)]}' { "log": [ { "commit": "5ee8dbf54602dc340d6235b1d6aa17c0f283f48c", "tree": "6edd1e11fbe3c4366d45e503d6a1fdb4ba822820", "parents": [ "6a42ff33f38d171a6bf8304f6323c43e8a0ed9b6", "a300000233a9ff842e2fb450fb9a79f7827a586d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:52:03 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:52:03 2026 -0800" }, "message": "Merge tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux\n\nPull fsverity fix from Eric Biggers:\n \"Prevent CONFIG_FS_VERITY from being enabled when the page size is\n 256K, since it doesn\u0027t work in that case\"\n\n* tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux:\n fsverity: add dependency on 64K or smaller pages\n" }, { "commit": "6a42ff33f38d171a6bf8304f6323c43e8a0ed9b6", "tree": "cbc80bb0b7f772a9133fd32032c3e6b952c0a231", "parents": [ "398871616ffd8a793f01861b0ee66f6bee494389", "3875ceb592d3cb23dc932165cc1eeb74cf4dc319" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:49:05 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:49:05 2026 -0800" }, "message": "Merge tag \u0027libcrypto-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux\n\nPull crypto library fixes from Eric Biggers:\n\n - Several test fixes:\n\n - Fix flakiness in the interrupt context tests in certain VMs\n\n - Make the lib/crypto/ KUnit tests depend on the corresponding\n library options rather than selecting them. This follows the\n standard KUnit convention, and it fixes an issue where enabling\n CONFIG_KUNIT_ALL_TESTS pulled in all the crypto library code\n\n - Add a kunitconfig file for lib/crypto/\n\n - Fix a couple stale references to \"aes-generic\" that made it in\n concurrently with the rename to \"aes-lib\"\n\n - Update the help text for several CRYPTO kconfig options to remove\n outdated information about users that now use the library instead\n\n* tag \u0027libcrypto-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:\n crypto: testmgr - Fix stale references to aes-generic\n crypto: Clean up help text for CRYPTO_CRC32\n crypto: Clean up help text for CRYPTO_CRC32C\n crypto: Clean up help text for CRYPTO_XXHASH\n crypto: Clean up help text for CRYPTO_SHA256\n crypto: Clean up help text for CRYPTO_BLAKE2B\n lib/crypto: tests: Add a .kunitconfig file\n lib/crypto: tests: Depend on library options rather than selecting them\n kunit: irq: Ensure timer doesn\u0027t fire too frequently\n" }, { "commit": "398871616ffd8a793f01861b0ee66f6bee494389", "tree": "93f38b1bdb95aa198fd990eba6ca9d36206a335d", "parents": [ "abacaf559950eec0d99d37ff6b92049409af5943", "084f843093bee5563b179fd4b630122ba820e0c7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:37:27 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:37:27 2026 -0800" }, "message": "Merge tag \u0027acpi-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fixes from Rafael Wysocki:\n\n - Revert a commit related to ACPI device power management that was\n not supposed to make any functional difference, but it did so and\n introduced a regression (Rafael Wysocki)\n\n - Update the _CPC object definition in ACPICA to match ACPI 6.6 and\n prevent the kernel from printing a false-positive warning regarding\n _CPC output package format on platforms shipping with firmware based\n on ACPI 6.6 (Saket Dumbre)\n\n* tag \u0027acpi-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n Revert \"ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM\"\n ACPICA: Update the _CPC definition to match ACPI 6.6\n" }, { "commit": "abacaf559950eec0d99d37ff6b92049409af5943", "tree": "35cb46179fc961ff60205f261c97213bea3321c0", "parents": [ "18ecff396c9edb9add34f612d9fb99bb34833cc0", "cf440e5b40649d1ffbc6c4e33fef3223c7482897" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:00:46 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:00:46 2026 -0800" }, "message": "Merge tag \u0027net-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from CAN, netfilter and wireless.\n\n Current release - new code bugs:\n\n - sched: cake: fixup cake_mq rate adjustment for diffserv config\n\n - wifi: fix missing ieee80211_eml_params member initialization\n\n Previous releases - regressions:\n\n - tcp: give up on stronger sk_rcvbuf checks (for now)\n\n Previous releases - always broken:\n\n - net: fix rcu_tasks stall in threaded busypoll\n\n - sched:\n - fq: clear q-\u003eband_pkt_count[] in fq_reset()\n - only allow act_ct to bind to clsact/ingress qdiscs and shared\n blocks\n\n - bridge: check relevant per-VLAN options in VLAN range grouping\n\n - xsk: fix fragment node deletion to prevent buffer leak\n\n Misc:\n\n - spring cleanup of inactive maintainers\"\n\n* tag \u0027net-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (138 commits)\n xdp: produce a warning when calculated tailroom is negative\n net: enetc: use truesize as XDP RxQ info frag_size\n libeth, idpf: use truesize as XDP RxQ info frag_size\n i40e: use xdp.frame_sz as XDP RxQ info frag_size\n i40e: fix registering XDP RxQ info\n ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz\n ice: fix rxq info registering in mbuf packets\n xsk: introduce helper to determine rxq-\u003efrag_size\n xdp: use modulo operation to calculate XDP frag tailroom\n selftests/tc-testing: Add tests exercising act_ife metalist replace behaviour\n net/sched: act_ife: Fix metalist update behavior\n selftests: net: add test for IPv4 route with loopback IPv6 nexthop\n net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop\n net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled\n net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled\n MAINTAINERS: remove Thomas Falcon from IBM ibmvnic\n MAINTAINERS: remove Claudiu Manoil and Alexandre Belloni from Ocelot switch\n MAINTAINERS: replace Taras Chornyi with Elad Nachman for Marvell Prestera\n MAINTAINERS: remove Jonathan Lemon from OpenCompute PTP\n MAINTAINERS: replace Clark Wang with Frank Li for Freescale FEC\n ...\n" }, { "commit": "084f843093bee5563b179fd4b630122ba820e0c7", "tree": "27c9b584dbf5736a306f1cd7a8491964a685b088", "parents": [ "00fd9aad55e7ced494a738a07662155d058b872f", "800ca7b88a0c0eba6fa721e043eb3ed5b10ecc4f" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Mar 05 18:46:43 2026 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Mar 05 18:46:43 2026 +0100" }, "message": "Merge branch \u0027acpica\u0027\n\nMerge a fix updating the _CPC object definition in ACPICA to avoid\nprinting a false-positive output package format warning on new\nplatforms (Saket Dumbre)\n\n* acpica:\n ACPICA: Update the _CPC definition to match ACPI 6.6\n" }, { "commit": "18ecff396c9edb9add34f612d9fb99bb34833cc0", "tree": "09c8e31ef39a17bbc57c818b2331dc61bd8d8a20", "parents": [ "c107785c7e8dbabd1c18301a1c362544b5786282", "f26b098d937488e8f5c617d465760a10bfcc7f13" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 08:05:05 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 08:05:05 2026 -0800" }, "message": "Merge tag \u0027trace-v7.0-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Fix thresh_return of function graph tracer\n\n The update to store data on the shadow stack removed the abuse of\n using the task recursion word as a way to keep track of what\n functions to ignore. The trace_graph_return() was updated to handle\n this, but when function_graph tracer is using a threshold (only trace\n functions that took longer than a specified time), it uses\n trace_graph_thresh_return() instead.\n\n This function was still incorrectly using the task struct recursion\n word causing the function graph tracer to permanently set all\n functions to \"notrace\"\n\n - Fix thresh_return nosleep accounting\n\n When the calltime was moved to the shadow stack storage instead of\n being on the fgraph descriptor, the calculations for the amount of\n sleep time was updated. The calculation was done in the\n trace_graph_thresh_return() function, which also called the\n trace_graph_return(), which did the calculation again, causing the\n time to be doubled.\n\n Remove the call to trace_graph_return() as what it needed to do\n wasn\u0027t that much, and just do the work in\n trace_graph_thresh_return().\n\n - Fix syscall trace event activation on boot up\n\n The syscall trace events are pseudo events attached to the\n raw_syscall tracepoints. When the first syscall event is enabled, it\n enables the raw_syscall tracepoint and doesn\u0027t need to do anything\n when a second syscall event is also enabled.\n\n When events are enabled via the kernel command line, syscall events\n are partially enabled as the enabling is called before rcu_init. This\n is due to allow early events to be enabled immediately. Because\n kernel command line events do not distinguish between different types\n of events, the syscall events are enabled here but are not fully\n functioning. After rcu_init, they are disabled and re-enabled so that\n they can be fully enabled.\n\n The problem happened is that this \"disable-enable\" is done one at a\n time. If more than one syscall event is specified on the command\n line, by disabling them one at a time, the counter never gets to\n zero, and the raw_syscall is not disabled and enabled, keeping the\n syscall events in their non-fully functional state.\n\n Instead, disable all events and re-enabled them all, as that will\n ensure the raw_syscall event is also disabled and re-enabled.\n\n - Disable preemption in ftrace pid filtering\n\n The ftrace pid filtering attaches to the fork and exit tracepoints to\n add or remove pids that should be traced. They access variables\n protected by RCU (preemption disabled). Now that tracepoint callbacks\n are called with preemption enabled, this protection needs to be added\n explicitly, and not depend on the functions being called with\n preemption disabled.\n\n - Disable preemption in event pid filtering\n\n The event pid filtering needs the same preemption disabling guards as\n ftrace pid filtering.\n\n - Fix accounting of the memory mapped ring buffer on fork\n\n Memory mapping the ftrace ring buffer sets the vm_flags to DONTCOPY.\n But this does not prevent the application from calling\n madvise(MADVISE_DOFORK). This causes the mapping to be copied on\n fork. After the first tasks exits, the mapping is considered unmapped\n by everyone. But when he second task exits, the counter goes below\n zero and triggers a WARN_ON.\n\n Since nothing prevents two separate tasks from mmapping the ftrace\n ring buffer (although two mappings may mess each other up), there\u0027s\n no reason to stop the memory from being copied on fork.\n\n Update the vm_operations to have an \".open\" handler to update the\n accounting and let the ring buffer know someone else has it mapped.\n\n - Add all ftrace headers in MAINTAINERS file\n\n The MAINTAINERS file only specifies include/linux/ftrace.h But misses\n ftrace_irq.h and ftrace_regs.h. Make the file use wildcards to get\n all *ftrace* files.\n\n* tag \u0027trace-v7.0-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n ftrace: Add MAINTAINERS entries for all ftrace headers\n tracing: Fix WARN_ON in tracing_buffers_mmap_close\n tracing: Disable preemption in the tracepoint callbacks handling filtered pids\n ftrace: Disable preemption in the tracepoint callbacks handling filtered pids\n tracing: Fix syscall events activation by ensuring refcount hits zero\n fgraph: Fix thresh_return nosleeptime double-adjust\n fgraph: Fix thresh_return clear per-task notrace\n" }, { "commit": "cf440e5b40649d1ffbc6c4e33fef3223c7482897", "tree": "b1433ad464bd0521de238365ba888de2e7d9a13f", "parents": [ "5d1271ff4c131cd4a601dabdfdcdc1fe1252493f", "8821e857759be9db3cde337ad328b71fe5c8a55f" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:27 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:03:27 2026 -0800" }, "message": "Merge branch \u0027Address-XDP-frags-having-negative-tailroom\u0027\n\nLarysa Zaremba says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nAddress XDP frags having negative tailroom\n\nAside from the issue described below, tailroom calculation does not account\nfor pages being split between frags, e.g. in i40e, enetc and\nAF_XDP ZC with smaller chunks. These series address the problem by\ncalculating modulo (skb_frag_off() % rxq-\u003efrag_size) in order to get\ndata offset within a smaller block of memory. Please note, xskxceiver\ntail grow test passes without modulo e.g. in xdpdrv mode on i40e,\nbecause there is not enough descriptors to get to flipped buffers.\n\nMany ethernet drivers report xdp Rx queue frag size as being the same as\nDMA write size. However, the only user of this field, namely\nbpf_xdp_frags_increase_tail(), clearly expects a truesize.\n\nSuch difference leads to unspecific memory corruption issues under certain\ncircumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when\nrunning xskxceiver\u0027s XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses\nall DMA-writable space in 2 buffers. This would be fine, if only\nrxq-\u003efrag_size was properly set to 4K, but value of 3K results in a\nnegative tailroom, because there is a non-zero page offset.\n\nWe are supposed to return -EINVAL and be done with it in such case,\nbut due to tailroom being stored as an unsigned int, it is reported to be\nsomewhere near UINT_MAX, resulting in a tail being grown, even if the\nrequested offset is too much(it is around 2K in the abovementioned test).\nThis later leads to all kinds of unspecific calltraces.\n\n[ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6\n[ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4\n[ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000]\n[ 7340.339230] in xskxceiver[42b5,400000+69000]\n[ 7340.340300] likely on CPU 6 (core 0, socket 6)\n[ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 \u003c4c\u003e 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe\n[ 7340.340888] likely on CPU 3 (core 0, socket 3)\n[ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff \u003c8b\u003e 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7\n[ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI\n[ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy)\n[ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014\n[ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80\n[ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 \u003c8b\u003e 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89\n[ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202\n[ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010\n[ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff\n[ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0\n[ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0\n[ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500\n[ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000\n[ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0\n[ 7340.421237] PKRU: 55555554\n[ 7340.421623] Call Trace:\n[ 7340.421987] \u003cTASK\u003e\n[ 7340.422309] ? softleaf_from_pte+0x77/0xa0\n[ 7340.422855] swap_pte_batch+0xa7/0x290\n[ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270\n[ 7340.424102] zap_pte_range+0x281/0x580\n[ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240\n[ 7340.425177] unmap_page_range+0x24d/0x420\n[ 7340.425714] unmap_vmas+0xa1/0x180\n[ 7340.426185] exit_mmap+0xe1/0x3b0\n[ 7340.426644] __mmput+0x41/0x150\n[ 7340.427098] exit_mm+0xb1/0x110\n[ 7340.427539] do_exit+0x1b2/0x460\n[ 7340.427992] do_group_exit+0x2d/0xc0\n[ 7340.428477] get_signal+0x79d/0x7e0\n[ 7340.428957] arch_do_signal_or_restart+0x34/0x100\n[ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0\n[ 7340.430159] do_syscall_64+0x188/0x6b0\n[ 7340.430672] ? __do_sys_clone3+0xd9/0x120\n[ 7340.431212] ? switch_fpu_return+0x4e/0xd0\n[ 7340.431761] ? arch_exit_to_user_mode_prepare.isra.0+0xa1/0xc0\n[ 7340.432498] ? do_syscall_64+0xbb/0x6b0\n[ 7340.433015] ? __handle_mm_fault+0x445/0x690\n[ 7340.433582] ? count_memcg_events+0xd6/0x210\n[ 7340.434151] ? handle_mm_fault+0x212/0x340\n[ 7340.434697] ? do_user_addr_fault+0x2b4/0x7b0\n[ 7340.435271] ? clear_bhb_loop+0x30/0x80\n[ 7340.435788] ? clear_bhb_loop+0x30/0x80\n[ 7340.436299] ? clear_bhb_loop+0x30/0x80\n[ 7340.436812] ? clear_bhb_loop+0x30/0x80\n[ 7340.437323] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 7340.437973] RIP: 0033:0x7f4161b14169\n[ 7340.438468] Code: Unable to access opcode bytes at 0x7f4161b1413f.\n[ 7340.439242] RSP: 002b:00007ffc6ebfa770 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca\n[ 7340.440173] RAX: fffffffffffffe00 RBX: 00000000000005a1 RCX: 00007f4161b14169\n[ 7340.441061] RDX: 00000000000005a1 RSI: 0000000000000109 RDI: 00007f415bfff990\n[ 7340.441943] RBP: 00007ffc6ebfa7a0 R08: 0000000000000000 R09: 00000000ffffffff\n[ 7340.442824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n[ 7340.443707] R13: 0000000000000000 R14: 00007f415bfff990 R15: 00007f415bfff6c0\n[ 7340.444586] \u003c/TASK\u003e\n[ 7340.444922] Modules linked in: rfkill intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit libnvdimm kvm_intel vfat fat kvm snd_pcm irqbypass rapl iTCO_wdt snd_timer intel_pmc_bxt iTCO_vendor_support snd ixgbevf virtio_net soundcore i2c_i801 pcspkr libeth_xdp net_failover i2c_smbus lpc_ich failover libeth virtio_balloon joydev 9p fuse loop zram lz4hc_compress lz4_compress 9pnet_virtio 9pnet netfs ghash_clmulni_intel serio_raw qemu_fw_cfg\n[ 7340.449650] ---[ end trace 0000000000000000 ]---\n\nThe issue can be fixed in all in-tree drivers, but we cannot just trust OOT\ndrivers to not do this. Therefore, make tailroom a signed int and produce a\nwarning when it is negative to prevent such mistakes in the future.\n\nThe issue can also be easily reproduced with ice driver, by applying\nthe following diff to xskxceiver and enjoying a kernel panic in xdpdrv mode:\n\ndiff --git a/tools/testing/selftests/bpf/prog_tests/test_xsk.c b/tools/testing/selftests/bpf/prog_tests/test_xsk.c\nindex 5af28f359cfd..042d587fa7ef 100644\n--- a/tools/testing/selftests/bpf/prog_tests/test_xsk.c\n+++ b/tools/testing/selftests/bpf/prog_tests/test_xsk.c\n@@ -2541,8 +2541,8 @@ int testapp_adjust_tail_grow_mb(struct test_spec *test)\n {\n test-\u003emtu \u003d MAX_ETH_JUMBO_SIZE;\n /* Grow by (frag_size - last_frag_Size) - 1 to stay inside the last fragment */\n- return testapp_adjust_tail(test, (XSK_UMEM__MAX_FRAME_SIZE / 2) - 1,\n- XSK_UMEM__LARGE_FRAME_SIZE * 2);\n+ return testapp_adjust_tail(test, XSK_UMEM__MAX_FRAME_SIZE * 100,\n+ 6912);\n }\n\n int testapp_tx_queue_consumer(struct test_spec *test)\n\nIf we print out the values involved in the tailroom calculation:\n\ntailroom \u003d rxq-\u003efrag_size - skb_frag_size(frag) - skb_frag_off(frag);\n\n4294967040 \u003d 3456 - 3456 - 256\n\nI personally reproduced and verified the issue in ice and i40e,\naside from WiP ixgbevf implementation.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260305111253.2317394-1-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8821e857759be9db3cde337ad328b71fe5c8a55f", "tree": "b1433ad464bd0521de238365ba888de2e7d9a13f", "parents": [ "f8e18abf183dbd636a8725532c7f5aa58957de84" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:50 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:05 2026 -0800" }, "message": "xdp: produce a warning when calculated tailroom is negative\n\nMany ethernet drivers report xdp Rx queue frag size as being the same as\nDMA write size. However, the only user of this field, namely\nbpf_xdp_frags_increase_tail(), clearly expects a truesize.\n\nSuch difference leads to unspecific memory corruption issues under certain\ncircumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when\nrunning xskxceiver\u0027s XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses\nall DMA-writable space in 2 buffers. This would be fine, if only\nrxq-\u003efrag_size was properly set to 4K, but value of 3K results in a\nnegative tailroom, because there is a non-zero page offset.