)]}' { "log": [ { "commit": "835912998ca54a76b5c57f8c8459a86b1b45de40", "tree": "ddf6334b015d9e8304b3b2c1b5d68414c4b21401", "parents": [ "f9a11716c8445b496e9fafeec7e8412d384d02e2", "dcf413245c8c2351f7f80502f89c344256f61a66" ], "author": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Oct 20 07:41:14 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Oct 20 07:41:14 2026 +0200" }, "message": "Merge branch \u0027xfrm: state: exact mark/mask match for control-plane SA lookups\u0027\n\nAntony Antony says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nWhile looking into a XFRM_MSG_MIGRATE_STATE issue reported by Sashiko,\nwe found the underlying problem generalizes: xfrm allows multiple SAs\nto coexist for the same (SPI, daddr, proto) differing only in mark,\nand every netlink method that resolves \"which SA\" - xfrm get_sa(),\ndel_sa(), update, get_ae, new_ae, expire, migrate - uses the same\nwildcard mark match the data path needs. A broader-mask SA can\nsilently shadow a more specific one:\n\n # ip xfrm state add ... spi 0x1000 mark 1 mask 1 (SA_target)\n # ip xfrm state add ... spi 0x1000 mark 0 mask 0\n (SA_decoy, catch-all, added after -\u003e bucket head)\n # ip xfrm state delete dst ... proto esp spi 0x1000 mark 1 mask 1\n -\u003e deletes SA_decoy; SA_target survives, untouched\n\nxfrm policy had the same bug, fixed in commit 4f47e8ab6ab7\n(\"xfrm: policy: match with both mark and mask on user interfaces\").\n\nNetlink state lookups using spi use an exact mark/mask match except\nfor UPDSA; the wildcard match stays for the data path and state_add only.\nThis series applies that fix across every affected method,\nnot just XFRM_MSG_MIGRATE_STATE.\n\nAlso reject marks with value bits outside the mask (state ADD,\nALLOCSPI, policy ADD, MIGRATE_STATE new mark). These are\nmisconfigurations anyway, since the extra bits can never match, and\nbreak exact match added here.\n\nThis series does not touch PF_KEY, which no longer receives\nnon-critical fixes.\n\nstate_lookup_byaddr is out of scope. This is only fixing spi based\nlookups.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "dcf413245c8c2351f7f80502f89c344256f61a66", "tree": "ddf6334b015d9e8304b3b2c1b5d68414c4b21401", "parents": [ "24bc5e549913c37fa30693fd3a62a16757c14327" ], "author": { "name": "Antony Antony", "email": "antony.antony@secunet.com", "time": "Wed Oct 07 11:36:08 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Oct 19 08:02:09 2026 +0200" }, "message": "docs: xfrm: include mark in XFRM_MSG_MIGRATE_STATE EEXIST tuple\n\nDocument mark as part of the EEXIST tuple and update the SA lookup\ndescription to match.\n\nFixes: c13c0cc6f52e (\"xfrm: add documentation for XFRM_MSG_MIGRATE_STATE\")\nSigned-off-by: Antony Antony \u003cantony.antony@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "24bc5e549913c37fa30693fd3a62a16757c14327", "tree": "7da7853fb5667741c6902264bb1dc5df0049c496", "parents": [ "a46232c697c809aaa2b0ad18157b49d66201fd7f" ], "author": { "name": "Antony Antony", "email": "antony.antony@secunet.com", "time": "Wed Oct 07 11:35:58 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Oct 19 08:02:08 2026 +0200" }, "message": "xfrm: pass extack through to xfrm_init_replay() from xfrm_init_state()\n\nxfrm_init_state() takes an extack parameter but doesn\u0027t pass it to\nxfrm_init_replay(), so replay-window errors can\u0027t be reported via\nextack.\n\nFixes: 231a1744dc43 (\"xfrm: add extack to xfrm_init_state\")\nSigned-off-by: Antony Antony \u003cantony.antony@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "a46232c697c809aaa2b0ad18157b49d66201fd7f", "tree": "f37f62130f69463d906affdb6b14bdf3eeab3507", "parents": [ "da94223774ea012188ef76f89e0bd642b39ba517" ], "author": { "name": "Antony Antony", "email": "antony.antony@secunet.com", "time": "Wed Oct 07 11:35:48 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Oct 19 08:02:07 2026 +0200" }, "message": "xfrm: include mark in MIGRATE_STATE SA collision check\n\nThe SA lookup tuple is (daddr, spi, proto, family, mark), but the\nEEXIST pre-check and the xfrm_state_insert() vs xfrm_state_add()\ndecision only considered daddr and family, ignoring mark.\nA migration that only changes the mark inserts a duplicate SA tuple\ninto the hash tables.\n\nThe collision check is implemented as xfrm_state_mark_collides(),\nwhich walks the SPI hash bucket for the target tuple and excludes the\nstate being migrated by pointer, rather than doing a separate\nexact-match lookup followed by a wildcard lookup and comparing the\nresult against self.\n\nBefore:\nroot@west:~# ip xfrm state add src 10.1.1.1 dst 10.1.1.2 proto esp \\\n spi 0x1000 reqid 100 mode tunnel aead \"rfc4106(gcm(aes))\" \\\n 0x1111111111111111111111111111111111111111 96 \\\n mark 0x1 mask 0xff\n\nroot@west:~# ip xfrm state add src 10.1.1.1 dst 10.1.1.2 proto esp \\\n spi 0x1000 reqid 100 mode tunnel aead \"rfc4106(gcm(aes))\" \\\n 0x1111111111111111111111111111111111111111 96 \\\n mark 0x2 mask 0xff\nroot@west:~# ip xfrm state migrate dst 10.1.1.2 proto esp spi 0x1000 \\\n mark 0x1 mask 0xff \\\n new-dst 10.1.1.2 new-src 10.1.1.1 new-reqid 100 \\\n new-mark 0x2 mask 0xff\nip x s\nsrc 10.1.1.1 dst 10.1.1.2\n proto esp spi 0x00001000 reqid 100 mode tunnel\n replay-window 0\n mark 0x2/0xff\n aead rfc4106(gcm(aes)) 0x1111111111111111111111111111111111111111 96\n anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000\nsrc 10.1.1.1 dst 10.1.1.2\n proto esp spi 0x00001000 reqid 100 mode tunnel\n replay-window 0\n mark 0x2/0xff\n aead rfc4106(gcm(aes)) 0x1111111111111111111111111111111111111111 96\n anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000\n sel src 0.0.0.0/0 dst 0.0.0.0/0\n\nNotice two states with same mark 0x2/0xff.\nAfter:\n\nError: New SA tuple already occupied.\n\nFixes: a9d155ea9b44 (\"xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Antony Antony \u003cantony.antony@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "da94223774ea012188ef76f89e0bd642b39ba517", "tree": "fcb2f8b223085dc61008c2fd31eebc1e0778f3a2", "parents": [ "3eb841b771e81e0692b3ebfc75fdb774022cc4f6" ], "author": { "name": "Antony Antony", "email": "antony.antony@secunet.com", "time": "Wed Oct 07 11:35:39 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Oct 19 08:02:06 2026 +0200" }, "message": "xfrm: fix hw offload state leak on xfrm_do_migrate_state() error path\n\nIn the error path, the cloned state is dropped without removing its\nhardware offload, leaking the offloaded SA entry.\n\nFixes: a9d155ea9b44 (\"xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Antony Antony \u003cantony.antony@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "3eb841b771e81e0692b3ebfc75fdb774022cc4f6", "tree": "9b16b09e4a8b8e942b2f278e0fac1d5de6ee1e64", "parents": [ "6362f459bfc485d805f0439ae4566c1b014abfa4" ], "author": { "name": "Antony Antony", "email": "antony.antony@secunet.com", "time": "Wed Oct 07 11:35:27 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Oct 19 08:02:05 2026 +0200" }, "message": "xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()\n\nA concurrent delete can free the migrated state before\nxfrm_do_migrate_state() finishes using it.\n\nFixes: a9d155ea9b44 (\"xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Antony Antony \u003cantony.antony@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "6362f459bfc485d805f0439ae4566c1b014abfa4", "tree": "7b2819e682d8803ac0e37d4e64aa8d502b47a91b", "parents": [ "b3056e57b0657a4401349187c620d0fa1b8914c8" ], "author": { "name": "Antony Antony", "email": "antony.antony@secunet.com", "time": "Wed Oct 07 11:35:09 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Oct 19 08:02:05 2026 +0200" }, "message": "xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups\n\nAdd __xfrm_state_lookup_exact(); wire it into DELSA/GETSA, GETAE/NEWAE,\nEXPIRE, MIGRATE_STATE. xfrm_state_update() (UPDSA) keeps wildcard match\nbecause ALLOCSPI\u0027s larval state may be unmarked (mark 0/0), so an\nexact-match UPDSA would not find it and the ADD fallback would then\nfail with -EEXIST via xfrm_state_add().\n\nFixes: 3d6acfa7641f (\"xfrm: SA lookups with mark\")\nSigned-off-by: Antony Antony \u003cantony.antony@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "b3056e57b0657a4401349187c620d0fa1b8914c8", "tree": "8f2ea9bbc7ded213f22baa96146795b161439ab5", "parents": [ "07d7b25224f503e76e63eb6947a0b9e0da7998a8" ], "author": { "name": "Antony Antony", "email": "antony.antony@secunet.com", "time": "Wed Oct 07 11:35:00 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Oct 19 08:02:03 2026 +0200" }, "message": "xfrm: policy: reject mark with bits outside its mask on add\n\nSame issue as states: an invalid mark/mask is silently truncated on\ninsert, so GETPOLICY and DELPOLICY can no longer find the policy by\nid. Reject it instead.\n\nThe mark is no longer sanitized on policy insert.\n\nFixes: 0b91fda3a1f0 (\"xfrm: Sanitize marks before insert\")\nCc: \u003cstable+noautosel@kernel.org\u003e # avoid breaking existing userspace ABI\nSigned-off-by: Antony Antony \u003cantony.antony@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "07d7b25224f503e76e63eb6947a0b9e0da7998a8", "tree": "0b516cca18e34f8a5dc6a9d93f55812eb2c3ef4e", "parents": [ "c8c2c8a2bbe4319f63d029d161aaee2b17687371" ], "author": { "name": "Antony Antony", "email": "antony.antony@secunet.com", "time": "Wed Oct 07 11:34:50 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Oct 19 08:02:02 2026 +0200" }, "message": "xfrm: state: reject mark with bits outside its mask on ALLOCSPI\n\nLike state add and policy add in this series, ALLOCSPI rejects a mark\nwhose value has bits outside its mask.\n\nFixes: bd55775c8dd6 (\"xfrm: SA lookups signature with mark\")\nCc: \u003cstable+noautosel@kernel.org\u003e # avoid breaking existing userspace ABI\nSigned-off-by: Antony Antony \u003cantony.antony@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "c8c2c8a2bbe4319f63d029d161aaee2b17687371", "tree": "d5b407598e0c7b56f0155f6e3cbc730ca1b184a4", "parents": [ "f9a11716c8445b496e9fafeec7e8412d384d02e2" ], "author": { "name": "Antony Antony", "email": "antony.antony@secunet.com", "time": "Wed Oct 07 11:34:28 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Oct 19 08:02:02 2026 +0200" }, "message": "xfrm: state: reject mark with bits outside its mask on add\n\nA mark/mask like 0x101/0xff is silently truncated to 0x01/0xff on\ninsert, so the exact-match lookups added later in this series (DELSA,\nGETSA, GETAE, NEWAE, EXPIRE, MIGRATE_STATE) could not find the SA.\nReject it instead.\n\nThe mark is no longer sanitized on state add.\n\nAlso reject an invalid XFRMA_MARK (the new mark) in\nXFRM_MSG_MIGRATE_STATE.\n\nFixes: 0b91fda3a1f0 (\"xfrm: Sanitize marks before insert\")\nCc: \u003cstable+noautosel@kernel.org\u003e # needs exact-match SA lookups from this series\nSigned-off-by: Antony Antony \u003cantony.antony@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "f9a11716c8445b496e9fafeec7e8412d384d02e2", "tree": "1e6342b572654bdc8af1f4c32eaba02e7b3aa9f2", "parents": [ "e35a12dffd5da67b6ca12bd23eebdd0570592205" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Thu Oct 08 14:38:32 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Oct 12 10:40:32 2026 +0200" }, "message": "xfrm: espintcp: reorder operations within espintcp_init_sk\n\nWhen enabled on a socket, espintcp sets the socket callbacks to its\nown before it has finished setting up its context and published it as\nicsk_ulp_data. Any one of those callbacks that gets called before will\ndereference a NULL icsk_ulp_data.\n\nFix this by reording the operations, and add memory barriers to ensure\ncallers will have a struct espintcp_ctx available. Add a few\nWRITE_ONCE/READ_ONCE too while we\u0027re there.\n\nFixes: e27cca96cd68 (\"xfrm: add espintcp (RFC 8229)\")\nCc: stable@vger.kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nReported-by: Peihan Liu \u003cronbogo@outlook.com\u003e\nReported-by: Yilin Zhu \u003czylzyl2333@gmail.com\u003e\nReported-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nReported-by: Eulgyu Kim \u003ceulgyukim@snu.ac.kr\u003e\nReported-by: Jaeyoung Chung \u003cjjy600901@snu.ac.kr\u003e\nLink: https://lore.kernel.org/all/c30b645074a1b379e0f7fe297f917c66137d9964.1778464688.git.zylzyl2333@gmail.com/\nLink: https://lore.kernel.org/all/20260819155349.3555804-1-jjy600901@snu.ac.kr\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "e35a12dffd5da67b6ca12bd23eebdd0570592205", "tree": "7f6d329788bf8f023b8763c9f3464c6aa881ccf1", "parents": [ "86de3a1118a16dbbbe5fabe9aa20ffb93c072ed5" ], "author": { "name": "Shubham Antil", "email": "shubham@octane.security", "time": "Wed Oct 07 13:28:07 2026 +0530" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Oct 12 10:40:31 2026 +0200" }, "message": "xfrm: zero-initialise km_event in the replay-notify path\n\nxfrm_replay_notify(), xfrm_replay_notify_bmp() and\nxfrm_replay_notify_esn() declare a struct km_event on the stack and\ninitialise only its .event and .data.aevent fields, leaving .seq and\n.portid uninitialised. build_aevent() then builds the XFRM_MSG_NEWAE\nmessage with those fields:\n\n nlmsg_put(skb, c-\u003eportid, c-\u003eseq, ...)\n\nso the netlink header of a replay event carries uninitialised stack\nvalues rather than defined ones. This was confirmed at runtime rather\nthan by inspection alone: the .seq and .portid carried in that header\nhold values that nothing in the replay path assigns.\n\nThe request-driven paths set these header fields from the requester\n(xfrm_get_ae() / xfrm_new_ae()); only the kernel-originated replay path\nleaves them unset. Zero-initialise the event so the header fields are 0,\nthe correct value for a kernel-originated notification.\n\nFixes: f8cd54884e67 (\"[IPSEC]: Sync series - core changes\")\nReported-by: Giovanni Vignone \u003cgio@octane.security\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Shubham Antil \u003cshubham@octane.security\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "86de3a1118a16dbbbe5fabe9aa20ffb93c072ed5", "tree": "f14404f687daa6286329df81db277e8cd75639ab", "parents": [ "868f63c8bfafa9b827168c9126f85264c39c02ec" ], "author": { "name": "Qihang", "email": "q.h.hack.winter@gmail.com", "time": "Wed Sep 23 16:41:23 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Wed Sep 30 07:54:33 2026 +0200" }, "message": "xfrm: interface: validate the IP header on xmit\n\nPackets injected into an xfrm interface (e.g. AF_PACKET on an xfrmi\ndevice) reach the xfrm output path without IP header validation, but\nxfrm4_transport_output() uses iph-\u003eihl for __skb_pull() and memmove()\nand expects the header to be valid.\n\nvti_tunnel_xmit() already calls pskb_inet_may_pull() before handing\npackets to the xfrm output path. Do the same in xfrmi_xmit() and\nperform the header checks ip_rcv_core()/ip6_rcv_core() do on entry\nto the IP stack: reject wrong IP versions and malformed IPv4 header\nlengths.\n\nFixes: f203b76d7809 (\"xfrm: Add virtual xfrm interfaces\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nSigned-off-by: Qihang \u003cq.h.hack.winter@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "868f63c8bfafa9b827168c9126f85264c39c02ec", "tree": "a7b3f3757e34666df617f6cca14abecf654b2bea", "parents": [ "c9151088f1674fd29ff26a20f5fc687acf53a2f0" ], "author": { "name": "Chengfeng Ye", "email": "nicoyip.dev@gmail.com", "time": "Thu Sep 03 22:57:34 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Thu Sep 17 08:09:05 2026 +0200" }, "message": "xfrm: retry inexact policy lookup after node reinsertion\n\nAn inexact policy lookup first records pointers to candidate hlist heads\nand then traverses the lists. A concurrent policy insertion can merge\ninexact tree nodes between those operations:\n\n lookup policy insertion\n ------ ----------------\n find inexact candidates\n save obsolete hlist head\n write_seqcount_begin(\u0026bin-\u003ecount)\n merge inexact tree nodes\n hlist_del_rcu(\u0026policy-\u003ebydst)\n reinsert policy-\u003ebydst in survivor\n write_seqcount_end(\u0026bin-\u003ecount)\n evaluate saved candidate list\n miss the moved policy\n\nThe merge immediately reinserts the same hlist node into the surviving\ntree node. RCU keeps the policy alive, but it does not provide a\nconsistent view while its list node is moved. A lookup that selected the\nobsolete list can observe it empty. A lookup already traversing a moved\npolicy can instead follow the next pointer rewritten by the reinsertion.\nEither case can return an incorrect IPsec policy result.\n\nThe per-bin sequence counter already brackets calls to\nxfrm_policy_inexact_insert_node(), including node merges. The read side,\nhowever, currently validates the counter only while searching an\nindividual rb-tree. A successful search returns without validation, and\nthe later candidate-list traversal is outside that read-side section.\n\nSnapshot the per-bin sequence before discovering candidate heads and\nvalidate it after evaluating all candidate lists. Retry the lookup if\nthe inexact policy tree changes while it is being searched.\n\nFixes: 9cf545ebd591 (\"xfrm: policy: store inexact policies in a tree ordered by destination address\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "c9151088f1674fd29ff26a20f5fc687acf53a2f0", "tree": "5d219670a0f060605a7692b25678446a3d1e29b2", "parents": [ "dd56c0bc4836fa705acb2f6a8a44af669d30fa3a", "b4288c59bda883b0e5cd95099dc3b0b7b7fc50f6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 19:18:26 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 19:18:26 2026 -0700" }, "message": "Merge branch \u0027net-psp-avoid-conflicts-with-skb-decrypted-and-sk_validate_xmit_skb\u0027\n\nDaniel Zahka says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: psp: avoid conflicts with skb-\u003edecrypted and sk_validate_xmit_skb()\n\nSashiko\u0027s review of commit da630d1da2b1 (\"netdevsim: psp: drop tx key\nops\") [1] showed that there is a hazard between PSP and offloaded TLS,\nwhere both can clobber what the other set in the sk_validate_xmit_skb\ncallback.\n\nIt was discussed further on the mailing list [2], and it was pointed out\nthat there are conflicts with PSP and TLS ULP both using the\nskb-\u003edecrypted bit.\n\nThe simplest fix is to make psp and tls mutually exclusive. This series\ngoes a bit further and makes psp exclusive with all TCP ULPs. The PSP\nimplementation that we have is not designed to be used with any TCP ULP,\nso don\u0027t allow a socket to have state for both.\n\nI will send a subsequent series to net-next which will remove the\nability to perform the rx-assoc and tx-assoc psp netlink calls on\nsockets that are not in the TCP_ESTABLISHED state. This will close the\nremaining quirk that a sk_clone() on a listen socket with psp tx-assoc\nstate will leave a stale sk-\u003esk_validate_xmit_skb call back on a new,\nnon-psp socket. I do not believe that change needs to be regarded as a\nfix, because it only stands to add unecessary validation code in the tx\npath.\n\n[1]: https://sashiko.dev/#/patchset/20260903-psp-prep-v1-0-d47e9c4c375d%40gmail.com\n[2]: https://lore.kernel.org/netdev/20260903-psp-prep-v1-0-d47e9c4c375d@gmail.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260915-psp-ktls-fix-v2-0-0eedc3b148ec@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b4288c59bda883b0e5cd95099dc3b0b7b7fc50f6", "tree": "5d219670a0f060605a7692b25678446a3d1e29b2", "parents": [ "a41f24c612c3f5139a3143307eb85bbcf1bd4d07" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Tue Sep 15 16:11:38 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 19:18:24 2026 -0700" }, "message": "selftests: drv-net: psp: test PSP and TCP ULP mutual exclusion\n\nTest both setting PSP after TLS ULP, and TLS ULP after PSP.\n\nAdd CONFIG_TLS\u003dy to the drivers/net/config.