\n\nUse READ_ONCE() to read dev-\u003ehard_header_len and dev-\u003eneeded_headroom as\nthey can be updated concurrently under RTNL (e.g. in\nvlan_transfer_features()) while vlan_dev_hard_header() runs locklessly on\nthe transmit path. Also avoid LL_RESERVED_SPACE(dev) here so that the\nextra HH_DATA_MOD alignment padding does not trigger unnecessary\npskb_expand_head() reallocations on inner stacked VLAN devices after the\nouter VLAN header has been pushed.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Zixuan Chai \u003cpetalzu987@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/cover.1789987105.git.petalzu987@gmail.com/\nLink: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nCc: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-5-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "907b978e82cb4c1c245fc2985bb27c5d5c88c8f6", "tree": "99c10e831fdd7b59ce532cdc840640aae27ad3ca", "parents": [ "ac704ff08e511c87643799c385f55ecd69b85e03" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:50 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "net/sched: sch_teql: fix shadowed err in __teql_resolve()\n\n__teql_resolve() declares an inner \u0027int err;\u0027 inside the\n\u0027if (neigh_event_send(n, skb_res) \u003d\u003d 0)\u0027 block, shadowing the outer\n\u0027int err \u003d 0;\u0027. As a result, a negative return from dev_hard_header()\nis written to the inner variable and __teql_resolve() still returns 0.\n\nRemove the shadowed variable and set the outer err to -EINVAL when\ndev_hard_header() returns a negative error.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCloses: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-4-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ac704ff08e511c87643799c385f55ecd69b85e03", "tree": "5f38ad6d4b85abd248210eec244ab86ed2bb3621", "parents": [ "72f9dd522f8d6c5a00be9695c7bb74631eb5069e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:49 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "bridge: check llc_mac_hdr_init() return value in br_send_bpdu()\n\nIf llc_mac_hdr_init() fails (for instance if the port device type does\nnot support LLC or dev_hard_header() fails), br_send_bpdu() should drop\nthe skb instead of resetting the mac header to the LLC payload and\ntransmitting a malformed frame.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCloses: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nCc: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nCc: Ido Schimmel \u003cidosch@nvidia.com\u003e\nCc: bridge@lists.linux.dev\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "72f9dd522f8d6c5a00be9695c7bb74631eb5069e", "tree": "bac4f4f9105b9f14cd11c4f6c5d44cca3a88cc33", "parents": [ "72b5b9a28b996e09b8b5b944370c79851bb68f52" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:48 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "llc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCloses: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "72b5b9a28b996e09b8b5b944370c79851bb68f52", "tree": "80b7fa56b5820d1f2be01da4399dda48eb003ab1", "parents": [ "488089055b61be8f7e97817d4608844f0fba2648" ], "author": { "name": "Zixuan Chai", "email": "petalzu987@gmail.com", "time": "Thu Sep 24 09:26:05 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:58:16 2026 -0700" }, "message": "llc: reserve device headroom for allocated frames\n\nllc_alloc_frame() reserves link-layer headroom using the device type.\nThis is insufficient for stacked Ethernet devices such as VLAN devices,\nwhere vlan_dev_hard_header() pushes a VLAN header before the lower\ndevice\u0027s Ethernet header. An LLC response on such a device can\ntherefore underflow skb headroom in eth_header().\n\nUse LL_RESERVED_SPACE() to account for the device\u0027s actual required\nheadroom while preserving the existing LLC device-type check.\n\nFixes: bf9ae5386bca (\"llc: use dev_hard_header\")\nCc: stable@vger.kernel.org\nReported-by: VEGA \u003cvega@nebusec.ai\u003e\nSigned-off-by: Zixuan Chai \u003cpetalzu987@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cweir@nebusec.ai\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924012613.2533934-1-weir@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "488089055b61be8f7e97817d4608844f0fba2648", "tree": "886115a15dd1a17818339673d5b7ea0c3b4a2d16", "parents": [ "83769c23fb1879edc916a526ba424285033baf2d", "296c83b5ccc808c080865eb20fd7a477b0355bb7" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:57:01 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:57:01 2026 -0700" }, "message": "Merge branch \u0027gve-dqo-fix-handling-of-out-of-range-tso-mss\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ngve: DQO: fix handling of out of range TSO MSS\n\nThe DQO TX path assumes that the MSS of a TSO packet is within the\nrange supported by the device, [88, 9728].\n\nThis holds for locally generated traffic, but not for packets coming\nfrom a tap or from a packet socket: virtio_net_hdr_to_skb() takes\ngso_size from user space and only enforces a minimum, layer 2\nforwarding does not check the MTU of GSO packets, and\ngso_features_check() bounds skb-\u003elen and gso_segs but never gso_size.\n\nPatch 1, from Eddie Phillips, deals with the lower bound. It moves the\nexisting test out of gve_prep_tso() into gve_features_check_dqo(), so\nthat these packets are segmented in software instead of being dropped.\n\nPatch 2 deals with the upper bound, which is currently not checked at\nall. gve_tx_fill_tso_ctx_desc() stores gso_size into a 14 bits wide\nfield, so that an MSS of 16384 silently becomes zero. Falling back to\nsoftware segmentation is not an option here, because skb_segment()\nsplits at gso_size regardless of the MTU, and would only replace an\ninvalid TSO packet by non TSO packets larger than the 9728 bytes the\ndevice supports. These packets are dropped instead.\n\nAs noted in patch 2, oversized non TSO packets can still reach the\ndevice whenever the stack segments in software. This is not specific\nto gve and is better fixed in the core, so a patch for\n__is_skb_forwardable() will be sent separately for net-next.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260924004252.1196328-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "296c83b5ccc808c080865eb20fd7a477b0355bb7", "tree": "886115a15dd1a17818339673d5b7ea0c3b4a2d16", "parents": [ "3b430ea6234087957b0d3cd181e3116722b59819" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 00:42:52 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:56:59 2026 -0700" }, "message": "gve: DQO: reject TSO packets with an out of range MSS\n\ngve_prep_tso() notes that the device requires the MSS to be \u003c\u003d 9728,\nbut does not enforce it, assuming the 9K MTU enforced by the hypervisor\nand the 64KB limit on TSO sizes are enough.\n\nThis does not hold for packets that were not generated locally.\nA guest behind a tap, or any packet socket user, can provide an\narbitrary gso_size in virtio_net_hdr. Layer 2 forwarding does not check\nthe MTU for GSO packets (is_skb_forwardable()), and gso_features_check()\nonly bounds skb-\u003elen and gso_segs, never gso_size.\n\nSuch a packet reaches gve_tx_fill_tso_ctx_desc(), which puts gso_size\ninto the mss field of the TSO context descriptor. This field is 14 bits\nwide, so a gso_size of 16384 is silently turned into an MSS of zero.\n\nDrop these packets from gve_prep_tso(), and make sure that\ngve_features_check_dqo() leaves their GSO bits alone: skb_segment()\nsplits at gso_size regardless of the MTU, so falling back to software\nsegmentation would give the device non TSO packets bigger than the\n9728 bytes it supports.\n\nNote that the device can still be given oversized non TSO packets when\nthe stack segments in software for other reasons, for instance after\nTSO has been disabled with ethtool. This is a generic issue, because\nthe MTU check is skipped for GSO packets in the forwarding path, and\nis addressed separately.\n\nFixes: a57e5de476be (\"gve: DQO: Add TX path\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260924004252.1196328-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3b430ea6234087957b0d3cd181e3116722b59819", "tree": "0f861c1c8f08498ad4c8fc89fc79dfd0222ce039", "parents": [ "83769c23fb1879edc916a526ba424285033baf2d" ], "author": { "name": "Eddie Phillips", "email": "eddiephillips@google.com", "time": "Thu Sep 24 00:42:51 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:56:59 2026 -0700" }, "message": "gve: fix TX drop when GSO MSS is too small for hw\n\nThe device has a strict requirement that the minimum MSS\n(gso_size) for TSO/GSO packets must be at least 88 bytes. If a packet\nbelow this threshold is pushed to the hardware, it can cause\nhardware to silently drop the packet, leading to increased latency\nand retransmissions.\n\nCurrently, this is validated too late in the transmit pipeline\n(gve_prep_tso), leading to silent drops.\n\nFix this by moving the validation into the .ndo_features_check\ncallback (gve_features_check_dqo). If we detect a GSO packet with\na gso_size smaller than GVE_TX_MIN_TSO_MSS_DQO, we clear the GSO\nfeature flags for this packet.