\n\nWe are supposed to return -EINVAL and be done with it in such case, but due\nto tailroom being stored as an unsigned int, it is reported to be somewhere\nnear UINT_MAX, resulting in a tail being grown, even if the requested\noffset is too much (it is around 2K in the abovementioned test). This later\nleads to all kinds of unspecific calltraces.\n\n[ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6\n[ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4\n[ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000]\n[ 7340.339230] in xskxceiver[42b5,400000+69000]\n[ 7340.340300] likely on CPU 6 (core 0, socket 6)\n[ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 \u003c4c\u003e 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe\n[ 7340.340888] likely on CPU 3 (core 0, socket 3)\n[ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff \u003c8b\u003e 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7\n[ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI\n[ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy)\n[ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014\n[ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80\n[ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 \u003c8b\u003e 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89\n[ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202\n[ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010\n[ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff\n[ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0\n[ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0\n[ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500\n[ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000\n[ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0\n[ 7340.421237] PKRU: 55555554\n[ 7340.421623] Call Trace:\n[ 7340.421987] \u003cTASK\u003e\n[ 7340.422309] ? softleaf_from_pte+0x77/0xa0\n[ 7340.422855] swap_pte_batch+0xa7/0x290\n[ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270\n[ 7340.424102] zap_pte_range+0x281/0x580\n[ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240\n[ 7340.425177] unmap_page_range+0x24d/0x420\n[ 7340.425714] unmap_vmas+0xa1/0x180\n[ 7340.426185] exit_mmap+0xe1/0x3b0\n[ 7340.426644] __mmput+0x41/0x150\n[ 7340.427098] exit_mm+0xb1/0x110\n[ 7340.427539] do_exit+0x1b2/0x460\n[ 7340.427992] do_group_exit+0x2d/0xc0\n[ 7340.428477] get_signal+0x79d/0x7e0\n[ 7340.428957] arch_do_signal_or_restart+0x34/0x100\n[ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0\n[ 7340.430159] do_syscall_64+0x188/0x6b0\n[ 7340.430672] ? __do_sys_clone3+0xd9/0x120\n[ 7340.431212] ? switch_fpu_return+0x4e/0xd0\n[ 7340.431761] ? arch_exit_to_user_mode_prepare.isra.0+0xa1/0xc0\n[ 7340.432498] ? do_syscall_64+0xbb/0x6b0\n[ 7340.433015] ? __handle_mm_fault+0x445/0x690\n[ 7340.433582] ? count_memcg_events+0xd6/0x210\n[ 7340.434151] ? handle_mm_fault+0x212/0x340\n[ 7340.434697] ? do_user_addr_fault+0x2b4/0x7b0\n[ 7340.435271] ? clear_bhb_loop+0x30/0x80\n[ 7340.435788] ? clear_bhb_loop+0x30/0x80\n[ 7340.436299] ? clear_bhb_loop+0x30/0x80\n[ 7340.436812] ? clear_bhb_loop+0x30/0x80\n[ 7340.437323] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 7340.437973] RIP: 0033:0x7f4161b14169\n[ 7340.438468] Code: Unable to access opcode bytes at 0x7f4161b1413f.\n[ 7340.439242] RSP: 002b:00007ffc6ebfa770 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca\n[ 7340.440173] RAX: fffffffffffffe00 RBX: 00000000000005a1 RCX: 00007f4161b14169\n[ 7340.441061] RDX: 00000000000005a1 RSI: 0000000000000109 RDI: 00007f415bfff990\n[ 7340.441943] RBP: 00007ffc6ebfa7a0 R08: 0000000000000000 R09: 00000000ffffffff\n[ 7340.442824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n[ 7340.443707] R13: 0000000000000000 R14: 00007f415bfff990 R15: 00007f415bfff6c0\n[ 7340.444586] \u003c/TASK\u003e\n[ 7340.444922] Modules linked in: rfkill intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit libnvdimm kvm_intel vfat fat kvm snd_pcm irqbypass rapl iTCO_wdt snd_timer intel_pmc_bxt iTCO_vendor_support snd ixgbevf virtio_net soundcore i2c_i801 pcspkr libeth_xdp net_failover i2c_smbus lpc_ich failover libeth virtio_balloon joydev 9p fuse loop zram lz4hc_compress lz4_compress 9pnet_virtio 9pnet netfs ghash_clmulni_intel serio_raw qemu_fw_cfg\n[ 7340.449650] ---[ end trace 0000000000000000 ]---\n\nThe issue can be fixed in all in-tree drivers, but we cannot just trust OOT\ndrivers to not do this. Therefore, make tailroom a signed int and produce a\nwarning when it is negative to prevent such mistakes in the future.\n\nFixes: bf25146a5595 (\"bpf: add frags support to the bpf_xdp_adjust_tail() API\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nAcked-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-10-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f8e18abf183dbd636a8725532c7f5aa58957de84", "tree": "9575635f7033a7cfa902539fa53f3f77c3c512d3", "parents": [ "75d9228982f23d68066ca0b7d87014c3eb8ddc85" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:49 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:05 2026 -0800" }, "message": "net: enetc: use truesize as XDP RxQ info frag_size\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects truesize instead of DMA\nwrite size. Different assumptions in enetc driver configuration lead to\nnegative tailroom.\n\nSet frag_size to the same value as frame_sz.\n\nFixes: 2768b2e2f7d2 (\"net: enetc: register XDP RX queues with frag_size\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-9-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "75d9228982f23d68066ca0b7d87014c3eb8ddc85", "tree": "19a61716e1289e779feb690fc73f0465c9684090", "parents": [ "c69d22c6c46a1d792ba8af3d8d6356fdc0e6f538" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:48 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:05 2026 -0800" }, "message": "libeth, idpf: use truesize as XDP RxQ info frag_size\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buffer size instead\nof DMA write size. Different assumptions in idpf driver configuration lead\nto negative tailroom.\n\nTo make it worse, buffer sizes are not actually uniform in idpf when\nsplitq is enabled, as there are several buffer queues, so rxq-\u003erx_buf_size\nis meaningless in this case.\n\nUse truesize of the first bufq in AF_XDP ZC, as there is only one. Disable\ngrowing tail for regular splitq.\n\nFixes: ac8a861f632e (\"idpf: prepare structures to support XDP\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-8-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c69d22c6c46a1d792ba8af3d8d6356fdc0e6f538", "tree": "11155a899c3938024362de3d4df98a60f956ba3a", "parents": [ "8f497dc8a61429cc004720aa8e713743355d80cf" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:47 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:04 2026 -0800" }, "message": "i40e: use xdp.frame_sz as XDP RxQ info frag_size\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buffer size instead\nof DMA write size. Different assumptions in i40e driver configuration lead\nto negative tailroom.\n\nSet frag_size to the same value as frame_sz in shared pages mode, use new\nhelper to set frag_size when AF_XDP ZC is active.\n\nFixes: a045d2f2d03d (\"i40e: set xdp_rxq_info::frag_size\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-7-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8f497dc8a61429cc004720aa8e713743355d80cf", "tree": "0d248580ac95dde2ff9c66697f6e74248eef9b02", "parents": [ "e142dc4ef0f451b7ef99d09aaa84e9389af629d7" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:46 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:04 2026 -0800" }, "message": "i40e: fix registering XDP RxQ info\n\nCurrent way of handling XDP RxQ info in i40e has a problem, where frag_size\nis not updated when xsk_buff_pool is detached or when MTU is changed, this\nleads to growing tail always failing for multi-buffer packets.\n\nCouple XDP RxQ info registering with buffer allocations and unregistering\nwith cleaning the ring.\n\nFixes: a045d2f2d03d (\"i40e: set xdp_rxq_info::frag_size\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-6-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e142dc4ef0f451b7ef99d09aaa84e9389af629d7", "tree": "2baf8713348e6bddb6b7cdfcb3ddc0dc3496c15d", "parents": [ "02852b47c706772af795d3e28fca99fc9b923b2c" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:45 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:04 2026 -0800" }, "message": "ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead\nof DMA write size. Different assumptions in ice driver configuration lead\nto negative tailroom.\n\nThis allows to trigger kernel panic, when using\nXDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to\n6912 and the requested offset to a huge value, e.g.\nXSK_UMEM__MAX_FRAME_SIZE * 100.\n\nDue to other quirks of the ZC configuration in ice, panic is not observed\nin ZC mode, but tailroom growing still fails when it should not.\n\nUse fill queue buffer truesize instead of DMA write size in XDP RxQ info.\nFix ZC mode too by using the new helper.\n\nFixes: 2fba7dc5157b (\"ice: Add support for XDP multi-buffer on Rx side\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-5-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "02852b47c706772af795d3e28fca99fc9b923b2c", "tree": "b9a711fd9859b1c2377c5405f18a7f1a3bea6c70", "parents": [ "16394d80539937d348dd3b9ea32415c54e67a81b" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:44 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:03 2026 -0800" }, "message": "ice: fix rxq info registering in mbuf packets\n\nXDP RxQ info contains frag_size, which depends on the MTU. This makes the\nold way of registering RxQ info before calculating new buffer sizes\ninvalid. Currently, it leads to frag_size being outdated, making it\nsometimes impossible to grow tailroom in a mbuf packet. E.g. fragments are\nactually 3K+, but frag size is still as if MTU was 1500.\n\nAlways register new XDP RxQ info after reconfiguring memory pools.\n\nFixes: 2fba7dc5157b (\"ice: Add support for XDP multi-buffer on Rx side\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-4-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "16394d80539937d348dd3b9ea32415c54e67a81b", "tree": "3675d1fc662565c6f8fae92a441e2f96e2ab2cbd", "parents": [ "88b6b7f7b216108a09887b074395fa7b751880b1" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:43 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:03 2026 -0800" }, "message": "xsk: introduce helper to determine rxq-\u003efrag_size\n\nrxq-\u003efrag_size is basically a step between consecutive strictly aligned\nframes. In ZC mode, chunk size fits exactly, but if chunks are unaligned,\nthere is no safe way to determine accessible space to grow tailroom.\n\nReport frag_size to be zero, if chunks are unaligned, chunk_size otherwise.\n\nFixes: 24ea50127ecf (\"xsk: support mbuf on ZC RX\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-3-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "88b6b7f7b216108a09887b074395fa7b751880b1", "tree": "9d8605f8808c41e424dbb0e3d09bce3de742a0c2", "parents": [ "5d1271ff4c131cd4a601dabdfdcdc1fe1252493f" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:42 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:03 2026 -0800" }, "message": "xdp: use modulo operation to calculate XDP frag tailroom\n\nThe current formula for calculating XDP tailroom in mbuf packets works only\nif each frag has its own page (if rxq-\u003efrag_size is PAGE_SIZE), this\ndefeats the purpose of the parameter overall and without any indication\nleads to negative calculated tailroom on at least half of frags, if shared\npages are used.\n\nThere are not many drivers that set rxq-\u003efrag_size. Among them:\n* i40e and enetc always split page uniformly between frags, use shared\n pages\n* ice uses page_pool frags via libeth, those are power-of-2 and uniformly\n distributed across page\n* idpf has variable frag_size with XDP on, so current API is not applicable\n* mlx5, mtk and mvneta use PAGE_SIZE or 0 as frag_size for page_pool\n\nAs for AF_XDP ZC, only ice, i40e and idpf declare frag_size for it. Modulo\noperation yields good results for aligned chunks, they are all power-of-2,\nbetween 2K and PAGE_SIZE. Formula without modulo fails when chunk_size is\n2K. Buffers in unaligned mode are not distributed uniformly, so modulo\noperation would not work.\n\nTo accommodate unaligned buffers, we could define frag_size as\ndata + tailroom, and hence do not subtract offset when calculating\ntailroom, but this would necessitate more changes in the drivers.\n\nDefine rxq-\u003efrag_size as an even portion of a page that fully belongs to a\nsingle frag. When calculating tailroom, locate the data start within such\nportion by performing a modulo operation on page offset.\n\nFixes: bf25146a5595 (\"bpf: add frags support to the bpf_xdp_adjust_tail() API\")\nAcked-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-2-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5d1271ff4c131cd4a601dabdfdcdc1fe1252493f", "tree": "3942b977020b98f11de797118f794a03ddaffc3e", "parents": [ "e2cedd400c3ec0302ffca2490e8751772906ac23" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Wed Mar 04 09:06:03 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:54:09 2026 -0800" }, "message": "selftests/tc-testing: Add tests exercising act_ife metalist replace behaviour\n\nAdd 2 test cases to exercise fix in act_ife\u0027s internal metalist\nbehaviour.\n\n- Update decode ife action into encode with tcindex metadata\n- Update decode ife action into encode with multiple metadata\n\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260304140603.76500-2-jhs@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e2cedd400c3ec0302ffca2490e8751772906ac23", "tree": "51a208c2cad6d61e0402ec608c3dd4d1a5d7b0c3", "parents": [ "4517b74cc07c3b766ca92cf6cea352e65f6e8f9b" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Wed Mar 04 09:06:02 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:54:08 2026 -0800" }, "message": "net/sched: act_ife: Fix metalist update behavior\n\nWhenever an ife action replace changes the metalist, instead of\nreplacing the old data on the metalist, the current ife code is appending\nthe new metadata. Aside from being innapropriate behavior, this may lead\nto an unbounded addition of metadata to the metalist which might cause an\nout of bounds error when running the encode op:\n\n[ 138.423369][ C1] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255\n[ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full)\n[ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 138.425800][ C1] Call Trace:\n[ 138.425804][ C1] \u003cIRQ\u003e\n[ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122)\n[ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))\n[ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)\n[ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))\n[ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2))\n[ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171)\n[ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57)\n[ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)\n[ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3))\n[ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45)\n[ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)\n\nTo solve this issue, fix the replace behavior by adding the metalist to\nthe ife rcu data structure.\n\nFixes: aa9fd9a325d51 (\"sched: act: ife: update parameters via rcu handling\")\nReported-by: Ruitong Liu \u003ccnitlrt@gmail.com\u003e\nTested-by: Ruitong Liu \u003ccnitlrt@gmail.com\u003e\nCo-developed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260304140603.76500-1-jhs@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4517b74cc07c3b766ca92cf6cea352e65f6e8f9b", "tree": "55719399e40a72211ad9dc662cadd2ea05a33a20", "parents": [ "168ff39e4758897d2eee4756977d036d52884c7e", "46c1ef0cfcea50aaf0b52316fdab94bf4b45795b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:53:19 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:53:20 2026 -0800" }, "message": "Merge branch \u0027net-ipv6-fix-panic-when-ipv4-route-references-loopback-ipv6-nexthop-and-add-selftest\u0027\n\nJiayuan Chen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop and add selftest\n\nsyzbot reported a kernel panic [1] when an IPv4 route references\na loopback IPv6 nexthop object:\n\nBUG: unable to handle page fault for address: ffff8d069e7aa000\nPF: supervisor read access in kernel mode\nPF: error_code(0x0000) - not-present page\nPGD 6aa01067 P4D 6aa01067 PUD 0\nOops: Oops: 0000 [#1] SMP PTI\nCPU: 2 UID: 0 PID: 530 Comm: ping Not tainted 6.19.0+ #193 PREEMPT\nRIP: 0010:ip_route_output_key_hash_rcu+0x578/0x9e0\nRSP: 0018:ffffd2ffc1573918 EFLAGS: 00010286\nRAX: ffff8d069e7aa000 RBX: ffffd2ffc1573988 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffd2ffc1573978 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8d060d496000\nR13: 0000000000000000 R14: ffff8d060399a600 R15: ffff8d06019a6ab8\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffff8d069e7aa000 CR3: 0000000106eb0001 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ip_route_output_key_hash+0x86/0x1a0\n __ip4_datagram_connect+0x2b5/0x4e0\n udp_connect+0x2c/0x60\n inet_dgram_connect+0x88/0xd0\n __sys_connect_file+0x56/0x90\n __sys_connect+0xa8/0xe0\n __x64_sys_connect+0x18/0x30\n x64_sys_call+0xfb9/0x26e0\n do_syscall_64+0xd3/0x1510\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nReproduction:\n\n ip -6 nexthop add id 100 dev lo\n ip route add 172.20.20.0/24 nhid 100\n ping -c1 172.20.20.1 # kernel crash\n\nProblem Description\n\nWhen a standalone IPv6 nexthop object is created with a loopback device,\nfib6_nh_init() misclassifies it as a reject route. Nexthop objects have\nno destination prefix (fc_dst\u003d::), so fib6_is_reject() always matches\nany loopback nexthop. The reject path skips fib_nh_common_init(), leaving\nnhc_pcpu_rth_output unallocated. When an IPv4 route later references\nthis nexthop and triggers a route lookup, __mkroute_output() calls\nraw_cpu_ptr(nhc-\u003enhc_pcpu_rth_output) on a NULL pointer, causing a page\nfault.\n\nThe reject classification was designed for regular IPv6 routes to prevent\nkernel routing loops, but nexthop objects should not be subject to this\ncheck since they carry no destination information. Loop prevention is\nhandled separately when the route itself is created.\n[1] https://syzkaller.appspot.com/bug?extid\u003d334190e097a98a1b81bb\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260304113817.294966-1-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "46c1ef0cfcea50aaf0b52316fdab94bf4b45795b", "tree": "55719399e40a72211ad9dc662cadd2ea05a33a20", "parents": [ "21ec92774d1536f71bdc90b0e3d052eff99cf093" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Wed Mar 04 19:38:14 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:53:17 2026 -0800" }, "message": "selftests: net: add test for IPv4 route with loopback IPv6 nexthop\n\nAdd a regression test for a kernel panic that occurs when an IPv4 route\nreferences an IPv6 nexthop object created on the loopback device.\n\nThe test creates an IPv6 nexthop on lo, binds an IPv4 route to it, then\ntriggers a route lookup via ping to verify the kernel does not crash.