\n\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260915-psp-ktls-fix-v2-2-0eedc3b148ec@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a41f24c612c3f5139a3143307eb85bbcf1bd4d07", "tree": "22b3d797f7db3ae3178d621d07d4b12faac0ffea", "parents": [ "dd56c0bc4836fa705acb2f6a8a44af669d30fa3a" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Tue Sep 15 16:11:37 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 19:18:24 2026 -0700" }, "message": "net: psp: avoid conflicts with skb-\u003edecrypted and sk_validate_xmit_skb()\n\nPSP conflicts with TLS ULP in its usage of both skb-\u003edecrypted and\nsk-\u003esk_validate_xmit_skb().\n\nMake PSP mutually exclusive with TLS ULP, the only other user of either\nof these. As other users of skb-\u003edecrypted come along, they can be added\nto sk_has_decrypt_user(). It would make sense to also assert that\nsk-\u003esk_validate_xmit_skb() is also NULL in both of these setup paths for\nsimilar future proofing, but the PSP listener/sk_clone() path is still\nbroken and it could be seen as a regression to not allow rx assoc to run\non a child of a listener socket with PSP tx assoc state.\n\nInclude all TCP ULPs in the sk_has_decrypt_user() check, even though TLS\nis the only one that conflicts with PSP via the decrypted bit. This is\nintentional because PSP was not designed to be used with ULPs. It is\nbest to close off surface area that may make bugs reachable, until\nsomeone wishes to design and test an actual user of PSP with ULPs.\n\nFixes: 6b46ca260e22 (\"net: psp: add socket security association code\")\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260915-psp-ktls-fix-v2-1-0eedc3b148ec@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dd56c0bc4836fa705acb2f6a8a44af669d30fa3a", "tree": "8739d044c65312677c3c76fb5457247d54d9e9e6", "parents": [ "c7ead9704249d57d4693a04697e3bbd285138fa9", "02fffd1939f6b45892f61822459953ce95e42948" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 19:07:16 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 19:07:17 2026 -0700" }, "message": "Merge branch \u0027net-stmmac-restore-previous-state-if-tc_setup_dwmac510_mqprio-fails\u0027\n\nLorenzo Bianconi says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: stmmac: restore previous state if tc_setup_dwmac510_mqprio() fails\n\nRestore previous mqprio qdisc configuration if\ntc_setup_dwmac510_mqprio() fails running the following configuration:\n\n $tc qdisc add dev eth0 root handle 1: mqprio queues 2@0 2@2\n $tc qdisc replace dev eth0 root handle 2: mqprio queues 2@0 2@2 fp E P\n\nPropagate FPE preemption-class mapping errors in\ntc_setup_dwmac510_mqprio() and tc_taprio_configure().\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260911-stmmac-tc_setup_dwmac510_mqprio-error-path-v3-0-a76b1e2547c1@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "02fffd1939f6b45892f61822459953ce95e42948", "tree": "8739d044c65312677c3c76fb5457247d54d9e9e6", "parents": [ "90e4b849dfa6fc8e6c050bcfe1b331b69c015d28" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Fri Sep 11 10:58:30 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 19:07:13 2026 -0700" }, "message": "net: stmmac: preserve real_num_tx_queues on mqprio setup failure\n\nWith the FPE preemption-class mapping error now propagated from\nstmmac_fpe_map_preemption_class(), tc_setup_dwmac510_mqprio() can fail\non the mapping step. The error path used to call stmmac_reset_tc_mqprio(),\nwhich resets the number of real TX queues to priv-\u003eplat-\u003etx_queues_to_use\n(the platform maximum), overwriting the value that was active before the\noffload was attempted (for example a lower count left over from a previous\nmqprio configuration).\n\nThe issue can be triggered using the following configuration:\n\n # First mqprio config lowers the hw queue count below the platform\n # default (e.g. 8 TX queues).\n $tc qdisc add dev eth0 root handle 1: mqprio queues 2@0 2@2\n\n # Replace mqprio configuration with a second one that fails FPE\n # preemption-class mapping. stmmac driver resets the real_num_tx_queues\n # to the platform maximum, losing the previous configuration.\n $tc qdisc replace dev eth0 root handle 2: mqprio queues 2@0 2@2 fp E P\n\nSave ndev-\u003ereal_num_tx_queues before lowering it and restore it,\ntogether with the TC-to-queue and priority-to-TC mappings, when the FPE\npreemption-class mapping fails, instead of resetting the queue count to\nthe platform maximum.\n\nNote that a failed setup makes the qdisc layer run mqprio_destroy() on\nthe new qdisc. Because priv-\u003ehw_offload is only assigned after\nndo_setup_tc() succeeds, mqprio_destroy() calls netdev_set_num_tc(dev, 0),\nso dev-\u003enum_tc ends up 0 regardless of the driver-side restore and the\nprevious qdisc is not reactivated. The restore is still needed to keep\nreal_num_tx_queues and to avoid leaving the failed configuration\u0027s\nTC-to-queue and priority-to-TC mappings in place.\n\nFixes: 195e4f409a40 (\"net: stmmac: support fp parameter of tc-mqprio\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260911-stmmac-tc_setup_dwmac510_mqprio-error-path-v3-2-a76b1e2547c1@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "90e4b849dfa6fc8e6c050bcfe1b331b69c015d28", "tree": "025cabcbcf5c45d659cceeeb60db45cf0a8d7307", "parents": [ "c7ead9704249d57d4693a04697e3bbd285138fa9" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Fri Sep 11 10:58:29 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 19:07:13 2026 -0700" }, "message": "net: stmmac: propagate FPE preemption-class mapping errors\n\nstmmac_fpe_map_preemption_class() dispatches through the\nstmmac_do_void_callback() helper, which forces the callback\u0027s return\nvalue to 0 whenever the op pointer is populated. As a result the\n-EINVAL returned by dwmac5_fpe_map_preemption_class() (e.g. when a\npreemptible TC owns more than one TXQ under SP scheduling) is silently\nswallowed by every caller.\n\nSwitch the dispatch macro to stmmac_do_callback() so the callback\u0027s real\nresult is propagated, and honour it in the taprio and mqprio qdisc\noffload.\n\nNote that the taprio \"if (ret)\" check in tc_taprio_configure() used to\nbe dead code and now becomes live: a preemptible TC spanning more than\none TXQ under SP scheduling cannot be programmed in hardware, so a\ntaprio or mqprio configuration that previously returned success while\nleaving the preemption-class register unprogrammed now fails with\n-EINVAL. For taprio, the failure also runs the disable path, tearing\ndown the schedule that was just installed; this is the intended\nbehaviour.\n\nFixes: 195e4f409a40 (\"net: stmmac: support fp parameter of tc-mqprio\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260911-stmmac-tc_setup_dwmac510_mqprio-error-path-v3-1-a76b1e2547c1@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c7ead9704249d57d4693a04697e3bbd285138fa9", "tree": "f538181ad1f21091e6c20044be43271b5e26376d", "parents": [ "31550d585589fde1ae95bf7f7a8188b2d2fdf1c7" ], "author": { "name": "Guanglei Zhu", "email": "zhugl3@xiaopeng.com", "time": "Fri Sep 11 10:17:34 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 18:58:45 2026 -0700" }, "message": "net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()\n\nThe netif index carried in the DPMAIF PIT header is five bits wide,\nbut ccmni_inst[] only has room for NIC_DEV_MAX (21) entries.\nt7xx_ccmni_recv_skb() indexes the array without a bounds check, so\nindexes 21 to 31 read past it. The out-of-bounds value lands in the\ncallback table that follows the array, which is never NULL, so the\nexisting !ccmni check does not catch it and the driver dereferences\nwhatever sits there as a struct t7xx_ccmni.\n\nDrop the skb when the index is out of range.\n\nFixes: 05d19bf500f8 (\"net: wwan: t7xx: Add WWAN network interface\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guanglei Zhu \u003czhugl3@xiaopeng.com\u003e\n\nVerified in a QEMU guest with a fault injector setting the netif\nindex to 25: the unpatched driver reads a value past ccmni_inst[],\nwhich lands in the callback table, and dereferences it far enough to\nqueue the skb. With this check the packet is dropped. Well-formed\ntraffic on index 0 is unaffected.\n\nChanges in v2: none.\n\nLink: https://patch.msgid.link/20260911021734.1396599-3-zhugl3@xiaopeng.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "31550d585589fde1ae95bf7f7a8188b2d2fdf1c7", "tree": "525662aacb0d71e4caaa2c2baeabb32d0def6304", "parents": [ "5d063822ac5184939c1ed377a339a01d8ae814e8" ], "author": { "name": "Guanglei Zhu", "email": "zhugl3@xiaopeng.com", "time": "Fri Sep 11 10:17:33 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 18:58:45 2026 -0700" }, "message": "net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value\n\nmhi_mbim_rx() ignores the return value of skb_copy_bits() when it\ncopies each datagram out of the NTB. The datagram offset and length\ncome from the DPE, which is only checked to lie within the NTB\nitself, so a modem can point a datagram outside the received skb.\nThe copy then fails and the freshly allocated skbn is passed to\nnetif_rx() with its uninitialized contents still in place, leaking\nkernel heap memory into the network stack.\n\nFree the skb and account an error when the copy fails.\n\nFixes: aa730a9905b7 (\"net: wwan: Add MHI MBIM network driver\")\nCc: stable@vger.kernel.org\nSuggested-by: Loic Poulain \u003cloic.poulain@oss.qualcomm.com\u003e\nSigned-off-by: Guanglei Zhu \u003czhugl3@xiaopeng.com\u003e\n\nVerified in a QEMU guest with a fault injector pointing a DPE\noutside the received NTB: the copy fails, and the unpatched driver\nhands the uninitialized skbn to the network stack (observed as\n\"unknown protocol\" on bytes that were never written). With this\ncheck the failed datagram is dropped and counted as an rx error.\n\nChanges in v2: factor the free-and-count sequence out into\nmhi_mbim_rx_drop(), shared with the unknown-protocol path, as\nsuggested by Loic Poulain.\n\nLink: https://patch.msgid.link/20260911021734.1396599-2-zhugl3@xiaopeng.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5d063822ac5184939c1ed377a339a01d8ae814e8", "tree": "dc1e4b225ebf452ca0e1df1851c763a099fed31a", "parents": [ "1dd85662fee6e2ac580b1c4f9a0c0a7ae6e31f0e" ], "author": { "name": "Guanglei Zhu", "email": "zhugl3@xiaopeng.com", "time": "Fri Sep 11 10:17:32 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 18:58:45 2026 -0700" }, "message": "net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain\n\nThe NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is\nzero. Nothing requires the offsets to advance, so a modem that\npoints an NDP at itself, or at an earlier NDP, keeps the loop\nspinning forever on one CPU.\n\nBreak out when the next NDP offset is not larger than the current\none.\n\nFixes: aa730a9905b7 (\"net: wwan: Add MHI MBIM network driver\")\nCc: stable@vger.kernel.org\nSuggested-by: Loic Poulain \u003cloic.poulain@oss.qualcomm.com\u003e\nSigned-off-by: Guanglei Zhu \u003czhugl3@xiaopeng.com\u003e\n\nVerified in a QEMU guest with a fault injector feeding the driver\u0027s\nreceive callback an NTB whose single NDP points at itself: the\nunpatched driver spins in mhi_mbim_rx() with one CPU pinned at 100%\nand the thread never returns. With this check the loop terminates\nwithin one iteration.\n\nChanges in v2: move the non-increasing check to the wNextNdpIndex\nretrieval site, as suggested by Loic Poulain, instead of tracking\nthe previous offset in a separate variable.\n\nLink: https://patch.msgid.link/20260911021734.1396599-1-zhugl3@xiaopeng.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1dd85662fee6e2ac580b1c4f9a0c0a7ae6e31f0e", "tree": "847466aa49afd77852fc130f4552a1a063793cc7", "parents": [ "9ed55f3dbef4f4adfe65eb03b0c35c53229a8490" ], "author": { "name": "Linus Walleij", "email": "linusw@kernel.org", "time": "Mon Sep 14 23:26:41 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 17:44:40 2026 -0700" }, "message": "net: ethernet: cortina: Ack RX overrun interrupt correctly\n\nThe RX overrun interrupt is reported in interrupt status register 4, but\ngmac_irq() acknowledges it using the RX descriptor error bit from status\nregister 0. For GMAC0 this writes the GMAC1 overrun bit, while for GMAC1\nthe shift leaves no bit in the 32-bit register.\n\nAcknowledge the same per-port RX overrun bit that was detected.\n\nFixes: 4d5ae32f5e1e (\"net: ethernet: Add a driver for Gemini gigabit ethernet\")\nSigned-off-by: Linus Walleij \u003clinusw@kernel.org\u003e\nLink: https://patch.msgid.link/20260914-b4-gemini-ethernet-fixes-2-v2-1-5ab39a047b90@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9ed55f3dbef4f4adfe65eb03b0c35c53229a8490", "tree": "5abd684d4d5ac2ca313f03418ea785f002abc211", "parents": [ "490599ab23134962a6d18a024e84541d77bdb999" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 15 04:30:54 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 17:34:56 2026 -0700" }, "message": "net: lock the socket in sock_gettstamp()\n\nsk-\u003esk_flags must only be changed while holding the socket lock,\nbecause sock_set_flag() and sock_reset_flag() use non atomic\noperations (__set_bit() and __clear_bit()).\n\nsock_gettstamp() is one of the last places where a bit of sk-\u003esk_flags\nis changed from a syscall without owning the socket lock, through\nsock_enable_timestamp(sk, SOCK_TIMESTAMP).\n\nsk_set_memalloc() and sk_clear_memalloc() also change sk-\u003esk_flags\nwithout the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp,\nsunrpc, wireguard) need a careful audit, this will be addressed in a\nseparate patch.\n\nJungwoo Lee and Wongi Lee reported an UDP socket use-after-free\ncaused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind()\ncan cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set,\nbecause both threads perform a read-modify-write on the same word.\n\n CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW)\n -------------------------------- ----------------------------\n read sk_flags \u003d F read sk_flags \u003d F\n compute F | BIT(SOCK_RCU_FREE) compute F | BIT(SOCK_TIMESTAMP)\n store F | BIT(SOCK_RCU_FREE)\n sk_add_node_rcu(sk, ...)\n store F | BIT(SOCK_TIMESTAMP)\n\nAfter the lost update, SOCK_RCU_FREE is clear while the socket is\nvisible to lockless UDP receive lookups. sk_destruct() then frees\nthe socket immediately instead of waiting for a RCU grace period,\nwhile the receive path still holds a reference-less pointer to it:\n\n BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410\n Read of size 8 at addr ffff888008806610 by task exploit/207\n CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1\n ipv4_pktinfo_prepare+0x30/0x410\n udp_queue_rcv_one_skb+0x51c/0x1180\n udp_unicast_rcv_skb+0x109/0x350\n ip_protocol_deliver_rcu+0x14b/0x310\n ip_local_deliver_finish+0x29d/0x390\n ip_local_deliver+0x24d/0x2a0\n\nOnly grab the socket lock when SOCK_TIMESTAMP has to be set,\nto keep the common case lockless.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Jungwoo Lee \u003cjwlee2217@gmail.com\u003e\nReported-by: Wongi Lee \u003cqw3rtyp0@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260915043055.3441600-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "490599ab23134962a6d18a024e84541d77bdb999", "tree": "48122edd4e0f470ecaf9d9d1a1fe46023aadd0e3", "parents": [ "5ae916fabca141b79b32e2e57f3c915c0f1e1b2e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 19:23:27 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 17:33:06 2026 -0700" }, "message": "eth: fbnic: ring the doorbell if a burst ends in a drop\n\nfbnic_tx_map() skips the doorbell write, and the completion request,\nfor every packet handed to it with xmit_more set, counting on the\npacket which ends the burst to publish them all. When that packet is\ndropped instead - skb_put_padto(), skb_cow_head() or a DMA mapping\nfailure - nothing rings. The descriptors of the preceding packets stay\ninvisible to the HW until the next transmit on that queue, which for a\nburst-then-idle workload may never come.\n\nRemember the meta descriptor of the last packet left without a doorbell\nand flush it from the error paths. The completion request has to be set\non that descriptor rather than simply writing the tail, otherwise the HW\nwould transmit the packets but never report a head, and the ring would\nfill up and stall for good.\n\nThis is very similar to Joe\u0027s recent series of fixes for bnxt.\nNot seen in real life, reproduced under QEMU with failure injection.\n\nFixes: 9a57bacd574b (\"eth: fbnic: Add basic Tx handling\")\nReviewed-by: Alexander Duyck \u003calexanderduyck@fb.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260915022327.913218-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5ae916fabca141b79b32e2e57f3c915c0f1e1b2e", "tree": "01a097b8505d85f37b10961979429e526053d28c", "parents": [ "150dba2c69e93302af24a0c868eebe4871e2e107" ], "author": { "name": "Yige Jiang", "email": "yigejiang86@gmail.com", "time": "Sun Sep 13 14:41:02 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 17:32:15 2026 -0700" }, "message": "net: netsec: fix device_node reference leak on phy_np\n\nnetsec_of_probe() takes a reference on the PHY device_node with\nof_parse_phandle() and stores it in priv-\u003ephy_np, but the driver never\ndrops it. One device_node reference is leaked per probe, on the success\npath as well as on every error path reached after netsec_of_probe().\n\nNeither consumer takes ownership. of_mdio_parse_addr() is a static\ninline taking a const struct device_node * that only reads the \"reg\"\nproperty. of_phy_connect() borrows as well: of_phy_get_and_connect() in\ndrivers/net/mdio/of_mdio.c brackets its own call with of_node_get() at\n:364 and of_node_put() at :373, which would be a double put if\nof_phy_connect() consumed the reference.\n\nThe node is still in use at netsec_netdev_open() time, where it is\npassed to of_phy_connect(), so it has device lifetime. Release it at\nthe probe error label, which every failure path after the acquire\nfunnels through, and in netsec_remove(). Both releases precede\nfree_netdev(), since priv is netdev_priv(ndev). The ACPI probe path\nleaves priv-\u003ephy_np NULL and of_node_put(NULL) is a no-op.\n\nThere is no end-user visible symptom on currently supported platforms:\na device_node is only freed once OF_DYNAMIC is enabled and the node has\nbeen detached, so on a static device tree the imbalance is inert. It is\nobservable as a refcount that grows across bind/unbind cycles, and would\nmatter under device tree overlays.\n\nFound by static analysis of reference acquire/release pairing rather\nthan from a runtime report. No reproducer was produced and the change\nhas not been runtime tested; it is compile-tested only (arm64,\nCONFIG_SNI_NETSEC\u003dm via COMPILE_TEST).\n\nFixes: 533dd11a12f6 (\"net: socionext: Add Synquacer NetSec driver\")\nSigned-off-by: Yige Jiang \u003cyigejiang86@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260913064102.37452-1-yigejiang86@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "150dba2c69e93302af24a0c868eebe4871e2e107", "tree": "63edd38ac7e786d73401e68ae890bd51ab058395", "parents": [ "37213e61120297920ae4c937fcb326a360da5084" ], "author": { "name": "Farhad Alemi", "email": "farhad.alemi@berkeley.edu", "time": "Sat Sep 12 07:40:09 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 17:30:23 2026 -0700" }, "message": "net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check\n\nipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the\nroute to the tunnel\u0027s remote endpoint and set ctx-\u003edev to its device,\nwhich is the tunnel itself when that route resolves back to the tunnel.\ndev_fill_forward_path() then makes no progress and trips\nWARN_ON_ONCE(last_dev \u003d\u003d ctx-\u003edev) as soon as a flowtable tries to\noffload a flow through the tunnel. That routing loop is a configuration\nany CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and\nip6_tnl_xmit() already treat it as a tx error, so remove the warning and\njust fail the walk, as commit 008e7a7c293b (\"net: remove WARN_ON_ONCE\nwhen accessing forward path array\") did for the path stack overflow.