\n\nFixes: a57e5de476be (\"gve: DQO: Add TX path\")\nSigned-off-by: Eddie Phillips \u003ceddiephillips@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260924004252.1196328-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "415f2044228cc8b948dc04e079aaa86a4d1aa1d3", "tree": "71512a50ce57f1a72f253b74264dff7fde3de777", "parents": [ "5fc5768c7ca92895ccd1de94dc521e5a55ae7896", "e7e0a54300a896e731dffd3e2e8dae5631d6243d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 10:53:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 10:53:59 2026 -0700" }, "message": "Merge tag \u0027landlock-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux\n\nPull Landlock fixes from Mickaël Salaün:\n \"This mainly fixes the Landlock tracepoint support merged this cycle so\n that denial and rule events report the intended policy context,\n whether through tracefs or BTF-visible callbacks.\n\n The size of this all is mainly from propagating the corrected contract\n through event definitions and producers, adding new tests for the\n reported context, and updating the documentation.\n\n Also improve annotation and fix a GCC 16 build warning\"\n\n* tag \u0027landlock-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:\n landlock: Widen ruleset versions to 64 bits\n landlock: Add counted_by in landlock_domain\n landlock: Fix tracepoint contract documentation\n selftests/landlock: Test network denial context\n selftests/landlock: Test filesystem denial blockers\n landlock: Report the effective signal number\n landlock: Report the actual ptrace tracer\n landlock: Fix network denial trace context\n landlock: Fix rule tracepoint context\n landlock: Fix filesystem denial blocker reporting\n landlock: Fix tracepoint fixed-width type names\n landlock: Work around gcc-16 -Wuninitialized warning\n" }, { "commit": "83769c23fb1879edc916a526ba424285033baf2d", "tree": "ac3e133847e92e1be5420840455588279ccab477", "parents": [ "06e3f54e8b22040ada01a28343badf1990b4dd7d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Sep 23 14:59:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:51:29 2026 -0700" }, "message": "gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n\ngve_can_send_tso() computes how many buffers each segment of a GSO\npacket would span, and for this it needs the length of the headers\nthat the device replicates in front of every segment.\n\nIt unconditionally uses skb_tcp_all_headers(), which reads the doff\nfield of the TCP header. SKB_GSO_UDP_L4 packets have no TCP header:\ntcp_hdrlen() then reads one byte of the UDP payload, and header_len\ncan be anything in [0, 60] instead of the transport offset plus the\neight bytes of the UDP header that gve_prep_tso() programs into the\nTSO context descriptor.\n\nA wrong header length shifts all the segment boundaries computed in\nthe loop, so the number of buffers per segment can be over or under\nestimated. In the first case, GSO is needlessly disabled for this\npacket by gve_features_check_dqo() and the stack has to segment it.\nIn the second case, the driver hands the device a packet whose\nsegments span more than GVE_TX_MAX_DATA_DESCS buffers.\n\nUse the UDP header length for SKB_GSO_UDP_L4 packets, matching what\ngve_prep_tso() does.\n\nFixes: 014c607f86ab (\"gve: add support for UDP GSO for DQO format\")\nCloses: https://lore.kernel.org/netdev/CANn89i+MS4L60sFQ49\u003d-f-mibeveUfcrpVkD5X+Qy6SOnEpd6w@mail.gmail.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Ankit Garg \u003cnktgrg@google.com\u003e\nCc: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nCc: Joshua Washington \u003cjoshwash@google.com\u003e\nCc: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Ankit Garg \u003cnktgrg@google.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260923145942.731365-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "06e3f54e8b22040ada01a28343badf1990b4dd7d", "tree": "9aef63ca855d0f5730db275590fac7c010bc317e", "parents": [ "8db67bb6a1fffa4df68fbbc22e39943aeeff9178" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Sep 23 13:03:18 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:48:10 2026 -0700" }, "message": "net: flush skb_defer_nodes in dev_cpu_dead()\n\nWhen a CPU goes offline, dev_cpu_dead() drains its softnet queues\n(completion_queue, output_queue, poll_list, process_queue, and\ninput_pkt_queue), but leaves net_hotdata.skb_defer_nodes untouched.\n\nIf oldcpu goes offline while holding pending skbs in its\nskb_defer_nodes lists (e.g. below the sysctl_skb_defer_max \u003e\u003e 1 IPI\nthreshold, or if the IPI races with CPU teardown), those skbs remain\nstranded until oldcpu is brought back online. If any of these skbs\nhold page_pool fragments, page_pool_destroy() will stall indefinitely\nwaiting for inflight pages to be returned when a netdev or driver is\ntorn down while oldcpu is offline.\n\nAdditionally, if smp_call_function_single_async() fails in\nkick_defer_list_purge() because the target CPU went offline, reset\ndefer_ipi_scheduled to 0 so future IPI kicks are not blocked when the\nCPU comes back online.\n\nAlso, if oldcpu was the last online CPU on its NUMA node, drain that\nnode\u0027s slot across all CPUs so no skbs deferred from that node remain\nstranded on idle remote CPUs (or if the node itself is subsequently\nofflined).\n\nFinally, in skb_attempt_defer_free(), re-check cpu_online(cpu) and\nwhether the caller migrated CPUs after llist_add(), flushing the node\nlist if so, to close the preemption TOCTOU race against CPU/node\nteardown.\n\nFixes: 68822bdf76f1 (\"net: generalize skb freeing deferral to per-cpu lists\")\nFixes: 5628f3fe3b16 (\"net: add NUMA awareness to skb_attempt_defer_free()\")\nCloses: https://lore.kernel.org/netdev/20260916003430.3612956-1-kris.pan@intel.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Kris Pan \u003ckris.pan@intel.com\u003e\nLink: https://patch.msgid.link/20260923130318.607255-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8db67bb6a1fffa4df68fbbc22e39943aeeff9178", "tree": "a2ce3f2b519033b14058d38935960be67ffe4a1e", "parents": [ "56d82862a0a243ac14ba11b6d7b57ddc2d064b95" ], "author": { "name": "Coia Prant", "email": "coiaprant@gmail.com", "time": "Wed Sep 23 20:37:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:47:24 2026 -0700" }, "message": "net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails\n\ngmac_clk_enable() enables the bulk clocks first and then the optional\nPHY clock. If clk_prepare_enable() on the PHY clock fails, the function\nreturns without rolling back the bulk clocks, and bsp_priv-\u003eclk_enabled\nstays false, so the later gmac_clk_enable(bsp_priv, false) becomes a\nno-op and the bulk clock references are leaked.\n\nAdd the missing clk_bulk_disable_unprepare() on that failure path.\n\nFixes: ea449f7fa0bf (\"net: ethernet: stmmac: dwmac-rk: rework optional clock handling\")\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Heiko Stuebner \u003cheiko@sntech.de\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nSigned-off-by: Coia Prant \u003ccoiaprant@gmail.com\u003e\nLink: https://patch.msgid.link/20260923123713.3137146-1-coiaprant@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "56d82862a0a243ac14ba11b6d7b57ddc2d064b95", "tree": "fe06631dbb251cf22f86807315d0aa8bd1b1258c", "parents": [ "8e1937fed6738460554ec123c64839e2445e7d53" ], "author": { "name": "Dairui Zhang", "email": "zhangdairui@gmail.com", "time": "Wed Sep 23 13:01:01 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:40:50 2026 -0700" }, "message": "af_packet: fix integer overflow in prb_calc_retire_blk_tmo()\n\nprb_calc_retire_blk_tmo() computes in 32-bit int arithmetic:\n\n mbits \u003d (blk_size_in_bytes * 8) / (1024 * 1024);\n\nIf I\u0027m reading the validation right, tp_block_size is user\ncontrolled and packet_set_ring() only rejects values that are \u003c\u003d 0\nas int or not page aligned, so a 256MiB block goes right through\n(and alloc_one_pg_vec_page() even has a vzalloc fallback for it).\n0x10000000 * 8 wraps to INT_MIN, and on a NIC reporting 1 Gbps\n(div \u003d\u003d 1) the function ends up returning -2047.\n\nThe condition is actually (8 * size) mod 2^32 \u003e\u003d 2^31 \u0026\u0026 div \u003d\u003d 1,\nso the trigger set is [256,512), [768,1024), [1280,1536) and\n[1792,2048) MiB. Other sizes wrap to non-negative values and faster\nlinks divide the unsigned value back below 2^31, which is why this\ndoesn\u0027t blow up for everyone.\n\nWhat makes it fatal is what happens next in init_prb_bdqc():\n\n p1-\u003einterval_ktime \u003d ms_to_ktime(prb_calc_retire_blk_tmo(...));\n hrtimer_start(\u0026p1-\u003eretire_blk_timer, p1-\u003einterval_ktime,\n HRTIMER_MODE_REL_SOFT);\n\nA negative relative timeout expires immediately. The callback\nunconditionally returns HRTIMER_RESTART, and hrtimer_forward() turns\nthe negative interval into hrtimer_resolution:\n\n if (interval \u003c hrtimer_resolution)\n interval \u003d hrtimer_resolution;\n\nSo the SOFT timer re-fires at the maximum rate forever, holding\nsk_receive_queue.lock each pass. One CPU spins in softirq until the\nsocket is closed. Repeat with more rings and the machine is gone.