\n\n ./fib_nexthops.sh\n Tests passed: 249\n Tests failed: 0\n\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20260304113817.294966-3-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "21ec92774d1536f71bdc90b0e3d052eff99cf093", "tree": "21c7a3b1e1e714536ed927fc669b29db633a5634", "parents": [ "168ff39e4758897d2eee4756977d036d52884c7e" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Wed Mar 04 19:38:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:53:17 2026 -0800" }, "message": "net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop\n\nWhen a standalone IPv6 nexthop object is created with a loopback device\n(e.g., \"ip -6 nexthop add id 100 dev lo\"), fib6_nh_init() misclassifies\nit as a reject route. This is because nexthop objects have no destination\nprefix (fc_dst\u003d::), causing fib6_is_reject() to match any loopback\nnexthop. The reject path skips fib_nh_common_init(), leaving\nnhc_pcpu_rth_output unallocated. If an IPv4 route later references this\nnexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and\npanics.\n\nSimplify the check in fib6_nh_init() to only match explicit reject\nroutes (RTF_REJECT) instead of using fib6_is_reject(). The loopback\npromotion heuristic in fib6_is_reject() is handled separately by\nip6_route_info_create_nh(). After this change, the three cases behave\nas follows:\n\n1. Explicit reject route (\"ip -6 route add unreachable 2001:db8::/64\"):\n RTF_REJECT is set, enters reject path, skips fib_nh_common_init().\n No behavior change.\n\n2. Implicit loopback reject route (\"ip -6 route add 2001:db8::/32 dev lo\"):\n RTF_REJECT is not set, takes normal path, fib_nh_common_init() is\n called. ip6_route_info_create_nh() still promotes it to reject\n afterward. nhc_pcpu_rth_output is allocated but unused, which is\n harmless.\n\n3. Standalone nexthop object (\"ip -6 nexthop add id 100 dev lo\"):\n RTF_REJECT is not set, takes normal path, fib_nh_common_init() is\n called. nhc_pcpu_rth_output is properly allocated, fixing the crash\n when IPv4 routes reference this nexthop.\n\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nFixes: 493ced1ac47c (\"ipv4: Allow routes to use nexthop objects\")\nReported-by: syzbot+334190e097a98a1b81bb@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/698f8482.a70a0220.2c38d7.00ca.GAE@google.com/T/\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20260304113817.294966-2-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "168ff39e4758897d2eee4756977d036d52884c7e", "tree": "192f382072961aa5c179efd814dddd59fc92bd45", "parents": [ "e5e890630533bdc15b26a34bb8e7ef539bdf1322" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Wed Mar 04 13:03:57 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:52:56 2026 -0800" }, "message": "net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. If an IPv6 packet is injected into the interface,\nroute_shortcircuit() is called and a NULL pointer dereference happens on\nneigh_lookup().\n\n BUG: kernel NULL pointer dereference, address: 0000000000000380\n Oops: Oops: 0000 [#1] SMP NOPTI\n [...]\n RIP: 0010:neigh_lookup+0x20/0x270\n [...]\n Call Trace:\n \u003cTASK\u003e\n vxlan_xmit+0x638/0x1ef0 [vxlan]\n dev_hard_start_xmit+0x9e/0x2e0\n __dev_queue_xmit+0xbee/0x14e0\n packet_sendmsg+0x116f/0x1930\n __sys_sendto+0x1f5/0x200\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x12f/0x1590\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFix this by adding an early check on route_shortcircuit() when protocol\nis ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because\nVXLAN can be built-in even when IPv6 is built as a module.\n\nFixes: e15a00aafa4b (\"vxlan: add ipv6 route short circuit support\")\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20260304120357.9778-2-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e5e890630533bdc15b26a34bb8e7ef539bdf1322", "tree": "a651114bee5c34c0ef2f9fa7e492ac3e5c1d9aea", "parents": [ "02b2920e30e323522438593e6ed9525f31cc727e" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Wed Mar 04 13:03:56 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:52:56 2026 -0800" }, "message": "net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. Then, if neigh_suppress is enabled and an ICMPv6\nNeighbor Discovery packet reaches the bridge, br_do_suppress_nd() will\ndereference ipv6_stub-\u003end_tbl which is NULL, passing it to\nneigh_lookup(). This causes a kernel NULL pointer dereference.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000268\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n [...]\n RIP: 0010:neigh_lookup+0x16/0xe0\n [...]\n Call Trace:\n \u003cIRQ\u003e\n ? neigh_lookup+0x16/0xe0\n br_do_suppress_nd+0x160/0x290 [bridge]\n br_handle_frame_finish+0x500/0x620 [bridge]\n br_handle_frame+0x353/0x440 [bridge]\n __netif_receive_skb_core.constprop.0+0x298/0x1110\n __netif_receive_skb_one_core+0x3d/0xa0\n process_backlog+0xa0/0x140\n __napi_poll+0x2c/0x170\n net_rx_action+0x2c4/0x3a0\n handle_softirqs+0xd0/0x270\n do_softirq+0x3f/0x60\n\nFix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in\nthe callers. This is in essence disabling NS/NA suppression when IPv6 is\ndisabled.\n\nFixes: ed842faeb2bd (\"bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports\")\nReported-by: Guruprasad C P \u003cgurucp2005@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/CAHXs0ORzd62QOG-Fttqa2Cx_A_VFp\u003dutE2H2VTX5nqfgs7LDxQ@mail.gmail.com/\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nAcked-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260304120357.9778-1-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "02b2920e30e323522438593e6ed9525f31cc727e", "tree": "c7c8931229ed3ce82e7b7eabdce0b2e3e16bfa50", "parents": [ "c952291593e54415a7bb74c4a7187a7c7c7e8651", "ed6579002548f3d9c00380e2aeaa8305d3ed8fc5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:45 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:47 2026 -0800" }, "message": "Merge branch \u0027maintainers-annual-cleanup-of-inactive-maintainers\u0027\n\nJakub Kicinski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nMAINTAINERS: annual cleanup of inactive maintainers\n\nAnnual cleanup of inactive maintainers under networking.\nThe goal is to make sure MAINTAINERS reflect reality for\ncode which is relatively actively changed (at least 70 commits\nin the last 2 years or at least 120 commits in the last 5 years).\n\nThose who either:\n - were the initial author / \"upstreamer\" of the driver; or\n - authored at least 1/3rd of the exiting code base (per git blame); or\n - authored at least 25% of commits before becoming inactive\nare moved to CREDITS.\n\nThe discovery of inactive maintainers was done using gitdm tools,\nwith a bunch of ad-hoc scripts on top to do the rest. I tried to\ndouble check the results but this is mostly a scripted cleanup\nso please report inaccuracies if any.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260303215339.2333548-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ed6579002548f3d9c00380e2aeaa8305d3ed8fc5", "tree": "c7c8931229ed3ce82e7b7eabdce0b2e3e16bfa50", "parents": [ "4d37e68c46d15beb4af782b19d7f1b382316776c" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:11 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:45 2026 -0800" }, "message": "MAINTAINERS: remove Thomas Falcon from IBM ibmvnic\n\nWe have not seen emails or tags from Thomas\u0027s IBM address\n(tlfalcon@linux.ibm.com) in over 5 years. Looks like Thomas\nis active in perf tooling at Intel (thomas.falcon@intel.com).\n\nSubsystem IBM Power SRIOV Virtual NIC Device Driver\n Changes 49 / 134 (36%)\n Last activity: 2025-08-26\n Haren Myneni \u003charen@linux.ibm.com\u003e:\n Tags 3c14917953a5 2025-08-26 00:00:00 2\n Rick Lindsley \u003cricklind@linux.ibm.com\u003e:\n Nick Child \u003cnnac123@linux.ibm.com\u003e:\n Author d93a6caab5d7 2025-03-25 00:00:00 14\n Tags d93a6caab5d7 2025-03-25 00:00:00 16\n Thomas Falcon \u003ctlfalcon@linux.ibm.com\u003e:\n Top reviewers:\n [22]: drt@linux.ibm.com\n [13]: horms@kernel.org\n [9]: ricklind@linux.vnet.ibm.com\n [3]: davemarq@linux.ibm.com\n INACTIVE MAINTAINER Thomas Falcon \u003ctlfalcon@linux.ibm.com\u003e\n\nMove Thomas to CREDITS as the initial author of ibmvnic.\n\nAcked-by: Thomas Falcon \u003cthomas.falcon@intel.com\u003e\nLink: https://patch.msgid.link/20260303215339.2333548-12-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4d37e68c46d15beb4af782b19d7f1b382316776c", "tree": "088ec7cfb8b5c6d79dbd2ce6db8c029abc4488ba", "parents": [ "9ede3e910f088fb3ffec0ed821f0b03951000d23" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:10 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:45 2026 -0800" }, "message": "MAINTAINERS: remove Claudiu Manoil and Alexandre Belloni from Ocelot switch\n\nWe have not seen tags from Claudiu for the Ocelot switch driver\nin over 5 years. He is active upstream in other NXP subsystems\n(ENETC, gianfar), with 46 emails on lore since 2024.\nWe have not seen tags from Alexandre for the Ocelot switch driver\nin over 5 years. He is very active upstream in other subsystems\n(RTC, I3C, Atmel/Microchip SoC), with over 1,200 emails on lore\nsince 2024.\nVladimir Oltean is active.\n\nSubsystem OCELOT ETHERNET SWITCH DRIVER\n Changes 180 / 494 (36%)\n Last activity: 2026-02-12\n Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e:\n Author c22ba07c827f 2026-02-10 00:00:00 33\n Tags 026f6513c588 2026-02-12 00:00:00 39\n Claudiu Manoil \u003cclaudiu.manoil@nxp.com\u003e:\n Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e:\n Top reviewers:\n [49]: f.fainelli@gmail.com\n [19]: horms@kernel.org\n [10]: richardcochran@gmail.com\n [9]: jacob.e.keller@intel.com\n [8]: colin.foster@in-advantage.com\n INACTIVE MAINTAINER Claudiu Manoil \u003cclaudiu.manoil@nxp.com\u003e\n\nAcked-by: Claudiu Manoil \u003cclaudiu.manoil@nxp.com\u003e\nAcked-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\nLink: https://patch.msgid.link/20260303215339.2333548-11-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9ede3e910f088fb3ffec0ed821f0b03951000d23", "tree": "5fc2f986a8be64c6e27d6b181b861dbed5bed659", "parents": [ "60da2d2752ac4513fc3a91a0558dfd8176d2313f" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:09 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:45 2026 -0800" }, "message": "MAINTAINERS: replace Taras Chornyi with Elad Nachman for Marvell Prestera\n\nWe have not seen emails or tags from Taras in over 5 years,\nand there is no recent mailing list activity.\nElad Nachman has been providing reviews in the last couple\nof years and is the top reviewer for this subsystem.\n\nSubsystem MARVELL PRESTERA ETHERNET SWITCH DRIVER\n Changes 39 / 157 (24%)\n (No activity)\n Top reviewers:\n [8]: enachman@marvell.com\n [6]: horms@kernel.org\n [4]: idosch@nvidia.com\n [3]: andrew@lunn.ch\n [3]: jacob.e.keller@intel.com\n [3]: jiri@nvidia.com\n INACTIVE MAINTAINER Taras Chornyi \u003ctaras.chornyi@plvision.eu\u003e\n\nLink: https://patch.msgid.link/20260303215339.2333548-10-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "60da2d2752ac4513fc3a91a0558dfd8176d2313f", "tree": "aa14c8ccb2650b99c23e2b019441db6c28234355", "parents": [ "34f49454b25cd2e532f137174ef59b778f1a09f5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:08 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:45 2026 -0800" }, "message": "MAINTAINERS: remove Jonathan Lemon from OpenCompute PTP\n\nWe have not seen emails or tags from Jonathan in over 5 years,\nand there is no recent mailing list activity.\nVadim Fedorenko is active.\n\nSubsystem OPENCOMPUTE PTP CLOCK DRIVER\n Changes 49 / 130 (37%)\n Last activity: 2025-11-25\n Jonathan Lemon \u003cjonathan.lemon@gmail.com\u003e:\n Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e:\n Author d3ca2ef0c915 2025-09-19 00:00:00 5\n Tags 648282e2d1e5 2025-11-25 00:00:00 20\n Top reviewers:\n [7]: horms@kernel.org\n [4]: jiri@nvidia.com\n [3]: richardcochran@gmail.com\n [2]: aleksandr.loktionov@intel.com\n INACTIVE MAINTAINER Jonathan Lemon \u003cjonathan.lemon@gmail.com\u003e\n\nAdd Jonathan to CREDITS as the initial author of ptp_ocp.\n\nAcked-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nLink: https://patch.msgid.link/20260303215339.2333548-9-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "34f49454b25cd2e532f137174ef59b778f1a09f5", "tree": "a3f97f48c53b1298485eb7c275a86eb0bc7614b7", "parents": [ "593cdf14523bfb837b947012cdc6545a53ea67b5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:07 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:44 2026 -0800" }, "message": "MAINTAINERS: replace Clark Wang with Frank Li for Freescale FEC\n\nWe have not seen tags from Clark for FEC in over 5 years.\nHe has some limited recent activity on the mailing list in other\nNXP subsystems (stmmac, phy). Wei Fang and Shenwei Wang are active,\nwith decent review coverage (61%).\n\nFrank Li has been reviewing code actively more recenty, let\u0027s\nmake it official.\n\nSubsystem FREESCALE IMX / MXC FEC DRIVER\n Changes 57 / 92 (61%)\n Last activity: 2026-02-10\n Wei Fang \u003cwei.fang@nxp.com\u003e:\n Author 25eb3058eb70 2026-02-10 00:00:00 33\n Tags 25eb3058eb70 2026-02-10 00:00:00 61\n Shenwei Wang \u003cshenwei.wang@nxp.com\u003e:\n Author d466c16026e9 2025-09-14 00:00:00 6\n Tags d466c16026e9 2025-09-14 00:00:00 6\n Clark Wang \u003cxiaoning.wang@nxp.com\u003e:\n Top reviewers:\n [23]: Frank.Li@nxp.com\n [17]: andrew@lunn.ch\n [4]: csokas.bence@prolan.hu\n [3]: horms@kernel.org\n [2]: maxime.chevallier@bootlin.com\n INACTIVE MAINTAINER Clark Wang \u003cxiaoning.wang@nxp.com\u003e\n\nReviewed-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260303215339.2333548-8-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "593cdf14523bfb837b947012cdc6545a53ea67b5", "tree": "53be080ae52067914a22f4296763b0f8e91ff1b8", "parents": [ "77f72ef58fb849cbe39fd69a20f9ae5076cd442b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:06 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:44 2026 -0800" }, "message": "MAINTAINERS: remove DENG Qingfang from MediaTek switch\n\nWe have not seen tags from DENG Qingfang for the MediaTek\nswitch driver in over 5 years. He is active upstream with\nPPP/PPPoE patches in net-next. Chester and Daniel are active.\n\nSubsystem MEDIATEK SWITCH DRIVER\n Changes 26 / 70 (37%)\n Last activity: 2025-12-01\n Chester A. Unal \u003cchester.a.unal@arinc9.com\u003e:\n Tags 585943b7ad30 2025-12-01 00:00:00 7\n Daniel Golle \u003cdaniel@makrotopia.org\u003e:\n Author 497041d76301 2025-04-23 00:00:00 2\n Tags 3b87e60d2131 2025-12-01 00:00:00 14\n DENG Qingfang \u003cdqfext@gmail.com\u003e:\n Sean Wang \u003csean.wang@mediatek.com\u003e:\n Top reviewers:\n [4]: andrew@lunn.ch\n [4]: florian.fainelli@broadcom.com\n [4]: arinc.unal@arinc9.com\n [2]: olteanv@gmail.com\n INACTIVE MAINTAINER DENG Qingfang \u003cdqfext@gmail.com\u003e\n\nAcked-by: Chester A. Unal \u003cchester.a.unal@arinc9.com\u003e\nLink: https://patch.msgid.link/20260303215339.2333548-7-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "77f72ef58fb849cbe39fd69a20f9ae5076cd442b", "tree": "2b2a2c1682c49f705f1adf8188905ada7f284a14", "parents": [ "e07f796a86b2f0fda976268a08c321579022fcbc" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:05 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:44 2026 -0800" }, "message": "MAINTAINERS: remove Sean Wang from MediaTek Ethernet and switch\n\nWe have not seen tags from Sean in over 5 years,\nwith only one mailing list post since 2024.\nFelix and Lorenzo are active for the Ethernet driver,\nand Chester, Daniel and DENG Qingfang are active for\nthe switch driver.\n\nSubsystem MEDIATEK ETHERNET DRIVER\n Changes 55 / 113 (48%)\n Last activity: 2025-10-12\n Felix Fietkau \u003cnbd@nbd.name\u003e:\n Author d4736737110f 2025-09-02 00:00:00 3\n Tags d4736737110f 2025-09-02 00:00:00 4\n Sean Wang \u003csean.wang@mediatek.com\u003e:\n Lorenzo Bianconi \u003clorenzo@kernel.org\u003e:\n Author 96326447d466 2025-08-13 00:00:00 35\n Tags 3abc0e55ea1f 2025-10-12 00:00:00 40\n Top reviewers:\n [26]: horms@kernel.org\n [5]: andrew@lunn.ch\n [4]: jacob.e.keller@intel.com\n [3]: shannon.nelson@amd.com\n [3]: michal.swiatkowski@linux.intel.com\n INACTIVE MAINTAINER Sean Wang \u003csean.wang@mediatek.com\u003e\n\nSubsystem MEDIATEK SWITCH DRIVER\n Changes 26 / 70 (37%)\n Last activity: 2025-12-01\n Chester A. Unal \u003cchester.a.unal@arinc9.com\u003e:\n Tags 585943b7ad30 2025-12-01 00:00:00 7\n Daniel Golle \u003cdaniel@makrotopia.org\u003e:\n Author 497041d76301 2025-04-23 00:00:00 2\n Tags 3b87e60d2131 2025-12-01 00:00:00 14\n DENG Qingfang \u003cdqfext@gmail.com\u003e:\n Sean Wang \u003csean.wang@mediatek.com\u003e:\n Top reviewers:\n [4]: andrew@lunn.ch\n [4]: florian.fainelli@broadcom.com\n [4]: arinc.unal@arinc9.com\n [2]: olteanv@gmail.com\n INACTIVE MAINTAINER Sean Wang \u003csean.wang@mediatek.com\u003e\n\nAcked-by: Chester A. Unal \u003cchester.a.unal@arinc9.com\u003e\nLink: https://patch.msgid.link/20260303215339.2333548-6-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e07f796a86b2f0fda976268a08c321579022fcbc", "tree": "851f3e7057b0c39be8c8fb7b155d0624c1cc2e84", "parents": [ "80f8a19fe7cf5b1b5d541c7aaa37aa9d7653bda5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:03 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:36 2026 -0800" }, "message": "MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2\n\nWe have not seen tags from Jerin for OcteonTX2 in over 5 years.\nRecent lore activity is in DPDK (non-kernel), not Linux.\nSunil, Linu, Geetha, hariprasad, and Subbaraya are active,\nthough the review coverage isn\u0027t great (38%).\n\nSubsystem MARVELL OCTEONTX2 RVU ADMIN FUNCTION DRIVER\n Changes 53 / 138 (38%)\n Last activity: 2026-02-18\n Sunil Goutham \u003csgoutham@marvell.com\u003e:\n Author fc1b2901e0fe 2024-03-08 00:00:00 1\n Tags 70f8986ecef1 2025-06-16 00:00:00 9\n Linu Cherian \u003clcherian@marvell.com\u003e:\n Author a861e5809f3e 2025-10-30 00:00:00 7\n Tags a861e5809f3e 2025-10-30 00:00:00 7\n Geetha sowjanya \u003cgakula@marvell.com\u003e:\n Author 70e9a5760abf 2026-01-29 00:00:00 16\n Tags 70e9a5760abf 2026-01-29 00:00:00 20\n Jerin Jacob \u003cjerinj@marvell.com\u003e:\n hariprasad \u003chkelam@marvell.com\u003e:\n Author 45be47bf5d7d 2026-02-18 00:00:00 22\n Tags 45be47bf5d7d 2026-02-18 00:00:00 25\n Subbaraya Sundeep \u003csbhatta@marvell.com\u003e:\n Author 47a1208776d7 2025-10-30 00:00:00 20\n Tags 47a1208776d7 2025-10-30 00:00:00 30\n Top reviewers:\n [36]: horms@kernel.org\n [4]: jacob.e.keller@intel.com\n [4]: kalesh-anakkur.purayil@broadcom.com\n [3]: vadim.fedorenko@linux.dev\n [2]: shaojijie@huawei.com\n [2]: jiri@nvidia.com\n INACTIVE MAINTAINER Jerin Jacob \u003cjerinj@marvell.com\u003e\n\nLink: https://patch.msgid.link/20260303215339.2333548-4-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "80f8a19fe7cf5b1b5d541c7aaa37aa9d7653bda5", "tree": "48044bf788a46b91ffae54bd851e55f689680412", "parents": [ "f9b5bf12eb65e1e708a883a1e24712e81ed2f340" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:02 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:36 2026 -0800" }, "message": "MAINTAINERS: remove Manish Chopra from QLogic QL4xxx (now orphan)\n\nWe have not seen tags from Manish for the QL4xxx driver in over 5 years,\nand there is no mailing list activity since Oct 2023. There has been\nno maintainer activity in this subsystem at all.\n\nSince there is no other maintainer for this driver it becomes an Orphan.\n\nSubsystem QLOGIC QL4xxx ETHERNET DRIVER\n Changes 40 / 74 (54%)\n (No activity)\n Top reviewers:\n [30]: horms@kernel.org\n [2]: jiri@nvidia.com\n [2]: shannon.nelson@amd.com\n [1]: saeedm@nvidia.com\n [1]: aleksandr.loktionov@intel.com\n [1]: kory.maincent@bootlin.com\n INACTIVE MAINTAINER Manish Chopra \u003cmanishc@marvell.com\u003e\n\nLink: https://patch.msgid.link/20260303215339.2333548-3-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f9b5bf12eb65e1e708a883a1e24712e81ed2f340", "tree": "b4bdbc9e314f1f6c4a6f90fb02599e2f37bf47e9", "parents": [ "c952291593e54415a7bb74c4a7187a7c7c7e8651" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:01 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:35 2026 -0800" }, "message": "MAINTAINERS: remove Johan Hedberg from Bluetooth subsystem\n\nWe have not seen emails or tags from Johan in over 5 years,\nand there is no recent mailing list activity.