\n\nFixes: ab427db17885 (\"netfilter: flowtable: Add IPIP rx sw acceleration\")\nFixes: d98103575dcd (\"netfilter: flowtable: Add IP6IP6 rx sw acceleration\")\nCloses: https://lore.kernel.org/all/CA+0ovCgaRvbd0Udj70b2xxG8Cx3CaCpNhnf1V4RWQuDveZYZhA@mail.gmail.com/\nSuggested-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Farhad Alemi \u003cfarhad.alemi@berkeley.edu\u003e\nReviewed-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nLink: https://patch.msgid.link/CA+0ovCgKDOk+Bg6Gh5Lwx94u_jJjQ30-vY1JcY2BYfhnWJJbPA@mail.gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "37213e61120297920ae4c937fcb326a360da5084", "tree": "3efe062c0655d0528447eba053a4c354b16baf39", "parents": [ "60404266ef3e0a1cd8f7a164060e0c83efb72f4b" ], "author": { "name": "Mark Amirkan", "email": "markdamirkan@gmail.com", "time": "Sun Sep 13 10:31:08 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 17:29:11 2026 -0700" }, "message": "net/packet: avoid truncating TPACKET_V3 private size\n\ntpacket_req3.tp_sizeof_priv is an unsigned int, and packet_set_ring()\nvalidates the full value against the block size. init_prb_bdqc() then\nstores it in the unsigned short blk_sizeof_priv field.\n\nCommit 2b6867c2ce76 (\"net/packet: fix overflow in check for priv area\nsize\") fixed the validation arithmetic, but an accepted value above\nUSHRT_MAX still narrows when it is stored.\n\nFor a 131072-byte block, tp_sizeof_priv\u003d65536 is valid. The narrowing\nmakes offset_to_first_pkt 48 instead of 65584, so packet records can be\nplaced in the private area that userspace asked the kernel to preserve.\n\nblk_sizeof_priv is internal state, so widen it to hold the validated\nUAPI value.\n\nFixes: f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer implementation.\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mark Amirkan \u003cmarkdamirkan@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260913-b4-send-packet-private-v1-1-925eab2cd388@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "60404266ef3e0a1cd8f7a164060e0c83efb72f4b", "tree": "763559180bd2da2ba3c93ffd0ce6d5716b512aa4", "parents": [ "33ff111d7ba3beb86e28938d6382bb5beabd865a" ], "author": { "name": "Mark Amirkan", "email": "markdamirkan@gmail.com", "time": "Sun Sep 13 10:30:05 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 17:28:06 2026 -0700" }, "message": "mptcp: return sk_wait_data() errors from recvmsg()\n\nCommit 581302298524 (\"mptcp: error out earlier on disconnect\") made\nmptcp_recvmsg() stop when sk_wait_data() returns an error. The error is\nstored in err, but the function then jumps to a path which returns\ncopied. When no data was copied, recvmsg() therefore returns zero and\nreports a false EOF.\n\nStore the result in copied, which is the value returned by the function.\nThis also keeps the usual partial-read result when data was copied before\nthe error.\n\nA recvmsg() blocked in one thread reproduces the issue when another\nthread disconnects the same MPTCP socket with connect(AF_UNSPEC).\nBefore this change recvmsg() returns zero; afterwards it returns -EPIPE.\n\nFixes: 581302298524 (\"mptcp: error out earlier on disconnect\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mark Amirkan \u003cmarkdamirkan@gmail.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260913-b4-send-mptcp-recv-error-v1-1-4eaa3684a8b8@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "33ff111d7ba3beb86e28938d6382bb5beabd865a", "tree": "342556a876bed47596f98fbf9ee0a4ec3045a2ca", "parents": [ "a9ce4053dc945c5372dedba5017ee675b30dc0c5" ], "author": { "name": "Mark Amirkan", "email": "markdamirkan@gmail.com", "time": "Sun Sep 13 10:28:08 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 17:27:35 2026 -0700" }, "message": "net/packet: clear RX owner on VNET header error\n\nCommit 61fad6816fc1 (\"net/packet: tpacket_rcv: avoid a producer race\ncondition\") added rx_owner_map and made tpacket_rcv() claim a V1 or V2\nring slot before converting the virtio-net header. If the conversion\nfails, the drop path leaves the slot claimed.\n\nWith a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves\nthe only slot unavailable, so the ring also drops the next valid packet.\n\nClear the ownership bit on this error path. TPACKET_V3 already clears\nits block state here.\n\nFixes: 61fad6816fc1 (\"net/packet: tpacket_rcv: avoid a producer race condition\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mark Amirkan \u003cmarkdamirkan@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260913-b4-send-packet-vnet-v1-1-5545ffb528ae@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a9ce4053dc945c5372dedba5017ee675b30dc0c5", "tree": "fc018e933608c0e7689f4aabfd134b99060fcfab", "parents": [ "f6fb2ac5e19ae4b66112a698050db80e51f841c3" ], "author": { "name": "Mark Amirkan", "email": "markdamirkan@gmail.com", "time": "Sun Sep 13 17:14:09 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 17:26:40 2026 -0700" }, "message": "net: lan743x: fix RX checksum use-after-free\n\nlan743x_rx_process_buffer() adds each non-first receive buffer to the\nhead skb\u0027s frag_list. On the last descriptor, lan743x_rx_trim_skb()\nlinearizes the head and frees the fragment skb metadata.\n\nThe checksum-success path then writes ip_summed through the local skb\npointer, which still points to the final fragment. This causes a\nuse-after-free write when a packet spans more than one receive buffer.\n\nSet ip_summed on the surviving head skb instead. Multi-buffer receive\ncan occur after a live MTU increase because existing ring entries keep\ntheir old buffer size until they are replenished.\n\nA KUnit test invoking lan743x_rx_process_buffer() with a two-buffer\npacket produced a one-byte KASAN use-after-free write before this change.\nThe same test passed after the change. The driver object also builds\nwith W\u003d1. This was not tested on physical LAN743x hardware.\n\nFixes: cd6910501cfd (\"net: lan743x: Add support for Rx IP \u0026 TCP checksum offload\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mark Amirkan \u003cmarkdamirkan@gmail.com\u003e\nReviewed-by: Chenguang Zhao \u003czhaochenguang@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260913-b4-send-lan743x-uaf-v1-1-73d563d08ba9@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f6fb2ac5e19ae4b66112a698050db80e51f841c3", "tree": "8a3f252868296ab450688f151a6ef5fb091fc6c6", "parents": [ "7f4a5ec6258fd7c92633ec4b0493fc51166d9398" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Sat Sep 12 14:08:31 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 17:15:29 2026 -0700" }, "message": "selftests/tc-testing: add codel/fq_codel interval boundary cases\n\nAdd tdc cases locking the codel/fq_codel small-interval uAPI after\nthe dropping-loop bound (previous patch): sub-tick and two-tick\nintervals are ACCEPTED (the loop bound makes them safe), the\n1024us boundary is accepted, and a sub-tick target sojourn delay is\naccepted (it does not participate in the control law):\n\n codel: 6e44/a8c3/a695/9793 - interval 1us/3us/1024us and\n target 1us accepted (rendered 0us/2us/1.02ms/0us by tc)\n fq_codel: 1b4d/3540/49c5/3e0f - interval 1us/3us/1024us and\n target 1us accepted\n\nThe positive cases match the full rendered qdisc line (tc renders\ninterval 1us as 0us, 3us as 2us, 1024us as 1.02ms), mirroring the\nexisting tests in these files.\n\nThese cases do not test the dropping-loop bound itself: tdc cannot\nobserve per-dequeue drop counts. c797 (fq_codel target 1 interval 1)\npasses unmodified on the patched kernel, which is the uAPI evidence\nfor the previous patch.\n\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-1L5H.v1.20260912080102@mojatatu.com.2\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7f4a5ec6258fd7c92633ec4b0493fc51166d9398", "tree": "52a0b76cbaeddf0ba5c57a62d90177c4dc4d4335", "parents": [ "fefaac1176bf3cf002a8dc83339d6ed6a369941a" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Sat Sep 12 14:08:30 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 17:15:29 2026 -0700" }, "message": "net/sched: codel: bound the dropping loop per dequeue call\n\nThe CoDel control law schedules the next drop one interval/sqrt(count)\nafter the previous drop, using the configured interval\n(codel_params.interval). For very small intervals the scheduled step\nrounds down to zero, so the dropping loop in codel_dequeue() never\nadvances and drains the entire backlog under the qdisc lock in one\ncall - an unprivileged user can trigger a soft lockup this way.\n\nFix in the shared codel code used by both codel and fq_codel:\n\n1. Make the control-law step at least 1 tick so the dropping loop\n always moves forward.\n\n2. Cap the dropping loop at CODEL_MAX_DROPS_PER_DEQUEUE (256) drops\n per codel_dequeue() call, resyncing drop_next to now when the cap\n is hit: the catch-up owed to the loop grows with the idle gap and\n the backlog, which no interval threshold can bound. This is a\n deliberate behaviour change after long idle gaps.\n\nThe cap applies to fq_codel (4b549a2ef4be) and the mac80211 TXQ path\n(fixed interval, cap only).\n\nThe target sojourn delay (codel_params.target) is not validated: it\ndoes not feed the control law, so a sub-tick value is aggressive\nrather than deadlock-prone.\n\nConditions to recreate the bug:\n - tc qdisc add dev lo root handle 1: tbf rate 1kbit burst 2kb limit 1000000\n - tc qdisc add dev lo parent 1:1 handle 10: codel interval 2us target 1ms noecn limit 1000000 (same for fq_codel)\n - unpatched kernel: tc accepts it; a UDP flood under the 1kbit tbf\n soft-lockups (watchdog: BUG: soft lockup) while one\n codel_dequeue() call drops the backlog under the qdisc lock\n - patched kernel: same setup, at most 256 drops per dequeue call,\n no soft lockup\n\nTesting: claim reproducer and interval 2us/3us variants run clean;\ntdc qdisc category passes (see the selftests patch).\n\nFixes: 76e3cc126bb2 (\"codel: Controlled Delay AQM\")\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/QDISC-1L5H.v1.20260912080102@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fefaac1176bf3cf002a8dc83339d6ed6a369941a", "tree": "ab8893c9e199bb9f981ab9fbc8840a3c5a6d28b5", "parents": [ "7c7d5e9d7e3942ba5aec9847f61a6e76d7773191", "1eeca1d5e0920fbdad6449768fd2d4364e714180" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 15:54:55 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 15:54:56 2026 -0700" }, "message": "Merge tag \u0027wireless-2026-09-16\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nMany fixes:\n - mac80211: S1G TIM bitmap fix\n - ath12k: remove undocumented DT ABI implementation\n - various firmware API and over-the-air hardening changes\n - fixes for most cfg80211/mac80211 syzbot reports\n\n* tag \u0027wireless-2026-09-16\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (67 commits)\n wifi: brcmsmac: fix UAF in brcms_free_timer()\n wifi: brcmfmac: fix lost 802.1x TX completion wakeup\n wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()\n wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown\n wifi: ath12k: ahb: Revert undocumented ABI and dead code\n wifi: mac80211: refuse to make a monitor active when it has no queue\n wifi: libipw: reject TKIP frames without a full MIC\n wifi: virt_wifi: don\u0027t transfer operstate before register\n wifi: cfg80211: check if AP has been started or joined a mesh before adding new station\n wifi: cfg80211: move link_id validation earlier in nl80211_new_station()\n wifi: cfg80211: do not support direct add of station to AP_VLAN interfaces\n wifi: cfg80211: verify if AP_VLAN belongs to the correct AP\n wifi: mac80211: set up the TX info early to fix failure paths\n wifi: mac80211: mesh: release the channel if start fails\n wifi: mac80211: mesh: reset the CSA state when leaving\n wifi: mac80211: add HE 6 GHz capability in the scan elems len\n wifi: mac80211: don\u0027t access the TSF of a down interface\n wifi: mac80211: don\u0027t RCU-dereference the mesh CSA settings we just set\n wifi: mac80211: don\u0027t allow link changes when iface is down\n wifi: mac80211: require a peer station for TDLS setup confirm\n ...\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260916083642.110609-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7c7d5e9d7e3942ba5aec9847f61a6e76d7773191", "tree": "9ee39b8e1c9e91cd37d5e84778cd1cb1fe19ca71", "parents": [ "ceac0de741bfb47ca255eee075257b3bb31f0651", "96f01b53c2d05e003b040892256de54a586e8529" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 15:54:18 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 16 15:54:19 2026 -0700" }, "message": "Merge tag \u0027ipsec-2026-09-16\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2026-09-16\n\n1) xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()\n Add the up-front nr_frags guard iptfs_skb_add_frags() already has,\n so an out-of-range offset can\u0027t walk past the on-stack frags[] array.\n\n2) xfrm: serialize state GC with device state flush\n Serialize xfrm_state destruction against the deferred-device pass\n with a dedicated mutex, since the device GC list doesn\u0027t hold a state\n reference and the two paths could free the same state.\n\n3) xfrm: add missing RCU read lock in xfrm_send_migrate_state()\n Hold the RCU read lock around xfrm_nlmsg_multicast() so the\n rcu_dereference() of net-\u003exfrm.nlsk doesn\u0027t warn.\n\n4) xfrm: iptfs: fix runt reassembly panic from short inner tot_len\n Require the runt length to cover at least the minimum IP header,\n so a tot_len in [6, 19] (IPv4) can\u0027t write past the declared length\n and trip skb_over_panic().\n\n5) ipv6: xfrm: use full sockets in local error paths\n Use skb_to_full_sk() in xfrm6_local_rxpmtu() and xfrm6_local_error()\n and bail out without a full socket, so a TCP_NEW_SYN_RECV request_sock\n isn\u0027t miscast as a full inet/IPv6 socket.\n\n6) xfrm: fix compat ALLOCSPI request use-after-free\n Drop the redundant alloc_compat() in xfrm_alloc_userspi() so the\n compat translator no longer reads past the payload and publishes a\n child a multicast clone can still see after xfrm_user_rcv_msg() frees.\n\n7) xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()\n Force the dst before queuing, hold dev across the workqueue deferral,\n and take rcu_read_lock() around the finish() loop, so transport-mode\n reinjection doesn\u0027t deref non-refcounted dst/dev under workqueue.\n\n8) xfrm: use hlist_del_init_rcu for state_cache and state_cache_input\n Switch to hlist_del_init_rcu() so a second __xfrm_state_delete() is\n a no-op instead of writing through LIST_POISON2, closing the UAFs.\n\n9) esp: downgrade zerocopy managed frags before mutating skb frags\n Call skb_zcopy_downgrade_managed() before ESP rewrites the skb frag\n array, so per-frag unrefs in esp_ssg_unref() and skb_release_data()\n stay balanced for ubuf-owned managed frags.\n\n10) xfrm: hold net_device reference under RCU in bundle creation\n Read dst-\u003edev via dst_dev_rcu() and keep RCU active through\n xfrm_fill_dst(), so a concurrent RTM_DELLINK can\u0027t free dev\n under bundle creation.\n\n11) xfrm: save input state data before secpath resets\n Save the state protocol on the stack while it\u0027s still valid and\n use the saved address family for transport_finish(), so post-reset\n dereferences (VTI, XFRM if, MAX_DEPTH error) can\u0027t UAF the state.\n\n12) net: xfrm: reject unrepresentable espintcp transport headers\n Use the careful transport-header helper and drop the skb through\n the XFRM error path when the offset can\u0027t be represented, instead\n of silently truncating it.\n\n* tag \u0027ipsec-2026-09-16\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:\n net: xfrm: reject unrepresentable espintcp transport headers\n xfrm: save input state data before secpath resets\n xfrm: hold net_device reference under RCU in bundle creation\n esp: downgrade zerocopy managed frags before mutating skb frags\n xfrm: use hlist_del_init_rcu for state_cache and state_cache_input\n xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()\n xfrm: fix compat ALLOCSPI request use-after-free\n ipv6: xfrm: use full sockets in local error paths\n xfrm: iptfs: fix runt reassembly panic from short inner tot_len\n xfrm: add missing RCU read lock in xfrm_send_migrate_state()\n xfrm: serialize state GC with device state flush\n xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260916101938.118628-1-steffen.klassert@secunet.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ceac0de741bfb47ca255eee075257b3bb31f0651", "tree": "5f3a412a5da309ca190ee87af037f44955ea17bb", "parents": [ "2842ce397dd09882530b42f7fdb0c855767eb24e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Sep 11 16:08:04 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 18:44:02 2026 -0700" }, "message": "netlink: do not free nlk-\u003egroups while lockless readers can use it\n\nnetlink_realloc_groups() uses krealloc() under netlink_table_grab().\nWhenever NLGRPSZ(groups) lands in a different kmalloc bucket, the old\nbitmap is freed immediately.\n\nTwo readers of nlk-\u003egroups / nlk-\u003engroups do not hold the netlink\ntable lock:\n\n1) sk_diag_dump_groups(). Hashed (bound) sockets are dumped from the\n rhashtable walk in __netlink_diag_dump(), which only holds RCU.\n Only the mc_list part of the dump takes nl_table_lock.\n\n2) netlink_native_seq_show() (/proc/net/netlink), whose walk has been\n lockless since commit 21e4902aea80 (\"netlink: Lockless lookup with\n RCU grace period in socket release\").\n\nBoth can read a freed buffer, and sk_diag_dump_groups() can also read\npast the end of the old (smaller) buffer if it happens to load the old\n@groups pointer together with the new @ngroups value, copying the\nresult into a NETLINK_DIAG_GROUPS attribute.\n\nThis is the same class of bug that commit f773608026ee (\"netlink:\naccess nlk groups safely in netlink bind and getname\") fixed for bind()\nand getname(); these two readers were missed. Simply grabbing the table\nlock in sk_diag_dump_groups() is not an option, because it is also\ncalled with nl_table_lock already held from the mc_list section of the\ndump.\n\nMake the lockless readers safe instead:\n\n- Allocate a new bitmap and free the old one after an RCU grace period,\n instead of relying on the implicit kfree() done by krealloc().\n\n- Publish @groups before @ngroups, both with release semantics, and have\n the lockless readers load @ngroups first. A reader can then never pair\n the new (bigger) size with the old (smaller) buffer, and a reader\n picking up the new pointer while still seeing the old size is\n guaranteed to see the initialized bitmap.\n\nnetlink_realloc_groups() is called from process context (bind() and\nsetsockopt()), so kfree_rcu_mightsleep() can be used, once the table\nhas been released.\n\nFixes: 21e4902aea80 (\"netlink: Lockless lookup with RCU grace period in socket release\")\nFixes: ad202074320c (\"netlink: Use rhashtable walk interface in diag dump\")\nReported-by: James Burton \u003cjamesburton@meta.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260911160804.917099-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2842ce397dd09882530b42f7fdb0c855767eb24e", "tree": "75078af382d48e3dfd8d383a4ce85ee9346cdf7e", "parents": [ "f0ef4b1eaed000a304726a43091588e8426ba08a" ], "author": { "name": "Nikolay Aleksandrov", "email": "razor@blackwall.org", "time": "Mon Sep 14 13:52:58 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 18:31:57 2026 -0700" }, "message": "net: bridge: vlan: fix bugs caused by switchdev deletion errors\n\nAllowing switchdev to prevent vlan deletion and error out in __vlan_del\ncould cause multiple different issues - inconsistent state, memory leaks\nwhen flushing, NULL pointer dereference on bridge error when flushing.\nIt doesn\u0027t make sense to allow it to stop __vlan_del, so log the error\nand continue with software vlan deletion. This is also consistent with\n8021q behaviour.\n\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nFixes: bf361ad38165 (\"net: bridge: check __vlan_vid_del for error\")\nFixes: 5454f5c28eca (\"net: bridge: vlan: check for errors from __vlan_del in __vlan_flush\")\nFixes: 2594e9064a57 (\"bridge: vlan: add per-vlan struct and move to rhashtables\")\nFixes: 9c86ce2c1ae3 (\"net: bridge: Notify about bridge VLANs\")\nSigned-off-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260914105258.3436918-1-razor@blackwall.