\n\nThe overflow itself is ancient - it was introduced together with\nTPACKET_V3 in f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer\nimplementation.\"). Its effect prior to f7460d2989fa (\"net:\naf_packet: Use hrtimer to do the retire operation\", v6.18) was not\nas clear-cut, though: the return value was stored into an unsigned\nshort retire_blk_tov, so a negative result was truncated, and a\n0-jiffy delay loop could be programmed as well. Neither is nearly\nas detrimental as the immediate maximum-rate spin the hrtimer\nconversion turned it into.\n\n(Unrelated to CVE-2019-20812 - that one was the ethtool failure path\nreturning 0, which now returns DEFAULT_PRB_RETIRE_TOV.)\n\nReproducer, needs CAP_NET_RAW (a --network host container has it by\ndefault) and a 1 Gbps NIC (QEMU e1000 works):\n\n int fd \u003d socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));\n bind(fd, ...);\n int v \u003d TPACKET_V3;\n setsockopt(fd, SOL_PACKET, PACKET_VERSION, \u0026v, sizeof(v));\n struct tpacket_req3 req \u003d {\n .tp_block_size \u003d 0x10000000,\n .tp_block_nr \u003d 1,\n .tp_frame_size \u003d 2048,\n .tp_frame_nr \u003d 0x10000000 / 2048,\n .tp_retire_blk_tov \u003d 0,\n };\n setsockopt(fd, SOL_PACKET, PACKET_RX_RING, \u0026req, sizeof(req));\n\nCompute in 64 bits instead. The operands are already bounded by the\nexisting validation, so nothing else changes. If you\u0027d prefer a\ndifferent fix, just say so and I\u0027ll respin.\n\nFixes: f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer implementation.\")\nCc: stable@vger.kernel.org\nSigned-off-by: Dairui Zhang \u003czhangdairui@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260923050101.1510064-1-zhangdairui@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8e1937fed6738460554ec123c64839e2445e7d53", "tree": "5d10c6bd523256962d460cb9fc378f48216ffa8b", "parents": [ "b94773dc4df7026a6f29b2c65e96e88d29cdb576" ], "author": { "name": "Ginger Li", "email": "ginger.jzllee@gmail.com", "time": "Tue Sep 22 16:09:09 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:21:45 2026 -0700" }, "message": "tipc: Fix a data race on mon-\u003epeer_cnt in mon_timeout()\n\nmon_timeout() evaluates dom_size(mon-\u003epeer_cnt) before it takes mon-\u003elock,\nwhile mon-\u003epeer_cnt is updated under that lock by tipc_mon_add_peer() and\ntipc_mon_remove_peer(). The value can therefore be stale, and the decision\nwhether the local domain has to be recomputed can be based on an outdated\nmember count.\n\nRead mon-\u003epeer_cnt inside the write_lock_bh(\u0026mon-\u003elock) protected region.\n\nFixes: 35c55c9877f8 (\"tipc: add neighbor monitoring framework\")\nSigned-off-by: Ginger Li \u003cginger.jzllee@gmail.com\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20260922080909.21123-1-ginger.jzllee@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b94773dc4df7026a6f29b2c65e96e88d29cdb576", "tree": "f33a3cffc1582c8a98067d7580d114efafaea961", "parents": [ "61cb282fe97b3b0ba32ca09417a693162bf4ae3f" ], "author": { "name": "Alexander Sverdlin", "email": "alexander.sverdlin@siemens.com", "time": "Tue Sep 22 09:52:46 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:21:20 2026 -0700" }, "message": "net: phy: intel-xway: workaround 100BASE-TX Link-Up issue\n\nMaxLinear GSW12x/GSW14x Ethernet Switch Errata Sheet states:\n\"An issue has been sporadically observed after device power-on on the first\nlink-up attempt in 100BASE-TX mode resulting in either the link-up taking a\nlong time, or failing to link-up altogether...\n\nWorkaround:\nAfter power-on, enable Cable Diagnostic Mode for all ports and disable\nit...\"\n\nImplement the proposed workaround unconditionally in the Intel XWAY driver\n(MaxLinear GSW1xx switches incorporate Intel XWAY PHYs) because the\ndiagnostic bits have the same meaning even in older integral PHYs such as\nGPY111/PEF7071/PHY11G. So it\u0027s not clear how to distinguish the affected\nnewer integrated PHYs, but the workaround should not hurt the older PHYs.\n\nCc: stable@vger.kernel.org\nFixes: 22335939ec90 (\"net: dsa: add driver for MaxLinear GSW1xx switch family\")\nSigned-off-by: Alexander Sverdlin \u003calexander.sverdlin@siemens.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260922075251.23386-1-alexander.sverdlin@siemens.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "61cb282fe97b3b0ba32ca09417a693162bf4ae3f", "tree": "d1214b84bb1f1773f609603d93bee4c9a07749b3", "parents": [ "ba3d1f480c7a3fba963e7867ad6cc557c197acbc" ], "author": { "name": "Sidraya Jayagond", "email": "sidraya@linux.ibm.com", "time": "Tue Sep 22 09:31:49 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:19:50 2026 -0700" }, "message": "net/smc: fix UAF on lgr list traversal in smcr_port_err()\n\nsmcr_port_err() traverses smc_lgr_list.list without holding\nsmc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()\nto free an lgr while it is still being dereferenced.\n\nHold smc_lgr_list.lock across the traversal. Update\nsmc_ib_gid_check() to call smcr_port_err() after releasing the lock.\n\nFixes: 541afa10c126 (\"net/smc: add smcr_port_err() and smcr_link_down() processing\")\nReviewed-by: Mahanta Jambigi \u003cmjambigi@linux.ibm.com\u003e\nSigned-off-by: Sidraya Jayagond \u003csidraya@linux.ibm.com\u003e\nReviewed-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20260922073149.474762-1-sidraya@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ba3d1f480c7a3fba963e7867ad6cc557c197acbc", "tree": "77e8369813a2d60c9464a9262a30b7e8938d9ad5", "parents": [ "1a983a4e14c635c40354be110cd9a1a5c94e01e6" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Mon Sep 21 14:50:27 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:03:23 2026 -0700" }, "message": "net/rds: size a connection\u0027s path set by the transport it ends up with\n\n__rds_conn_create() computes npaths from the caller\u0027s transport before\nit decides whether a connection to one of the host\u0027s own addresses is\nto be handled by the loopback transport instead. That substitution is\nwhat an RDS/TCP socket sending to a local address gets, and after it\nthe path init loop still runs for the TCP transport\u0027s RDS_MPATH_WORKERS\npaths and allocates an ordered workqueue for each, while\nrds_loop_conn_alloc() only ever provides transport data for path 0.\n\nrds_conn_destroy() sizes its teardown from c_trans, by then the\nloopback transport, so it visits path 0 only - and\nrds_conn_path_destroy() would skip the other paths anyway, since it\nreturns before destroy_workqueue() for a path without transport data.\nkfree(c_path) then drops the last pointers to seven workqueues. That\nrepeats for every such connection, on every netns teardown or module\nunload, and every distinct local destination address is a separate\nconnection.\n\nRecompute npaths once the transport is final, so that creation and\ndestruction agree on the set of paths. The c_path array stays sized\nfor the caller\u0027s transport; the unused entries are freed with it.\n\nFixes: 4716af3897e9 (\"net/rds: Give each connection path its own workqueue\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260921215027.174657-1-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1a983a4e14c635c40354be110cd9a1a5c94e01e6", "tree": "34bab83130682d046ee59f149ea21b3e6ffcde0d", "parents": [ "5b49efa1e16228921ceeae68d34defc8a4548dcb" ], "author": { "name": "Sang-Hoon Choi", "email": "csh0052@gmail.com", "time": "Tue Sep 22 03:15:59 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:59:32 2026 -0700" }, "message": "nfp: hold IPsec RX state under the XArray lock\n\nnfp_net_ipsec_rx() drops the XArray lock before taking a reference to the\nxfrm_state it found. The delete path can erase the entry and drop the last\nstate reference in that interval. RX can then try to increment a zero\nrefcount after the state has been queued for destruction.\n\nThe driver queues firmware invalidation asynchronously; the delete path\ndoes not wait for the command to complete or drain pending RX processing.\n\nThe XFRM garbage collector waits for an RCU grace period before freeing\nthe state. That delays reclamation but does not make acquiring a reference\nfrom zero valid.\n\nTake the xfrm_state reference before releasing the XArray lock so\nxa_erase() cannot run between lookup and reference acquisition.\n\nFixes: 57f273adbcd4 (\"nfp: add framework to support ipsec offloading\")\nReported-by: Changyul Lee \u003clcy8047@gmail.com\u003e\nSigned-off-by: Sang-Hoon Choi \u003ccsh0052@gmail.com\u003e\nLink: https://patch.msgid.link/179001455912.44752.17153022439349797877.idr-bug-92@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5b49efa1e16228921ceeae68d34defc8a4548dcb", "tree": "49ea2e553d48cb7c37bc2b3c297d2829d1b4bb2f", "parents": [ "a08b39c5d5735a3bf3932c50ae2cef41857077c6", "9476b4468862927297c94c440863cd8ed1e7cc83" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:57 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:57 2026 -0700" }, "message": "Merge branch \u0027net-ena-fix-resource-cleanup-on-probe-failure\u0027\n\nGuangshuo Li says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: ena: fix resource cleanup on probe failure\n\nThis series fixes two resource leaks in the ena_probe() error path after\nena_device_init() has successfully initialized device resources.