\nMarcel Holtmann hasn\u0027t provided any tags in the Bluetooth\nsubsystem in over 5 years, but he is active on the Bluetooth\nmailing list, providing informal review.\nLuiz Augusto von Dentz is very active, handling essentially\nall commits and reviews (12% coverage, but Luiz is the sole\nactive committer).\n\nSubsystem BLUETOOTH SUBSYSTEM\n Changes 50 / 411 (12%)\n Last activity: 2026-02-23\n Marcel Holtmann \u003cmarcel@holtmann.org\u003e:\n Johan Hedberg \u003cjohan.hedberg@gmail.com\u003e:\n Luiz Augusto von Dentz \u003cluiz.dentz@gmail.com\u003e:\n Author 138d7eca445e 2026-02-23 00:00:00 164\n Committer 138d7eca445e 2026-02-23 00:00:00 361\n Tags 138d7eca445e 2026-02-23 00:00:00 362\n Top reviewers:\n [15]: pmenzel@molgen.mpg.de\n [8]: keescook@chromium.org\n [5]: willemb@google.com\n [4]: horms@kernel.org\n [3]: kuniyu@amazon.com\n [3]: luiz.von.dentz@intel.com\n INACTIVE MAINTAINER Johan Hedberg \u003cjohan.hedberg@gmail.com\u003e\n\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nLink: https://patch.msgid.link/20260303215339.2333548-2-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c952291593e54415a7bb74c4a7187a7c7c7e8651", "tree": "e4744c7ebd4278fb1099956a531bde878a7db120", "parents": [ "6be2681514261324c8ee8a1c6f76cefdf700220f" ], "author": { "name": "Sun Jian", "email": "sun.jian.kdev@gmail.com", "time": "Wed Feb 25 19:14:51 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:34:55 2026 -0800" }, "message": "selftests: net: tun: don\u0027t abort XFAIL cases\n\nThe tun UDP tunnel GSO fixture contains XFAIL-marked variants intended to\nexercise failure paths (e.g. EMSGSIZE / \"Message too long\").\nUsing ASSERT_EQ() in these tests aborts the subtest, which prevents the\nharness from classifying them as XFAIL and can make the overall net: tun\ntest fail.\n\nSwitch the relevant ASSERT_EQ() checks to EXPECT_EQ() so the subtests\ncontinue running and the failures are correctly reported and accounted\nas XFAIL where applicable.\n\nSigned-off-by: Sun Jian \u003csun.jian.kdev@gmail.com\u003e\nLink: https://patch.msgid.link/20260225111451.347923-2-sun.jian.kdev@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6be2681514261324c8ee8a1c6f76cefdf700220f", "tree": "2169814d15a0e20c19880b7d41b15e9a8932f76d", "parents": [ "37380976cf22893537ff229224a0daa2f4a28e65" ], "author": { "name": "Sun Jian", "email": "sun.jian.kdev@gmail.com", "time": "Wed Feb 25 19:14:50 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:34:54 2026 -0800" }, "message": "selftests/harness: order TEST_F and XFAIL_ADD constructors\n\nTEST_F() allocates and registers its struct __test_metadata via mmap()\ninside its constructor, and only then assigns the\n_##fixture_##test##_object pointer.\n\nXFAIL_ADD() runs in a constructor too and reads\n_##fixture_##test##_object to initialize xfail-\u003etest. If XFAIL_ADD runs\nfirst, xfail-\u003etest can be NULL and the expected failure will be reported\nas FAIL.\n\nUse constructor priorities to ensure TEST_F registration runs before\nXFAIL_ADD, without adding extra state or runtime lookups.\n\nFixes: 2709473c9386 (\"selftests: kselftest_harness: support using xfail\")\nSigned-off-by: Sun Jian \u003csun.jian.kdev@gmail.com\u003e\nLink: https://patch.msgid.link/20260225111451.347923-1-sun.jian.kdev@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "37380976cf22893537ff229224a0daa2f4a28e65", "tree": "25dbae10eb13770a422e28dc176c092a75211054", "parents": [ "0abc73c8a40fd64ac1739c90bb4f42c418d27a5e", "9df95785d3d8302f7c066050117b04cd3c2048c2" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:33:25 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:33:26 2026 -0800" }, "message": "Merge tag \u0027nf-26-03-05\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter: updates for net\n\n1) Inseo An reported a bug with the set element handling in nf_tables:\n When set cannot accept more elements, we unlink and immediately free\n an element that was inserted into a public data structure, freeing it\n without waiting for RCU grace period. Fix this by doing the\n increment earlier and by deferring possible unlink-and-free to the\n existing abort path, which performs the needed synchronize_rcu before\n free. From Pablo Neira Ayuso. This is an ancient bug, dating back to\n kernel 4.10.\n\n2) syzbot reported WARN_ON() splat in nf_tables that occurs on memory\n allocation failure. Fix this by a new iterator annotation:\n The affected walker does not need to clone the data structure and\n can just use the live version if no clone exists yet.\n Also from Pablo. This bug existed since 6.10 days.\n\n3) Ancient forever bug in nft_pipapo data structure:\n The garbage collection logic to remove expired elements is broken.\n We must unlink from data structure and can only hand the freeing\n to call_rcu after the clone/live pointers of the data structures\n have been swapped. Else, readers can observe the free\u0027d element.\n Reported by Yiming Qian.\n\n* tag \u0027nf-26-03-05\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: nft_set_pipapo: split gc into unlink and reclaim phase\n netfilter: nf_tables: clone set on flush only\n netfilter: nf_tables: unconditionally bump set-\u003enelems before insertion\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260305122635.23525-1-fw@strlen.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f26b098d937488e8f5c617d465760a10bfcc7f13", "tree": "9c49a4bac0af84b7e118a5223d4422629b391730", "parents": [ "e39bb9e02b68942f8e9359d2a3efe7d37ae6be0e" ], "author": { "name": "Jerome Marchand", "email": "jmarchan@redhat.com", "time": "Thu Mar 05 10:31:17 2026 +0100" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Thu Mar 05 10:17:31 2026 -0500" }, "message": "ftrace: Add MAINTAINERS entries for all ftrace headers\n\nThere is currently no entry for ftrace_irq.h and ftrace_regs.h. Add a\ngeneric entry for all *ftrace* headers to include them and prevent\noverlooking future ftrace headers.\n\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nLink: https://patch.msgid.link/20260305093117.853700-1-jmarchan@redhat.com\nSigned-off-by: Jerome Marchand \u003cjmarchan@redhat.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "0abc73c8a40fd64ac1739c90bb4f42c418d27a5e", "tree": "87a30d50e6f000020777fae1bbebfbab5fbdc59a", "parents": [ "b824c3e16c1904bf80df489e293d1e3cbf98896d" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Tue Mar 03 18:56:39 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Mar 05 15:39:51 2026 +0100" }, "message": "net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()\n\nReset eBPF program pointer to old_prog and do not decrease its ref-count\nif mtk_open routine in mtk_xdp_setup() fails.\n\nFixes: 7c26c20da5d42 (\"net: ethernet: mtk_eth_soc: add basic XDP support\")\nSuggested-by: Paolo Valerio \u003cpvalerio@redhat.com\u003e\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260303-mtk-xdp-prog-ptr-fix-v2-1-97b6dbbe240f@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9df95785d3d8302f7c066050117b04cd3c2048c2", "tree": "938612ef3bd2cd56f829810493de30123c46a1ff", "parents": [ "fb7fb4016300ac622c964069e286dc83166a5d52" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 03 16:31:32 2026 +0100" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Thu Mar 05 13:22:37 2026 +0100" }, "message": "netfilter: nft_set_pipapo: split gc into unlink and reclaim phase\n\nYiming Qian reports Use-after-free in the pipapo set type:\n Under a large number of expired elements, commit-time GC can run for a very\n long time in a non-preemptible context, triggering soft lockup warnings and\n RCU stall reports (local denial of service).\n\nWe must split GC in an unlink and a reclaim phase.\n\nWe cannot queue elements for freeing until pointers have been swapped.\nExpired elements are still exposed to both the packet path and userspace\ndumpers via the live copy of the data structure.\n\ncall_rcu() does not protect us: dump operations or element lookups starting\nafter call_rcu has fired can still observe the free\u0027d element, unless the\ncommit phase has made enough progress to swap the clone and live pointers\nbefore any new reader has picked up the old version.\n\nThis a similar approach as done recently for the rbtree backend in commit\n35f83a75529a (\"netfilter: nft_set_rbtree: don\u0027t gc elements on insert\").\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "fb7fb4016300ac622c964069e286dc83166a5d52", "tree": "17dc7977990bb5c44e8af3677161567daf2593dd", "parents": [ "def602e498a4f951da95c95b1b8ce8ae68aa733a" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Mon Mar 02 23:28:15 2026 +0100" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Thu Mar 05 13:22:37 2026 +0100" }, "message": "netfilter: nf_tables: clone set on flush only\n\nSyzbot with fault injection triggered a failing memory allocation with\nGFP_KERNEL which results in a WARN splat:\n\niter.err\nWARNING: net/netfilter/nf_tables_api.c:845 at nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845, CPU#0: syz.0.17/5992\nModules linked in:\nCPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026\nRIP: 0010:nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845\nCode: 8b 05 86 5a 4e 09 48 3b 84 24 a0 00 00 00 75 62 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 63 6d fa f7 90 \u003c0f\u003e 0b 90 43\n+80 7c 35 00 00 0f 85 23 fe ff ff e9 26 fe ff ff 89 d9\nRSP: 0018:ffffc900045af780 EFLAGS: 00010293\nRAX: ffffffff89ca45bd RBX: 00000000fffffff4 RCX: ffff888028111e40\nRDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000\nRBP: ffffc900045af870 R08: 0000000000400dc0 R09: 00000000ffffffff\nR10: dffffc0000000000 R11: fffffbfff1d141db R12: ffffc900045af7e0\nR13: 1ffff920008b5f24 R14: dffffc0000000000 R15: ffffc900045af920\nFS: 000055557a6a5500(0000) GS:ffff888125496000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fb5ea271fc0 CR3: 000000003269e000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n __nft_release_table+0xceb/0x11f0 net/netfilter/nf_tables_api.c:12115\n nft_rcv_nl_event+0xc25/0xdb0 net/netfilter/nf_tables_api.c:12187\n notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85\n blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380\n netlink_release+0x123b/0x1ad0 net/netlink/af_netlink.c:761\n __sock_release net/socket.c:662 [inline]\n sock_close+0xc3/0x240 net/socket.c:1455\n\nRestrict set clone to the flush set command in the preparation phase.\nAdd NFT_ITER_UPDATE_CLONE and use it for this purpose, update the rbtree\nand pipapo backends to only clone the set when this iteration type is\nused.\n\nAs for the existing NFT_ITER_UPDATE type, update the pipapo backend to\nuse the existing set clone if available, otherwise use the existing set\nrepresentation. After this update, there is no need to clone a set that\nis being deleted, this includes bound anonymous set.\n\nAn alternative approach to NFT_ITER_UPDATE_CLONE is to add a .clone\ninterface and call it from the flush set path.\n\nReported-by: syzbot+4924a0edc148e8b4b342@syzkaller.appspotmail.com\nFixes: 3f1d886cc7c3 (\"netfilter: nft_set_pipapo: move cloning of match info to insert/removal path\")\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "def602e498a4f951da95c95b1b8ce8ae68aa733a", "tree": "809a1dc4f74d343d74018ee45b27e45650bfd482", "parents": [ "b824c3e16c1904bf80df489e293d1e3cbf98896d" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Mon Mar 02 23:12:37 2026 +0100" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Thu Mar 05 13:22:37 2026 +0100" }, "message": "netfilter: nf_tables: unconditionally bump set-\u003enelems before insertion\n\nIn case that the set is full, a new element gets published then removed\nwithout waiting for the RCU grace period, while RCU reader can be\nwalking over it already.\n\nTo address this issue, add the element transaction even if set is full,\nbut toggle the set_full flag to report -ENFILE so the abort path safely\nunwinds the set to its previous state.\n\nAs for element updates, decrement set-\u003enelems to restore it.\n\nA simpler fix is to call synchronize_rcu() in the error path.\nHowever, with a large batch adding elements to already maxed-out set,\nthis could cause noticeable slowdown of such batches.\n\nFixes: 35d0ac9070ef (\"netfilter: nf_tables: fix set-\u003enelems counting with no NLM_F_EXCL\")\nReported-by: Inseo An \u003cy0un9sa@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "b824c3e16c1904bf80df489e293d1e3cbf98896d", "tree": "3373cb91f1ee6ad6789cb9de00eee6a8c6894649", "parents": [ "ae779bcb18cb0ef0da1402b9dd837e2084e23e27" ], "author": { "name": "Sebastian Andrzej Siewior", "email": "bigeasy@linutronix.de", "time": "Mon Mar 02 17:26:31 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Mar 05 12:14:21 2026 +0100" }, "message": "net: Provide a PREEMPT_RT specific check for netdev_queue::_xmit_lock\n\nAfter acquiring netdev_queue::_xmit_lock the number of the CPU owning\nthe lock is recorded in netdev_queue::xmit_lock_owner. This works as\nlong as the BH context is not preemptible.\n\nOn PREEMPT_RT the softirq context is preemptible and without the\nsoftirq-lock it is possible to have multiple user in __dev_queue_xmit()\nsubmitting a skb on the same CPU. This is fine in general but this means\nalso that the current CPU is recorded as netdev_queue::xmit_lock_owner.\nThis in turn leads to the recursion alert and the skb is dropped.\n\nInstead checking the for CPU number, that owns the lock, PREEMPT_RT can\ncheck if the lockowner matches the current task.\n\nAdd netif_tx_owned() which returns true if the current context owns the\nlock by comparing the provided CPU number with the recorded number. This\nresembles the current check by negating the condition (the current check\nreturns true if the lock is not owned).\nOn PREEMPT_RT use rt_mutex_owner() to return the lock owner and compare\nthe current task against it.\nUse the new helper in __dev_queue_xmit() and netif_local_xmit_active()\nwhich provides a similar check.\nUpdate comments regarding pairing READ_ONCE().\n\nReported-by: Bert Karwatzki \u003cspasswolf@web.de\u003e\nCloses: https://lore.kernel.org/all/20260216134333.412332-1-spasswolf@web.de\nFixes: 3253cb49cbad4 (\"softirq: Allow to drop the softirq-BKL lock on PREEMPT_RT\")\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nReported-by: Bert Karwatzki \u003cspasswolf@web.de\u003e\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nLink: https://patch.msgid.link/20260302162631.uGUyIqDT@linutronix.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ae779bcb18cb0ef0da1402b9dd837e2084e23e27", "tree": "08b9998a86c87bda39d94ed8f731ef32e9a9d8ed", "parents": [ "550921c67baa3669e108308b0d8cc9ee6471604b", "2cd70e3968f505996d5fefdf7ca684f0f4575734" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:48:51 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:48:51 2026 -0800" }, "message": "Merge branch \u0027net-stmmac-fix-vlan-handling-when-interface-is-down\u0027\n\nOvidiu Panait says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: stmmac: Fix VLAN handling when interface is down\n\nVLAN register accesses on the MAC side require the PHY RX clock to be\nactive. When the network interface is down, the PHY is suspended and\nthe RX clock is unavailable, causing VLAN operations to fail with\ntimeouts.\n\nThe VLAN core automatically removes VID 0 after the interface goes down\nand re-adds it when it comes back up, so these timeouts happen during\nnormal interface down/up:\n\n # ip link set end1 down\n renesas-gbeth 15c40000.ethernet end1: Timeout accessing MAC_VLAN_Tag_Filter\n renesas-gbeth 15c40000.ethernet end1: failed to kill vid 0081/0\n\nAdding VLANs while the interface is down also fails:\n\n # ip link add link end1 name end1.10 type vlan id 10\n renesas-gbeth 15c40000.ethernet end1: Timeout accessing MAC_VLAN_Tag_Filter\n RTNETLINK answers: Device or resource busy\n\nPatch 4 fixes this by adding checks in the VLAN paths for netif_running(),\nand skipping register accesses if the interface is down. Only the software\nstate is updated in this case. When the interface is brought up, the VLAN\nstate is restored to hardware.\n\nPatches 1-3 fix some issues in the existing VLAN implementation.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260303145828.7845-1-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2cd70e3968f505996d5fefdf7ca684f0f4575734", "tree": "08b9998a86c87bda39d94ed8f731ef32e9a9d8ed", "parents": [ "bd7ad51253a76fb35886d01cfe9a37f0e4ed6709" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Tue Mar 03 14:58:28 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:48:49 2026 -0800" }, "message": "net: stmmac: Defer VLAN HW configuration when interface is down\n\nVLAN register accesses on the MAC side require the PHY RX clock to be\nactive. When the network interface is down, the PHY is suspended and\nthe RX clock is unavailable, causing VLAN operations to fail with\ntimeouts.\n\nThe VLAN core automatically removes VID 0 after the interface goes down\nand re-adds it when it comes back up, so these timeouts happen during\nnormal interface down/up:\n\n # ip link set end1 down\n renesas-gbeth 15c40000.ethernet end1: Timeout accessing MAC_VLAN_Tag_Filter\n renesas-gbeth 15c40000.ethernet end1: failed to kill vid 0081/0\n\nAdding VLANs while the interface is down also fails:\n\n # ip link add link end1 name end1.10 type vlan id 10\n renesas-gbeth 15c40000.ethernet end1: Timeout accessing MAC_VLAN_Tag_Filter\n RTNETLINK answers: Device or resource busy\n\nTo fix this, check if the interface is up before accessing VLAN registers.\nThe software state is always kept up to date regardless of interface state.\n\nWhen the interface is brought up, stmmac_vlan_restore() is called\nto write the VLAN state to hardware.\n\nFixes: ed64639bc1e0 (\"net: stmmac: Add support for VLAN Rx filtering\")\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nLink: https://patch.msgid.link/20260303145828.7845-5-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bd7ad51253a76fb35886d01cfe9a37f0e4ed6709", "tree": "8993725387e3ad21ef9a0acd0a38856ad02ed24c", "parents": [ "e38200e361cbe331806dc454c76c11c7cd95e1b9" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Tue Mar 03 14:58:27 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:48:49 2026 -0800" }, "message": "net: stmmac: Fix VLAN HW state restore\n\nWhen the network interface is opened or resumed, a DMA reset is performed,\nwhich resets all hardware state, including VLAN state. Currently, only\nthe resume path is restoring the VLAN state via\nstmmac_restore_hw_vlan_rx_fltr(), but that is incomplete: the VLAN hash\ntable and the VLAN_TAG control bits are not restored.\n\nTherefore, add stmmac_vlan_restore(), which restores the full VLAN\nstate by updating both the HW filter entries and the hash table, and\ncall it from both the open and resume paths.\n\nThe VLAN restore is moved outside of phylink_rx_clk_stop_block/unblock\nin the resume path because receive clock stop is already disabled when\nstmmac supports VLAN.\n\nAlso, remove the hash readback code in vlan_restore_hw_rx_fltr() that\nattempts to restore VTHM by reading VLAN_HASH_TABLE, as it always reads\nzero after DMA reset, making it dead code.