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f0ef4b1eaed000a304726a43091588e8426ba08a", "tree": "bb18ce1c7c5cdfd5df81f015f083943028d32719", "parents": [ "3f118c8217c109fd13ca61caa301d72c483897ef" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Mon Sep 14 09:41:07 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 18:25:06 2026 -0700" }, "message": "net: stmmac: do not overwrite phc_index when no PTP clock is registered\n\nstmmac_get_ts_info() reports phc_index as 0 when hardware timestamping\nis supported but no PTP clock has been registered yet (e.g. while the\ninterface is down). Zero is a valid PHC index and would make userspace\nresolve the wrong clock; the absence of a clock should be reported as\n-1.\n\nThe ethtool core already initializes phc_index to -1 before invoking\nthe get_ts_info callback (ethtool_init_tsinfo()), so just drop the\nerroneous assignment.\n\nFixes: 9364fa7fcf12 (\"net: stmmac: Remove setting of RX software timestamp\")\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Rahul Rameshbabu \u003crrameshbabu@nvidia.com\u003e\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nReviewed-by: Gal Pressman \u003cgal@nvidia.com\u003e\nLink: https://patch.msgid.link/20260914-stmmac-fix-phc_index-v2-1-bf3d90373fe4@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3f118c8217c109fd13ca61caa301d72c483897ef", "tree": "14b6e2f1319792916760ca4d8d06dbb1a80f6b43", "parents": [ "ad77dba64dc1a522014b2cd7376a67004140375b" ], "author": { "name": "Zhiling Zou", "email": "zhilinz@nebusec.ai", "time": "Sat Sep 12 21:22:43 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 18:00:46 2026 -0700" }, "message": "openvswitch: avoid reallocating confirmed conntrack labels\n\novs_ct_get_conn_labels() adds the labels extension when a conntrack\nentry does not have one. Confirmed conntracks can be read locklessly,\nso adding an extension may reallocate and free the extension block\nwhile another CPU accesses it.\n\nOnly add the extension for unconfirmed conntracks. A confirmed\nconntrack without labels now fails the caller\u0027s label operation instead\nof reallocating its extension storage.\n\nFixes: c2ac66735870 (\"openvswitch: Allow matching on conntrack label\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nSigned-off-by: Zhiling Zou \u003czhilinz@nebusec.ai\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/372fbb062b40ae6723684f55484be86ff0064f8e.1789218015.git.zhilinz@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ad77dba64dc1a522014b2cd7376a67004140375b", "tree": "e1fd5a411c7bb76507456946395b90d730ebf81e", "parents": [ "455ebeadf714f51e1dbbd6a022c74c9215b1cd76", "439f392084f8f7f59ab9d47a9579185accefe1d8" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:58:36 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:58:37 2026 -0700" }, "message": "Merge branch \u0027net-drop_monitor-fix-concurrency-issues-preemption-warning-and-buffer-overrun\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: drop_monitor: fix concurrency issues, preemption warning, and buffer overrun\n\nThis series addresses several issues discovered in the drop_monitor subsystem:\n\nPatch 1 adds missing tracepoint unregistration synchronization to the\nnet_dm_trace_on_set() error unwind path, preventing in-flight probes\nfrom scheduling work after the module reference has been dropped.\n\nPatch 2 resolves a race condition during monitoring teardown where per-CPU\ntimers can be re-armed after deletion if a concurrent worker encounters a\nmemory allocation failure, switching to timer_shutdown_sync().\n\nPatch 3 fixes a CONFIG_DEBUG_PREEMPT warning reported by syzbot when\nkfree_skb() is invoked from preemptible process context, using raw_cpu_ptr()\nsince each per-CPU queue is safely protected by its own spinlock.\n\nPatch 4 fixes an out-of-bounds write in reset_per_cpu_data() where memset()\noverwrote the allocated SKB tailroom by sizeof(struct nlattr) bytes.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260910204612.3762015-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "439f392084f8f7f59ab9d47a9579185accefe1d8", "tree": "e1fd5a411c7bb76507456946395b90d730ebf81e", "parents": [ "c19b7d35086b7d240f1ca3088b0079d2bd39ffb9" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 10 20:46:12 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:58:35 2026 -0700" }, "message": "drop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n al \u003d sizeof(struct net_dm_alert_msg);\n al +\u003d dm_hit_limit * sizeof(struct net_dm_drop_point);\n al +\u003d sizeof(struct nlattr);\n\n skb \u003d genlmsg_new(al, GFP_KERNEL);\n ...\n nla \u003d nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n ...\n msg \u003d nla_data(nla);\n memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg.\n\nFixes: 683703a26e46 (\"drop_monitor: Update netlink protocol to include netlink attribute header in alert message\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910204612.3762015-5-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c19b7d35086b7d240f1ca3088b0079d2bd39ffb9", "tree": "8c32548ae448d6b4d4ecabc26f05b56da2f6df41", "parents": [ "c391a40f71886b28c082b47270f0e856fa3e1150" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 10 20:46:11 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:58:35 2026 -0700" }, "message": "drop_monitor: use raw_cpu_ptr() in tracepoint probes\n\nsyzbot reported a preemption warning in sk_skb_reason_drop():\n\n BUG: using smp_processor_id() in preemptible [00000000] code: syz.0.17/5917\n caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 net/core/drop_monitor.c:519\n\nIn net_dm_packet_trace_kfree_skb_hit(), data \u003d this_cpu_ptr(\u0026dm_cpu_data)\nis evaluated before spin_lock_irqsave(\u0026data-\u003edrop_queue.lock, flags).\nWhen kfree_skb() is called from preemptible context (e.g. process context\nduring close() on /dev/net/tun), preemption is enabled, triggering the\nCONFIG_DEBUG_PREEMPT warning in smp_processor_id().\n\nThe same pattern exists in net_dm_hw_trap_summary_probe() and\nnet_dm_hw_trap_packet_probe() for dm_hw_cpu_data.\n\nThis is a false positive because each per-cpu structure is protected\nby its own spinlock. If the task migrates to another CPU right after\nreading the per-cpu pointer, the lock still safely synchronizes\naccess to that queue.\n\nUse raw_cpu_ptr() instead of this_cpu_ptr() to silence\nCONFIG_DEBUG_PREEMPT without disturbing interrupt state or breaking\nPREEMPT_RT locking semantics.\n\nFixes: ca30707dee2b (\"drop_monitor: Add packet alert mode\")\nFixes: 5855357cd40e (\"drop_monitor: Prepare probe functions for devlink tracepoint\")\nReported-by: syzbot+dc57fd6722deb17e92af@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6aa316b2.f81106d8.2ab401.0014.GAE@google.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260910204612.3762015-4-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c391a40f71886b28c082b47270f0e856fa3e1150", "tree": "dfd445c49c587198606e64c1b321cb18f1ab3ec1", "parents": [ "6a038ef2b57922b6d9ca98ddac0df0681849b704" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 10 20:46:10 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:58:34 2026 -0700" }, "message": "drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown\n\nIn drop_monitor teardown paths (net_dm_trace_off_set(),\nnet_dm_hw_monitor_stop(), and error unwind paths in net_dm_trace_on_set()\nand net_dm_hw_monitor_start()), per-CPU timers are stopped using\ntimer_delete_sync() followed by cancel_work_sync().\n\nHowever, there is a circular dependency between send_timer and\ndm_alert_work:\n1) sched_send_work() (timer callback) schedules dm_alert_work.\n2) send_dm_alert() / net_dm_hw_summary_work() calls reset_per_cpu_data()\n or net_dm_hw_reset_per_cpu_data().\n3) If memory allocation fails under memory pressure in the reset\n function, it re-arms the timer via mod_timer(\u0026data-\u003esend_timer, ...).\n\nIf dm_alert_work is running concurrently while timer_delete_sync()\nexecutes on another CPU, an allocation failure in the worker will\nre-arm the timer after timer_delete_sync() has already returned.\nOnce cancel_work_sync() completes and module_put() is called, the timer\nremains active in the timer wheel. If the module is then unloaded, the\ntimer will fire and execute sched_send_work() in freed memory,\ntriggering a kernel panic / use-after-free.\n\nSwitch from timer_delete_sync() to timer_shutdown_sync(). This guarantees\nthat any in-flight timer handler has finished and prevents subsequent\nre-arming attempts from running workers from succeeding. When monitoring\nis restarted later, timer_setup() is invoked, which cleanly\nre-initializes the timer.\n\nFixes: 9398e9c0b1d4 (\"drop_monitor: Perform cleanup upon probe registration failure\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260910204612.3762015-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6a038ef2b57922b6d9ca98ddac0df0681849b704", "tree": "d4763fcf151755b5f9b9db41d2ebb3ef15d285d3", "parents": [ "455ebeadf714f51e1dbbd6a022c74c9215b1cd76" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 10 20:46:09 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:58:34 2026 -0700" }, "message": "drop_monitor: synchronize tracepoint unregistration on error path\n\nIf register_trace_napi_poll() fails in net_dm_trace_on_set(),\nunregister_trace_kfree_skb() is called to roll back the kfree_skb\ntracepoint registration.\n\nHowever, tracepoint_synchronize_unregister() is omitted before calling\ncancel_work_sync() and module_put(). An in-flight probe executing\nconcurrently on another CPU could call schedule_work() after\ncancel_work_sync() has already returned, leaving a pending work item\nscheduled after the module reference is dropped. If the module is then\nunloaded, executing the work item triggers a kernel panic.\n\nAdd tracepoint_synchronize_unregister() after unregister_trace_kfree_skb()\nin the error path, matching net_dm_trace_off_set() and\nnet_dm_hw_probe_unregister().\n\nFixes: 7c747838a558 (\"drop_monitor: Split tracing enable / disable to different functions\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910204612.3762015-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "455ebeadf714f51e1dbbd6a022c74c9215b1cd76", "tree": "cb775d963a4823472e940bce94ae8b8f01bfb63c", "parents": [ "ecc7253683a3c55caa868ce0ee530fcb0044bd3c" ], "author": { "name": "Gris Ge", "email": "cnfourt@gmail.com", "time": "Sun Sep 13 17:08:50 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:34:31 2026 -0700" }, "message": "net: ip_tunnel: initialize `options_len` before referencing options\n\nThe following command triggers a kernel panic:\n\n ip link add d0 type dummy; ip link set d0 up\n ip route add 10.30.0.0/16 \\\n encap ip id 300 geneve_opts 4660:66:11223344 dev d0\n\n memcpy: detected buffer overflow: 4 byte write of buffer size 0\n kernel BUG at lib/string_helpers.c:1044!\n ...\n ip_tun_parse_opts.part.0.cold+0x10/0x10\n ip_tun_build_state+0x116/0x2a0\n\nOn kernels built with GCC 15+ and `CONFIG_FORTIFY_SOURCE`, the fortified\n`memcpy()` got 0 sized destination with request of 4 bytes length:\n\n static int ip_tun_parse_opts_geneve(...)\n {\n ...\n attr \u003d tb[LWTUNNEL_IP_OPT_GENEVE_DATA];\n data_len \u003d nla_len(attr); /* \u003d\u003d 4 */\n\n struct geneve_opt *opt \u003d ip_tunnel_info_opts(info) + opts_len;\n memcpy(opt-\u003eopt_data, nla_data(attr), data_len);\n /* ^^^^^^^^^^^^^ 0 since options_len is assigned afterwards */\n\nFixed by initializing the counter before the options are referenced.\nMatching what `tunnel_key_opts_set()` already does.\n\nFixes: bb5e62f2d547 (\"net: Add options as a flexible array to struct ip_tunnel_info\")\nCc: stable@vger.kernel.org\nSigned-off-by: Gris Ge \u003ccnfourt@gmail.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nReviewed-by: Gustavo A. R. Silva \u003cgustavoars@kernel.org\u003e\nLink: https://patch.msgid.link/20260913090851.468216-1-cnfourt@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ecc7253683a3c55caa868ce0ee530fcb0044bd3c", "tree": "6a2a6bb79488c0c17ed3a8d4551382fd5dc21711", "parents": [ "562219874cba1be6b708fb29a89fe8f54544b022" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sat Sep 12 23:30:48 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:07:01 2026 -0700" }, "message": "pppoatm: ensure a writable skb header and linear data\n\nIn pppoatm_send(), LLC encapsulation checks whether there is sufficient\nheadroom for the 4-byte LLC header, but does not ensure that the skb header\nis writable.\n\nNormal transmit packets passing through ppp_start_xmit() have their header\nunshared via skb_cow_head(). However, packets can also reach pppoatm_send()\nvia PPP channel bridging (PPPIOCBRIDGECHAN) without going through\nppp_start_xmit().\n\nUse skb_cow_head() to ensure both sufficient headroom and a writable\nheader before pushing the LLC header.\n\nWhile at it:\n- Call pskb_may_pull(skb, 1) before inspecting skb-\u003edata[0] to prevent\n out-of-bounds reads on zero-length or non-linear frames (e.g. from\n bridging).\n- Defer SC_COMP_PROT protocol compression until after pppoatm_may_send()\n succeeds. This eliminates the temporary skb allocation on admission failure\n and completely removes the fragile \"undo\" heuristic at the nospace label,\n avoiding any risk of reading uninitialized headroom or performing an\n unbalanced skb_push().\n\nFixes: 4cf476ced45d (\"ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260912233048.3977192-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "562219874cba1be6b708fb29a89fe8f54544b022", "tree": "f08c58d1dc0b2d1353b85ca1920a92e9ae42463b", "parents": [ "15989abd74f16f44bf953d056b95f1d2fda9b0cd", "14c5eb685cdefbd32e73d2723071ecbd8effbce9" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:03:13 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:03:14 2026 -0700" }, "message": "Merge branch \u0027net-sched-fix-action-batch-deletion-cleanup\u0027\n\nXuanqiang Luo says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: fix action batch deletion cleanup\n\nBatched RTM_DELACTION requests can leak references to unprocessed actions\nwhen deletion stops at a filter-bound action.\n\nPatch 1 fixes the failure cleanup.\n\nPatch 2 adds tc-testing regression coverage.\n\nFailure reproduction (key output excerpts):\n\n python3 tdc.py -f /root/tc-testing/batch-delete.json\n\nnot ok 1 d710 - Release tail references after first action deletion fails\n\tCould not match regex pattern. Verify command output:\n[...]\n\t index 2 ref 2 bind 0\n[...]\n\t index 3 ref 2 bind 0\n\nnot ok 2 d711 - Release tail references after middle action deletion fails\n\tCould not match regex pattern. Verify command output:\n[...]\n\t index 3 ref 2 bind 0\n\nnot ok 3 d713 - Delete a tail action once after a failed batch\n\tCould not match regex pattern. Verify command output:\ntotal acts 2\n[...]\n\t index 2 ref 1 bind 0\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260910093413.34509-1-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "14c5eb685cdefbd32e73d2723071ecbd8effbce9", "tree": "f08c58d1dc0b2d1353b85ca1920a92e9ae42463b", "parents": [ "6e05e46fa821a5c1b281355f1f622ac76cb6080a" ], "author": { "name": "Xuanqiang Luo", "email": "luoxuanqiang@kylinos.cn", "time": "Thu Sep 10 17:34:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:03:09 2026 -0700" }, "message": "selftests: tc-testing: test action batch deletion failure cleanup\n\nAdd tests for cleanup after a batched RTM_DELACTION request fails at\na gact action bound to a filter. Check that subsequent actions retain\ntheir original reference counts and that earlier successful deletions\nare preserved.\n\nCover failures at the first and middle entries. Verify that a remaining\nunbound action can be removed with one subsequent delete.\n\nSigned-off-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910093413.34509-3-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6e05e46fa821a5c1b281355f1f622ac76cb6080a", "tree": "defe45ca6b54051500dd6cbf6facb4bfa1063ca4", "parents": [ "15989abd74f16f44bf953d056b95f1d2fda9b0cd" ], "author": { "name": "Xuanqiang Luo", "email": "luoxuanqiang@kylinos.cn", "time": "Thu Sep 10 17:34:12 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 17:03:09 2026 -0700" }, "message": "net/sched: act_api: release tail references on DELACTION failure\n\nA batched RTM_DELACTION request takes a temporary reference on each\naction before attempting any deletion. tcf_action_delete() clears\neach processed slot and drops its temporary reference before attempting\nthe deletion. If deletion fails, tca_action_gd() calls\ntcf_action_put_many() to release the remaining references, but its\ntcf_act_for_each_action() iterator stops at the first NULL slot.\n\nWhen a batch stops at an action bound to a filter, this leaks a\nreference on each subsequent action. A later delete of an unbound\naction can then return success without removing it from the IDR.\n\nWalk the full array in tcf_action_put_many() and skip NULL slots to\nrelease the references held on the unprocessed actions.\n\nFixes: a0e947c9ccff (\"net/sched: act_api: avoid non-contiguous action array\")\nCc: stable@vger.kernel.org\nSigned-off-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910093413.34509-2-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "15989abd74f16f44bf953d056b95f1d2fda9b0cd", "tree": "716bc8eaa6d036d009f63857d0e52de9ed54b931", "parents": [ "433cfc302561bc7e23b1305e1779e0d83156cb61" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Fri Sep 11 11:20:15 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 16:55:52 2026 -0700" }, "message": "net: stmmac: fix TSO header length truncation\n\nstmmac_tso_xmit() stores the protocol header length returned by\nstmmac_tso_header_size() in a u8. stmmac_tso_valid_packet() admits\nheaders up to 1023 bytes, so a header longer than 255 bytes wraps modulo\n256 (486 becomes 230, 256 becomes 0).\n\nA TCP over IPv6 socket carrying a few hundred bytes of sticky\ndestination/hop-by-hop options makes skb_tcp_all_headers() exceed 255\nwhile staying below the 1023-byte limit, so such an skb reaches\nstmmac_tso_xmit().\n\nWiden proto_hdr_len to unsigned int, which is sufficient since the value\nis bounded by the hardware limit, and adjust the debug print specifier\naccordingly.\n\nFixes: 9edfa7dab811 (\"net: stmmac: enable TSO for IPv6\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260911-stmmac-fix-header-length-v1-1-8fc103334327@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "433cfc302561bc7e23b1305e1779e0d83156cb61", "tree": "c1d65f519aad9bd62decab7b83ab7187507e4aad", "parents": [ "c5e367a8a3f939e9935369a38ea7e0f872f594b5", "b645ccd410547d0e0e4a9543f828119e24dc7635" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 16:45:06 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 16:45:07 2026 -0700" }, "message": "Merge branch \u0027af_unix-fix-inconsistent-scc_index\u0027\n\nKuniyuki Iwashima says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\naf_unix: Fix inconsistent scc_index.\n\nJames Burton reported that a single SCC could have multiple\nscc_index and unix_vertex_dead() fails to detect a dead SCC.\n\nPatch 1 fixes it and Patch 2 adds a test case.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260912030852.1467872-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b645ccd410547d0e0e4a9543f828119e24dc7635", "tree": "c1d65f519aad9bd62decab7b83ab7187507e4aad", "parents": [ "4a4263dfeabad72f95e8ab6e15146861fa4144dd" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Sat Sep 12 03:07:52 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 16:45:05 2026 -0700" }, "message": "selftest: af_unix: Add test case with mixed lowpoint in scm_rights.c.\n\nThe new test case creates two SCCs so that each of them\nhas multiple scc_index.\n\nWithout patch, GC cannot free the sockets and the test fails.\n\n # RUN scm_rights.dgram.mixed_lowpoints ...