\n\nPatch 1 adds the missing PHC cleanup.\nPatch 2 adds the missing MMIO read request cleanup.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260921154202.471662-1-lgs201920130244@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9476b4468862927297c94c440863cd8ed1e7cc83", "tree": "49ea2e553d48cb7c37bc2b3c297d2829d1b4bb2f", "parents": [ "0958ea4355e2e9220ad4e13da3b7d94f365ed34f" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Mon Sep 21 23:42:02 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:55 2026 -0700" }, "message": "net: ena: fix MMIO read buffer leak on probe failure\n\nena_device_init() initializes the MMIO read mechanism with\nena_com_mmio_reg_read_request_init(), which allocates a coherent DMA\nbuffer for MMIO read responses.\n\nThe normal removal path releases this buffer through\nena_com_mmio_reg_read_request_destroy(). However, if ena_probe() fails\nafter ena_device_init() succeeds, the error path destroys the admin\nresources and eventually frees ena_dev without destroying the MMIO read\nrequest, leaving the coherent DMA buffer allocated.\n\nCall ena_com_mmio_reg_read_request_destroy() in the probe error path\nbefore releasing the remaining device resources.\n\nThis issue was found by manual code inspection.\n\nFixes: 1738cd3ed342 (\"net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nLink: https://patch.msgid.link/20260921154202.471662-3-lgs201920130244@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0958ea4355e2e9220ad4e13da3b7d94f365ed34f", "tree": "e95c06fefb48b50ed31f2076c92801ab53e9a4c8", "parents": [ "a08b39c5d5735a3bf3932c50ae2cef41857077c6" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Mon Sep 21 23:42:01 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:55 2026 -0700" }, "message": "net: ena: fix PHC cleanup on probe failure\n\nena_probe() initializes the PHC as part of ena_device_init(), but the\nprobe failure path does not destroy it before freeing the PHC private\ndata.\n\nThe normal removal path calls ena_phc_destroy() through\nena_destroy_device() before ena_phc_free(). However, if probe fails\nafter ena_device_init() succeeds, the error path reaches ena_phc_free()\nwithout unregistering the PTP clock or destroying the device PHC\nresources.\n\nCall ena_phc_destroy() in the probe error path before freeing the PHC\nprivate data.\n\nThis issue was found by manual code inspection.\n\nCc: stable@vger.kernel.org tags and describe this as a consistency cleanup\nFixes: e0ea34158ee8 (\"net: ena: Add PHC support in the ENA driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nCc: stable\nLink: https://patch.msgid.link/20260921154202.471662-2-lgs201920130244@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a08b39c5d5735a3bf3932c50ae2cef41857077c6", "tree": "08bf9a0c01ce4367fafe9f6b81df3d572b9c8cdb", "parents": [ "33a61f09232bbbc5db9ded09bf85f4b9b5744c04", "dad19b59da050cb60d3f7023dac2a042a84bf0bd" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:04 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:05 2026 -0700" }, "message": "Merge branch \u0027ovs-net-sched-fixes-for-uaf-after-conntrack-extension-realloc\u0027\n\nIlya Maximets says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\novs, net/sched: fixes for UAF after conntrack extension realloc\n\nOne clean up change plus two fixes for the UAF on helper extension\nrealloc x 2. First half for OVS and the second half for the similar\ncode in act_ct. This should cover all the known cases of this problem\nin these two modules.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260921145655.3167436-1-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dad19b59da050cb60d3f7023dac2a042a84bf0bd", "tree": "08bf9a0c01ce4367fafe9f6b81df3d572b9c8cdb", "parents": [ "00df72e39f306e2f7adb68528a5c92109da6a0a9" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:48 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:02 2026 -0700" }, "message": "net/sched: act_ct: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -\u003e nf_ct_helper()\n -\u003e helper-\u003ehelp()\n -\u003e nf_ct_expect_related_report()\n -\u003e nf_ct_expect_insert()\n -\u003e hlist_add_head_rcu(\u0026exp-\u003elnode, \u0026master_help-\u003eexpectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that\u0027s not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway.\n\nFixes: a21b06e73191 (\"net: sched: add helper support in act_ct\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-7-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "00df72e39f306e2f7adb68528a5c92109da6a0a9", "tree": "3756562aa8c9c3ed5be520af59077dca7bfed2f2", "parents": [ "f85009dfcd65e5969526b0db7a49b5413746e630" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:47 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:02 2026 -0700" }, "message": "net/sched: act_ct: remove \u0027add_helper\u0027 dead code\n\nThis variable can only become \u0027true\u0027 when the connection is not\nconfirmed, but it is only checked when it is confirmed. So, it can be\ntreated as being always false and just removed.\n\nFixes: a21b06e73191 (\"net: sched: add helper support in act_ct\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-6-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f85009dfcd65e5969526b0db7a49b5413746e630", "tree": "fb3f76eda2d5e8748a669f6dba07a7242e1f81f7", "parents": [ "1a4151e6be57b098b7a5ebfbde58585e83200cdc" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:46 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:02 2026 -0700" }, "message": "net/sched: act_ct: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up processing both again but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels or run NAT and adds the\n new extension for that breaking the pointer in the expectation\n list causing UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where we need to process both clones without\nmodifications in the same zone. So, let\u0027s just reset the entry in\ncase for some reason we got an skb with a shared one. This doesn\u0027t\naffect any known use cases, but avoids any potential problems with\nsharing and modification of the unconfirmed ct entry.\n\nUnlike openvswitch module, act_ct allows for NAT without commit.\nChanging that would be a uAPI break. So, act_ct needs to reset on NAT\nregardless of the commit flag to avoid reallocation of the extension\nspace. This, however, doesn\u0027t really change the picture for sensible\nnetworking cases as there should be no need to run the same packet\ntwice (before and after the clone) through conntrack without packet\nheader or zone changes and without commit.\n\nThe fixes tag points to the introduction of helpers, since that\u0027s the\nmain UAF trigger for the sharing.\n\nFixes: a21b06e73191 (\"net: sched: add helper support in act_ct\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-5-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1a4151e6be57b098b7a5ebfbde58585e83200cdc", "tree": "7c4feed8cf53f38f69d6cdf6c54216d625b43ad7", "parents": [ "5e6c14dd42a1c1fe938e573dc6c9098145b2b0c4" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:45 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:01 2026 -0700" }, "message": "net: openvswitch: conntrack: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -\u003e nf_ct_helper()\n -\u003e helper-\u003ehelp()\n -\u003e nf_ct_expect_related_report()\n -\u003e nf_ct_expect_insert()\n -\u003e hlist_add_head_rcu(\u0026exp-\u003elnode, \u0026master_help-\u003eexpectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that\u0027s not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway.\n\nFixes: cae3a2627520 (\"openvswitch: Allow attaching helpers to ct action\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-4-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e6c14dd42a1c1fe938e573dc6c9098145b2b0c4", "tree": "a51be25ec871fdbf14d524e15560acaf26de558b", "parents": [ "26b2bd70d22457556e2fa01cbf1192cb1a94d619" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:44 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:01 2026 -0700" }, "message": "net: openvswitch: conntrack: remove \u0027add_helper\u0027 dead code\n\nThis variable can only become \u0027true\u0027 when the connection is not\nconfirmed, but it is only checked when it is confirmed. So, it can be\ntreated as being always false and just removed.