\n\nFixes: 3cd1cfcba26e (\"net: stmmac: Implement VLAN Hash Filtering in XGMAC\")\nFixes: ed64639bc1e0 (\"net: stmmac: Add support for VLAN Rx filtering\")\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nLink: https://patch.msgid.link/20260303145828.7845-4-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e38200e361cbe331806dc454c76c11c7cd95e1b9", "tree": "b25781d691a1763ac3a05fe116d910cb24f829f0", "parents": [ "35dfedce442c4060cfe5b98368bc9643fb995716" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Tue Mar 03 14:58:26 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:48:49 2026 -0800" }, "message": "net: stmmac: Improve double VLAN handling\n\nThe double VLAN bits (EDVLP, ESVL, DOVLTC) are handled inconsistently\nbetween the two vlan_update_hash() implementations:\n\n- dwxgmac2_update_vlan_hash() explicitly clears the double VLAN bits when\nis_double is false, meaning that adding a 802.1Q VLAN will disable\ndouble VLAN mode:\n\n $ ip link add link eth0 name eth0.200 type vlan id 200 protocol 802.1ad\n $ ip link add link eth0 name eth0.100 type vlan id 100\n # Double VLAN bits no longer set\n\n- vlan_update_hash() sets these bits and only clears them when the last\nVLAN has been removed, so double VLAN mode remains enabled even after all\n802.1AD VLANs are removed.\n\nAddress both issues by tracking the number of active 802.1AD VLANs in\npriv-\u003enum_double_vlans. Pass this count to stmmac_vlan_update() so both\nimplementations correctly set the double VLAN bits when any 802.1AD\nVLAN is active, and clear them only when none remain.\n\nAlso update vlan_update_hash() to explicitly clear the double VLAN bits\nwhen is_double is false, matching the dwxgmac2 behavior.\n\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nLink: https://patch.msgid.link/20260303145828.7845-3-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "35dfedce442c4060cfe5b98368bc9643fb995716", "tree": "4f39d0906c3c4e0fcc85016079cf63c0bc913d5c", "parents": [ "550921c67baa3669e108308b0d8cc9ee6471604b" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Tue Mar 03 14:58:25 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:48:48 2026 -0800" }, "message": "net: stmmac: Fix error handling in VLAN add and delete paths\n\nstmmac_vlan_rx_add_vid() updates active_vlans and the VLAN hash\nregister before writing the HW filter entry. If the filter write\nfails, it leaves a stale VID in active_vlans and the hash register.\n\nstmmac_vlan_rx_kill_vid() has the reverse problem: it clears\nactive_vlans before removing the HW filter. On failure, the VID is\ngone from active_vlans but still present in the HW filter table.\n\nTo fix this, reorder the operations to update the hash table first,\nthen attempt the HW filter operation. If the HW filter fails, roll\nback both the active_vlans bitmap and the hash table by calling\nstmmac_vlan_update() again.\n\nFixes: ed64639bc1e0 (\"net: stmmac: Add support for VLAN Rx filtering\")\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nLink: https://patch.msgid.link/20260303145828.7845-2-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "550921c67baa3669e108308b0d8cc9ee6471604b", "tree": "3ba50f13f4a85a1238374c4620c7972bbcb1aa05", "parents": [ "ff2c591625a6f187164aa256fec2356799ee87e5", "554a1c34c11a057d01819ce9bb04653a8ffc8071" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:35:35 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:35:35 2026 -0800" }, "message": "Merge branch \u0027100GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-03-03 (ice, libie, iavf, igb, igc)\n\nLarysa removes VF restriction for LLDP filters on ice to allow for LLDP\ntraffic to reach the correct destination.\n\nJakub adds retry mechanism for AdminQ Read/Write SFF EEPROM call to\nfollow hardware specification on ice.\n\nZilin Guan adds cleanup path to free XDP rings on failure in\nice_set_ringparam().\n\nMichal bypasses firmware logging unroll in libie when it isn\u0027t supported.\n\nKohei Enju fixes iavf to take into account hardware MTU support when\nsetting max MTU values.\n\nVivek Behera fixes issues on igb and igc using incorrect IRQs when Tx/Rx\nqueues do not share the same IRQ.\n\n* \u0027100GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n igc: Fix trigger of incorrect irq in igc_xsk_wakeup function\n igb: Fix trigger of incorrect irq in igb_xsk_wakeup\n iavf: fix netdev-\u003emax_mtu to respect actual hardware limit\n libie: don\u0027t unroll if fwlog isn\u0027t supported\n ice: Fix memory leak in ice_set_ringparam()\n ice: fix retry for AQ command 0x06EE\n ice: reintroduce retry mechanism for indirect AQ\n ice: fix adding AQ LLDP filter for VF\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260303231155.2895065-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ff2c591625a6f187164aa256fec2356799ee87e5", "tree": "f16b8822939196a306c67faa628bbba86d044130", "parents": [ "f43ed0c5450cd3a68313c9fd02b298fc58fd4b80", "1777f349ff41b62dfe27454b69c27b0bc99ffca5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:21:15 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:21:16 2026 -0800" }, "message": "Merge branch \u0027mptcp-misc-fixes-for-v7-0-rc2\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: misc fixes for v7.0-rc2\n\nHere are various unrelated fixes:\n\n- Patch 1: avoid bufferbloat in simult_flows selftest which can cause\n instabilities. A fix for v5.10.\n\n- Patches 2-3: reduce RM_ADDR lost by not sending it over the same\n subflow as the one being removed, if possible. A fix for v5.13.\n\n- Patches 4-5: avoid a WARN when using signal + subflow endpoints with a\n subflow limit of 0, and removing such endpoints during an active\n connection. A fix for v5.17.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-0-4b5462b6f016@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1777f349ff41b62dfe27454b69c27b0bc99ffca5", "tree": "f16b8822939196a306c67faa628bbba86d044130", "parents": [ "579a752464a64cb5f9139102f0e6b90a1f595ceb" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Mar 03 11:56:06 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:21:13 2026 -0800" }, "message": "selftests: mptcp: join: check removing signal+subflow endp\n\nThis validates the previous commit: endpoints with both the signal and\nsubflow flags should always be marked as used even if it was not\npossible to create new subflows due to the MPTCP PM limits.\n\nFor this test, an extra endpoint is created with both the signal and the\nsubflow flags, and limits are set not to create extra subflows. In this\ncase, an ADD_ADDR is sent, but no subflows are created. Still, the local\nendpoint is marked as used, and no warning is fired when removing the\nendpoint, after having sent a RM_ADDR.\n\nThe \u0027Fixes\u0027 tag here below is the same as the one from the previous\ncommit: this patch here is not fixing anything wrong in the selftests,\nbut it validates the previous fix for an issue introduced by this commit\nID.\n\nFixes: 85df533a787b (\"mptcp: pm: do not ignore \u0027subflow\u0027 if \u0027signal\u0027 flag is also set\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-5-4b5462b6f016@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "579a752464a64cb5f9139102f0e6b90a1f595ceb", "tree": "122745954cbea355fa4bdc5d07be970f7a9501a9", "parents": [ "560edd99b5f58b2d4bbe3c8e51e1eed68d887b0e" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Mar 03 11:56:05 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:21:13 2026 -0800" }, "message": "mptcp: pm: in-kernel: always mark signal+subflow endp as used\n\nSyzkaller managed to find a combination of actions that was generating\nthis warning:\n\n msk-\u003epm.local_addr_used \u003d\u003d 0\n WARNING: net/mptcp/pm_kernel.c:1071 at __mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline], CPU#1: syz.2.17/961\n WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline], CPU#1: syz.2.17/961\n WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210, CPU#1: syz.2.17/961\n Modules linked in:\n CPU: 1 UID: 0 PID: 961 Comm: syz.2.17 Not tainted 6.19.0-08368-gfafda3b4b06b #22 PREEMPT(full)\n Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.17.0-debian-1.17.0-1build1 04/01/2014\n RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline]\n RIP: 0010:mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline]\n RIP: 0010:mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210\n Code: 89 c5 e8 46 30 6f fe e9 21 fd ff ff 49 83 ed 80 e8 38 30 6f fe 4c 89 ef be 03 00 00 00 e8 db 49 df fe eb ac e8 24 30 6f fe 90 \u003c0f\u003e 0b 90 e9 1d ff ff ff e8 16 30 6f fe eb 05 e8 0f 30 6f fe e8 9a\n RSP: 0018:ffffc90001663880 EFLAGS: 00010293\n RAX: ffffffff82de1a6c RBX: 0000000000000000 RCX: ffff88800722b500\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffff8880158b22d0 R08: 0000000000010425 R09: ffffffffffffffff\n R10: ffffffff82de18ba R11: 0000000000000000 R12: ffff88800641a640\n R13: ffff8880158b1880 R14: ffff88801ec3c900 R15: ffff88800641a650\n FS: 00005555722c3500(0000) GS:ffff8880f909d000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f66346e0f60 CR3: 000000001607c000 CR4: 0000000000350ef0\n Call Trace:\n \u003cTASK\u003e\n genl_family_rcv_msg_doit+0x117/0x180 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x3a8/0x3f0 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x16d/0x240 net/netlink/af_netlink.c:2550\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x3e9/0x4c0 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x4aa/0x5b0 net/netlink/af_netlink.c:1894\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0xc9/0xf0 net/socket.c:742\n ____sys_sendmsg+0x272/0x3b0 net/socket.c:2592\n ___sys_sendmsg+0x2de/0x320 net/socket.c:2646\n __sys_sendmsg net/socket.c:2678 [inline]\n __do_sys_sendmsg net/socket.c:2683 [inline]\n __se_sys_sendmsg net/socket.c:2681 [inline]\n __x64_sys_sendmsg+0x110/0x1a0 net/socket.c:2681\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x143/0x440 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f66346f826d\n Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\n RSP: 002b:00007ffc83d8bdc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 00007f6634985fa0 RCX: 00007f66346f826d\n RDX: 00000000040000b0 RSI: 0000200000000740 RDI: 0000000000000007\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6634985fa8\n R13: 00007f6634985fac R14: 0000000000000000 R15: 0000000000001770\n \u003c/TASK\u003e\n\nThe actions that caused that seem to be:\n\n - Set the MPTCP subflows limit to 0\n - Create an MPTCP endpoint with both the \u0027signal\u0027 and \u0027subflow\u0027 flags\n - Create a new MPTCP connection from a different address: an ADD_ADDR\n linked to the MPTCP endpoint will be sent (\u0027signal\u0027 flag), but no\n subflows is initiated (\u0027subflow\u0027 flag)\n - Remove the MPTCP endpoint\n\nIn this case, msk-\u003epm.local_addr_used has been kept to 0 -- because no\nsubflows have been created -- but the corresponding bit in\nmsk-\u003epm.id_avail_bitmap has been cleared when the ADD_ADDR has been\nsent. This later causes a splat when removing the MPTCP endpoint because\nmsk-\u003epm.local_addr_used has been kept to 0.\n\nNow, if an endpoint has both the signal and subflow flags, but it is not\npossible to create subflows because of the limits or the c-flag case,\nthen the local endpoint counter is still incremented: the endpoint is\nused at the end. This avoids issues later when removing the endpoint and\ncalling __mark_subflow_endp_available(), which expects\nmsk-\u003epm.local_addr_used to have been previously incremented if the\nendpoint was marked as used according to msk-\u003epm.id_avail_bitmap.\n\nNote that signal_and_subflow variable is reset to false when the limits\nand the c-flag case allows subflows creation. Also, local_addr_used is\nonly incremented for non ID0 subflows.\n\nFixes: 85df533a787b (\"mptcp: pm: do not ignore \u0027subflow\u0027 if \u0027signal\u0027 flag is also set\")\nCc: stable@vger.kernel.org\nCloses: https://github.com/multipath-tcp/mptcp_net-next/issues/613\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-4-4b5462b6f016@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "560edd99b5f58b2d4bbe3c8e51e1eed68d887b0e", "tree": "e6a1501b60bf68aaa3ebac80cdefc10b2c7b7e16", "parents": [ "fb8d0bccb221080630efcd9660c9f9349e53cc9e" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Mar 03 11:56:04 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:21:12 2026 -0800" }, "message": "selftests: mptcp: join: check RM_ADDR not sent over same subflow\n\nThis validates the previous commit: RM_ADDR were sent over the first\nfound active subflow which could be the same as the one being removed.\nIt is more likely to loose this notification.\n\nFor this check, RM_ADDR are explicitly dropped when trying to send them\nover the initial subflow, when removing the endpoint attached to it. If\nit is dropped, the test will complain because some RM_ADDR have not been\nreceived.\n\nNote that only the RM_ADDR are dropped, to allow the linked subflow to\nbe quickly and cleanly closed. To only drop those RM_ADDR, a cBPF byte\ncode is used. If the IPTables commands fail, that\u0027s OK, the tests will\ncontinue to pass, but not validate this part. This can be ignored:\nanother subtest fully depends on such command, and will be marked as\nskipped.\n\nThe \u0027Fixes\u0027 tag here below is the same as the one from the previous\ncommit: this patch here is not fixing anything wrong in the selftests,\nbut it validates the previous fix for an issue introduced by this commit\nID.\n\nFixes: 8dd5efb1f91b (\"mptcp: send ack for rm_addr\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-3-4b5462b6f016@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fb8d0bccb221080630efcd9660c9f9349e53cc9e", "tree": "91c279a402616695fe7ab51b744eb28d59fef245", "parents": [ "8c09412e584d9bcc0e71d758ec1008d1c8d1a326" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Mar 03 11:56:03 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:21:12 2026 -0800" }, "message": "mptcp: pm: avoid sending RM_ADDR over same subflow\n\nRM_ADDR are sent over an active subflow, the first one in the subflows\nlist. There is then a high chance the initial subflow is picked. With\nthe in-kernel PM, when an endpoint is removed, a RM_ADDR is sent, then\nlinked subflows are closed. This is done for each active MPTCP\nconnection.\n\nMPTCP endpoints are likely removed because the attached network is no\nlonger available or usable. In this case, it is better to avoid sending\nthis RM_ADDR over the subflow that is going to be removed, but prefer\nsending it over another active and non stale subflow, if any.\n\nThis modification avoids situations where the other end is not notified\nwhen a subflow is no longer usable: typically when the endpoint linked\nto the initial subflow is removed, especially on the server side.\n\nFixes: 8dd5efb1f91b (\"mptcp: send ack for rm_addr\")\nCc: stable@vger.kernel.org\nReported-by: Frank Lorenz \u003clorenz-frank@web.de\u003e\nCloses: https://github.com/multipath-tcp/mptcp_net-next/issues/612\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-2-4b5462b6f016@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8c09412e584d9bcc0e71d758ec1008d1c8d1a326", "tree": "ec138f5faf65fd32a90b1e9db8479cf6691560fe", "parents": [ "f43ed0c5450cd3a68313c9fd02b298fc58fd4b80" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 03 11:56:02 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:21:12 2026 -0800" }, "message": "selftests: mptcp: more stable simult_flows tests\n\nBy default, the netem qdisc can keep up to 1000 packets under its belly\nto deal with the configured rate and delay. The simult flows test-case\nsimulates very low speed links, to avoid problems due to slow CPUs and\nthe TCP stack tend to transmit at a slightly higher rate than the\n(virtual) link constraints.\n\nAll the above causes a relatively large amount of packets being enqueued\nin the netem qdiscs - the longer the transfer, the longer the queue -\nproducing increasingly high TCP RTT samples and consequently increasingly\nlarger receive buffer size due to DRS.\n\nWhen the receive buffer size becomes considerably larger than the needed\nsize, the tests results can flake, i.e. because minimal inaccuracy in the\npacing rate can lead to a single subflow usage towards the end of the\nconnection for a considerable amount of data.\n\nAddress the issue explicitly setting netem limits suitable for the\nconfigured link speeds and unflake all the affected tests.\n\nFixes: 1a418cb8e888 (\"mptcp: simult flow self-tests\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-1-4b5462b6f016@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f43ed0c5450cd3a68313c9fd02b298fc58fd4b80", "tree": "fc124196aee5c0e9c1f3357273ff02aef16d9124", "parents": [ "40bf00ec2ee271df5ba67593991760adf8b5d0ed", "d793458c45df2aed498d7f74145eab7ee22d25aa" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:15:51 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:18:58 2026 -0800" }, "message": "Merge branch \u0027nfc-fix-leaks-and-races-surfaced-by-nipa\u0027\n\nJakub Kicinski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnfc: fix leaks and races surfaced by NIPA\n\nI recently added the nci test to NIPA. Somewhat surprisingly it runs\nwithout much settup but hits kmemleaks fairly often. Fix a handful of\nissues to make the test pass in a stable way.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260303162346.2071888-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d793458c45df2aed498d7f74145eab7ee22d25aa", "tree": "fc124196aee5c0e9c1f3357273ff02aef16d9124", "parents": [ "0efdc02f4f6d52f8ca5d5889560f325a836ce0a8" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 08:23:45 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:18:57 2026 -0800" }, "message": "nfc: rawsock: cancel tx_work before socket teardown\n\nIn rawsock_release(), cancel any pending tx_work and purge the write\nqueue before orphaning the socket. rawsock_tx_work runs on the system\nworkqueue and calls nfc_data_exchange which dereferences the NCI\ndevice. Without synchronization, tx_work can race with socket and\ndevice teardown when a process is killed (e.g. by SIGKILL), leading\nto use-after-free or leaked references.\n\nSet SEND_SHUTDOWN first so that if tx_work is already running it will\nsee the flag and skip transmitting, then use cancel_work_sync to wait\nfor any in-progress execution to finish, and finally purge any\nremaining queued skbs.\n\nFixes: 23b7869c0fd0 (\"NFC: add the NFC socket raw protocol\")\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260303162346.2071888-6-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0efdc02f4f6d52f8ca5d5889560f325a836ce0a8", "tree": "9916c27cdd5d1e5d7ef81631b41e4c482565fcdd", "parents": [ "66083581945bd5b8e99fe49b5aeb83d03f62d053" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 08:23:44 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:18:57 2026 -0800" }, "message": "nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback\n\nMove clear_bit(NCI_DATA_EXCHANGE) before invoking the data exchange\ncallback in nci_data_exchange_complete().\n\nThe callback (e.g. rawsock_data_exchange_complete) may immediately\nschedule another data exchange via schedule_work(tx_work). On a\nmulti-CPU system, tx_work can run and reach nci_transceive() before\nthe current nci_data_exchange_complete() clears the flag, causing\ntest_and_set_bit(NCI_DATA_EXCHANGE) to return -EBUSY and the new\ntransfer to fail.\n\nThis causes intermittent flakes in nci/nci_dev in NIPA:\n\n # # RUN NCI.NCI1_0.t4t_tag_read ...\n # # t4t_tag_read: Test terminated by timeout\n # # FAIL NCI.NCI1_0.t4t_tag_read\n # not ok 3 NCI.NCI1_0.t4t_tag_read\n\nFixes: 38f04c6b1b68 (\"NFC: protect nci_data_exchange transactions\")\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260303162346.2071888-5-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "66083581945bd5b8e99fe49b5aeb83d03f62d053", "tree": "13e3add511cdf6161741092806511f7ff6965540", "parents": [ "d42449d2c17cdf06d1f63268557450bd3f051e9a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 08:23:43 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:18:57 2026 -0800" }, "message": "nfc: nci: complete pending data exchange on device close\n\nIn nci_close_device(), complete any pending data exchange before\nclosing. The data exchange callback (e.g.