\n # scm_rights.c:176:mixed_lowpoints:Expected 0 (0) \u003d\u003d ret (12)\n # mixed_lowpoints: Test terminated by assertion\n # FAIL scm_rights.dgram.mixed_lowpoints\n not ok 5 scm_rights.dgram.mixed_lowpoints\n ...\n # FAILED: 45 / 50 tests passed.\n # Totals: pass:45 fail:5 xfail:0 xpass:0 skip:0 error:0\n\nWith the patch, all tests pass.\n\n # PASSED: 50 / 50 tests passed.\n # Totals: pass:50 fail:0 xfail:0 xpass:0 skip:0 error:0\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260912030852.1467872-3-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4a4263dfeabad72f95e8ab6e15146861fa4144dd", "tree": "5599fb84af489e861679958a2539006ca62ba0f6", "parents": [ "c5e367a8a3f939e9935369a38ea7e0f872f594b5" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Sat Sep 12 03:07:51 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 16:45:05 2026 -0700" }, "message": "af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().\n\nCommit bfdb01283ee8 (\"af_unix: Assign a unique index to SCC.\")\nchanged Tarjan\u0027s algorithm to update lowlink with lowlink,\nwhich is called lowpoint (unix_vertex.scc_index).\n\nunix_vertex_dead() assumes all vertices in an SCC share the same\nlowpoint, but this is not always true if an SCC has two or more\nback edges, depending on the order of DFS.\n\nFor example, the graph below has two back edges from B to A\nand from C to B.\n\n A --\u003e B --\u003e C\n ^ | ^ |\n `----\u0027 `----\u0027\n\nIf DFS walks through A -\u003e B -\u003e C -\u003e B (-\u003e C -\u003e B) -\u003e A (-\u003e B -\u003e A),\neach index and scc_index will be updated as follows.\n\n A --\u003e B --\u003e C C \u003d (3, 3) (index, scc_index)\n B \u003d (2, 2)\n A \u003d (1, 1)\n\n A ... B ... C C \u003d (3, 2)\u003c-.\n ^ | B \u003d (2, 2) -\u0027\n `----\u0027 A \u003d (1, 1)\n\n A ... B ... C C \u003d (3, 2)\n ^ | . . B \u003d (2, 1)\u003c-.\n `----\u0027 .... A \u003d (1, 1) -\u0027\n\nThen, unix_vertex_dead() thinks that B is passed to another\nSCC with scc_index 2, and the SCC is not garbage-collected.\n\nThis does not happen if DFS walks in a different order below\nor starts from B.\n\n 1 3\n A --\u003e B --\u003e C\n ^ | ^ |\n `----\u0027 `----\u0027\n 2 4\n\nLet\u0027s unify scc_index across the SCC when finalising it.\n\nNote that updating v-\u003eindex was previously done in unix_scc_dead(),\nwhen called from __unix_walk_scc(), just to save one loop. Since\n__unix_walk_scc() now iterates over the SCC anyway, the update is\nmoved back to __unix_walk_scc() and \u0027fast\u0027 argument is dropped.\n\nFixes: 4090fa373f0e (\"af_unix: Replace garbage collection algorithm.\")\nReported-by: James Burton \u003cjamesburton@meta.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260912030852.1467872-2-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c5e367a8a3f939e9935369a38ea7e0f872f594b5", "tree": "8d2780c739c3ddc9422303e688f41791f6f1dc2c", "parents": [ "83a945a529d6e002dd7339c532288a931f463dba", "801fb950cae7048eb7d83b18857d1ca37b8cd5a4" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 16:40:55 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 15 16:40:55 2026 -0700" }, "message": "Merge tag \u0027for-net-2026-09-15\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\nCore:\n\n - hci: put the peer\u0027s on-air address on air when we cannot resolve\n - hci: keep dst_type with dst when reusing an LE connection\n - hci_core: Fix queuing tx_work after workqueue is drained\n - hci_sync: Serialize local codec list cleanup\n - hci_codec: validate vendor codec count length\n - eir: validate service data length before reading UUID\n - RFCOMM: avoid socket lock inversion in listener cleanup\n - ISO: Fix parent socket leak in iso_conn_ready()\n - ISO: set BT_LISTEN before requesting a BIG sync\n - coredump: Quiesce dump work on unregister\n\nDrivers:\n\n - btintel_pcie: validate TX skb length in send_sync\n - btmtk: fix wrong status for short WMT FUNC_CTRL events\n - btmtksdio, btmtkuart: validate WMT event length before struct access\n - hci_qca: Do not write to the serial port after it is closed\n - btusb: fix NXP IW610 composite device handling\n - btintel_pcie: fix off-by-one bounds check in RX submit\n - btmtksdio: Fix PM runtime reference leak in shutdown\n\n* tag \u0027for-net-2026-09-15\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup\n Bluetooth: keep dst_type with dst when reusing an LE connection\n Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit\n Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown\n Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access\n Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events\n Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync\n Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()\n Bluetooth: hci_sync: Serialize local codec list cleanup\n Bluetooth: hci_qca: Do not write to the serial port after it is closed\n Bluetooth: hci_codec: validate vendor codec count length\n Bluetooth: put the peer\u0027s on-air address on air when we cannot resolve\n Bluetooth: coredump: Quiesce dump work on unregister\n Bluetooth: btintel_pcie: validate TX skb length in send_sync\n Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained\n Bluetooth: eir: validate service data length before reading UUID\n Bluetooth: btusb: fix NXP IW610 composite device handling\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260915192441.1130583-1-luiz.dentz@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "801fb950cae7048eb7d83b18857d1ca37b8cd5a4", "tree": "8d2780c739c3ddc9422303e688f41791f6f1dc2c", "parents": [ "555cd2bd860e7c4bdc3f4e4405b05515b0d9bc87" ], "author": { "name": "Juan Perdomo", "email": "jcperdomo100@gmail.com", "time": "Sat Sep 12 23:09:45 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:55:41 2026 -0400" }, "message": "Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup\n\nrfcomm_sock_cleanup_listen() closes unaccepted child sockets through\nrfcomm_sock_close(), which takes the child socket lock before\nrfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these\nlocks in reverse order while handling connections and DLC state changes,\nso lockdep reports a possible deadlock.\n\nClose dequeued children without taking their socket lock. The accept queue\nowns a reference to each child, and bt_accept_dequeue() locks the child\nwhile unlinking it and clearing its parent pointer.\n\nDropping the child lock makes it important to prevent a concurrent\nrfcomm_connect_ind() from enqueueing a new child after cleanup observes an\nempty queue. Set a listening socket to BT_CLOSED while its lock is still\nheld, before dropping the lock and draining the queue. The state check in\nrfcomm_connect_ind() then rejects new children once cleanup starts.\n\nReported-by: syzbot+0cece8fa7d83523f47a3@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d0cece8fa7d83523f47a3\nFixes: b7ce436a5d79 (\"Bluetooth: switch to lock_sock in RFCOMM\")\nSigned-off-by: Juan Perdomo \u003cjcperdomo100@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "555cd2bd860e7c4bdc3f4e4405b05515b0d9bc87", "tree": "6a77620419e8930b0061034d2bca3a8ae9ddaafc", "parents": [ "2ea5a87a5a7ae58cb2662b8a7d06f209383e1765" ], "author": { "name": "Radek Podgorny", "email": "radek@podgorny.cz", "time": "Sun Sep 13 22:28:02 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:55:32 2026 -0400" }, "message": "Bluetooth: keep dst_type with dst when reusing an LE connection\n\nhci_connect_le() swaps the caller\u0027s identity address for the peer\u0027s\ncached RPA when one is known, and stamps the matching\nADDR_LE_DEV_RANDOM on the local dst_type. On the conn-reuse path only\nthe address is copied into the connection:\n\n if (conn) {\n bacpy(\u0026conn-\u003edst, dst);\n\nso conn-\u003edst ends up holding an RPA while conn-\u003edst_type still names the\nidentity it was resolved from, and hci_le_create_conn_sync() puts that\npair on air unchanged. An RPA declared as a public address is not\nsomething any peer can answer.\n\nMeasured on a CYW43438 against a peer advertising an RPA the host holds\nthe IRK for, connecting to the identity address over a raw L2CAP socket.\nThe first attempt creates the connection, the second takes the reuse\npath:\n\n LE Create Connection 3C:78:95:78:37:C3 type public\n LE Create Connection 5B:75:A2:26:D6:18 type public\n LE Connection Complete: Unknown Connection Identifier (0x02)\n\nThe second address is the peer\u0027s RPA. btmon annotates it with an OUI\nlookup rather than \"(Resolvable)\" precisely because the command declares\nit public; the same bit pattern annotates as resolvable once the type is\nright.\n\nThe mistyped pair is also why nothing downstream repairs it.\nhci_bdaddr_is_rpa() tests the type before the address, so an RPA carrying\na public type is not recognised as one, and hci_find_irk_by_addr() then\nsearches for an identity address that does not match it either.\n\nCopy the type along with the address.\n\nThe assignment used to be unconditional just below this block and covered\nboth paths; it moved into hci_conn_add_unset(), which the reuse path does\nnot go through.\n\nCc: stable@vger.kernel.org\nFixes: 14b06c3a88f7 (\"Bluetooth: HCI: Always use the identity address when initializing a connection\")\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Radek Podgorny \u003cradek@podgorny.cz\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "2ea5a87a5a7ae58cb2662b8a7d06f209383e1765", "tree": "a638c3e1b1c57dee1188e045a8cdc77d4fde9277", "parents": [ "7b60ee5f46f2ee329de661f7c68b6818d8136220" ], "author": { "name": "Sai Teja Aluvala", "email": "aluvala.sai.teja@intel.com", "time": "Fri Sep 11 17:22:22 2026 +0530" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:55:27 2026 -0400" }, "message": "Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit\n\nbtintel_pcie_submit_rx() used frbd_index \u003e rxq-\u003ecount to guard the\nFRBD array access, allowing frbd_index \u003d\u003d rxq-\u003ecount to pass through\nand index one element past the end of the array. Change the check to\n\u003e\u003d rxq-\u003ecount so every out-of-range index is rejected.\n\nThis issue was reported by Claude Mythos.\n\nFixes: c2b636b3f788 (Bluetooth: btintel_pcie: Add support for PCIe transport)\nSigned-off-by: Sai Teja Aluvala \u003caluvala.sai.teja@intel.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "7b60ee5f46f2ee329de661f7c68b6818d8136220", "tree": "af651194003a76d73145f923ed48d7dffe79835c", "parents": [ "8879e3e0a84a86954c855caceead4867e74a9a27" ], "author": { "name": "Tzung-Bi Shih", "email": "tzungbi@kernel.org", "time": "Mon Sep 14 09:47:29 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:55:01 2026 -0400" }, "message": "Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown\n\nIn btmtksdio_shutdown(), pm_runtime_get_sync() is called at the\nbeginning of the function. However, if sending the WMT function\ncontrol command fails later, the driver returns early.\n\nIt bypasses the corresponding pm_runtime_put_noidle() and\npm_runtime_disable() calls, leaking the PM usage counter and leaving PM\nruntime enabled indefinitely.\n\nFall through to execute the PM runtime cleanup block even if WMT errors.\n\nFixes: 7f3c563c575e (\"Bluetooth: btmtksdio: Add runtime PM support to SDIO based Bluetooth\")\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@kernel.org\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "8879e3e0a84a86954c855caceead4867e74a9a27", "tree": "312c2730fcbee27cd2a6685502fa05f8e03cb1c6", "parents": [ "78b6abd6c7a7591aacdae657f813214dae4fcd3b" ], "author": { "name": "Chris Lu", "email": "chris.lu@mediatek.com", "time": "Mon Sep 14 14:56:54 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:54:54 2026 -0400" }, "message": "Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access\n\nbtmtksdio.c and btmtkuart.c cast a received WMT event straight to\nstruct btmtk_hci_wmt_evt and read its op/flag fields without checking\nthe event is long enough to contain them, unlike btmtk.c. The\nFUNC_CTRL case then further casts to struct btmtk_hci_wmt_evt_funcc\nand reads its 2-byte status field, again without a length check.\nFirmware that sends a short or malformed WMT event makes both drivers\nread past the end of the received SKB.\n\nMirror btmtk.c: validate the base WMT header with skb_pull_data()\nbefore touching any of its fields, and when a FUNC_CTRL event turns\nout to be the short, header-only form (a plain enable/disable ack\nwith no status word), decode the result from the header\u0027s own flag\nbyte instead (0 \u003d success, otherwise failure).\n\nVerified setup on MT7920, MT7921, MT7922 and MT7925: no regression.\n\nFixes: 9aebfd4a2200 (\"Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices\")\nFixes: e0b67035a90b (\"Bluetooth: mediatek: update the common setup between MT7622 and other devices\")\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Chris Lu \u003cchris.lu@mediatek.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "78b6abd6c7a7591aacdae657f813214dae4fcd3b", "tree": "04241e2a356b779b94ff49e4acfc5ac8e816eb90", "parents": [ "296e7f3c5071cc02dc22e1566e759179fa1792ae" ], "author": { "name": "Chris Lu", "email": "chris.lu@mediatek.com", "time": "Mon Sep 14 14:56:53 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:54:48 2026 -0400" }, "message": "Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events\n\nA too-short BTMTK_WMT_FUNC_CTRL event (WMT header only, no trailing\n2-byte status word) is always treated as BTMTK_WMT_ON_UNDONE. This\nshort form is how firmware acks a plain enable/disable request, and\nthe actual result is carried in the header\u0027s own flag byte (0 \u003d\nsuccess), not a separate status word. Decode it from there instead of\nassuming failure.\n\nVerified setup on MT7920, MT7921, MT7922 and MT7925: no regression.\n\nFixes: e3ac0d9f1a20 (\"Bluetooth: btmtk: accept too short WMT FUNC_CTRL events\")\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Chris Lu \u003cchris.lu@mediatek.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "296e7f3c5071cc02dc22e1566e759179fa1792ae", "tree": "3849b9b2e79d0a09da2d237fc933427e39668efb", "parents": [ "ca18ee413a7cb6f09885778039225e58bae0d607" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Sep 10 14:07:24 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:53:12 2026 -0400" }, "message": "Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync\n\nA BIS connection is matched to its parent socket by looking for a\nsocket in BT_LISTEN state with the same BIG handle:\n\n iso_conn_ready()\n if (test_bit(HCI_CONN_BIG_SYNC, \u0026hcon-\u003eflags))\n parent \u003d iso_get_sock(hdev, \u0026hcon-\u003esrc, \u0026hcon-\u003edst,\n BT_LISTEN, iso_match_big_hcon, hcon);\n\nThe socket was only moved to BT_LISTEN after iso_conn_big_sync()\nreturned, while the LE BIG Create Sync command has already been queued\nby then. If the BIG sync is established before the state is updated,\nwhich is easy to hit with an emulated controller as the command may\ncomplete in a few hundred microseconds, no parent is found and the BIS\nconnections are never notified to the listening socket.\n\nThe user space is then left waiting for connections that never arrive,\ne.g. bluetoothd never completes a MediaTransport1.Acquire of a\nBroadcast Sink transport.\n\nMove the socket to BT_LISTEN before requesting the BIG sync, so the\nstate is visible by the time the command is queued, and restore the\nprevious state if the request could not be started. Since the socket is\nbriefly visible as a listening socket, child sockets may have been\nqueued in the meantime, so drain the accept queue before restoring the\nstate: the cleanup paths of BT_CONNECT2/BT_CONNECTED don\u0027t do it and the\nchildren would be left with a dangling parent pointer.\n\nFixes: fbdc4bc47268 (\"Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync\")\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "ca18ee413a7cb6f09885778039225e58bae0d607", "tree": "69f4e5cd70061b214b05e35e9fe0168de92a8c4f", "parents": [ "9a10987a2f160a44a638c9a35994ca6e3089696e" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Sep 10 14:06:27 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:53:03 2026 -0400" }, "message": "Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()\n\niso_get_sock() returns the parent socket with a reference held, which is\ndropped by sock_put() once the child socket has been set up. The error\npath taken when iso_sock_alloc() fails only calls release_sock() and\nreturns, leaking the reference and thus the parent socket itself.\n\nDrop the reference on that path as well.\n\nFixes: fa224d0c094a (\"Bluetooth: ISO: Reassociate a socket with an active BIS\")\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "9a10987a2f160a44a638c9a35994ca6e3089696e", "tree": "a51b2e71ef528643cf3c8cedfef5a46062b4897b", "parents": [ "4e93c65f87825e1e012bce56615320aeb123815d" ], "author": { "name": "Chengfeng Ye", "email": "nicoyip.dev@gmail.com", "time": "Sat Aug 22 01:43:50 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:52:31 2026 -0400" }, "message": "Bluetooth: hci_sync: Serialize local codec list cleanup\n\nhci_dev_close_sync() clears hdev-\u003elocal_codecs after releasing hdev-\u003elock.\nCodec list additions and both traversals in sco_sock_getsockopt() use that\nlock, but the close path does not. A close and BT_CODEC query can therefore\ninterleave as follows:\n\n hci_dev_close_sync() sco_sock_getsockopt()\n hci_dev_lock()\n fetch codec entry\n hci_codec_list_clear()\n kfree(entry)\n read entry-\u003eid\n\nThe reader then accesses an entry which the close path has freed. KASAN\nreported:\n\n BUG: KASAN: slab-use-after-free in sco_sock_getsockopt+0xfa0/0xfe0\n Read of size 1 at addr ffff8881001c3450\n Call Trace:\n sco_sock_getsockopt+0xfa0/0xfe0\n do_sock_getsockopt+0x537/0x7b0\n __sys_getsockopt+0xf2/0x170\n Allocated by task 92:\n hci_codec_list_add.isra.0+0x2c/0x440\n hci_read_codec_capabilities+0x224/0x590\n hci_read_supported_codecs+0x2c2/0x640\n Freed by task 92:\n kfree+0x131/0x3c0\n hci_codec_list_clear+0xd8/0x160\n hci_dev_close_sync+0x92a/0xfa0\n\nTake hdev-\u003elock around the clear operation at its existing point in the\nclose path. This makes the clear wait for active readers and prevents a new\ntraversal until the list is empty without changing teardown ordering.\n\nFixes: b938790e7054 (\"Bluetooth: hci_codec: Fix leaking content of local_codecs\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "4e93c65f87825e1e012bce56615320aeb123815d", "tree": "4b875025e0f0be221f0dbc9b80a58ca36f34e6e4", "parents": [ "d0795cfd6f655f4de84868a4f4bb41a03f037b3d" ], "author": { "name": "Ibrahim Abdelkader", "email": "iabdelka@qti.qualcomm.com", "time": "Wed Aug 19 14:54:25 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:52:19 2026 -0400" }, "message": "Bluetooth: hci_qca: Do not write to the serial port after it is closed\n\nhci_uart_close() closes the serdev port if HCI_QUIRK_NON_PERSISTENT_SETUP\nis set (for example, for the WCN399x family). A failed hci_dev_open_sync()\nfollowing a successful qca_setup() calls hdev-\u003eclose() but not\nhdev-\u003eshutdown(), so the port is closed while power-\u003evregs_on is left true.\nqca_serdev_remove() then passes its power-\u003evregs_on test and calls\nqca_power_off(), which writes to the closed port unconditionally.\n\nSeen on a WCN3988 by unbinding the driver after a controller failure. The\ntrace below is from a 7.0.0 based kernel, where qca_power_off() was still\nnamed qca_power_shutdown():\n\n Unable to handle kernel NULL pointer dereference at virtual address\n 0000000000000038\n Call trace:\n tty_set_termios+0x50/0x238 (P)\n ttyport_set_baudrate+0x84/0xc0\n serdev_device_set_baudrate+0x24/0x40\n qca_power_shutdown+0x158/0x1fc [hci_uart]\n qca_serdev_remove+0x54/0x68 [hci_uart]\n serdev_drv_remove+0x1c/0x2c\n device_remove+0x4c/0x80\n device_release_driver_internal+0x1cc/0x224\n device_driver_detach+0x18/0x24\n unbind_store+0xb4/0xc0\n\nCheck HCI_UART_PROTO_READY, which hci_uart_close() clears in the same place\nit closes the port, before writing to it. The regulator disable is left\nunconditional so the controller is still powered down.