\n\nFixes: 3c1860543fcc (\"openvswitch: add nf_ct_is_confirmed check before assigning the helper\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-3-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "26b2bd70d22457556e2fa01cbf1192cb1a94d619", "tree": "add4d4409a93d8e8e7ac9fc4522902413d8de5eb", "parents": [ "33a61f09232bbbc5db9ded09bf85f4b9b5744c04" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:43 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:01 2026 -0700" }, "message": "net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up committing both but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels and adds the new extension\n for that breaking the pointer in the expectation list causing\n UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where committing both clones without modifications\ninto the same zone is needed. So, let\u0027s just reset the entry in case\nfor some reason we got an skb with a shared one during commit. This\ndoesn\u0027t affect any known use cases, but avoids any potential problems\nwith sharing and modification of the unconfirmed ct entry.\n\nThe fixes tag points to the introduction of helpers, since that\u0027s the\nmain UAF trigger for the sharing.\n\nFixes: cae3a2627520 (\"openvswitch: Allow attaching helpers to ct action\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-2-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "33a61f09232bbbc5db9ded09bf85f4b9b5744c04", "tree": "2d3503172121f63ef09798d7f62ea7c8400f55aa", "parents": [ "3173cba1170131816972ed2b6185cb970ba8b747", "006208026819d5e9e5ec07b3e73d95960a059327" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:50:49 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:50:49 2026 -0700" }, "message": "Merge tag \u0027ovpn-net-20260921\u0027 of https://github.com/OpenVPN/ovpn-net-next\n\nAntonio Quartulli says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIncluded fixes:\n* add selftest coverage for peer VPN address validation\n* reject multicast, broadcast and loopback peer VPN addresses, which\n can never identify a peer\n* reject MP peers left with no usable VPN address, as they can never\n be selected for TX\n* reject duplicate peer VPN addresses, which made peer lookup return\n an arbitrary peer\n* fix stale entry left in the VPN address hashtable when an address\n is cleared\n* fix torn IPv6 address read on lockless TX when the unusable local\n source is cleared in place\n* fix torn IPv6 address read on lockless TX when a new local endpoint\n is learned in place\n* fix dst cache being populated with a route resolved from an already\n replaced bind\n* fix stale route being reused after the socket mark or UDP source\n port changed\n* fix bogus validation of an unspecified local source address, which\n must instead be left to route source autoselection\n* fix IPv6 link-local peer endpoints losing their scope id when\n configured via netlink, breaking route lookup\n\n* tag \u0027ovpn-net-20260921\u0027 of https://github.com/OpenVPN/ovpn-net-next:\n selftests: ovpn: validate peer VPN addresses\n ovpn: reject invalid peer VPN addresses\n ovpn: reject multipeer peers without VPN addresses\n ovpn: reject duplicate peer VPN addresses\n ovpn: always unhash old VPN addresses before rehashing\n ovpn: replace bind when clearing stale local source\n ovpn: replace bind when learning local endpoint\n ovpn: validate peer state before caching UDP dst\n ovpn: track UDP socket route key for peer dst cache\n ovpn: skip UDP source validation for unspecified addresses\n ovpn: preserve IPv6 scope id for netlink peer endpoints\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260921102215.3599702-1-antonio@openvpn.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3173cba1170131816972ed2b6185cb970ba8b747", "tree": "961e6baefb38b4633e6a0cc8352928bc62fcde9b", "parents": [ "a940003f44e7e441c228151dd212642152700ec8" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Mon Sep 21 15:15:49 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:40:29 2026 -0700" }, "message": "net: libwx: fix races in Tx timestamp handling\n\nwx-\u003eptp_tx_skb is shared between the Tx path, the PTP auxiliary\nworker and the timestamp cleanup paths. The\nWX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from\nsubmitting timestamp requests, but does not serialize the worker\nagainst cleanup.\n\nAs a result, wx_ptp_clear_tx_timestamp() can free an skb after\nwx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may\nthen pass the freed skb to skb_tstamp_tx() and release the same\nreference again.\n\nThe cleanup path may also clear the in-progress bit while the worker\nis still processing the old skb. This allows the Tx path to publish a\nnew skb which the worker can subsequently overwrite with NULL,\nleaking its reference.\n\nAdd a dedicated spinlock to protect publication and consumption of\nthe Tx timestamp skb. Detach the skb and clear the in-progress bit\nwhile holding the lock, then deliver the timestamp and release the skb\nafter dropping it. Use the same locked cleanup in the quiesce path,\nbut keep the detach there free of register accesses: quiesce runs\nduring PCIe error recovery, where MMIO is not reliable, and it\ndeliberately did not touch the device before. The lock is taken with\ninterrupts disabled, because netpoll can call ndo_start_xmit() with\nhard interrupts already off.\n\nWhen handling a Tx DMA mapping failure, keep the transmit path\nreference until after comparing the skb under the lock. This prevents\nskb address reuse from making the error path mistake a newer timestamp\nrequest for the failed one.\n\nFixes: 06e75161b9d4 (\"net: wangxun: Add support for PTP clock\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nLink: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/6C7EC12D69217315%2B20260818074721.45536-1-jiawenwu%40trustnetic.com\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/77431AF9A0E369F3+20260921071549.1141804-1-jiawenwu@trustnetic.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a940003f44e7e441c228151dd212642152700ec8", "tree": "4e491ab33176cf4658363151cc3350da30c5b785", "parents": [ "f75f21ef36285e5f56ee0c428bd2909ee81165b9" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Mon Sep 21 01:20:44 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:36:05 2026 -0700" }, "message": "net: phylink: record the PHY only once bringup cannot fail\n\nphylink_bringup_phy() stores the PHY in pl-\u003ephydev before its last\nfallible step: on a MAC whose phylink ops implement LPI,\nphy_eee_rx_clock_stop() can fail with a real MDIO error. The callers\nunwind with phy_detach(), which knows nothing about pl-\u003ephydev, so a\npointer to a PHY that is no longer attached outlives the failed\nconnect.\n\nWhat that costs depends on how the caller got here.\nphylink_connect_phy() goes through phylink_attach_phy(), which refuses\nto attach while pl-\u003ephydev is set, turning a transient MDIO error into\na permanent -EBUSY. The SFP path is worse than that: sfp_sm_probe_phy()\nanswers the failure with phy_device_remove() and phy_device_free(), and\nit assigns sfp-\u003emod_phy only past that error return, so nothing clears\npl-\u003ephydev and it is left pointing at a freed phy_device that\nphylink_resolve() and the ethtool helpers go on reading.\nphylink_fwnode_phy_connect() has no such check, so a later connect\noverwrites the stale pointer and hides the problem. A disconnect does\nnot: phylink_disconnect_phy() hands that pointer to phy_disconnect(),\nand the second phy_detach() on the same PHY drops references the first\none already released.\n\nFound while making a DSA port survive a PHY whose driver arrives after\nthe switch probes: keeping the port across a failed connect and\nretrying is what makes this window reachable.\n\nPublish the pointer after the last call that can fail instead of\nunwinding it afterwards. Nothing between the two points reads\npl-\u003ephydev, and the registration that follows cannot fail:\nphy_request_interrupt() falls back to polling on its own. The PHY-side\nstate keeps the order it had, so no MDIO operation moves relative to\nanother.\n\nFixes: 03abf2a7c654 (\"net: phylink: add EEE management\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260920222044.1752860-1-f@lex.la\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f75f21ef36285e5f56ee0c428bd2909ee81165b9", "tree": "a7311bba54a71a7f756e92f4df75dc0eb3c9a100", "parents": [ "fe99bbeee5c5dbd3abc30721a8079ced59649d97" ], "author": { "name": "Ming Wang", "email": "wangming01@loongson.cn", "time": "Sun Sep 20 15:44:59 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:27:47 2026 -0700" }, "message": "net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist\n\nThe MeiG Smart SRM821 5G module (0x2dee:0x4d53) crashes and drops off\nthe USB bus when it receives a Zero Length Packet (ZLP) after sending\nor receiving an NTB of exactly 16384 bytes (tx_max).\n\nAccording to the MBIM specification, devices do not require a ZLP\nif the NTB size is exactly dwNtbOutMaxSize. However, the cdc_mbim\ndriver defaults to sending ZLPs for devices not explicitly whitelisted\nto accommodate non-conformant hardware. This default behavior breaks\nthe strictly conformant MeiG SRM821 module.