\nrawsock_data_exchange_complete) holds a socket reference.\n\nNIPA occasionally hits this leak:\n\nunreferenced object 0xff1100000f435000 (size 2048):\n comm \"nci_dev\", pid 3954, jiffies 4295441245\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 \u0027..@............\n backtrace (crc ec2b3c5):\n __kmalloc_noprof+0x4db/0x730\n sk_prot_alloc.isra.0+0xe4/0x1d0\n sk_alloc+0x36/0x760\n rawsock_create+0xd1/0x540\n nfc_sock_create+0x11f/0x280\n __sock_create+0x22d/0x630\n __sys_socket+0x115/0x1d0\n __x64_sys_socket+0x72/0xd0\n do_syscall_64+0x117/0xfc0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nFixes: 38f04c6b1b68 (\"NFC: protect nci_data_exchange transactions\")\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260303162346.2071888-4-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d42449d2c17cdf06d1f63268557450bd3f051e9a", "tree": "e546f1d1b36f12a584d5ddf8af24905a2034b371", "parents": [ "7bd4b0c4779f978a6528c9b7937d2ca18e936e2c" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 08:23:42 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:16:10 2026 -0800" }, "message": "nfc: digital: free skb on digital_in_send error paths\n\ndigital_in_send() takes ownership of the skb passed by the caller\n(nfc_data_exchange), make sure it\u0027s freed on all error paths.\n\nFound looking around the real driver for similar bugs to the one\njust fixed in nci.\n\nFixes: 2c66daecc409 (\"NFC Digital: Add NFC-A technology support\")\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260303162346.2071888-3-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7bd4b0c4779f978a6528c9b7937d2ca18e936e2c", "tree": "0d3d07acbbe460f2358b3232bcc76ed1f64a4f65", "parents": [ "40bf00ec2ee271df5ba67593991760adf8b5d0ed" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 08:23:41 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 18:14:29 2026 -0800" }, "message": "nfc: nci: free skb on nci_transceive early error paths\n\nnci_transceive() takes ownership of the skb passed by the caller,\nbut the -EPROTO, -EINVAL, and -EBUSY error paths return without\nfreeing it.\n\nDue to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes\nthe nci/nci_dev selftest hits the error path occasionally in NIPA,\nand kmemleak detects leaks:\n\nunreferenced object 0xff11000015ce6a40 (size 640):\n comm \"nci_dev\", pid 3954, jiffies 4295441246\n hex dump (first 32 bytes):\n 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk\n 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk\n backtrace (crc 7c40cc2a):\n kmem_cache_alloc_node_noprof+0x492/0x630\n __alloc_skb+0x11e/0x5f0\n alloc_skb_with_frags+0xc6/0x8f0\n sock_alloc_send_pskb+0x326/0x3f0\n nfc_alloc_send_skb+0x94/0x1d0\n rawsock_sendmsg+0x162/0x4c0\n do_syscall_64+0x117/0xfc0\n\nFixes: 6a2968aaf50c (\"NFC: basic NCI protocol implementation\")\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260303162346.2071888-2-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "40bf00ec2ee271df5ba67593991760adf8b5d0ed", "tree": "5763550848ee64fcc49883936dbb88d382c9b4f2", "parents": [ "a4c2b8be2e5329e7fac6e8f64ddcb8958155cfcb" ], "author": { "name": "Bobby Eshleman", "email": "bobbyeshleman@meta.com", "time": "Mon Mar 02 16:32:56 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 17:59:27 2026 -0800" }, "message": "net: devmem: use READ_ONCE/WRITE_ONCE on binding-\u003edev\n\nbinding-\u003edev is protected on the write-side in\nmp_dmabuf_devmem_uninstall() against concurrent writes, but due to the\nconcurrent bare reads in net_devmem_get_binding() and\nvalidate_xmit_unreadable_skb() it should be wrapped in a\nREAD_ONCE/WRITE_ONCE pair to make sure no compiler optimizations play\nwith the underlying register in unforeseen ways.\n\nDoesn\u0027t present a critical bug because the known compiler optimizations\ndon\u0027t result in bad behavior. There is no tearing on u64, and load\nomissions/invented loads would only break if additional binding-\u003edev\nreferences were inlined together (they aren\u0027t right now).\n\nThis just more strictly follows the linux memory model (i.e.,\n\"Lock-Protected Writes With Lockless Reads\" in\ntools/memory-model/Documentation/access-marking.txt).\n\nFixes: bd61848900bf (\"net: devmem: Implement TX path\")\nSigned-off-by: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nLink: https://patch.msgid.link/20260302-devmem-membar-fix-v2-1-5b33c9cbc28b@meta.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a4c2b8be2e5329e7fac6e8f64ddcb8958155cfcb", "tree": "9493c38f57bd0528ce1bce63429d4de25d09c44d", "parents": [ "f7d92f11bd33a6eb49c7c812255ef4ab13681f0f" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Mar 04 01:56:40 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 17:54:22 2026 -0800" }, "message": "net_sched: sch_fq: clear q-\u003eband_pkt_count[] in fq_reset()\n\nWhen/if a NIC resets, queues are deactivated by dev_deactivate_many(),\nthen reactivated when the reset operation completes.\n\nfq_reset() removes all the skbs from various queues.\n\nIf we do not clear q-\u003eband_pkt_count[], these counters keep growing\nand can eventually reach sch-\u003elimit, preventing new packets to be queued.\n\nMany thanks to Praveen for discovering the root cause.\n\nFixes: 29f834aa326e (\"net_sched: sch_fq: add 3 bands and WRR scheduling\")\nDiagnosed-by: Praveen Kaligineedi \u003cpkaligineedi@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Neal Cardwell \u003cncardwell@google.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260304015640.961780-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f7d92f11bd33a6eb49c7c812255ef4ab13681f0f", "tree": "9037ffa835b759071372893133cb52d56a087b3e", "parents": [ "165573e41f2f66ef98940cf65f838b2cb575d9d1" ], "author": { "name": "Ian Ray", "email": "ian.ray@gehealthcare.com", "time": "Mon Mar 02 18:32:37 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 17:48:12 2026 -0800" }, "message": "net: nfc: nci: Fix zero-length proprietary notifications\n\nNCI NFC controllers may have proprietary OIDs with zero-length payload.\nOne example is: drivers/nfc/nxp-nci/core.c, NXP_NCI_RF_TXLDO_ERROR_NTF.\n\nAllow a zero length payload in proprietary notifications *only*.\n\nBefore:\n\n-- \u003e8 --\nkernel: nci: nci_recv_frame: len 3\n-- \u003e8 --\n\nAfter:\n\n-- \u003e8 --\nkernel: nci: nci_recv_frame: len 3\nkernel: nci: nci_ntf_packet: NCI RX: MT\u003dntf, PBF\u003d0, GID\u003d0x1, OID\u003d0x23, plen\u003d0\nkernel: nci: nci_ntf_packet: unknown ntf opcode 0x123\nkernel: nfc nfc0: NFC: RF transmitter couldn\u0027t start. Bad power and/or configuration?\n-- \u003e8 --\n\nAfter fixing the hardware:\n\n-- \u003e8 --\nkernel: nci: nci_recv_frame: len 27\nkernel: nci: nci_ntf_packet: NCI RX: MT\u003dntf, PBF\u003d0, GID\u003d0x1, OID\u003d0x5, plen\u003d24\nkernel: nci: nci_rf_intf_activated_ntf_packet: rf_discovery_id 1\n-- \u003e8 --\n\nFixes: d24b03535e5e (\"nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\")\nSigned-off-by: Ian Ray \u003cian.ray@gehealthcare.com\u003e\nLink: https://patch.msgid.link/20260302163238.140576-1-ian.ray@gehealthcare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "165573e41f2f66ef98940cf65f838b2cb575d9d1", "tree": "74427cfae505c0669a61173dd43b6f971f4f7786", "parents": [ "7f083faf59d14c04e01ec05a7507f036c965acf8" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Mar 02 20:55:27 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 17:44:35 2026 -0800" }, "message": "tcp: secure_seq: add back ports to TS offset\n\nThis reverts 28ee1b746f49 (\"secure_seq: downgrade to per-host timestamp offsets\")\n\ntcp_tw_recycle went away in 2017.\n\nZhouyan Deng reported off-path TCP source port leakage via\nSYN cookie side-channel that can be fixed in multiple ways.\n\nOne of them is to bring back TCP ports in TS offset randomization.\n\nAs a bonus, we perform a single siphash() computation\nto provide both an ISN and a TS offset.\n\nFixes: 28ee1b746f49 (\"secure_seq: downgrade to per-host timestamp offsets\")\nReported-by: Zhouyan Deng \u003cdengzhouyan_nwpu@163.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nAcked-by: Florian Westphal \u003cfw@strlen.de\u003e\nLink: https://patch.msgid.link/20260302205527.1982836-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7f083faf59d14c04e01ec05a7507f036c965acf8", "tree": "48acb23bc7a487086c3ebd32057d8edb86c20d87", "parents": [ "c649e99764f6baeddb65e9b88a24df082636a8f4" ], "author": { "name": "Koichiro Den", "email": "den@valinux.co.jp", "time": "Sat Feb 28 23:53:07 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 17:43:45 2026 -0800" }, "message": "net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs\n\nWhen shrinking the number of real tx queues,\nnetif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush\nqdiscs for queues which will no longer be used.\n\nqdisc_reset_all_tx_gt() currently serializes qdisc_reset() with\nqdisc_lock(). However, for lockless qdiscs, the dequeue path is\nserialized by qdisc_run_begin/end() using qdisc-\u003eseqlock instead, so\nqdisc_reset() can run concurrently with __qdisc_run() and free skbs\nwhile they are still being dequeued, leading to UAF.\n\nThis can easily be reproduced on e.g. virtio-net by imposing heavy\ntraffic while frequently changing the number of queue pairs:\n\n iperf3 -ub0 -c $peer -t 0 \u0026\n while :; do\n ethtool -L eth0 combined 1\n ethtool -L eth0 combined 2\n done\n\nWith KASAN enabled, this leads to reports like:\n\n BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760\n ...\n Call Trace:\n \u003cTASK\u003e\n ...\n __qdisc_run+0x133f/0x1760\n __dev_queue_xmit+0x248f/0x3550\n ip_finish_output2+0xa42/0x2110\n ip_output+0x1a7/0x410\n ip_send_skb+0x2e6/0x480\n udp_send_skb+0xb0a/0x1590\n udp_sendmsg+0x13c9/0x1fc0\n ...\n \u003c/TASK\u003e\n\n Allocated by task 1270 on cpu 5 at 44.558414s:\n ...\n alloc_skb_with_frags+0x84/0x7c0\n sock_alloc_send_pskb+0x69a/0x830\n __ip_append_data+0x1b86/0x48c0\n ip_make_skb+0x1e8/0x2b0\n udp_sendmsg+0x13a6/0x1fc0\n ...\n\n Freed by task 1306 on cpu 3 at 44.558445s:\n ...\n kmem_cache_free+0x117/0x5e0\n pfifo_fast_reset+0x14d/0x580\n qdisc_reset+0x9e/0x5f0\n netif_set_real_num_tx_queues+0x303/0x840\n virtnet_set_channels+0x1bf/0x260 [virtio_net]\n ethnl_set_channels+0x684/0xae0\n ethnl_default_set_doit+0x31a/0x890\n ...\n\nSerialize qdisc_reset_all_tx_gt() against the lockless dequeue path by\ntaking qdisc-\u003eseqlock for TCQ_F_NOLOCK qdiscs, matching the\nserialization model already used by dev_reset_queue().\n\nAdditionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state\nreflects an empty queue, avoiding needless re-scheduling.\n\nFixes: 6b3ba9146fe6 (\"net: sched: allow qdiscs to handle locking\")\nSigned-off-by: Koichiro Den \u003cden@valinux.co.jp\u003e\nLink: https://patch.msgid.link/20260228145307.3955532-1-den@valinux.co.jp\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c649e99764f6baeddb65e9b88a24df082636a8f4", "tree": "a69a2aacd4741658aae3a54148e6a74bae5fd702", "parents": [ "18b43bec5437914e3b51bb08dc6c6e7b0a2df4d1", "7e1e6d6845329adb2da75110a061557e9c26d9b7" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 16:47:45 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 16:47:46 2026 -0800" }, "message": "Merge tag \u0027linux-can-fixes-for-7.0-20260302\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can\n\nMarc Kleine-Budde says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: can 2026-03-02\n\nThe first 2 patches are by Oliver Hartkopp. The first fixes the\nlocking for CAN Broadcast Manager op runtime updates, the second fixes\nthe packet statisctics for the CAN dummy driver.\n\nAlban Bedel\u0027s patch fixes a potential problem in the error path of the\nmcp251x\u0027s ndo_open callback.\n\nA patch by Ziyi Guo add USB endpoint type validation to the esd_usb\ndriver.\n\nThe next 6 patches are by Greg Kroah-Hartman and fix URB data parsing\nfor the ems_usb and ucan driver, fix URB anchoring in the etas_es58x,\nand in the f81604 driver fix URB data parsing, add URB error handling\nand fix URB anchoring.\n\nA patch by me targets the gs_usb driver and fixes interoperability\nwith the CANable-2.5 firmware by always configuring the bit rate\nbefore starting the device.\n\nThe last patch is by Frank Li and fixes a CHECK_DTBS warning for the\nnxp,sja1000 dt-binding.\n\n* tag \u0027linux-can-fixes-for-7.0-20260302\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:\n dt-bindings: net: can: nxp,sja1000: add reference to mc-peripheral-props.yaml\n can: gs_usb: gs_can_open(): always configure bitrates before starting device\n can: usb: f81604: correctly anchor the urb in the read bulk callback\n can: usb: f81604: handle bulk write errors properly\n can: usb: f81604: handle short interrupt urb messages properly\n can: usb: etas_es58x: correctly anchor the urb in the read bulk callback\n can: ucan: Fix infinite loop from zero-length messages\n can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message\n can: esd_usb: add endpoint type validation\n can: mcp251x: fix deadlock in error path of mcp251x_open\n can: dummy_can: dummy_can_init(): fix packet statistics\n can: bcm: fix locking for bcm_op runtime updates\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260302152755.1700177-1-mkl@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "18b43bec5437914e3b51bb08dc6c6e7b0a2df4d1", "tree": "03af4c282374d816d168cd39b377b5085a468654", "parents": [ "2697c45a481a299faa575a55cf1ff41826024e4f" ], "author": { "name": "Jason Xing", "email": "kernelxing@tencent.com", "time": "Tue Mar 03 11:37:20 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 16:42:53 2026 -0800" }, "message": "mailmap: reflect my gmail as default\n\nUse my gmail instead so that I can easily handle those emails\nthat CC me.\n\nSigned-off-by: Jason Xing \u003ckernelxing@tencent.com\u003e\nLink: https://patch.msgid.link/20260303033720.84108-1-kerneljasonxing@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c107785c7e8dbabd1c18301a1c362544b5786282", "tree": "f74fea067c9d069ee67919fc4fe4eb182d958c67", "parents": [ "0b3bb205808195159be633a8cefb602670e856fb", "f9d69d5e7bde2295eb7488a56f094ac8f5383b92" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 04 15:42:24 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 04 15:42:24 2026 -0800" }, "message": "Merge tag \u0027modules-7.0-rc3.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux\n\nPull module fixes from Sami Tolvanen:\n\n - Fix a potential kernel panic in the module loader by adding a bounds\n check for the ELF section index. This prevents crashes if attempting\n to load a module that uses SHN_XINDEX or is corrupted.\n\n - Fix the Kconfig menu layout for module versioning, signing, and\n compression options so they correctly appear as submenus in\n menuconfig.\n\n - Remove a redundant lockdep_free_key_range() call in the load_module()\n error path. This is already handled by module_deallocate() calling\n free_mod_mem() since the module_memory rework.\n\n* tag \u0027modules-7.0-rc3.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux:\n module: Fix kernel panic when a symbol st_shndx is out of bounds\n module: Fix the modversions and signing submenus\n module: Remove duplicate freeing of lockdep classes\n" }, { "commit": "2697c45a481a299faa575a55cf1ff41826024e4f", "tree": "a0c0174fa87380043ea25b0c6e4ce1960c26201a", "parents": [ "126fe7ef12ffe42fdc600fe22df733e96fa418ec", "4e10a730d1b511ff49723371ed6d694dd1b2c785" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 15:29:56 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 15:29:56 2026 -0800" }, "message": "Merge tag \u0027wireless-2026-03-04\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nSome more fixes:\n - mt76 gets three almost identical new length checks\n - cw1200 \u0026 ti: locking fixes\n - mac80211 has a fix for the recent EML frame handling\n - rsi driver no longer oddly responds to config, which\n had triggered a warning in mac80211\n - ath12k has two fixes for station statistics handling\n\n* tag \u0027wireless-2026-03-04\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:\n wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()\n wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()\n wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()\n wifi: wlcore: Fix a locking bug\n wifi: cw1200: Fix locking in error paths\n wifi: mac80211: fix missing ieee80211_eml_params member initialization\n wifi: rsi: Don\u0027t default to -EOPNOTSUPP in rsi_mac80211_config\n wifi: ath12k: fix station lookup failure when disconnecting from AP\n wifi: ath12k: use correct pdev id when requesting firmware stats\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260304112500.169639-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0b3bb205808195159be633a8cefb602670e856fb", "tree": "abab1f7bc9fec3f1ad29abf04a8fcaf026f54e42", "parents": [ "ecc64d2dc9ff9738d2a896beb68e02c2feaf9a02", "d320f160aa5ff36cdf83c645cca52b615e866e32" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 04 15:03:16 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 04 15:03:16 2026 -0800" }, "message": "Merge tag \u0027vfs-7.0-rc3.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - kthread: consolidate kthread exit paths to prevent use-after-free\n\n - iomap:\n - don\u0027t mark folio uptodate if read IO has bytes pending\n - don\u0027t report direct-io retries to fserror\n - reject delalloc mappings during writeback\n\n - ns: tighten visibility checks\n\n - netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict\n sequence\n\n* tag \u0027vfs-7.0-rc3.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n iomap: reject delalloc mappings during writeback\n iomap: don\u0027t mark folio uptodate if read IO has bytes pending\n selftests: fix mntns iteration selftests\n nstree: tighten permission checks for listing\n nsfs: tighten permission checks for handle opening\n nsfs: tighten permission checks for ns iteration ioctls\n netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence\n kthread: consolidate kthread exit paths to prevent use-after-free\n iomap: don\u0027t report direct-io retries to fserror\n" }, { "commit": "126fe7ef12ffe42fdc600fe22df733e96fa418ec", "tree": "7a022795491916a28c69dfa19ef77d859941e872", "parents": [ "fbdfa8da05b6ae44114fc4f9b3e83e1736fd411c" ], "author": { "name": "Joe Damato", "email": "joe@dama.to", "time": "Mon Mar 02 18:42:01 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 04 14:09:45 2026 -0800" }, "message": "mailmap: Add entry for Joe Damato\n\nMy Fastly email address is no longer used. Add a mailmap entry to\nreflect that.