\n\nThe dangling serport-\u003etty that turns this into a use-after-free is\naddressed in a separate patch.\n\nFixes: fa9ad876b8e0 (\"Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990\")\nSigned-off-by: Ibrahim Abdelkader \u003ciabdelka@qti.qualcomm.com\u003e\nReviewed-by: Hans de Goede \u003cjohannes.goede@oss.qualcomm.com\u003e\nSigned-off-by: Hans de Goede \u003cjohannes.goede@oss.qualcomm.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "d0795cfd6f655f4de84868a4f4bb41a03f037b3d", "tree": "c9f512b876be54e1ce317c33b114cdfad08946ad", "parents": [ "4914c499896121ae8b9d5b90f0abc5c8287ff396" ], "author": { "name": "Laxman Acharya Padhya", "email": "acharyalaxman8848@gmail.com", "time": "Mon Aug 24 21:42:36 2026 +0545" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:52:12 2026 -0400" }, "message": "Bluetooth: hci_codec: validate vendor codec count length\n\nThe Read Local Supported Codecs parsers consume the variable-sized\nstandard codec array before parsing the vendor codec count. Although the\ninitial reply-size check includes a vendor count byte in the fixed layout,\nit does not guarantee that the byte remains after the standard codec array.\n\nIf a controller reply ends immediately after that array, calculating the\nvendor codec array size reads vnd_codecs-\u003enum beyond the skb data. Use\nskb_pull_data() to validate and consume each codec header before using its\ncount in both command variants.\n\nFixes: 8961987f3f5f (\"Bluetooth: Enumerate local supported codec and cache details\")\nFixes: 9ae664028a9e (\"Bluetooth: Add support for Read Local Supported Codecs V2\")\nCc: stable@vger.kernel.org\nSuggested-by: Luiz Augusto von Dentz \u003cluiz.dentz@gmail.com\u003e\nSigned-off-by: Laxman Acharya Padhya \u003cacharyalaxman8848@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "4914c499896121ae8b9d5b90f0abc5c8287ff396", "tree": "59e093b0ce32670b16621685c1e27e155f2bae24", "parents": [ "d236517c264e41dc09833c708ef23bccb7a91219" ], "author": { "name": "Radek Podgorny", "email": "radek@podgorny.cz", "time": "Wed Sep 09 00:29:37 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:50:25 2026 -0400" }, "message": "Bluetooth: put the peer\u0027s on-air address on air when we cannot resolve\n\nAn identity address only reaches a peer that is advertising an RPA if the\ncontroller resolves it on our behalf. Where it cannot, the host has to put\nthe peer\u0027s on-air address on air itself.\n\nhci_connect_le() still swaps the caller\u0027s identity address for the peer\u0027s\ncached RPA before creating the connection, but __hci_conn_add() resolves\nthe RPA back to the identity address when it stores it, so the identity is\nwhat goes out. Storing the identity is right when the controller\ntranslates it on the way to the radio; without LL Privacy, or with this\npeer absent from the resolving list, nothing does.\n\nA peer advertising an RPA cannot answer its identity address, so the\nattempt burns a full create-connection timeout. That is not merely a slow\nconnect: a controller without extended scanning cannot scan while it is\ninitiating, so every dead attempt also takes the scanner off the air for\nthe whole timeout.\n\nMeasured on a CYW43438, which reports neither LL Privacy nor extended\nadvertising (LE features 3f 00 00 08 00 00 00 00), against a peer\nadvertising a resolvable private address the host holds the IRK for, with\nthe connection requested on the peer\u0027s identity address:\n\n before: LE Create Connection to the identity address, public type\n 1.61s -\u003e 22.07s, then LE Create Connection Cancel\n LE Connection Complete: Unknown Connection Identifier (0x02)\n after: LE Create Connection to the peer\u0027s RPA, random type\n LE Connection Complete: Success\n\nAdvertising reports reaching the host per second, same window, same five\nunrelated devices on the adapter:\n\n before 1s:2 [nothing from 2s through 21s] 22s:5 23s:3\n after 0s:11 1s:5 2s:2 3s:5 4s:3 5s:4 ... 21s:2 22s:1 23s:2\n\nOne dead connect costs twenty seconds of scanning for every device on the\nadapter, not just the one being dialled.\n\nKeep the RPA in conn-\u003edst unless the controller will translate the\nidentity address: address resolution enabled and the peer\u0027s identity\nactually programmed into the resolving list. Testing ll_privacy_capable()\nalone would not be enough: it reports the feature bit, not whether\nresolution is switched on and not whether this peer is in the list.\nResolution is cleared with the other volatile flags on power-off and\nswitched off again while suspend pauses scanning, and a peer\u0027s IRK is only\nprogrammed along the accept list path, so a direct-connect target, a peer\nwithout HCI_CONN_FLAG_ADDRESS_RESOLUTION, and one that did not fit in a\nfull list are all absent from it.\n\nWith the peer programmed, the identity address stays in conn-\u003edst and the\ncontroller translates it: measured on an Intel controller, the host dials\nthe identity and LE Enhanced Connection Complete reports Resolved Public\nwith the peer\u0027s RPA in the separate peer resolvable private address field.\nWith the peer absent from the list the same setup dials the RPA itself.\n\nEverything downstream already copes with an RPA in conn-\u003edst: it is what\nevery outgoing LE connection stored before 14b06c3a88f7, the connection\ncomplete event names the address that was dialled, and\nle_conn_complete_evt() resolves it back to the identity once the link is\nup. ISO links keep the unconditional conversion: they are created from an\nexisting ACL or a periodic sync and never dial this address themselves.\n\nKeeping the RPA is only right while the peer is still using it, which is\nwhy the preceding patch drops the cached RPA as soon as the peer is seen\nadvertising its identity address. Without that, a peer that turns privacy\noff would be dialled on the address it abandoned rather than the one it\nis answering on.\n\nFixes: 14b06c3a88f7 (\"Bluetooth: HCI: Always use the identity address when initializing a connection\")\nAssisted-by: Claude:claude-opus-5\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Radek Podgorny \u003cradek@podgorny.cz\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "d236517c264e41dc09833c708ef23bccb7a91219", "tree": "42d30ac66bd9864333ff5af6d009b297f1d82ce8", "parents": [ "4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Sun Sep 06 23:43:32 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:49:41 2026 -0400" }, "message": "Bluetooth: coredump: Quiesce dump work on unregister\n\nhci_devcd_handle_pkt_init() arms dump_timeout and coredump producers\nqueue dump_rx without holding an hdev reference. Unregister leaves both\nworks live, so disconnecting during an active dump lets them access hdev\nafter hci_release_dev() frees it.\n\nShut down coredump processing during unregister. Close the producer gate\nunder dump_q.lock before disabling both works, then free the active buffer\nand queued packets under hci_dev_lock. Serializing the gate with enqueue\nprevents controller-specific workers from adding packets after the final\npurge.\n\nFixes: 9695ef876fd1 (\"Bluetooth: Add support for hci devcoredump\")\nReported-by: syzbot+b170dbf55520ebf5969a@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003db170dbf55520ebf5969a\nReported-by: Aby Sam Ross \u003cabysamross@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260322210849.68743-1-abysamross@gmail.com\nSuggested-by: Aby Sam Ross \u003cabysamross@gmail.com\u003e\nReported-by: Tristan Madani \u003ctristan@talencesecurity.com\u003e\nLink: https://lore.kernel.org/r/20260814231248.3096377-1-tristmd@gmail.com\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nAssisted-by: OpenAI Codex:gpt-5\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9", "tree": "29a3afd91dcfe11acc1a589d2e3224e9a33e2cee", "parents": [ "6610c6fe4b8936c232048e6049bf77c70a6f759c" ], "author": { "name": "Chandrashekar Devegowda", "email": "chandrashekar.devegowda@intel.com", "time": "Tue Sep 08 15:26:58 2026 +0530" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:49:34 2026 -0400" }, "message": "Bluetooth: btintel_pcie: validate TX skb length in send_sync\n\nbtintel_pcie_prepare_tx() copies skb-\u003elen bytes into a fixed\nBTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy.\nOversized packets are currently rejected only in\nbtintel_pcie_send_frame(); any future caller of\nbtintel_pcie_send_sync() would silently overflow the DMA buffer.\n\nAdd the bounds check in btintel_pcie_send_sync() itself, right\nbefore skb_push() and the DMA copy.\n\nAssisted-by: Copilot:claude-sonnet-5 code-review code-generation\nFixes: 6e65a09f9275 (\"Bluetooth: btintel_pcie: Add *setup* function to download firmware\")\nSigned-off-by: Chandrashekar Devegowda \u003cchandrashekar.devegowda@intel.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "6610c6fe4b8936c232048e6049bf77c70a6f759c", "tree": "673a56885b94d4d1f6c279b998b65f86da4f5407", "parents": [ "e8241766794cf551d787fa3a77c0d54bbea6f6aa" ], "author": { "name": "ThangNN99", "email": "ngocthang2710.1999@gmail.com", "time": "Sun Sep 06 22:21:27 2026 +0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:48:44 2026 -0400" }, "message": "Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained\n\nhci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev-\u003etx_work\nunconditionally. They can run from the L2CAP/SCO/ISO socket send path\nwhile hci_dev_close_sync() is draining hdev-\u003eworkqueue (HCIDEVDOWN\nracing with a socket write). Since that queue_work() is not chained\nwork from the tx_work worker itself, __queue_work() sees the queue\nmarked __WQ_DRAINING, warns \"cannot queue %ps on wq %s\", and drops\nthe work:\n\n WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work\n Call Trace:\n queue_work_on\n l2cap_chan_send\n l2cap_sock_sendmsg\n ...\n\nhci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before\ndraining, but only hci_cmd_work() and handle_cmd_cnt_and_timer()\ncheck it before queuing. Route the tx_work producers through the\nsame guard via a shared hci_sched_tx() helper.\n\nFixes: 525daaea459f (\"Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\")\nReported-by: syzbot+b6919040d9958e2fc1ae@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003db6919040d9958e2fc1ae\nSigned-off-by: ThangNN99 \u003cngocthang2710.1999@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "e8241766794cf551d787fa3a77c0d54bbea6f6aa", "tree": "9922ad8b294f98836987474477c9025f0738e201", "parents": [ "2b50adefed9808a56d84d1de803cad882cc787fa" ], "author": { "name": "Aamir Ahmed", "email": "elb12345@hotmail.co.uk", "time": "Mon Sep 07 00:37:43 2026 +0100" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:30:14 2026 -0400" }, "message": "Bluetooth: eir: validate service data length before reading UUID\n\neir_get_service_data() reads a 16-bit UUID from the service data using\nget_unaligned_le16() without first checking that the data is long enough\nto hold a UUID16 (2 bytes). If a malformed EIR entry has a service data\nfield with only 1 byte of payload (field_len\u003d2), eir_get_data() returns\ndlen\u003d1. The subsequent get_unaligned_le16() then reads 1 byte past the\nfield boundary.\n\nAdditionally, if the corrupted UUID happens to match, the length\ncalculation \"dlen - 2\" underflows to SIZE_MAX since dlen is size_t.\nCurrent callers either pass NULL for the length parameter or bounds-check\nthe returned length, but future callers may not.\n\nAdd a check that dlen \u003e\u003d sizeof(u16) and skip fields that are too short\nto contain a valid UUID16.\n\nFixes: 8f9ae5b3ae80 (\"Bluetooth: eir: Add helpers for managing service data\")\nCc: stable@vger.kernel.org\nSigned-off-by: Aamir Ahmed \u003celb12345@hotmail.co.uk\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "2b50adefed9808a56d84d1de803cad882cc787fa", "tree": "b38428b8beaa65c81f07d7718b67364f3adbbb62", "parents": [ "83a945a529d6e002dd7339c532288a931f463dba" ], "author": { "name": "Nicolas Thibert", "email": "nithibert@gmail.com", "time": "Tue Sep 08 10:01:08 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 15 14:26:10 2026 -0400" }, "message": "Bluetooth: btusb: fix NXP IW610 composite device handling\n\nThe NXP IW610 module exposes itself as a composite USB device\n(0471:0215) with three interfaces: two real Bluetooth HCI interfaces\n(class 0xe0) and one vendor-specific WiFi interface (class 0xff) used\nby mwifiex-nxp.\n\nThe composite device\u0027s whole USB descriptor reports class 0xe0/01/01\n(Bluetooth), so btusb_table\u0027s generic USB_DEVICE_INFO(0xe0, 0x01, 0x01)\nentry matches every interface, not just the two real HCI ones -- btusb\nends up binding the WiFi interface too, and mwifiex-nxp never gets it.\n\nFix:\n1. In btusb_table (the table the USB core actually matches against),\n explicitly ignore the WiFi interface via BTUSB_IGNORE, ahead of the\n generic entry.\n2. In quirks_table, scope the existing BTUSB_MARVELL entry to the BT\n interface class instead of matching the whole device by VID/PID\n (harmless either way since quirks_table isn\u0027t consulted for initial\n binding, but keep it correct).\n\nNot upstream anywhere: checked NXP\u0027s own i.MX kernel fork\n(nxp-imx/linux-imx), no IW610 references in btusb.c on any branch --\ntheir reference designs wire this chip differently (WiFi over SDIO\nper their release notes), so they never hit this.\n\nSigned-off-by: Nicolas Thibert \u003cnithibert@gmail.com\u003e\nCc: stable@vger.kernel.org\nAssisted-by: LLM (Claude Sonnet 5, Anthropic)\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "83a945a529d6e002dd7339c532288a931f463dba", "tree": "86828766c2f2cd8a9b9e2e74a2537160011cf6f0", "parents": [ "8e759cd1f6444a946bd1fd2b2b29eea582eea1d5" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sat Sep 12 14:48:48 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 15:21:17 2026 +0200" }, "message": "tcp: do not let tcp_rmem be set below 4096\n\nWe can hit a division by zero crash in tcp_rcvbuf_grow()\nand tcp_rcv_space_adjust():\n\ndivide error: 0000 [#1] PREEMPT SMP\nRIP: 0010:tcp_rcvbuf_grow+0x187/0x450 net/ipv4/tcp_input.c:939\n...\ngrow \u003d div_u64(((u64)rcvwin \u003c\u003c 1) * (newval - oldval), oldval);\n\nThe division uses oldval \u003d tp-\u003ercvq_space.space as divisor.\nWhen tp-\u003ercvq_space.space is zero, this leads to a divide-by-zero\nexception.\n\ntp-\u003ercvq_space.space is initialized in tcp_init_buffer_space():\n tp-\u003ercvq_space.space \u003d min3(tp-\u003ercv_ssthresh, tp-\u003ercv_wnd,\n (u32)TCP_INIT_CWND * tp-\u003eadvmss);\n\nIf tcp_rmem[1] is configured to very small values (such as 1),\nsk-\u003esk_rcvbuf is initialized to 1. Then tcp_full_space(sk), which\ncomputes (sk-\u003esk_rcvbuf * scaling_ratio) \u003e\u003e 8, truncates to 0.\nThis sets tp-\u003ewindow_clamp \u003d 0, tp-\u003ercv_ssthresh \u003d 0, and\ntp-\u003ercvq_space.space \u003d 0. Later, when data arrives and DRS is invoked,\ntcp_rcvbuf_grow() divides by oldval \u003d\u003d 0.\n\nBack in 2015, commit b1cb59cf2efe (\"net: sysctl_net_core: check SNDBUF\nand RCVBUF for min length\") ensured that net.core.rmem_default and\nnet.core.rmem_max cannot be set below SOCK_MIN_RCVBUF. Similarly,\nSO_RCVBUF setsockopt enforces max_t(int, val * 2, SOCK_MIN_RCVBUF).\n\nHowever, net.ipv4.tcp_rmem still had .extra1 \u003d SYSCTL_ONE, allowing\narbitrarily small values.\n\nBecause SOCK_MIN_RCVBUF depends on sizeof(struct sk_buff) and cacheline\nalignment, its value varies across architectures and configuration options.\nUsing a fixed constant of 4096 ensures a predictable, architecture-\nindependent lower bound that is safely above SOCK_MIN_RCVBUF everywhere\nand matches the documented 4K default.\n\nFix this by setting tcp_rmem.extra1 to 4096 and updating the documentation.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260912144848.3448026-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "8e759cd1f6444a946bd1fd2b2b29eea582eea1d5", "tree": "6b5c9ca4b112aaec71080297328ca7548cfbb06d", "parents": [ "0654f4dba1fbc697f2653aba30cd68587fcbf10e" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Mon Sep 14 01:14:01 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 15:13:22 2026 +0200" }, "message": "tcp: Don\u0027t call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().\n\ntcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for\nTCP_LISTEN since commit 073d89808c06 (\"net: fix data-races around\nsk-\u003esk_forward_alloc\").\n\nHowever, there is still a small race window between tcp_v6_rcv()\nand tcp_v6_do_rcv(), where concurrent close() changes TCP_LISTEN\nto TCP_CLOSE, causing skb_clone_and_charge_r() to be called\nlocklessly and resulting in the splat below. [0]\n\nLet\u0027s avoid calling skb_clone_and_charge_r() for TCP_CLOSE as well.\n\nThis is fine for non-listeners because tcp_rcv_state_process()\ndrops skb for TCP_CLOSE and opt_skb was freed immediately anyway.\n\n[0]:\nsk-\u003esk_forward_alloc\nWARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162, CPU#1: ksoftirqd/1/28\nModules linked in:\nCPU: 1 UID: 0 PID: 28 Comm: ksoftirqd/1 Not tainted 7.2.0 #17 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\nRIP: 0010:inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162\nCode: 3d 49 ff e9 06 fd ff ff e8 d0 5b 83 f8 90 0f 0b 90 e9 35 fe ff ff e8 c2 5b 83 f8 90 0f 0b 90 e9 c5 fe ff ff e8 b4 5b 83 f8 90 \u003c0f\u003e 0b 90 e9 04 ff ff ff e8 a6 5b 83 f8 90 0f 0b 90 e9 65 fe ff ff\nRSP: 0018:ffffc90000677bb8 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff8880117bde80 RCX: ffffffff8957eb41\nRDX: ffff88801dad5d00 RSI: ffffffff8957ec3c RDI: 0000000000000005\nRBP: 00000000fffff000 R08: ffffffff8957eb41 R09: 00000000fffff000\nR10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000\nR13: ffff8880117bdf10 R14: ffffffff81c08eb7 R15: 0000000000000003\nFS: 0000000000000000(0000) GS:ffff8880d7ae5000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f93a1021138 CR3: 00000000207a9000 CR4: 0000000000350ef0\nCall Trace:\n \u003cTASK\u003e\n __sk_destruct+0x82/0xae0 net/core/sock.c:2356\n rcu_do_batch kernel/rcu/tree.c:2645 [inline]\n rcu_core+0x59c/0x1100 kernel/rcu/tree.c:2897\n handle_softirqs+0x1e4/0x9b0 kernel/softirq.c:622\n run_ksoftirqd kernel/softirq.c:1076 [inline]\n run_ksoftirqd+0x38/0x60 kernel/softirq.c:1068\n smpboot_thread_fn+0x458/0xc80 kernel/smpboot.c:160\n kthread+0x396/0x4a0 kernel/kthread.c:436\n ret_from_fork+0x8e0/0xe40 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nFixes: e994b2f0fb92 (\"tcp: do not lock listener to process SYN packets\")\nReported-by: Taras Madan \u003ctarasmadan@google.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260914011420.115556-1-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0654f4dba1fbc697f2653aba30cd68587fcbf10e", "tree": "1775eee83c23b1f4ff3d063cde21d2718a0d6118", "parents": [ "2cef2588c995722a901368def30befeef9ae55c6" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Sat Sep 12 14:09:20 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 13:30:53 2026 +0200" }, "message": "selftests/tc-testing: add hhf hh_limit cap tests\n\nCover the new TCA_HHF_HH_FLOWS_LIMIT bound: values above 2*HH_FLOWS_CNT\n(4294967295, 65536, 2049) are rejected with the configured limit left\nuntouched on both the change and the add path, the boundary value 2048 is\naccepted (installed at 100 first so the boundary change is load-bearing),\nand an add-time hh_limit 500 is preserved instead of being clobbered by\nthe default.\n\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nTested-by: hybris \u003chybris@mojatatu.ai\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/QDISC-B855.v1.20260911153152@mojatatu.com.2\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2cef2588c995722a901368def30befeef9ae55c6", "tree": "8c242c03aa2c6c5b827df2511ebc986b812cb43a", "parents": [ "18a6fe05fb6e18de29fa90d388bb34044114b3d8" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Sat Sep 12 14:09:19 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 13:30:53 2026 +0200" }, "message": "net/sched: hhf: cap hh_flows_limit at change time\n\nhhf_change() stores TCA_HHF_HH_FLOWS_LIMIT with no upper bound. A huge\nhh_flows_limit lets each new heavy-hitter flow pass the\nhh_flows_current_cnt check in alloc_new_hh() and forces a fixed-size\nkzalloc(GFP_ATOMIC) per flow under spoofed traffic, for unbounded memory\ngrowth.