\n\nAdd this device to the ZLP conformance whitelist (cdc_mbim_info) so\nthe driver will pad the NTB to avoid sending ZLPs, preventing the\ndevice firmware from crashing.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Ming Wang \u003cwangming01@loongson.cn\u003e\nLink: https://patch.msgid.link/20260920074500.826121-1-wangming01@loongson.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "161ea2d4f2a7e784f14b5b0548fcef3e05fc34f8", "tree": "2c682616d9438cfb57b93ccddaa0bc82c884a637", "parents": [ "447cb143d024d97257cefcdb2192e4b7d2fe47ac", "8d5dab574a9585817906bc214087ef29879a76b8" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:21:10 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:21:10 2026 -0700" }, "message": "Merge branch \u0027net-ethernet-oa_tc6-add-reset-gpios-support\u0027\n\nAlessandro Zini says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: ethernet: oa_tc6: add reset-gpios support\n\nThis series adds optional reset GPIO support for OPEN Alliance 10BASE-T1x\nMAC-PHY devices using the OA TC6 library, and documents the property for\nthe Microchip LAN8650/1 MAC-PHY.\n\nPatch 1 documents the optional reset-gpios property for the Microchip\nLAN8650/1.\n\nPatch 2 converts oa_tc6_init() to return an ERR_PTR instead of NULL, so\nthat -EPROBE_DEFER from the GPIO lookup added in patch 3 reaches the\ndriver core instead of being turned into -ENODEV.\n\nPatch 3 implements optional reset GPIO handling in the common oa_tc6\nlibrary. The reset line is requested asserted, kept asserted for 10 us and\n1 ms of settle time is allowed after deassertion for the crystal\noscillator startup, before the OPEN Alliance TC6 communication is started.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260918231450.55966-1-alessandro.zini@siemens.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8d5dab574a9585817906bc214087ef29879a76b8", "tree": "2c682616d9438cfb57b93ccddaa0bc82c884a637", "parents": [ "15358c2c3dca39d83fb372679daf9c79ac6fe9bb" ], "author": { "name": "Alessandro Zini", "email": "alessandro.zini@siemens.com", "time": "Sat Sep 19 01:14:50 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:21:05 2026 -0700" }, "message": "net: ethernet: oa_tc6: add reset-gpios support\n\nOPEN Alliance 10BASE-T1x MAC-PHY Serial Interface specification\n(v1.1, section 8.2) defines an external RESET pin as an optional reset\nsource for the MAC-PHY.\n\nAdd support for an optional reset GPIO in oa_tc6_init(). The GPIO is\nrequested asserted, kept asserted for 10 us and, once deasserted, 1 ms of\nsettle time is allowed for the crystal oscillator startup before the\ninitial TC6 control protection check and software reset are performed.\n\nAs the reset handling lives in the common library, it is available to all\nMAC-PHY devices using oa_tc6_init() that provide an external reset pin.\n\nSuggested-by: Parthiban Veerasooran \u003cparthiban.veerasooran@microchip.com\u003e\nSigned-off-by: Alessandro Zini \u003calessandro.zini@siemens.com\u003e\nLink: https://patch.msgid.link/20260918231450.55966-4-alessandro.zini@siemens.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "15358c2c3dca39d83fb372679daf9c79ac6fe9bb", "tree": "1d7b97a7e4b8d732b759cd3ef3ce302db487d0ab", "parents": [ "7afc23c9884d0cc0e01ecae9638b6c566e09a947" ], "author": { "name": "Alessandro Zini", "email": "alessandro.zini@siemens.com", "time": "Sat Sep 19 01:14:49 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:21:05 2026 -0700" }, "message": "net: ethernet: oa_tc6: return ERR_PTR from oa_tc6_init()\n\noa_tc6_init() returns NULL on failure, so the reason for the failure is\nlost and both callers turn it into a plain -ENODEV. In preparation for\nacquiring an optional reset GPIO, which can return -EPROBE_DEFER when the\nGPIO provider is not available yet, the error code has to reach the driver\ncore, otherwise the SPI device would never be probed again.\n\nConvert oa_tc6_init() to return an ERR_PTR on failure instead of NULL,\nand update the lan865x and adin1140 callers to check with IS_ERR() and\npropagate the error with PTR_ERR().\n\nSigned-off-by: Alessandro Zini \u003calessandro.zini@siemens.com\u003e\nLink: https://patch.msgid.link/20260918231450.55966-3-alessandro.zini@siemens.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7afc23c9884d0cc0e01ecae9638b6c566e09a947", "tree": "a418cc482b6a9448ef98649432fb0aed2a5ba391", "parents": [ "447cb143d024d97257cefcdb2192e4b7d2fe47ac" ], "author": { "name": "Alessandro Zini", "email": "alessandro.zini@siemens.com", "time": "Sat Sep 19 01:14:48 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:21:04 2026 -0700" }, "message": "dt-bindings: net: microchip,lan8650: add reset-gpios property\n\nAdd optional reset-gpios property to describe the connection to the\nhardware RESET_N pin of the LAN8650/1 MAC-PHY.\n\nAcked-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nSigned-off-by: Alessandro Zini \u003calessandro.zini@siemens.com\u003e\nLink: https://patch.msgid.link/20260918231450.55966-2-alessandro.zini@siemens.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fe99bbeee5c5dbd3abc30721a8079ced59649d97", "tree": "a983718e1dd5f2de4f05cfc58217735bea003abf", "parents": [ "26cc0e69cce062cd3aa6fae33074684669c35a71" ], "author": { "name": "Yilin Zhang", "email": "yilinzhang@moonshot.ai", "time": "Thu Sep 24 12:49:00 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:17:10 2026 -0700" }, "message": "tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()\n\nWhen tcp_send_synack() replaces the cloned SYN skb at the head of the\nretransmit queue with a copy, it frees the original with\ntcp_rtx_queue_unlink_and_free() and only repairs tp-\u003ehighest_sack.\ntp-\u003eretransmit_skb_hint keeps pointing at the freed\nskbuff_fclone_cache object.\n\nThe dangling hint is read in tcp_verify_retransmit_hint() and used as\nthe root of the rbtree walk in tcp_xmit_retransmit_queue(). An\nunprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with\nan attacker-supplied ICMP fragmentation-needed message, after which a\nsimultaneous open frees the armed SYN skb:\n\n BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n Read of size 4 at addr ffff88800604d928 by task swapper/1/0\n Call Trace:\n tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)\n tcp_v4_err (net/ipv4/tcp_ipv4.c:587)\n\nSync the hint to the copy.\n\nFixes: c31b70c9968f (\"tcp: Add logic to check for SYN w/ data in tcp_simple_retransmit\")\nReported-by: Kimi Security Team \u003cbug-report@moonshot.ai\u003e\nTested-by: Weiming Shi \u003cshiweiming@moonshot.ai\u003e\nSigned-off-by: Yilin Zhang \u003cyilinzhang@moonshot.ai\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/8a9dff4063a2745653b7e88ceb745d75efa16e68.1790224474.git.yilinzhang@moonshot.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "26cc0e69cce062cd3aa6fae33074684669c35a71", "tree": "b3f83760ecd653ecac8511928c3da0d5ae809c40", "parents": [ "0b2bbfee2bcb80017d4d47e94f8dc92151dcdd6f" ], "author": { "name": "Hui Peng", "email": "benquike@gmail.com", "time": "Mon Sep 21 05:10:01 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:11:56 2026 -0700" }, "message": "mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()\n\nWhen a socket transmits a packet with MCTP_TAG_PREALLOC set,\nmctp_lookup_prealloc_tag() iterates over the per-netns \u0026mns-\u003ekeys list\nand matches netid, req_tag, peer_addr, and manual_alloc, without\nchecking whether tmp-\u003esk \u003d\u003d \u0026msk-\u003esk. This allows any MCTP socket in the\nsame network namespace to use and consume another socket\u0027s preallocated\ntag.\n\nIterate the socket\u0027s own tag list (\u0026msk-\u003ekeys via sklist) instead of the\nnamespace-wide \u0026mns-\u003ekeys list in mctp_lookup_prealloc_tag(), ensuring\nthat only tags allocated by msk are matched.\n\nTested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag\n(0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a\n4-byte message with MCTP_TAG_PREALLOC from socket B in the same network\nnamespace. On the unfixed kernel, sendto(sock_b) using socket A\u0027s\npreallocated tag succeeds (ret \u003d 4); with this patch applied,\nsendto(sock_b) fails with -ENOENT (errno \u003d 2) while sendto(sock_a)\nsucceeds (ret \u003d 4).\n\nFixes: 63ed1aab3d40 (\"mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control\")\nSuggested-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Hui Peng \u003cbenquike@gmail.com\u003e\nLink: https://patch.msgid.link/20260921051002.1656692-1-benquike@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "447cb143d024d97257cefcdb2192e4b7d2fe47ac", "tree": "e93a07bff19555b114ec308e8404556a5c6cdf55", "parents": [ "1c85ea5df86bed136589a2866c22f394020d3fdf", "efc7f4646c1d4d45dd4cdab6a94275484e3287d0" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:28:31 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:28:31 2026 -0700" }, "message": "Merge branch \u0027selftests-drv-net-add-vlan-test\u0027\n\nOvidiu Panait says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nselftests: drv-net: Add VLAN test\n\nThis series adds a selftest that pings over 802.1q, 802.1ad and\nQinQ VLAN interfaces with RX VLAN stripping offloads enabled\nand disabled.