\n\nSigned-off-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260303024202.2526604-1-joe@dama.to\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ecc64d2dc9ff9738d2a896beb68e02c2feaf9a02", "tree": "edf3417fef8cd063027280ffabfd3ab6366d1597", "parents": [ "4053c47680da0a03a8df66735904d5b92db6a144", "6932256d3a3764f3a5e06e2cb8603be45b6a9fef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 04 08:21:11 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 04 08:21:11 2026 -0800" }, "message": "Merge tag \u0027sysctl-7.00-fixes-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl\n\nPull sysctl fix from Joel Granados:\n\n - Fix error when reporting jiffies converted values back to user space\n\n Return the converted value instead of \"Invalid argument\" error\n\n* tag \u0027sysctl-7.00-fixes-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:\n time/jiffies: Fix sysctl file error on configurations where USER_HZ \u003c HZ\n" }, { "commit": "4053c47680da0a03a8df66735904d5b92db6a144", "tree": "d1418b7af38e014d577300b601a19e0af1ebb6bc", "parents": [ "40d3f622477ccd99118498df5283941bf546dd9c", "24d87712727a5017ad142d63940589a36cd25647" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 04 08:12:06 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 04 08:12:06 2026 -0800" }, "message": "Merge tag \u0027media/v7.0-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fix from Mauro Carvalho Chehab:\n \"Fix for MPEG-TS decoder in dvb-net\"\n\n* tag \u0027media/v7.0-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n media: dvb-net: fix OOB access in ULE extension header tables\n" }, { "commit": "40d3f622477ccd99118498df5283941bf546dd9c", "tree": "937293beed073854b5377a5c2e27fc3e455664a6", "parents": [ "0031c06807cfa8aa51a759ff8aa09e1aa48149af", "b6c3af46c26f2d07c10a1452adc34b821719327e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 04 08:03:43 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 04 08:03:43 2026 -0800" }, "message": "Merge tag \u0027pinctrl-v7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n \"All of these are driver fixes except a memory leak in the\n pinconf_generic_parse_dt_config() helper which is the most\n important fix.\n\n - Rename and fix up the Intel Equilibrium immutable interrupt chip\n\n - Handle the Qualcomm QCS615 dual edge GPIO IRQ by adding the right\n flag\n\n - Fix a memory leak in the widely used pinconf_generic_parse_dt_config()\n and a more local leak in aml_dt_node_to_map_pinmux()\n\n - Fix double put in the Cirrus cs42l43_pin_probe()\n\n - Staticize amdisp_pinctrl_ops, Qualcomm SDM660 groups and functions\n\n - Unexport CIX sky1_pinctrl_pm_ops\n\n - Fix configuration of deferred pin in the Rockchip driver\n\n - Implement .get_direction() in the Sunxi driver squelching a dmesg\n warning message\n\n - Fix a readout of the last bank of registers in the Cypress CY8C95x0\n driver\"\n\n* tag \u0027pinctrl-v7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl: cy8c95x0: Don\u0027t miss reading the last bank registers\n pinctrl: sunxi: Implement gpiochip::get_direction()\n pinctrl: rockchip: Fix configuring a deferred pin\n pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()\n pinctrl: meson: amlogic-a4: Fix device node reference leak in aml_dt_node_to_map_pinmux()\n pinctrl: qcom: sdm660-lpass-lpi: Make groups and functions variables static\n pinctrl: cix: sky1: Unexport sky1_pinctrl_pm_ops\n pinctrl: amdisp: Make amdisp_pinctrl_ops variable static\n pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()\n pinctrl: qcom: qcs615: Add missing dual edge GPIO IRQ errata flag\n pinctrl: equilibrium: fix warning trace on load\n pinctrl: equilibrium: rename irq_chip function callbacks\n" }, { "commit": "d320f160aa5ff36cdf83c645cca52b615e866e32", "tree": "0a50709fc621feff167b736d86a5f7cb9d5f19d5", "parents": [ "d3ccc4d86dfe2d7321276bb1a97ab0afcbfd7200" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Mon Mar 02 09:30:02 2026 -0800" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Wed Mar 04 14:31:56 2026 +0100" }, "message": "iomap: reject delalloc mappings during writeback\n\nFilesystems should never provide a delayed allocation mapping to\nwriteback; they\u0027re supposed to allocate the space before replying.\nThis can lead to weird IO errors and crashes in the block layer if the\nfilesystem is being malicious, or if it hadn\u0027t set iomap-\u003edev because\nit\u0027s a delalloc mapping.\n\nFix this by failing writeback on delalloc mappings. Currently no\nfilesystems actually misbehave in this manner, but we ought to be\nstricter about things like that.\n\nCc: stable@vger.kernel.org # v5.5\nFixes: 598ecfbaa742ac (\"iomap: lift the xfs writeback code to iomap\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nLink: https://patch.msgid.link/20260302173002.GL13829@frogsfrogsfrogs\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "d3ccc4d86dfe2d7321276bb1a97ab0afcbfd7200", "tree": "1ff9744bb6f965c2c1cecabbd224732de0c52c21", "parents": [ "10047142d6ce3b8562546c61f3cf57f852b9b950", "debc1a492b2695d05973994fb0f796dbd9ceaae6" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Wed Mar 04 14:19:05 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Wed Mar 04 14:19:05 2026 +0100" }, "message": "Merge patch \"iomap: don\u0027t mark folio uptodate if read IO has bytes pending\"\n\nJoanne Koong \u003cjoannelkoong@gmail.com\u003e says:\n\nThis is a fix for this scenario:\n\n-\u003eread_folio() gets called on a folio size that is 16k while the file is 4k:\n a) ifs-\u003eread_bytes_pending gets initialized to 16k\n b) -\u003eread_folio_range() is called for the 4k read\n c) the 4k read succeeds, ifs-\u003eread_bytes_pending is now 12k and the\n0 to 4k range is marked uptodate\n d) the post-eof blocks are zeroed and marked uptodate in the call to\niomap_set_range_uptodate()\n e) iomap_set_range_uptodate() sees all the ranges are marked\nuptodate and it marks the folio uptodate\n f) iomap_read_end() gets called to subtract the 12k from\nifs-\u003eread_bytes_pending. it too sees all the ranges are marked\nuptodate and marks the folio uptodate using XOR\n g) the XOR call clears the uptodate flag on the folio\n\nThe same situation can occur if the last range read for the folio is done as\nan inline read and all the previous ranges have already completed by the time\nthe inline read completes.\n\nFor more context, the full discussion can be found in [1]. There was a\ndiscussion about alternative approaches in that thread, but they had more\ncomplications.\n\nThere is another discussion in v1 [2] about consolidating the read paths.\nUntil that is resolved, this patch fixes the issue.\n\n[1] https://lore.kernel.org/linux-fsdevel/CAJnrk1Z9za5w4FoJqTGx50zR2haHHaoot1KJViQyEHJQq4\u003d34w@mail.gmail.com/#t\n[2] https://lore.kernel.org/linux-fsdevel/20260219003911.344478-1-joannelkoong@gmail.com/T/#u\n\n* patches from https://patch.msgid.link/20260303233420.874231-1-joannelkoong@gmail.com:\n iomap: don\u0027t mark folio uptodate if read IO has bytes pending\n\nLink: https://patch.msgid.link/20260303233420.874231-1-joannelkoong@gmail.com\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "debc1a492b2695d05973994fb0f796dbd9ceaae6", "tree": "1ff9744bb6f965c2c1cecabbd224732de0c52c21", "parents": [ "10047142d6ce3b8562546c61f3cf57f852b9b950" ], "author": { "name": "Joanne Koong", "email": "joannelkoong@gmail.com", "time": "Tue Mar 03 15:34:20 2026 -0800" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Wed Mar 04 14:18:54 2026 +0100" }, "message": "iomap: don\u0027t mark folio uptodate if read IO has bytes pending\n\nIf a folio has ifs metadata attached to it and the folio is partially\nread in through an async IO helper with the rest of it then being read\nin through post-EOF zeroing or as inline data, and the helper\nsuccessfully finishes the read first, then post-EOF zeroing / reading\ninline will mark the folio as uptodate in iomap_set_range_uptodate().\n\nThis is a problem because when the read completion path later calls\niomap_read_end(), it will call folio_end_read(), which sets the uptodate\nbit using XOR semantics. Calling folio_end_read() on a folio that was\nalready marked uptodate clears the uptodate bit.\n\nFix this by not marking the folio as uptodate if the read IO has bytes\npending. The folio uptodate state will be set in the read completion\npath through iomap_end_read() -\u003e folio_end_read().\n\nReported-by: Wei Gao \u003cwegao@suse.com\u003e\nSuggested-by: Sasha Levin \u003csashal@kernel.org\u003e\nTested-by: Wei Gao \u003cwegao@suse.com\u003e\nReviewed-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nCc: stable@vger.kernel.org # v6.19\nLink: https://lore.kernel.org/linux-fsdevel/aYbmy8JdgXwsGaPP@autotest-wegao.qe.prg2.suse.org/\nFixes: b2f35ac4146d (\"iomap: add caller-provided callbacks for read and readahead\")\nSigned-off-by: Joanne Koong \u003cjoannelkoong@gmail.com\u003e\nLink: https://patch.msgid.link/20260303233420.874231-2-joannelkoong@gmail.com\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "6932256d3a3764f3a5e06e2cb8603be45b6a9fef", "tree": "6c197a9a3bb99655d4249095385e5e74777d3356", "parents": [ "11439c4635edd669ae435eec308f4ab8a0804808" ], "author": { "name": "Gerd Rausch", "email": "gerd.rausch@oracle.com", "time": "Wed Feb 25 15:37:49 2026 -0800" }, "committer": { "name": "Joel Granados", "email": "joel.granados@kernel.org", "time": "Wed Mar 04 13:48:31 2026 +0100" }, "message": "time/jiffies: Fix sysctl file error on configurations where USER_HZ \u003c HZ\n\nCommit 2dc164a48e6fd (\"sysctl: Create converter functions with two new\nmacros\") incorrectly returns error to user space when jiffies sysctl\nconverter is used. The old overflow check got replaced with an\nunconditional one:\n + if (USER_HZ \u003c HZ)\n + return -EINVAL;\nwhich will always be true on configurations with \"USER_HZ \u003c HZ\".\n\nRemove the check; it is no longer needed as clock_t_to_jiffies() returns\nULONG_MAX for the overflow case and proc_int_u2k_conv_uop() checks for\n\"\u003e INT_MAX\" after conversion\n\nFixes: 2dc164a48e6fd (\"sysctl: Create converter functions with two new macros\")\nReported-by: Colm Harrington \u003ccolm.harrington@oracle.com\u003e\nSigned-off-by: Gerd Rausch \u003cgerd.rausch@oracle.com\u003e\nSigned-off-by: Joel Granados \u003cjoel.granados@kernel.org\u003e\n" }, { "commit": "fbdfa8da05b6ae44114fc4f9b3e83e1736fd411c", "tree": "7ce1bfa267b80c182f0b713ca4f8de8aa4595019", "parents": [ "46d0d6f50dab706637f4c18a470aac20a21900d3" ], "author": { "name": "Naveen Anandhan", "email": "mr.navi8680@gmail.com", "time": "Sat Feb 28 13:17:35 2026 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Mar 04 05:42:57 2026 +0000" }, "message": "selftests: tc-testing: fix list_categories() crash on list type\n\nlist_categories() builds a set directly from the \u0027category\u0027\nfield of each test case. Since \u0027category\u0027 is a list,\nset(map(...)) attempts to insert lists into a set, which\nraises:\n\n TypeError: unhashable type: \u0027list\u0027\n\nFlatten category lists and collect unique category names\nusing set.update() instead.\n\nSigned-off-by: Naveen Anandhan \u003cmr.navi8680@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e39bb9e02b68942f8e9359d2a3efe7d37ae6be0e", "tree": "f2ceba28e95415d96868b5873b68510194717f91", "parents": [ "a5dd6f58666f22ae16b98a2177bebc3340d38fe9" ], "author": { "name": "Qing Wang", "email": "wangqing7171@gmail.com", "time": "Fri Feb 27 10:58:42 2026 +0800" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Tue Mar 03 22:25:32 2026 -0500" }, "message": "tracing: Fix WARN_ON in tracing_buffers_mmap_close\n\nWhen a process forks, the child process copies the parent\u0027s VMAs but the\nuser_mapped reference count is not incremented. As a result, when both the\nparent and child processes exit, tracing_buffers_mmap_close() is called\ntwice. On the second call, user_mapped is already 0, causing the function to\nreturn -ENODEV and triggering a WARN_ON.\n\nNormally, this isn\u0027t an issue as the memory is mapped with VM_DONTCOPY set.\nBut this is only a hint, and the application can call\nmadvise(MADVISE_DOFORK) which resets the VM_DONTCOPY flag. When the\napplication does that, it can trigger this issue on fork.\n\nFix it by incrementing the user_mapped reference count without re-mapping\nthe pages in the VMA\u0027s open callback.\n\nCc: stable@vger.kernel.org\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nCc: Lorenzo Stoakes \u003clorenzo.stoakes@oracle.com\u003e\nLink: https://patch.msgid.link/20260227025842.1085206-1-wangqing7171@gmail.com\nFixes: cf9f0f7c4c5bb (\"tracing: Allow user-space mapping of the ring-buffer\")\nReported-by: syzbot+3b5dd2030fe08afdf65d@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d3b5dd2030fe08afdf65d\nTested-by: syzbot+3b5dd2030fe08afdf65d@syzkaller.appspotmail.com\nSigned-off-by: Qing Wang \u003cwangqing7171@gmail.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "a5dd6f58666f22ae16b98a2177bebc3340d38fe9", "tree": "57ca91c9680d78ccba6408f52ca824d27b8ebbe9", "parents": [ "cc337974cd1084f9821179eb66f4e470d9fd2ed8" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Tue Mar 03 21:57:38 2026 -0500" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Tue Mar 03 22:25:32 2026 -0500" }, "message": "tracing: Disable preemption in the tracepoint callbacks handling filtered pids\n\nFiltering PIDs for events triggered the following during selftests:\n\n[37] event tracing - restricts events based on pid notrace filtering\n[ 155.874095]\n[ 155.874869] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 155.876037] WARNING: suspicious RCU usage\n[ 155.877287] 7.0.0-rc1-00004-g8cd473a19bc7 #7 Not tainted\n[ 155.879263] -----------------------------\n[ 155.882839] kernel/trace/trace_events.c:1057 suspicious rcu_dereference_check() usage!\n[ 155.889281]\n[ 155.889281] other info that might help us debug this:\n[ 155.889281]\n[ 155.894519]\n[ 155.894519] rcu_scheduler_active \u003d 2, debug_locks \u003d 1\n[ 155.898068] no locks held by ftracetest/4364.\n[ 155.900524]\n[ 155.900524] stack backtrace:\n[ 155.902645] CPU: 1 UID: 0 PID: 4364 Comm: ftracetest Not tainted 7.0.0-rc1-00004-g8cd473a19bc7 #7 PREEMPT(lazy)\n[ 155.902648] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n[ 155.902651] Call Trace:\n[ 155.902655] \u003cTASK\u003e\n[ 155.902659] dump_stack_lvl+0x67/0x90\n[ 155.902665] lockdep_rcu_suspicious+0x154/0x1a0\n[ 155.902672] event_filter_pid_sched_process_fork+0x9a/0xd0\n[ 155.902678] kernel_clone+0x367/0x3a0\n[ 155.902689] __x64_sys_clone+0x116/0x140\n[ 155.902696] do_syscall_64+0x158/0x460\n[ 155.902700] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[ 155.902702] ? trace_irq_disable+0x1d/0xc0\n[ 155.902709] entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[ 155.902711] RIP: 0033:0x4697c3\n[ 155.902716] Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00\n[ 155.902718] RSP: 002b:00007ffc41150428 EFLAGS: 00000246 ORIG_RAX: 0000000000000038\n[ 155.902721] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004697c3\n[ 155.902722] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011\n[ 155.902724] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000003fccf990\n[ 155.902725] R10: 000000003fccd690 R11: 0000000000000246 R12: 0000000000000001\n[ 155.902726] R13: 000000003fce8103 R14: 0000000000000001 R15: 0000000000000000\n[ 155.902733] \u003c/TASK\u003e\n[ 155.902747]\n\nThe tracepoint callbacks recently were changed to allow preemption. The\nevent PID filtering callbacks that were attached to the fork and exit\ntracepoints expected preemption disabled in order to access the RCU\nprotected PID lists.\n\nAdd a guard(preempt)() to protect the references to the PID list.\n\nCc: stable@vger.kernel.org\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20260303215738.6ab275af@fedora\nFixes: a46023d5616e (\"tracing: Guard __DECLARE_TRACE() use of __DO_TRACE_CALL() with SRCU-fast\")\nLink: https://patch.msgid.link/20260303131706.96057f61a48a34c43ce1e396@kernel.org\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "cc337974cd1084f9821179eb66f4e470d9fd2ed8", "tree": "c6273f2b6cd9719235e6c68a81ef80a5599887ab", "parents": [ "0a663b764dbdf135a126284f454c9f01f95a87d4" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Mon Mar 02 21:35:46 2026 -0500" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Tue Mar 03 22:25:31 2026 -0500" }, "message": "ftrace: Disable preemption in the tracepoint callbacks handling filtered pids\n\nWhen function trace PID filtering is enabled, the function tracer will\nattach a callback to the fork tracepoint as well as the exit tracepoint\nthat will add the forked child PID to the PID filtering list as well as\nremove the PID that is exiting.\n\nCommit a46023d5616e (\"tracing: Guard __DECLARE_TRACE() use of\n__DO_TRACE_CALL() with SRCU-fast\") removed the disabling of preemption\nwhen calling tracepoint callbacks.\n\nThe callbacks used for the PID filtering accounting depended on preemption\nbeing disabled, and now the trigger a \"suspicious RCU usage\" warning message.\n\nMake them explicitly disable preemption.\n\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20260302213546.156e3e4f@gandalf.local.home\nFixes: a46023d5616e (\"tracing: Guard __DECLARE_TRACE() use of __DO_TRACE_CALL() with SRCU-fast\")\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "0a663b764dbdf135a126284f454c9f01f95a87d4", "tree": "68e7b4225254d8c4af93e5e45c8eb4dab1a7a5f4", "parents": [ "b96d0c59cdbb2a22b2545f6f3d5c6276b05761dd" ], "author": { "name": "Huiwen He", "email": "hehuiwen@kylinos.cn", "time": "Tue Feb 24 10:35:44 2026 +0800" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Tue Mar 03 22:15:02 2026 -0500" }, "message": "tracing: Fix syscall events activation by ensuring refcount hits zero\n\nWhen multiple syscall events are specified in the kernel command line\n(e.g., trace_event\u003dsyscalls:sys_enter_openat,syscalls:sys_enter_close),\nthey are often not captured after boot, even though they appear enabled\nin the tracing/set_event file.\n\nThe issue stems from how syscall events are initialized. Syscall\ntracepoints require the global reference count (sys_tracepoint_refcount)\nto transition from 0 to 1 to trigger the registration of the syscall\nwork (TIF_SYSCALL_TRACEPOINT) for tasks, including the init process (pid 1).\n\nThe current implementation of early_enable_events() with disable_first\u003dtrue\nused an interleaved sequence of \"Disable A -\u003e Enable A -\u003e Disable B -\u003e Enable B\".\nIf multiple syscalls are enabled, the refcount never drops to zero,\npreventing the 0-\u003e1 transition that triggers actual registration.\n\nFix this by splitting early_enable_events() into two distinct phases:\n1. Disable all events specified in the buffer.\n2. Enable all events specified in the buffer.\n\nThis ensures the refcount hits zero before re-enabling, allowing syscall\nevents to be properly activated during early boot.\n\nThe code is also refactored to use a helper function to avoid logic\nduplication between the disable and enable phases.\n\nCc: stable@vger.kernel.org\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20260224023544.1250787-1-hehuiwen@kylinos.cn\nFixes: ce1039bd3a89 (\"tracing: Fix enabling of syscall events on the command line\")\nSigned-off-by: Huiwen He \u003chehuiwen@kylinos.cn\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "b96d0c59cdbb2a22b2545f6f3d5c6276b05761dd", "tree": "0da70a04b14243c5731aa90cf5f04e559b579936", "parents": [ "6ca8379b5d36e22b04e6315c3e49a6083377c862" ], "author": { "name": "Shengming Hu", "email": "hu.shengming@zte.com.cn", "time": "Sat Feb 21 11:33:14 2026 +0800" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Tue Mar 03 22:11:20 2026 -0500" }, "message": "fgraph: Fix thresh_return nosleeptime double-adjust\n\ntrace_graph_thresh_return() called handle_nosleeptime() and then delegated\nto trace_graph_return(), which calls handle_nosleeptime() again. When\nsleep-time accounting is disabled this double-adjusts calltime and can\nproduce bogus durations (including underflow).\n\nFix this by computing rettime once, applying handle_nosleeptime() only\nonce, using the adjusted calltime for threshold comparison, and writing\nthe return event directly via __trace_graph_return() when the threshold is\nmet.