\n\nBound the attribute with NLA_POLICY_MAX() at 2*HH_FLOWS_CNT (the\nhhf_init() default) and report the rejected value via extack. The\ndeprecated nested parse is kept: legacy tc does not set NLA_F_NESTED on\nTCA_OPTIONS. Configs relying on hh_limit above the default were relying\non unbounded, unsafe behaviour and are not supported going forward.\n\nhhf_init() also ran hhf_change() before setting the default\nhh_flows_limit, so a user-supplied hh_limit at add time was clobbered\nback to 2048. Set the default before hhf_change() so the configured\nvalue sticks.\n\nThis is a follow-up to commit eb56a495f59b (\"net/sched: hhf: clamp\nquantum in change and init paths\"), which bounded the quantum of the\nsame qdisc; the hh_flows_limit bound is the remaining unbounded knob of\nthat series\u0027 scope.\n\nConditions to recreate the bug: CAP_NET_ADMIN in a user namespace;\ntc qdisc change dev X root hhf hh_limit 4294967295 succeeds and the\nvalue is echoed by tc qdisc show, unbounding heavy-hitter flow\nallocations; also tc qdisc add dev X root hhf hh_limit 500 stores 2048\ninstead of 500.\n\nFixes: 10239edf86f1 (\"net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc\")\nCc: stable@vger.kernel.org\nReported-by: Sashiko (gemini) \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260822195509.112717-1-jhs@mojatatu.com\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nTested-by: hybris \u003chybris@mojatatu.ai\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/QDISC-B855.v1.20260911153152@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "18a6fe05fb6e18de29fa90d388bb34044114b3d8", "tree": "2c4acf60475d91b24f7d3cd3978a353b51b2c59f", "parents": [ "7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1" ], "author": { "name": "Nikolay Aleksandrov", "email": "razor@blackwall.org", "time": "Fri Sep 11 13:50:21 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 12:27:41 2026 +0200" }, "message": "net: bridge: mst: move switchdev call outside rcu\n\nThis is a follow-up of one of sashiko\u0027s pre-existing bug reports.\nbr_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs\nwhile holding rcu_read_lock() which invokes the blocking switchdev\nnotifier chain and may sleep. Nonzero MSTI changes come from netlink\nwith rtnl held. Move the switchdev call before entering the rcu section and\nassert that rtnl is held.\n\nThe call cannot be deferred because netlink needs its error and extack.\nAlso DSA reads the old bridge MST state during the callback and checks it.\nA deferred callback will be late and will see the updated state.\n\nFixes: 3a7c1661ae13 (\"net: bridge: mst: fix vlan use-after-free\")\nSigned-off-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260911105021.1385934-1-razor@blackwall.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1eeca1d5e0920fbdad6449768fd2d4364e714180", "tree": "292c97d02b6da107103c4f46562427fbe67da82e", "parents": [ "621d90169cef6c8da5b6134db5c0c4e23cdd09ce" ], "author": { "name": "Jiangshan Yi", "email": "yijiangshan@kylinos.cn", "time": "Sat Aug 15 20:10:43 2026 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Sep 15 11:52:56 2026 +0200" }, "message": "wifi: brcmsmac: fix UAF in brcms_free_timer()\n\nbrcms_free_timer() calls brcms_del_timer() which uses the non-synchronous\ncancel_delayed_work() to cancel the timer\u0027s underlying delayed work. If\nthe work callback (_brcms_timer) is already running, cancel_delayed_work()\nreturns false without waiting, and brcms_free_timer() proceeds to kfree(t)\nwhile the callback still accesses t through container_of().\n\nAdd an explicit cancel_delayed_work_sync() after brcms_del_timer() to\nguarantee that any in-flight callback has completed before the timer\nstructure is freed.\n\nFixes: 5b435de0d786 (\"net: wireless: add brcm80211 drivers\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jiangshan Yi \u003cyijiangshan@kylinos.cn\u003e\nAcked-by: Arend van Spriel \u003carend.vanspriel@broadcom.com\u003e\nLink: https://patch.msgid.link/20260815121043.938414-1-yijiangshan@kylinos.cn\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "621d90169cef6c8da5b6134db5c0c4e23cdd09ce", "tree": "0f9e2c83ed4b1e4910d3f35abf4e9a9f0ccb9abc", "parents": [ "769ec67d0abc64c7f716d16e9826c8ae2c5264c2" ], "author": { "name": "Karl Mehltretter", "email": "kmehltretter@gmail.com", "time": "Tue Aug 11 10:27:02 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Sep 15 11:52:24 2026 +0200" }, "message": "wifi: brcmfmac: fix lost 802.1x TX completion wakeup\n\nbrcmf_txfinalize() decrements pend_8021x_cnt before a lockless\nwaitqueue_active() check. atomic_dec() does not order the decrement\nagainst the check.\n\nThe waiter can therefore observe a nonzero count while the waker observes\nan empty queue, losing the final wakeup and delaying key installation\nuntil the 950 ms timeout.\n\nAdd smp_mb__after_atomic() to order the decrement before the queue\ncheck. wait_event_timeout() provides the matching barrier. LKMM confirms\nthat this forbids the lost-wakeup outcome.\n\nFixes: 21fff75d2fb6 (\"brcmfmac: use wait_event_timeout for 8021x pending count\")\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nAcked-by: Arend van Spriel \u003carend.vanspriel@broadcom.com\u003e\nLink: https://patch.msgid.link/20260811082702.44521-1-kmehltretter@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "769ec67d0abc64c7f716d16e9826c8ae2c5264c2", "tree": "6ab018a8b4b73aab4f0a4831907b80940171fb79", "parents": [ "2b04d6556964ae9f89819b86a0a7801e39c3aae5", "820b8cff81c796ba20573e04722ab62500713f97" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Sep 15 11:50:57 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Sep 15 11:51:18 2026 +0200" }, "message": "Merge tag \u0027ath-current-20260914\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath\n\nJeff Johnson says:\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nath.git update for v7.3-rc4\n\nIn ath12k: revert an undocumented and unapproved DT ABI that was added\nduring the v7.3 merge window.\n\nIn wcn36xx and ath11k: fix preexisting object lifetime issues.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1", "tree": "8b4ffd8a2c8f70776cfeddd942fdec627d9987b4", "parents": [ "2998147b59c9df0a51477c7a6b3d1f0ba3127dd4" ], "author": { "name": "Hohyun Sim", "email": "tlaghgus0425@korea.ac.kr", "time": "Thu Sep 10 15:37:43 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 10:31:54 2026 +0200" }, "message": "net: fddi: skfp: fix NULL deref when setting the MAC address while down\n\nskfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without\nchecking netif_running(). ResetAdapter() first calls card_stop(), which\nsets smc-\u003ehw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(),\nwhich walks the two transmit queues:\n\n\tfor (i \u003d QUEUE_S; i \u003c\u003d QUEUE_A0; i++) {\n\t\tqueue \u003d smc-\u003ehw.fp.tx[i] ;\n\t\t...\n\t\tt \u003d queue-\u003etx_curr_get ;\n\nsmc-\u003ehw.fp.tx[] is only populated by init_tx(), which is reached from\nskfp_open() through init_smt() -\u003e init_fddi_driver() -\u003e init_fplus() -\u003e\ninit_mac() -\u003e init_tx(). The private area is allocated and zeroed by\nalloc_fddidev(), so on an interface that has never been brought up both\nqueue pointers are still NULL. The hw_state test at the top of\nmac_drv_clear_tx_queue() does not catch this, because card_stop() has\njust set STOPPED; the function proceeds into the loop and dereferences\nNULL. ResetAdapter() does call init_smt() itself, but only after the\nqueues have been cleared.\n\nSetting the MAC address on a down interface therefore oopses:\n\n ip link set dev fddi0 address 02:00:00:00:00:01\n\n BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68/0x2c0 [skfp]\n Read of size 8 at addr 0000000000000010 by task ip/302\n Call Trace:\n \u003cTASK\u003e\n mac_drv_clear_tx_queue+0x68/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n ResetAdapter+0x29/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n skfp_ctl_set_mac_address+0x57/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n netif_set_mac_address+0x1e4/0x2c0\n do_setlink+0x684/0x2680\n \u003c/TASK\u003e\n\nAddress 0x10 is the offset of tx_curr_get, the third pointer in\nstruct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which\nResetAdapter() calls immediately afterwards, dereferences\nsmc-\u003ehw.fp.rx[QUEUE_R1] in the same way behind the same ineffective\nhw_state test; the transmit queue merely crashes first. Both are\ncovered by the guard below.\n\nSkip the adapter reset when the interface is down. dev_addr_set() is\nleft unconditional, so the new address is still recorded in\ndev-\u003edev_addr. Nothing is lost by not resetting the adapter here:\nskfp_open() deliberately re-reads the factory address on every open,\n\n\tread_address(smc, NULL);\n\teth_hw_addr_set(dev, smc-\u003ehw.fddi_canon_addr.a);\n\nand the comment above it states this is done to discard exactly such an\naddress override across a close/open cycle. An address set while the\ninterface is down could not have survived the following open even\nbefore this change, so the guard removes no working behaviour. Guarding\nthe hardware side of ndo_set_mac_address() with netif_running() is\nestablished practice; skge_set_mac_address() has done so since commit\n2eb3e621c4e0 (\"skge: set mac address bonding fix\").\n\nGuarding the reset as a whole, rather than NULL-checking the queues, is\nalso what the rest of the driver expects. After a previous open/close\nthe queue pointers are stale but non-NULL, so there is no crash, yet\nResetAdapter() goes on to call smt_online() and STI_FBI() (\"Enable\nBoard Interrupts\") while skfp_close() has already called free_irq() -\nthe adapter would be brought back online with no handler installed. The\nonly other ResetAdapter() caller is skfp_interrupt(), which by\nconstruction runs only while the device is open.\n\nFound by automated driver testing against an emulated SysKonnect FDDI\nadapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires\nCAP_NET_ADMIN.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nAssisted-by: LLM KASAN\nSigned-off-by: Hohyun Sim \u003ctlaghgus0425@korea.ac.kr\u003e\nLink: https://patch.msgid.link/20260910063743.110747-1-tlaghgus0425@korea.ac.kr\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2998147b59c9df0a51477c7a6b3d1f0ba3127dd4", "tree": "f1e35ab9540af34871f3058e0da5678f64a743c4", "parents": [ "23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e" ], "author": { "name": "Dong Chenchen", "email": "dongchenchen2@huawei.com", "time": "Thu Sep 10 22:00:42 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 10:20:38 2026 +0200" }, "message": "ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup\n\nWhen the forward output route cannot be used in icmp_route_lookup(),\nit enters the \"reverse path\" and calls ip_route_input() on fl4_dec.daddr,\nthe original packet\u0027s source address.\n\nip_route_input() only returns an error for truly invalid packets. For\nunreachable addresses it will succeed and return an input route whose\ndst.output is set to ip_rt_bug(). The existing check only rejects\nRTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned\nand later used for output, syzkaller triggering a WARN_ON_ONCE()\nin ip_rt_bug() as bellow:\n\n ------------[ cut here ]------------\n WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20\n RIP: 0010:ip_rt_bug+0x14/0x20\n Call Trace:\n ip_push_pending_frames+0xfa/0x100\n __icmp_send+0x905/0xf10\n ip_options_compile+0xc0/0xd0\n ip_rcv_finish_core+0x321/0xae0\n ip_rcv+0x1de/0x260\n __netif_receive_skb_one_core+0x11a/0x130\n netif_receive_skb+0x7b/0x260\n tun_get_user+0x11bf/0x1c10\n ------------[ cut here ]------------\n\nReject input route that is RTN_UNREACHABLE to fix it. The net warning\nis only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of\na race condition.\n\nFixes: 8b7817f3a959 (\"[IPSEC]: Add ICMP host relookup support\")\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Dong Chenchen \u003cdongchenchen2@huawei.com\u003e\nLink: https://patch.msgid.link/20260910140042.1880242-1-dongchenchen2@huawei.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e", "tree": "26ab5cfc6eb82646ab860c341937270413217e1f", "parents": [ "9e92ad4630f5dd1838ce6bbe6b1bd2c73d34de36" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Sun Sep 13 21:00:52 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 19:21:58 2026 -0700" }, "message": "net: bcmgenet: restore the hardware filters on open\n\nbcmgenet_hfb_init() runs INIT_LIST_HEAD() on priv-\u003erxnfc_list, which drops\nevery rule off the list, and bcmgenet_open() calls it on each ifup. Every\nrule the user configured is silently lost:\n\n # ethtool -N eth0 flow-type ether dst $MAC action 0\n Added rule with ID 0\n # ethtool -n eth0 | grep -c Filter:\n 1\n # ip link set eth0 down \u0026\u0026 ip link set eth0 up\n # ethtool -n eth0 | grep -c Filter:\n 0\n\nInitialise the lists once at probe and restore the rules on open, as\nbcmgenet_resume() already does.\n\nFixes: 3e370952287c (\"net: bcmgenet: add support for ethtool rxnfc flows\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Justin Chen \u003cjustin.chen@broadcom.com\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20260913190052.939955-1-nb@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9e92ad4630f5dd1838ce6bbe6b1bd2c73d34de36", "tree": "9d78a35353b6f1f33594297539f46255bfe96be9", "parents": [ "7616242a2b37883f7322aaa1d2bd6cd0fed28315" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Thu Sep 10 14:13:15 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 19:05:46 2026 -0700" }, "message": "net: dsa: mxl862xx: disable the stats poll on teardown\n\nmxl862xx_setup() arms the stats poll before mxl862xx_setup_mdio(), and\nnothing stops it until dsa_register_switch() has returned an error to\nmxl862xx_probe(). DSA frees the dsa_port list before it returns, so a\npoll that fires once .setup or a later step of dsa_tree_setup() has\nfailed walks freed ports. On shutdown the user ports stay registered,\nand the WORK_STOPPED flag test in mxl862xx_get_stats64() is not atomic\nwith the cancel in mxl862xx_shutdown(), so a re-arm that read the flag\nbefore it was set queues the poll after cancel_delayed_work_sync() has\nreturned.\n\nArm the poll once .setup has succeeded and stop it from a .teardown op,\nwhich DSA calls on unregister and after a failed registration, in both\ncases before it frees the ports. Use disable_delayed_work_sync() there\nand in shutdown(): it drains a running poll as the cancel did and turns\nevery later attempt to queue the work into a no-op, so the re-arm\ncannot bring the poll back. remove() and the probe error path only set\nWORK_STOPPED, which crc_err_work tests before it walks the ports.\n\nFixes: a21d33a5265f (\"net: dsa: mxl862xx: implement .get_stats64\")\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nLink: https://patch.msgid.link/1eb6f7fc1789b67e4b11e3f4d5ff080d0b6f7cbb.1789045590.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7616242a2b37883f7322aaa1d2bd6cd0fed28315", "tree": "14c54b2183cfab0d351bb5507445e285e7291b9c", "parents": [ "bde5212360bd44506edec073ebbd6d0c72f75820" ], "author": { "name": "Andrea Mayer", "email": "andrea.mayer@uniroma2.it", "time": "Sun Sep 13 21:44:21 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 19:03:01 2026 -0700" }, "message": "seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation\n\nWhen an SRv6 packet arrives on an interface enslaved to a VRF,\nvrf_ip6_rcv() sets IP6SKB_L3SLAVE in IP6CB, but decap_and_validate()\nhas never set IPSKB_L3SLAVE in IPCB. The bit stayed clear in the\ncommon case, and with CONFIG_IPV6_MIP6 the leftover frag_max_size of\na reassembled outer packet could even set it, with no VRF involved.\nCommit 44930446dde4 (\"ipv6: seg6: clear IPv4 control block on IPIP\ndecapsulation\") then made the unreliable bit reliably clear.\n\nThe effect of the missing flag is visible with End.DX4 when a\ndelivery to a local address of the node reaches the socket lookup.\nFor example, a UDP socket bound to the enslaved ingress interface\ndoes not receive any of the decapsulated packets, while an unbound\nsocket outside the VRF does.\nThis contradicts Documentation/networking/vrf.rst: by default the\nscope of an unbound UDP or TCP socket is limited to the default VRF.\n\nSet IPSKB_L3SLAVE for IPv4 in decap_and_validate(), which already does\nthe same for IPv6. The socket lookup then matches the decapsulated\npacket like any other packet received on that enslaved interface. Such\na packet matches an unbound UDP or TCP socket only when\nudp_l3mdev_accept or tcp_l3mdev_accept is set.\n\nFixes: 891ef8dd2a8d (\"ipv6: sr: implement additional seg6local actions\")\nSigned-off-by: Andrea Mayer \u003candrea.mayer@uniroma2.it\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260913194421.31-1-andrea.mayer@uniroma2.it\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bde5212360bd44506edec073ebbd6d0c72f75820", "tree": "64772922ee17b202efed3fef2de14e910ac456be", "parents": [ "6fb0a9d9071f1ff0cc5cfc0782302d9c90d642cb" ], "author": { "name": "Ahmed Naseef", "email": "naseefkm@gmail.com", "time": "Sat Sep 12 17:43:06 2026 +0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 19:01:51 2026 -0700" }, "message": "net: phy: mediatek: do not report link and per-speed LED rules together\n\nmtk_phy_led_hw_ctrl_get() reports TRIGGER_NETDEV_LINK whenever any of the\nspeed bits in on_set is on, and in addition reports every individual\nTRIGGER_NETDEV_LINK_* bit that is set. The netdev trigger refuses that\ncombination: netdev_led_attr_store() rejects TRIGGER_NETDEV_LINK together\nwith any per-speed rule, and it validates the whole resulting mode rather\nthan just the bit being written. Once the hardware has any link bit\nprogrammed, every write to the trigger attributes of that LED therefore\nfails with -EINVAL and the LED can no longer be configured.\n\nThe rules are also fed back into the hardware: the trigger stores what is\nread back, and a later write of device_name programs it again, expanding\nTRIGGER_NETDEV_LINK to every speed in on_set. An LED configured for a\nsingle speed is thereby silently widened to \"on at any link speed\".\n\nBoth are easy to see on the EcoNet EN7528, whose four PHYs share one LED\nblock. The first LED programs the block correctly, the second reads those\nrules back and rewrites them widened, and the remaining two then read the\nwidened value, so an LED configured for \"link_10 link_100\" ends up lit on a\n1000 Mbps link.\n\non_set holds every speed the LED can indicate and is exactly what\nmtk_phy_led_hw_ctrl_set() programs for TRIGGER_NETDEV_LINK, so report the\nspeed independent rule only when all of them are on, and the individual\nspeeds otherwise. The mapping is then the inverse of the one used when\nprogramming the LED and round trips without changing the register.\n\nFixes: c66937b0f8db (\"net: phy: mediatek-ge-soc: support PHY LEDs\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ahmed Naseef \u003cnaseefkm@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260912134306.3544329-1-naseefkm@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6fb0a9d9071f1ff0cc5cfc0782302d9c90d642cb", "tree": "85ccd19c466526d014968985eb97b9c30a851e51", "parents": [ "f97d8c7bab7843631206a114986c9059da03efeb" ], "author": { "name": "Chunfeng Song", "email": "springbreeze@stu.pku.edu.cn", "time": "Thu Sep 10 05:51:10 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 18:56:16 2026 -0700" }, "message": "rust: net: phy: fix off-by-one bit positions in device status accessors\n\nThe hand-written bitfield offsets in is_link_up(), is_autoneg_enabled()\nand is_autoneg_completed() were correct when the abstraction was\nmerged: at that time autoneg, link, and autoneg_complete were at bits\n13, 14, and 15 of struct phy_device\u0027s first bitfield unit. Commit\n2796ff1e3dca (\"net: phy: add flag is_genphy_driven to struct phy_device\")\nlater inserted is_genphy_driven just before autoneg, shifting the three\nfields up by one, so the accessors now read:\n\n is_link_up() reads bit 14 \u003d autoneg\n is_autoneg_enabled() reads bit 13 \u003d is_genphy_driven\n is_autoneg_completed() reads bit 15 \u003d link\n\nThe official ax88796b Rust driver uses all three accessors in its\nread_status() implementation, so it inherits the bug.