\n\nThis series contains only the selftest part of [1].\n\n[1] https://lore.kernel.org/20260908164309.59282-1-ovidiu.panait.rb@renesas.com\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260918112529.96039-1-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "efc7f4646c1d4d45dd4cdab6a94275484e3287d0", "tree": "e93a07bff19555b114ec308e8404556a5c6cdf55", "parents": [ "a57ddd89900480dc90fd9f553f7f71a8e875bf67" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Fri Sep 18 11:25:29 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:28:29 2026 -0700" }, "message": "selftests: drv-net: Add VLAN test\n\nAdd a test that validates ping traffic over VLAN interfaces. It aims\nto catch drivers which mishandle hardware VLAN tag stripping, in\nparticular QinQ.\n\nThree VLAN configurations are covered, each with hardware RX VLAN\nstripping enabled and disabled (via the rx-vlan-offload and\nrx-vlan-stag-hw-parse features):\n- a single 802.1q VLAN interface\n- a single 802.1ad VLAN interface\n- an 802.1q VLAN stacked on top of an 802.1ad interface\n\nThe \"hw\" test variants enable the RX VLAN stripping features supported\nby the device (rx-vlan-offload and rx-vlan-stag-hw-parse), the \"sw\"\ntest variants disable all of them. A test is xfailed if the requested\nconfiguration is not possible.\n\nVLAN insertion offloads are not tested for now.\n\nNETIF\u003dend0 LOCAL_V4\u003d172.16.0.2 REMOTE_V4\u003d172.16.0.3 \\\nREMOTE_TYPE\u003dssh REMOTE_ARGS\u003droot@172.16.0.3 \\\nrun_kselftest.sh -t drivers/net/hw:vlan.py\n TAP version 13\n 1..1\n # timeout set to 0\n # selftests: drivers/net/hw: vlan.py\n # # Interface: end0, driver: st_gmac\n # TAP version 13\n # 1..6\n # ok 1 vlan.test.8021q_hw\n # ok 2 vlan.test.8021q_sw\n # ok 3 vlan.test.8021ad_hw\n # ok 4 vlan.test.8021ad_sw\n # ok 5 vlan.test.qinq_hw\n # ok 6 vlan.test.qinq_sw\n # # Totals: pass:6 fail:0 xfail:0 xpass:0 skip:0 error:0\n ok 1 selftests: drivers/net/hw: vlan.py\n # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0\n\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20260918112529.96039-4-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a57ddd89900480dc90fd9f553f7f71a8e875bf67", "tree": "2e30958abedb09ded01d8000b109c273d90dfa10", "parents": [ "d3630df401a8ee91117db26b14a64520aa44fbdb" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Fri Sep 18 11:25:28 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:28:28 2026 -0700" }, "message": "selftests: drv-net: Check the features set by set_ethtool_feat()\n\nRead back the features after running ethtool -K to check if they were\nactually applied. The drivers might refuse to set a feature silently and\nthe test could run with a different configuration than the requested one.\n\nAdd a \u0027check\u0027 parameter to skip this, as the GRO \"hw\" mode handles the\ncase where HW GRO is cleared by the driver.\n\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20260918112529.96039-3-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d3630df401a8ee91117db26b14a64520aa44fbdb", "tree": "4f4a6bb75c67254ca67f69e4a792e276d59fe643", "parents": [ "1c85ea5df86bed136589a2866c22f394020d3fdf" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Fri Sep 18 11:25:27 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:28:28 2026 -0700" }, "message": "selftests: drv-net: Move _set_ethtool_feat() into lib\n\nMove the _set_ethtool_feat() helper from gro_lib.py into lib, so that it\ncan be reused by the VLAN test added in the next commit. Drop the leading\nunderscore, now that the helper is exported.\n\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20260918112529.96039-2-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5fc5768c7ca92895ccd1de94dc521e5a55ae7896", "tree": "1cbd495c00e921b5ce48bce2040f92723a9a3979", "parents": [ "f49a343b305c0b6c19a3b50c0bbf10bcd0e2e8fd", "1b1dca56828f33bc5e39b930ebed062e77fbe3b2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 08:25:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 08:25:26 2026 -0700" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Fix bpf_skb_change_tail() to drop the checksum offload instead of\n rejecting the trim of CHECKSUM_PARTIAL skbs (Daniel Borkmann)\n\n - Add KF_PERFMON kfunc flag and require CAP_PERFMON for kfuncs that\n read arbitrary memory and for untrusted read-only memory reads\n (Daniel Borkmann)\n\n - Clear scalar delta on narrowing stack spill (Daniel Borkmann)\n\n - Set up the frame pointer for the exception callback in arm64 JIT, and\n zero-fill other CPUs when BPF_F_CPU update creates a per-cpu hash\n element (Donggeun Yoo)\n\n - Various fixes (Emil Tsalapatis):\n - Fix bounds check underflow for skb-backed dynptrs\n - Fix rx_queue_mapping context access code generation in bpf_sock\n - Reject packet pointer arguments to subprogs that may mutate the\n packet\n - Reject ALU instructions that see arena and non-arena operands on\n different code paths\n\n - Fix copied_seq double-counting on sockmap self-redirect\n (Geliang Tang)\n\n - Fix divide-by-zero in btf_struct_walk() on a flexible array of\n zero-sized elements, fix out-of-bounds read of rtt_min in sock_ops\n (Jiayuan Chen)\n\n - Fix bpf_sock_destroy() out-of-bounds read of sk_protocol on TIME_WAIT\n and request socks, and sleeping under RCU when destroying a listener\n with pending children (Jiayuan Chen)\n\n - Fix JEQ/JNE with immediate operand in MIPS32 JIT and missing zero\n extension of BSWAP 16/32 in MIPS64 JIT (Johan Almbladh)\n\n - Avoid soft lockup in htab lookup[_and_delete] batch operations on\n large maps (Jose Fernandez)\n\n - Various fixes (Kumar Kartikeya Dwivedi):\n - Verify global subprogs in each sleepability context they are\n called from\n - Make post-verification instruction rewrites killable\n - Preserve packet pointer displacement in regsafe()\n - Apply CO-RE relocations before subprogram validation, restrict\n CO-RE poisoning to relocatable instructions, and reject truncated\n ldimm64 CO-RE relocations in libbpf\n - Assign lock identity to callback map values\n - Compare stack frames in regs_exact()\n - Bound ownership depth through local kptrs and graph roots\n\n - Fix u32 overflow in map batch operations when the map size exceeds\n 4GB (Masoud Aghasi)\n\n - Fix UAF in bpf memalloc due to concurrent consumption of ttrace lists\n in alloc_bulk() (Pu Lehui)\n\n - Allow gotox as the terminal instruction of a program or a subprogram\n (Siddharth Chintamaneni)\n\n - Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL, skip unsettled links\n in link iterator, and reject dev-bound-only programs on other devices\n (Weiming Shi)\n\n - Reject non-negative stack offsets in stack_slot_obj_get_spi()\n (Xu Yunxiang)\n\n - Check params size before reading reserved fields in\n bpf_crypto_ctx_create() (Yuqi Xu)\n\n - Reject max_entries \u003e INT_MAX in sock_map_alloc() (Zhao Gongyi)\n\n - Use a 32-bit compare in xsk_map_gen_lookup() (Zhiling Zou)\n\n - Use kvfree() in xdp_test_run_teardown() (Zhixing Chen)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (58 commits)\n selftests/bpf: Test per-cpu initialization of a BPF_F_CPU created element\n bpf: Zero-fill other CPUs when BPF_F_CPU creates a per-cpu hash element\n bpf: Fix BSWAP 32 and 16 on MIPS64\n bpf: Fix immediate JMP JEQ/JNE on MIPS32\n bpf: Reject dev-bound-only programs on other devices\n bpf, sockmap: Reject max_entries \u003e INT_MAX in sock_map_alloc\n selftests/bpf: Test for mixed arena/nonarena code paths\n bpf: Prevent variable arena/non-arena register contents\n selftests/bpf: Test rejection of pkt args to mutating subprogs\n bpf: Reject pkt arguments in mutating subprogs\n selftests/bpf: Add selftests for rx_queue_mapping context access\n bpf: Fix bpf_sock context code generation\n selftests/bpf: Test dynptr slices past end of skb\n bpf: Fix bounds check for skb-backed dynptrs\n selftests/bpf: Reject iterator destruction through fp+0\n bpf: Reject non-negative offsets in stack_slot_obj_get_spi()\n bpf: Check params size before reading reserved fields\n selftests/bpf: Check local object ownership depth\n bpf: Bound ownership depth through local kptrs and graph roots\n selftests/bpf: Cover frame changes in bounded loops\n ...\n" }, { "commit": "0b2bbfee2bcb80017d4d47e94f8dc92151dcdd6f", "tree": "9892ecb81b45e3c167a52d22d17f3e851ed13f50", "parents": [ "7c9f391ec89cb621d7af375ace2eb9a6248e5b9d", "0d80ba0a204c6a16bd7778b50de578dff107c0fe" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:16:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:16:58 2026 -0700" }, "message": "Merge branch \u0027net-dsa-mt7530-fix-two-crashes-on-driver-unbind\u0027\n\nAleksei Sviridkin says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: dsa: mt7530: fix two crashes on driver unbind\n\nUnbinding the MT7530 driver from an MT7531 dereferences NULL in\nregulator_disable(). On a Netcraze NC-1012 (MT7981B + MT7531, 6.18.44):\n\n # echo mdio-bus:1f \u003e /sys/bus/mdio_bus/drivers/mt7530-mdio/unbind\n\noopses there, and the build it was found on sets CONFIG_PANIC_ON_OOPS, so\nthe board goes down with it. Fix that and the same command gets as far as\nmt7530_remove_common(), which disposes interrupt mappings the switch\u0027s own\nregmap-irq chip still owns; the regmap-irq thread then faults in\nhandle_nested_irq() later in the same teardown. rmmod reaches both, since\nmdio_module_driver() calls .remove on module exit.\n\nPatch 1 is the regulator one. mt7530_probe() requests the core and io\nsupplies only for ID_MT7530 and mt7530_setup() enables them under the same\ntest, but mt7530_remove() disables them unconditionally, so on an MT7621 or\nan MT7531 both pointers are still NULL from devm_kzalloc(). It reaches the\nMDIO front end only.\n\nPatch 2 is the interrupt one, and it reaches further.\nmt7530_remove_common() disposes the per-PHY interrupt mappings by hand from\n.remove, while the regmap-irq chip that owns the domain is devm-registered\nand its parent interrupt is only freed once .remove has returned.\nregmap_del_irq_chip() disposes the same mappings itself, in an order that\ncannot race, so the driver\u0027s call adds nothing but a window. That helper is\ncalled from both front ends, so the defect also covers the MMIO parts -\nMT7988, EN7581, AN7583 and EN7528 - which have no regulators and never meet\nthe first defect at all.\n\nThe order is not arbitrary. On an MT7531 the regulator fault happens in the\nfirst thing mt7530_remove() does with the switch, so execution never\nreaches the interrupt defect. The second only became visible once the first\nwas fixed, which is also how both came to be found on one board.\n\nFound and verified there. Without patch 1 the unbind panics in\nregulator_disable(); with patch 1 alone the panic moves on to\nhandle_nested_irq(); with both, three unbind/bind cycles run, two back to\nback and a third after a pause. In the two whose dmesg was captured, each\nunbind removes the switch from the driver directory and takes lan1 to lan4\nwith it, each bind brings them back, and lan1 relinks at 1Gbps/full after\nboth binds, lan4 after the second. uptime rose from 58 to 202 seconds\nacross the three without resetting and pstore gained no new record. The\nthird cycle stayed unbound long enough to read the descriptors: no mt7530\nline in /proc/interrupts and no irq/79, irq/80 or irq/81 directory, and the\nnext bind reuses those three numbers - regmap-irq freeing and disposing\nwhat the driver no longer touches. The kernel under test was identified by\nthe sha256 of its ELF notes section, read from /sys/kernel/notes on the\nrunning board and computed in advance from the flashed image.\n\nWhat hardware could not answer here. There is no MT7530 or MT7621 part on\nthis bench, so the ID_MT7530 branch that patch 1 adds was checked by\nreading the generated code rather than by running it, and no MMIO part was\navailable to exercise patch 2 on that front end either. One unrelated WARN\nremains across the unbind, from sysfs_remove_link() under\ndsa_user_destroy(); it is a separate DSA teardown-ordering defect and is\nnot addressed here.\n\nv1: https://lore.kernel.org/20260914202421.2737079-1-f@lex.la\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260918015020.2518315-1-f@lex.la\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0d80ba0a204c6a16bd7778b50de578dff107c0fe", "tree": "9892ecb81b45e3c167a52d22d17f3e851ed13f50", "parents": [ "c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Fri Sep 18 04:50:20 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:16:53 2026 -0700" }, "message": "net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq\n\nmt7530_remove_common() disposes the per-PHY interrupt mappings from\n.remove, but the regmap-irq chip that owns the domain is devm-registered,\nso its parent interrupt is only freed once .remove has returned. The\nswitch\u0027s own regmap-irq thread can therefore still dispatch on a mapping\nthat is already gone: irq_find_mapping() returns 0, irq_to_desc() returns\nNULL and handle_nested_irq() locks desc-\u003elock without checking it. The\nattached PHYs have not given those interrupts back yet either, which the\nkernel warns about a moment before the fault.\n\nregmap_del_irq_chip() disposes the same mappings itself, after freeing the\nparent interrupt and before removing the domain, so there is nothing left\nfor the driver to do here. Until it runs the descriptors stay alive, and a\nlate dispatch on one of them is harmless: dsa_unregister_switch() has freed\nthe PHY handlers by then, so handle_nested_irq() finds no action and\nreturns.\n\nFixes: 254f6b272e3b (\"dsa: mt7530: Utilize REGMAP_IRQ for interrupt handling\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260918015020.2518315-3-f@lex.la\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4", "tree": "75d9088373b89abf48d6145d0f0e76a768256ab1", "parents": [ "7c9f391ec89cb621d7af375ace2eb9a6248e5b9d" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Fri Sep 18 04:50:19 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:16:53 2026 -0700" }, "message": "net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621\n\nThe core and io supplies are only requested for ID_MT7530: both the\ndevm_regulator_get() in probe and the regulator_enable() in\nmt7530_setup() are guarded by the switch id, but mt7530_remove()\ndisables them unconditionally. On an MT7621 or an MT7531 both pointers\nare still NULL from devm_kzalloc(), so rmmod or a sysfs unbind calls\nregulator_disable() on NULL.\n\nFixes: ddda1ac116c8 (\"net: dsa: mt7530: support the 7530 switch on the Mediatek MT7621 SoC\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260918015020.2518315-2-f@lex.la\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1b1dca56828f33bc5e39b930ebed062e77fbe3b2", "tree": "b4c1f3429aa6f6e4dfb178c39ae2786165d031ad", "parents": [ "8110ba09777873443db286b3cbb89b0e6311c554", "3422808f4e959266ea7790101ac90b8341f48226" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Sep 24 14:24:52 2026 +0000" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Sep 24 14:25:01 2026 +0000" }, "message": "Merge branch \u0027bpf-fix-per-cpu-initialization-of-a-bpf_f_cpu-created-hash-element\u0027\n\nDonggeun Yoo says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: fix per-cpu initialization of a BPF_F_CPU created hash element\n\nA BPF_F_CPU update that creates a [lru_]percpu_hash element writes the\nnamed CPU\u0027s slot and leaves the others holding the recycled element\u0027s\nvalues, so a lookup of the new key returns a deleted key\u0027s per-cpu\nvalues.\n\nPatch 1 zero-fills the other CPUs. Patch 2 adds the selftest: the\nexisting cpu_flag subtests always prime a key with BPF_F_ALL_CPUS\nfirst, so the create path is not covered today.\n\nv1: https://lore.kernel.org/bpf/20260920093153.439743-1-donggeunyoo.kernel@gmail.com/\nv2: https://lore.kernel.org/bpf/20260923000801.1764758-1-donggeunyoo.kernel@gmail.com/\n\nChanges in v3:\n - patch 1: key init_cpu on BPF_F_CPU rather than on onallcpus (Leon\n Hwang)\n - patch 1: re-flow the paragraph naming pcpu_copy_value() (BPF CI AI\n review)\n - patch 2: pin the thread across the delete and the create, and name a\n CPU other than the pinned one, so the BPF_F_NO_PREALLOC arm does not\n depend on staying put (BPF CI AI review)\n\nChanges in v2:\n - patch 1: cover the BPF_F_CPU entry condition in the block comment\n above pcpu_init_value() (BPF CI AI review, Alexei Starovoitov)\n - patch 2: skip the new subtests instead of failing them on a\n uniprocessor machine (Sashiko AI review)\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260924102321.2120434-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "3422808f4e959266ea7790101ac90b8341f48226", "tree": "b4c1f3429aa6f6e4dfb178c39ae2786165d031ad", "parents": [ "c3a66e5f5bab3912e9f84223c5a982bf4333d5a1" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Thu Sep 24 19:23:21 2026 +0900" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Sep 24 14:24:52 2026 +0000" }, "message": "selftests/bpf: Test per-cpu initialization of a BPF_F_CPU created element\n\nThe existing cpu_flag subtests always prime a key with BPF_F_ALL_CPUS\nbefore any BPF_F_CPU write, so the create path is never covered.\n\nAdd a subtest that creates the element with BPF_F_CPU on a map with\nmax_entries 1, so the key can only reuse the element the previous key\nreleased, and check that the CPUs the update did not name read back\nzero. Run it for PERCPU_HASH preallocated and BPF_F_NO_PREALLOC,\nwhose per-cpu areas come from different allocators, and for\nLRU_PERCPU_HASH.\n\nUnder BPF_F_NO_PREALLOC the reuse is only guaranteed on the cpu that\nran the delete, so pin the thread across the pair, and name a cpu other\nthan that one in map_flags.\n\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nLink: https://patch.msgid.link/20260924102321.2120434-3-donggeunyoo.kernel@gmail.com\n" } ], "next": "c3a66e5f5bab3912e9f84223c5a982bf4333d5a1" }