\nphy_attach_direct() sets is_genphy_driven only when it falls back to\nthe generic driver, and ax88796b has a real driver, so\nis_genphy_driven stays 0. The broken is_autoneg_enabled() therefore\nreads bit 13 as 0, compares it against AUTONEG_ENABLE (1), and always\nreturns false, so read_status() never reaches the\nresolve_aneg_linkmode() call.\n\nThe ordinary bindgen accessors take \u0026self. Calling them through\n(*phydev).link() would create a shared reference to the complete\nbindings::phy_device, which is not appropriate for an object wrapped in\nOpaque.\n\nUse the bindgen-generated raw accessors (link_raw(), autoneg_raw(),\nand autoneg_complete_raw()) instead. They retain the bit positions and\nendianness handling generated from the C layout without creating a Rust\nreference to the complete phy_device. Drop the hand-written numbers\ntogether with the TODO comment that marked them as a stopgap.\n\nThe raw accessors are only emitted by bindgen 0.71 and later, and were\nadded at the Rust-for-Linux project\u0027s request, so this fix can only be\nbackported to stable branches whose minimum bindgen version is at least\nthat, hence the scope on the Cc: stable line below.\n\nFound by a static equivalence audit (C2RustDrv, a C-to-Rust driver\nmigration tool) that compares hand-written bitfield offsets against\nthe bindgen layout of struct phy_device. Verified by building the\nbindings and checking the generated accessors; no runtime testing was\npossible without PHY hardware.\n\nFixes: 2796ff1e3dca (\"net: phy: add flag is_genphy_driven to struct phy_device\")\nCc: stable@vger.kernel.org # Only 7.1.y and later (requires bindgen\u0027s raw pointer accessors).\nLink: https://github.com/rust-lang/rust-bindgen/issues/2674\nSigned-off-by: Chunfeng Song \u003cspringbreeze@stu.pku.edu.cn\u003e\nReviewed-by: FUJITA Tomonori \u003cfujita.tomonori@gmail.com\u003e\nLink: https://patch.msgid.link/20260910055110.167110-1-springbreeze@stu.pku.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f97d8c7bab7843631206a114986c9059da03efeb", "tree": "02a00c6a4559309b82f69ac6b27a5f26b8cc7f51", "parents": [ "6c21ebc81338dd8abe021dec3d01acebd789ea2c" ], "author": { "name": "Aohan Mei", "email": "henrymei@tencent.com", "time": "Fri Sep 11 15:34:32 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 18:47:52 2026 -0700" }, "message": "rds: ib: use rds_conn_drop() on protocol version mismatch\n\nrds_ib_cm_connect_complete() runs from the RDMA-CM event handler with\nconn-\u003ec_cm_lock held. When the peer negotiates a protocol version\nolder than RDS_PROTOCOL_COMPAT_VERSION, the handler calls\nrds_conn_destroy(), which is only safe in the rmmod path: it\nsynchronously tears the connection down and flush_work()es the\nshutdown work cp_down_w.\n\nThat shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is\nthe very lock the event handler still holds, so the flush never\ncompletes: the two workers wait on each other and the RDS connection\nworkqueues stall for good.\n\nAll other RDMA-CM failure paths (REJECTED, CONNECT_ERROR,\nDISCONNECTED) use rds_conn_drop(), which marks the connection\nRDS_CONN_ERROR and schedules the shutdown work asynchronously. Use\nit here as well.\n\nFixes: f147dd9ecabf (\"RDS/IB: Disallow connections less than RDS 3.1\")\nReported-by: TencentOS Corvus AI \u003ccorvus@tencent.com\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nSigned-off-by: Aohan Mei \u003chenrymei@tencent.com\u003e\nLink: https://patch.msgid.link/20260911073436.3542080-1-ljp1205831794@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6c21ebc81338dd8abe021dec3d01acebd789ea2c", "tree": "2a00925dd85ee70571bc7105721b629c3692dce0", "parents": [ "e6b6078ea1731b05b3b552497b3bce4bf8b014ae", "e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 17:06:52 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 17:06:52 2026 -0700" }, "message": "Merge tag \u0027nf-26-09-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\n1) Fix KMSAN reports an uninit-value in nf_nat_setup_info() for netmap,\n from Theodor Arsenij Larionov Trichkine.\n\n2) Restrict deletion of netdevice in basechain and flowtable to exact\n matching only, from Fernando F. Mancera.\n\n3) Fix nf_nat_register_fn() error path allowing for a memleak.\n\n4) Hold reference on ct until flow is released to address, otherwise\n access to release ct-\u003eext or different ct due to typesafe RCU\n semantics.\n\n* tag \u0027nf-26-09-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: flowtable: hold reference on ct until flow is released\n netfilter: nf_nat: unregister and release hooks on error\n netfilter: nf_tables: fix device name and prefix match in hook lookup\n netfilter: nft_nat: fully initialise new_addr in netmap setup\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260913205447.1889203-1-pablo@netfilter.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "820b8cff81c796ba20573e04722ab62500713f97", "tree": "8fbd5587fae3008b62609cf5b8890a8c6f3b7d54", "parents": [ "d9be5e75530772fc31637070d51e5717d6aeaa2a" ], "author": { "name": "Nicolas Escande", "email": "nico.escande@gmail.com", "time": "Fri Jul 31 16:58:30 2026 +0200" }, "committer": { "name": "Jeff Johnson", "email": "jeff.johnson@oss.qualcomm.com", "time": "Mon Sep 14 11:43:31 2026 -0700" }, "message": "wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()\n\nWhen mac80211 removes a sta, it calls .sta_state() which in turn calls\nath11k_mac_station_remove(). In that function we clean up both peers \u0026\narsta related resources.\n\nBut when the firmware crashes, ath11k calls ieee80211_restart_hw(), which\nassumes that all driver related resources are cleaned up beforehand. This\ncleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not\nin fact free arsta-\u003erx_stats / tx_stats.\n\nExtract the arsta cleanup from ath11k_mac_station_remove() into a\nnew ath11k_mac_station_cleanup() and call it from both there and\nath11k_mac_peer_cleanup_all().\n\nThis should handle kmemleaks reports like:\n\tunreferenced object 0xffffff801ae66400 (size 1024):\n\t comm \"hostapd\", pid 1306, jiffies 4295011565\n\t hex dump (first 32 bytes):\n\t 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n\t 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n\t backtrace (crc d61c08ec):\n\t kmemleak_alloc+0x3c/0x50\n\t __kmalloc_cache_noprof+0x2b0/0x3e0\n\t ath11k_mac_op_sta_state+0x1dc/0xb10\n\t drv_sta_state+0xac/0x6f8\n\t sta_info_insert_rcu+0x314/0x5e0\n\t sta_info_insert+0x14/0x38\n\t ieee80211_add_station+0x10c/0x1a0\n\t nl80211_new_station+0x3e8/0x680\n\t genl_family_rcv_msg_doit+0xc0/0x120\n\t genl_rcv_msg+0x1b4/0x258\n\t netlink_rcv_skb+0x4c/0x108\n\t genl_rcv+0x38/0x60\n\t netlink_unicast+0x190/0x278\n\t netlink_sendmsg+0x15c/0x370\n\t ____sys_sendmsg+0x120/0x290\n\t ___sys_sendmsg+0x70/0xa0\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1\n\nFixes: d5c65159f289 (\"ath11k: driver for Qualcomm IEEE 802.11ax devices\")\nSigned-off-by: Nicolas Escande \u003cnico.escande@gmail.com\u003e\nReviewed-by: Rameshkumar Sundaram \u003crameshkumar.sundaram@oss.qualcomm.com\u003e\nReviewed-by: Baochen Qiang \u003cbaochen.qiang@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260731145830.769811-1-nico.escande@gmail.com\nSigned-off-by: Jeff Johnson \u003cjeff.johnson@oss.qualcomm.com\u003e\n" }, { "commit": "d9be5e75530772fc31637070d51e5717d6aeaa2a", "tree": "94b61b55053045d74b913dc569f2be6c058a035a", "parents": [ "ce9d5197d651cdd0fbb586c3d77c28438abe1b10" ], "author": { "name": "Fan Wu", "email": "fanwu01@zju.edu.cn", "time": "Thu Sep 10 02:09:07 2026 +0000" }, "committer": { "name": "Jeff Johnson", "email": "jeff.johnson@oss.qualcomm.com", "time": "Mon Sep 14 11:43:30 2026 -0700" }, "message": "wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown\n\nwcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(),\nwhich only dequeues the timer and does not wait for a callback that is\nalready executing; the preceding free_irq() calls synchronize the\ninterrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can\ntherefore be running past the teardown and use the wcn freed along\nwith the ieee80211_hw in wcn36xx_remove(): it takes wcn-\u003edxe_lock,\nreads wcn-\u003etx_ack_skb and passes wcn-\u003ehw to\nieee80211_tx_status_irqsafe().\n\nFix this by using timer_shutdown_sync(), which waits for a running\ncallback and also prevents the timer from being rearmed again. The\ntimer is set up again by wcn36xx_dxe_init() on the next start, so the\nstart/stop cycle is unaffected.\n\nThis issue was found by an in-house static analysis tool.\n\nFixes: fdf21cc37149 (\"wcn36xx: Add TX ack support\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nCo-developed-by: Song Li \u003csongl@zju.edu.cn\u003e\nSigned-off-by: Song Li \u003csongl@zju.edu.cn\u003e\nSigned-off-by: Fan Wu \u003cfanwu01@zju.edu.cn\u003e\nReviewed-by: Loic Poulain \u003cloic.poulain@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260910020907.3353-1-fanwu01@zju.edu.cn\nSigned-off-by: Jeff Johnson \u003cjeff.johnson@oss.qualcomm.com\u003e\n" }, { "commit": "ce9d5197d651cdd0fbb586c3d77c28438abe1b10", "tree": "7d4869a0ffee3e50462eb139441fcc418f541da2", "parents": [ "50d3d79dc0743b616afb00d01a626c76758721f7" ], "author": { "name": "Krzysztof Kozlowski", "email": "krzysztof.kozlowski@oss.qualcomm.com", "time": "Tue Aug 25 10:13:14 2026 +0200" }, "committer": { "name": "Jeff Johnson", "email": "jeff.johnson@oss.qualcomm.com", "time": "Mon Sep 14 11:43:30 2026 -0700" }, "message": "wifi: ath12k: ahb: Revert undocumented ABI and dead code\n\nCommit 96f46607bbce (\"wifi: ath12k: add AHB platform descriptor\nsupport\") added undocumented OF ABI, by relying on a very specific node\nname. This is not allowed and was never acked by Devicetree\nmaintainers.\n\nAdditionally that part of code is not even used, because all devices\nhave exactly the same user pd, so this was added \"for future\". Adding\ndead code just \"for future\" is heavily discouraged in kernel coding.\n\nSigned-off-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260825081313.71351-2-krzysztof.kozlowski@oss.qualcomm.com\nSigned-off-by: Jeff Johnson \u003cjeff.johnson@oss.qualcomm.com\u003e\n" }, { "commit": "2b04d6556964ae9f89819b86a0a7801e39c3aae5", "tree": "8ab503fbe7a6125e59d0cfc0b0190178573810d8", "parents": [ "06f42accaf3c6aecab1dcc57f68dde6c06c8b380" ], "author": { "name": "Devin Wittmayer", "email": "lucid_duck@justthetip.ca", "time": "Fri Sep 04 13:03:38 2026 -0700" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 14:52:49 2026 +0200" }, "message": "wifi: mac80211: refuse to make a monitor active when it has no queue\n\nA monitor interface only gets a TXQ if it\u0027s created active, and one can\u0027t\nbe added later. Setting the flag on a down interface is still allowed, so\nthe driver is handed a monitor with no queue. ath9k dereferences it:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000066\n RIP: 0010:ath_tx_node_init+0x49/0x170 [ath9k]\n ath9k_add_interface+0x10c/0x140 [ath9k]\n drv_add_interface+0x54/0x250 [mac80211]\n ieee80211_do_open+0x32f/0x800 [mac80211]\n\nReached with CAP_NET_ADMIN by \"iw dev X set monitor active\" followed by\n\"ip link set X up\". RTNL is held, so netlink operations block behind it.\n\nRefuse the flag when there is no queue to give.\n\nFixes: 79af1f866193 (\"mac80211: avoid allocating TXQs that won\u0027t be used\")\nCc: stable@vger.kernel.org\nSigned-off-by: Devin Wittmayer \u003clucid_duck@justthetip.ca\u003e\nLink: https://patch.msgid.link/20260904200338.10829-1-lucid_duck@justthetip.ca\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "06f42accaf3c6aecab1dcc57f68dde6c06c8b380", "tree": "77cfa00adf757525a957407ac972a8219ab2e997", "parents": [ "e5c8d7acd31b27057ea42cd405d0b3ece097bc89" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Wed Sep 09 15:11:24 2026 +0900" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 14:48:20 2026 +0200" }, "message": "wifi: libipw: reject TKIP frames without a full MIC\n\nlibipw_michael_mic_verify() assumes that an skb contains an eight-byte\nMichael MIC. A short TKIP frame makes the unsigned payload length wrap,\ncausing michael_mic() to read past the skb.\n\nCheck that the MIC is present before verifying it, and use the existing\nMICHAEL_MIC_LEN constant for all MIC lengths in the verifier.\n\nFixes: b453872c35cf (\"[NET] ieee80211 subsystem\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nLink: https://patch.msgid.link/20260909061124.3802517-1-4ncienth@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "e5c8d7acd31b27057ea42cd405d0b3ece097bc89", "tree": "0947328deb5935f4bd48cd24b22338426a64541f", "parents": [ "a842cfc1d6d85b34ad73959460def4d4641e82e8" ], "author": { "name": "Zihan Xi", "email": "zihanx@nebusec.ai", "time": "Wed Sep 09 12:37:18 2026 +0000" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 14:48:01 2026 +0200" }, "message": "wifi: virt_wifi: don\u0027t transfer operstate before register\n\nvirt_wifi_newlink() calls netif_stacked_transfer_operstate() before\nregister_netdevice(). If the lower device is dormant, that queues the\nnew netdev on lweventlist while it is still uninitialized. If\nregistration fails after that, for example because of an invalid name\nsuch as \"bad/name\", free_netdev() immediately frees the object. A\nlater linkwatch_fire_event() then use-after-frees the list entry.\n\nMove the transfer to after netdev_upper_dev_link(), as macvlan and\nipvlan already do.\n\nFixes: c7cdba31ed8b (\"mac80211-next: rtnetlink wifi simulation device\")\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nAssisted-by: LLM\nCo-developed-by: Luxing Yin \u003croot@tr0jan.top\u003e\nSigned-off-by: Luxing Yin \u003croot@tr0jan.top\u003e\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nLink: https://patch.msgid.link/f5a832fb0ab228ce6e2b5a91fba4ca8b79198a2f.1788948455.git.zihanx@nebusec.ai\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "a842cfc1d6d85b34ad73959460def4d4641e82e8", "tree": "80a38a2159229b66f988fcbe6d054571846eec3f", "parents": [ "e3d1acb0276742f288094cd7a497745364876bb8" ], "author": { "name": "Slawomir Stepien", "email": "sst@poczta.fm", "time": "Thu Sep 10 10:04:18 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 14:47:34 2026 +0200" }, "message": "wifi: cfg80211: check if AP has been started or joined a mesh before adding new station\n\nAdding a new station to AP makes only sense when the AP has been started\n(nl80211_start_ap()) or joined a mesh (__cfg80211_join_mesh()).\n\nCheck if AP is up and beaconing on the link or joined the mesh, when\nadding new station. Return error if this isn\u0027t the case.\n\nNote that libertas devices need special handling since they do not\nimplement join_mesh() and the decision must be made on channel\ndefinition.\n\nReported-by: syzbot+9bdc0c5998ab45b05030@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d9bdc0c5998ab45b05030\nSigned-off-by: Slawomir Stepien \u003csst@poczta.fm\u003e\nLink: https://patch.msgid.link/20260910080418.725741-3-sst@poczta.fm\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "e3d1acb0276742f288094cd7a497745364876bb8", "tree": "e9b9f63cc01513efaf20da8e9a534d6259fa0b6a", "parents": [ "4ae3128c230372b43d0c417e0fcf816e8290e9fa" ], "author": { "name": "Slawomir Stepien", "email": "sst@poczta.fm", "time": "Thu Sep 10 10:04:17 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 14:47:34 2026 +0200" }, "message": "wifi: cfg80211: move link_id validation earlier in nl80211_new_station()\n\nI do not see a reason why this check is so low in the function. Move it\nup right next to param fetch.\n\nThis new position is more beneficial for AP/Link state check that will\nbe added in upcoming commit.\n\nSigned-off-by: Slawomir Stepien \u003csst@poczta.fm\u003e\nLink: https://patch.msgid.link/20260910080418.725741-2-sst@poczta.fm\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "4ae3128c230372b43d0c417e0fcf816e8290e9fa", "tree": "42ac9e3d78cb90a9a845d94f0d6874cfc96ceb94", "parents": [ "ba7a79b9bc87776c8c1808407a7508a8be3a789e" ], "author": { "name": "Slawomir Stepien", "email": "sst@poczta.fm", "time": "Thu Sep 10 10:04:16 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 14:47:33 2026 +0200" }, "message": "wifi: cfg80211: do not support direct add of station to AP_VLAN interfaces\n\nPrevent userspace from adding stations directly to AP_VLAN type\ninterfaces. Userspace should first add the station to the base interface\n(AP type) and then can use CMD_SET_STATION to move it to AP_VLAN. The\nother way is by using NL80211_ATTR_STA_VLAN.\n\nWithout this path, we cannot check if the AP has been started before\nadding the station - wdev for AP_VLAN does not store information about\nthe base AP interface.\n\nSigned-off-by: Slawomir Stepien \u003csst@poczta.fm\u003e\nLink: https://patch.msgid.link/20260910080418.725741-1-sst@poczta.fm\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "ba7a79b9bc87776c8c1808407a7508a8be3a789e", "tree": "f65f5b114d09c631b3bb9ca297678380d5f7d7e2", "parents": [ "50d3d79dc0743b616afb00d01a626c76758721f7" ], "author": { "name": "Slawomir Stepien", "email": "sst@poczta.fm", "time": "Mon Sep 14 10:13:50 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 14:46:55 2026 +0200" }, "message": "wifi: cfg80211: verify if AP_VLAN belongs to the correct AP\n\nThe get_vlan() only checks if NL80211_ATTR_STA_VLAN target is an\nAP/AP_VLAN/P2P_GO interface on the same wiphy. It has no notion of which\nspecific AP a given AP_VLAN belongs to.\n\nFix that by comparing the ethernet addresses of the two net devices.\nGiven VLAN A\u0027 must have the same address as AP A. Otherwise, return\nerror code.\n\nSigned-off-by: Slawomir Stepien \u003csst@poczta.fm\u003e\nReported-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nLink: https://lore.kernel.org/all/22e7ddfc50d7a6a16c437b876dab5fe223799610.camel@sipsolutions.net/\nLink: https://patch.msgid.link/20260914081350.83484-1-sst@poczta.fm\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "e6b6078ea1731b05b3b552497b3bce4bf8b014ae", "tree": "940cb0d4a69be175ee17090309096fc0cf3c4b82", "parents": [ "78445023439506ebd83b86d40b1e428a3b309d4a", "979aabdad8dd03394467ee484a1a70f3d40b19ba" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 17:25:19 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 17:25:19 2026 -0700" }, "message": "Merge branch \u0027neighbour-small-fixes-for-rtm_-get-set-neightbl\u0027\n\nKuniyuki Iwashima says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nneighbour: Small fixes for RTM_{GET,SET}NEIGHTBL.\n\nWhile working on the follow-up suggested here,\n\n https://lore.kernel.org/20260902143023.GA3966681@shredder\n\nI found a few bugs in RTM_GETNEIGHTBL and RTM_SETNEIGHTBL,\nwhich this series fixes.\n\nPatch 1, 3, 4 will conflict with net-next in neightbl_dump_info()\ndue to removal of net_eq() below:\n\n\tp \u003d list_next_entry(\u0026tbl-\u003eparms, list);\n\tlist_for_each_entry_from_rcu(p, \u0026tbl-\u003eparms_list, list) {\n\t\tif (!net_eq(neigh_parms_net(p), net))\n\t\t\tcontinue;\n\nNote also that currently neigh_proc_dointvec_ms_jiffies_positive()\nis buggy and does not enforce min/max, and it needs this fix:\n\n https://lore.kernel.org/20260905233819.1064529-2-kuniyu@google.com\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260909233143.2401847-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "979aabdad8dd03394467ee484a1a70f3d40b19ba" }