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260221113314048jE4VRwIyZEALiYByGK0My@zte.com.cn\nFixes: 3c9880f3ab52b (\"ftrace: Use a running sleeptime instead of saving on shadow stack\")\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Shengming Hu \u003chu.shengming@zte.com.cn\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "6ca8379b5d36e22b04e6315c3e49a6083377c862", "tree": "cde9af8c9e21fa9aee322c2af895ce39a828bf2e", "parents": [ "11439c4635edd669ae435eec308f4ab8a0804808" ], "author": { "name": "Shengming Hu", "email": "hu.shengming@zte.com.cn", "time": "Sat Feb 21 11:30:07 2026 +0800" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Tue Mar 03 22:10:37 2026 -0500" }, "message": "fgraph: Fix thresh_return clear per-task notrace\n\nWhen tracing_thresh is enabled, function graph tracing uses\ntrace_graph_thresh_return() as the return handler. Unlike\ntrace_graph_return(), it did not clear the per-task TRACE_GRAPH_NOTRACE\nflag set by the entry handler for set_graph_notrace addresses. This could\nleave the task permanently in \"notrace\" state and effectively disable\nfunction graph tracing for that task.\n\nMirror trace_graph_return()\u0027s per-task notrace handling by clearing\nTRACE_GRAPH_NOTRACE and returning early when set.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260221113007819YgrZsMGABff4Rc-O_fZxL@zte.com.cn\nFixes: b84214890a9bc (\"function_graph: Move graph notrace bit to shadow stack global var\")\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Shengming Hu \u003chu.shengming@zte.com.cn\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "46d0d6f50dab706637f4c18a470aac20a21900d3", "tree": "8b6b7fb5ae167d5d3d2a0f86c83e8db8f5d7144a", "parents": [ "7f5d8e63f3d4dc952548502a2227de780cbcd21f" ], "author": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Mon Mar 02 12:34:09 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 18:39:43 2026 -0800" }, "message": "net/tcp-md5: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant\ntime. Use the appropriate helper function for this.\n\nFixes: cfb6eeb4c860 (\"[TCP]: MD5 Signature Option (RFC2385) support.\")\nFixes: 658ddaaf6694 (\"tcp: md5: RST: getting md5 key from listener\")\nCc: stable@vger.kernel.org\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\nLink: https://patch.msgid.link/20260302203409.13388-1-ebiggers@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7f5d8e63f3d4dc952548502a2227de780cbcd21f", "tree": "a751ad2d51b2ed2c2917d39113afcd8b481efecb", "parents": [ "e2f27363aa6d983504c6836dd0975535e2e9dba0" ], "author": { "name": "Stephen Hemminger", "email": "stephen@networkplumber.org", "time": "Mon Mar 02 11:50:20 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 18:39:27 2026 -0800" }, "message": "MAINTAINERS: update the skge/sky2 maintainers\n\nMark the skge and sky2 drivers as orphan.\nI no longer have any Marvell/SysKonnect boards to test with and\nmail to Mirko Lindner bounced because Marvell sold off that divsion.\n\nSigned-off-by: Stephen Hemminger \u003cstephen@networkplumber.org\u003e\nLink: https://patch.msgid.link/20260302195120.187183-1-stephen@networkplumber.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e2f27363aa6d983504c6836dd0975535e2e9dba0", "tree": "c4ffec90d12e63cc3d95e7ca5a5d5413a02bdc9f", "parents": [ "5af6e8b54927f7a8d3c7fd02b1bdc09e93d5c079" ], "author": { "name": "Raju Rangoju", "email": "Raju.Rangoju@amd.com", "time": "Mon Mar 02 09:51:24 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 17:24:38 2026 -0800" }, "message": "amd-xgbe: fix sleep while atomic on suspend/resume\n\nThe xgbe_powerdown() and xgbe_powerup() functions use spinlocks\n(spin_lock_irqsave) while calling functions that may sleep:\n- napi_disable() can sleep waiting for NAPI polling to complete\n- flush_workqueue() can sleep waiting for pending work items\n\nThis causes a \"BUG: scheduling while atomic\" error during suspend/resume\ncycles on systems using the AMD XGBE Ethernet controller.\n\nThe spinlock protection in these functions is unnecessary as these\nfunctions are called from suspend/resume paths which are already serialized\nby the PM core\n\nFix this by removing the spinlock. Since only code that takes this lock\nis xgbe_powerdown() and xgbe_powerup(), remove it completely.\n\nFixes: c5aa9e3b8156 (\"amd-xgbe: Initial AMD 10GbE platform driver\")\nSigned-off-by: Raju Rangoju \u003cRaju.Rangoju@amd.com\u003e\nLink: https://patch.msgid.link/20260302042124.1386445-1-Raju.Rangoju@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5af6e8b54927f7a8d3c7fd02b1bdc09e93d5c079", "tree": "91e1f29d334101adb2b477b3600649725d10e6c8", "parents": [ "4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Mar 02 03:40:46 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 17:23:50 2026 -0800" }, "message": "netconsole: fix sysdata_release_enabled_show checking wrong flag\n\nsysdata_release_enabled_show() checks SYSDATA_TASKNAME instead of\nSYSDATA_RELEASE, causing the configfs release_enabled attribute to\nreflect the taskname feature state rather than the release feature\nstate. This is a copy-paste error from the adjacent\nsysdata_taskname_enabled_show() function.\n\nThe corresponding _store function already uses the correct\nSYSDATA_RELEASE flag.\n\nFixes: 343f90227070 (\"netconsole: implement configfs for release_enabled\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260302-sysdata_release_fix-v1-1-e5090f677c7c@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f", "tree": "2e258ec5466c4dce2ab1f5debfc7ab7e9b36153e", "parents": [ "67edfec516d30d3e62925c397be4a1e5185802fc" ], "author": { "name": "Yung Chih Su", "email": "yuuchihsu@gmail.com", "time": "Mon Mar 02 14:02:47 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 17:20:37 2026 -0800" }, "message": "net: ipv4: fix ARM64 alignment fault in multipath hash seed\n\n`struct sysctl_fib_multipath_hash_seed` contains two u32 fields\n(user_seed and mp_seed), making it an 8-byte structure with a 4-byte\nalignment requirement.\n\nIn `fib_multipath_hash_from_keys()`, the code evaluates the entire\nstruct atomically via `READ_ONCE()`:\n\n mp_seed \u003d READ_ONCE(net-\u003eipv4.sysctl_fib_multipath_hash_seed).mp_seed;\n\nWhile this silently works on GCC by falling back to unaligned regular\nloads which the ARM64 kernel tolerates, it causes a fatal kernel panic\nwhen compiled with Clang and LTO enabled.\n\nCommit e35123d83ee3 (\"arm64: lto: Strengthen READ_ONCE() to acquire\nwhen CONFIG_LTO\u003dy\") strengthens `READ_ONCE()` to use Load-Acquire\ninstructions (`ldar` / `ldapr`) to prevent compiler reordering bugs\nunder Clang LTO. Since the macro evaluates the full 8-byte struct,\nClang emits a 64-bit `ldar` instruction. ARM64 architecture strictly\nrequires `ldar` to be naturally aligned, thus executing it on a 4-byte\naligned address triggers a strict Alignment Fault (FSC \u003d 0x21).\n\nFix the read side by moving the `READ_ONCE()` directly to the `u32`\nmember, which emits a safe 32-bit `ldar Wn`.\n\nFurthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire\nstruct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis\nshows that Clang splits this 8-byte write into two separate 32-bit\n`str` instructions. While this avoids an alignment fault, it destroys\natomicity and exposes a tear-write vulnerability. Fix this by\nexplicitly splitting the write into two 32-bit `WRITE_ONCE()`\noperations.\n\nFinally, add the missing `READ_ONCE()` when reading `user_seed` in\n`proc_fib_multipath_hash_seed()` to ensure proper pairing and\nconcurrency safety.\n\nFixes: 4ee2a8cace3f (\"net: ipv4: Add a sysctl to set multipath hash seed\")\nSigned-off-by: Yung Chih Su \u003cyuuchihsu@gmail.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260302060247.7066-1-yuuchihsu@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "67edfec516d30d3e62925c397be4a1e5185802fc", "tree": "ee4b94f898a13828185543d5644550203d1430d0", "parents": [ "2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a" ], "author": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Mon Mar 02 12:36:00 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 17:16:54 2026 -0800" }, "message": "net/tcp-ao: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant\ntime. Use the appropriate helper function for this.\n\nFixes: 0a3a809089eb (\"net/tcp: Verify inbound TCP-AO signed segments\")\nCc: stable@vger.kernel.org\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\nReviewed-by: Dmitry Safonov \u003c0x7f454c46@gmail.com\u003e\nLink: https://patch.msgid.link/20260302203600.13561-1-ebiggers@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a", "tree": "15764f85bc4fed99fba6ee2178e48697fc6f3fc8", "parents": [ "1a86a1f7d88996085934139fa4c063b6299a2dd3" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sun Mar 01 11:45:48 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 17:14:48 2026 -0800" }, "message": "ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()\n\nl3mdev_master_dev_rcu() can return NULL when the slave device is being\nun-slaved from a VRF. All other callers deal with this, but we lost\nthe fallback to loopback in ip6_rt_pcpu_alloc() -\u003e ip6_rt_get_dev_rcu()\nwith commit 4832c30d5458 (\"net: ipv6: put host and anycast routes on\ndevice with address\").\n\n KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]\n RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)\n Call Trace:\n ip6_pol_route (net/ipv6/route.c:2318)\n fib6_rule_lookup (net/ipv6/fib6_rules.c:115)\n ip6_route_output_flags (net/ipv6/route.c:2607)\n vrf_process_v6_outbound (drivers/net/vrf.c:437)\n\nI was tempted to rework the un-slaving code to clear the flag first\nand insert synchronize_rcu() before we remove the upper. But looks like\nthe explicit fallback to loopback_dev is an established pattern.\nAnd I guess avoiding the synchronize_rcu() is nice, too.\n\nFixes: 4832c30d5458 (\"net: ipv6: put host and anycast routes on device with address\")\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20260301194548.927324-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0031c06807cfa8aa51a759ff8aa09e1aa48149af", "tree": "ec9f2c50e3d4c2eb2f4d08f65c6d2bbb3ecd26c4", "parents": [ "6a8dab043c649450ee58c84c3c6051def96778ed", "085f067389d12bd9800c0a9672a174c1de7a8069" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Mar 03 14:25:18 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Mar 03 14:25:18 2026 -0800" }, "message": "Merge tag \u0027cgroup-for-7.0-rc2-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n\n - Fix circular locking dependency in cpuset partition code by\n deferring housekeeping_update() calls to a workqueue instead\n of calling them directly under cpus_read_lock\n\n - Fix null-ptr-deref in rebuild_sched_domains_cpuslocked() when\n generate_sched_domains() returns NULL due to kmalloc failure\n\n - Fix incorrect cpuset behavior for effective_xcpus in\n partition_xcpus_del() and cpuset_update_tasks_cpumask()\n in update_cpumasks_hier()\n\n - Fix race between task migration and cgroup iteration\n\n* tag \u0027cgroup-for-7.0-rc2-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup/cpuset: fix null-ptr-deref in rebuild_sched_domains_cpuslocked\n cgroup/cpuset: Call housekeeping_update() without holding cpus_read_lock\n cgroup/cpuset: Defer housekeeping_update() calls from CPU hotplug to workqueue\n cgroup/cpuset: Move housekeeping_update()/rebuild_sched_domains() together\n kselftest/cgroup: Simplify test_cpuset_prs.sh by removing \"S+\" command\n cgroup/cpuset: Set isolated_cpus_updating only if isolated_cpus is changed\n cgroup/cpuset: Clarify exclusion rules for cpuset internal variables\n cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in update_cpumasks_hier()\n cgroup/cpuset: Fix incorrect change to effective_xcpus in partition_xcpus_del()\n cgroup: fix race between task migration and iteration\n" }, { "commit": "6a8dab043c649450ee58c84c3c6051def96778ed", "tree": "4dbe2111005bc4bcc8a4a4a7ba80871cf7bf945f", "parents": [ "c44db6c820140ffbc0e293a34c6a6de4b363422b", "b06ccbabe2506fd70b9167a644978b049150224a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Mar 03 14:14:20 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Mar 03 14:14:20 2026 -0800" }, "message": "Merge tag \u0027sched_ext-for-7.0-rc2-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n\n - Fix starvation of scx_enable() under fair-class saturation by\n offloading the enable path to an RT kthread\n\n - Fix out-of-bounds access in idle mask initialization on systems with\n non-contiguous NUMA node IDs\n\n - Fix a preemption window during scheduler exit and a refcount\n underflow in cgroup init error path\n\n - Fix SCX_EFLAG_INITIALIZED being a no-op flag\n\n - Add READ_ONCE() annotations for KCSAN-clean lockless accesses and\n replace naked scx_root dereferences with container_of() in kobject\n callbacks\n\n - Tooling and selftest fixes: compilation issues with clang 17,\n strtoul() misuse, unused options cleanup, and Kconfig sync\n\n* tag \u0027sched_ext-for-7.0-rc2-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Fix starvation of scx_enable() under fair-class saturation\n sched_ext: Remove redundant css_put() in scx_cgroup_init()\n selftests/sched_ext: Fix peek_dsq.bpf.c compile error for clang 17\n selftests/sched_ext: Add -fms-extensions to bpf build flags\n tools/sched_ext: Add -fms-extensions to bpf build flags\n sched_ext: Use READ_ONCE() for plain reads of scx_watchdog_timeout\n sched_ext: Replace naked scx_root dereferences in kobject callbacks\n sched_ext: Use READ_ONCE() for the read side of dsq-\u003enr update\n tools/sched_ext: fix strtoul() misuse in scx_hotplug_seq()\n sched_ext: Fix SCX_EFLAG_INITIALIZED being a no-op flag\n sched_ext: Fix out-of-bounds access in scx_idle_init_masks()\n sched_ext: Disable preemption between scx_claim_exit() and kicking helper work\n tools/sched_ext: Add Kconfig to sync with upstream\n tools/sched_ext: Sync README.md Kconfig with upstream scx\n selftests/sched_ext: Remove duplicated unistd.h include in rt_stall.c\n tools/sched_ext: scx_sdt: Remove unused \u0027-f\u0027 option\n tools/sched_ext: scx_central: Remove unused \u0027-p\u0027 option\n selftests/sched_ext: Fix unused-result warning for read()\n selftests/sched_ext: Abort test loop on signal\n" }, { "commit": "b06ccbabe2506fd70b9167a644978b049150224a", "tree": "493c2b708c69b59c607f0c09fe1f8f5f2db82359", "parents": [ "1336b579f6079fb8520be03624fcd9ba443c930b" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Mar 03 01:01:15 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Mar 03 11:10:40 2026 -1000" }, "message": "sched_ext: Fix starvation of scx_enable() under fair-class saturation\n\nDuring scx_enable(), the READY -\u003e ENABLED task switching loop changes the\ncalling thread\u0027s sched_class from fair to ext. Since fair has higher\npriority than ext, saturating fair-class workloads can indefinitely starve\nthe enable thread, hanging the system. This was introduced when the enable\npath switched from preempt_disable() to scx_bypass() which doesn\u0027t protect\nagainst fair-class starvation. Note that the original preempt_disable()\nprotection wasn\u0027t complete either - in partial switch modes, the calling\nthread could still be starved after preempt_enable() as it may have been\nswitched to ext class.\n\nFix it by offloading the enable body to a dedicated system-wide RT\n(SCHED_FIFO) kthread which cannot be starved by either fair or ext class\ntasks. scx_enable() lazily creates the kthread on first use and passes the\nops pointer through a struct scx_enable_cmd containing the kthread_work,\nthen synchronously waits for completion.\n\nThe workfn runs on a different kthread from sch-\u003ehelper (which runs\ndisable_work), so it can safely flush disable_work on the error path\nwithout deadlock.\n\nFixes: 8c2090c504e9 (\"sched_ext: Initialize in bypass mode\")\nCc: stable@vger.kernel.org # v6.12+\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "554a1c34c11a057d01819ce9bb04653a8ffc8071", "tree": "88c63085ad7578ca4e6e0f38200a30b21489347d", "parents": [ "d4c13ab36273a8c318ba06799793cc1f5d9c6fa1" ], "author": { "name": "Vivek Behera", "email": "vivek.behera@siemens.com", "time": "Tue Jan 20 08:52:16 2026 +0100" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Mar 03 13:06:05 2026 -0800" }, "message": "igc: Fix trigger of incorrect irq in igc_xsk_wakeup function\n\nThis patch addresses the issue where the igc_xsk_wakeup function\nwas triggering an incorrect IRQ for tx-0 when the i226 is configured\nwith only 2 combined queues or in an environment with 2 active CPU cores.\nThis prevented XDP Zero-copy send functionality in such split IRQ\nconfigurations.\n\nThe fix implements the correct logic for extracting q_vectors saved\nduring rx and tx ring allocation and utilizes flags provided by the\nndo_xsk_wakeup API to trigger the appropriate IRQ.\n\nFixes: fc9df2a0b520 (\"igc: Enable RX via AF_XDP zero-copy\")\nFixes: 15fd021bc427 (\"igc: Add Tx hardware timestamp request for AF_XDP zero-copy packet\")\nSigned-off-by: Vivek Behera \u003cvivek.behera@siemens.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.keller@intel.com\u003e\nReviewed-by: Aleksandr loktinov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Piotr Kwapulinski \u003cpiotr.kwapulinski@intel.com\u003e\nReviewed-by: Song Yoong Siang \u003cyoong.siang.song@intel.com\u003e\nTested-by: Avigail Dahan \u003cavigailx.dahan@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "d4c13ab36273a8c318ba06799793cc1f5d9c6fa1", "tree": "9d547100ca35d3c5486d402398f582e3c709a972", "parents": [ "b84852170153671bb0fa6737a6e48370addd8e1a" ], "author": { "name": "Vivek Behera", "email": "vivek.behera@siemens.com", "time": "Thu Jan 22 15:16:52 2026 +0100" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Mar 03 13:06:05 2026 -0800" }, "message": "igb: Fix trigger of incorrect irq in igb_xsk_wakeup\n\nThe current implementation in the igb_xsk_wakeup expects\nthe Rx and Tx queues to share the same irq. This would lead\nto triggering of incorrect irq in split irq configuration.\nThis patch addresses this issue which could impact environments\nwith 2 active cpu cores\nor when the number of queues is reduced to 2 or less\n\ncat /proc/interrupts | grep eno2\n 167: 0 0 0 0 IR-PCI-MSIX-0000:08:00.0\n 0-edge eno2\n 168: 0 0 0 0 IR-PCI-MSIX-0000:08:00.0\n 1-edge eno2-rx-0\n 169: 0 0 0 0 IR-PCI-MSIX-0000:08:00.0\n 2-edge eno2-rx-1\n 170: 0 0 0 0 IR-PCI-MSIX-0000:08:00.0\n 3-edge eno2-tx-0\n 171: 0 0 0 0 IR-PCI-MSIX-0000:08:00.0\n 4-edge eno2-tx-1\n\nFurthermore it uses the flags input argument to trigger either rx, tx or\nboth rx and tx irqs as specified in the ndo_xsk_wakeup api documentation\n\nFixes: 80f6ccf9f116 (\"igb: Introduce XSK data structures and helpers\")\nSigned-off-by: Vivek Behera \u003cvivek.behera@siemens.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSuggested-by: Maciej Fijalkowski \u003cmaciej.fijalkowski@intel.com\u003e\nAcked-by: Maciej Fijalkowski \u003cmaciej.fijalkowski@intel.com\u003e\nTested-by: Saritha Sanigani \u003csarithax.sanigani@intel.com\u003e (A Contingent Worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "b84852170153671bb0fa6737a6e48370addd8e1a", "tree": "a9c27dbb0c9e98aa50632c65879b8e34a04b0c51", "parents": [ "636cc3bd12f499c74eaf5dc9a7d5b832f1bb24ed" ], "author": { "name": "Kohei Enju", "email": "kohei@enjuk.jp", "time": "Tue Feb 10 15:57:14 2026 +0000" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Mar 03 13:06:04 2026 -0800" }, "message": "iavf: fix netdev-\u003emax_mtu to respect actual hardware limit\n\niavf sets LIBIE_MAX_MTU as netdev-\u003emax_mtu, ignoring vf_res-\u003emax_mtu\nfrom PF [1]. This allows setting an MTU beyond the actual hardware\nlimit, causing TX queue timeouts [2].\n\nSet correct netdev-\u003emax_mtu using vf_res-\u003emax_mtu from the PF.\n\nNote that currently PF drivers such as ice/i40e set the frame size in\nvf_res-\u003emax_mtu, not MTU. Convert vf_res-\u003emax_mtu to MTU before setting\nnetdev-\u003emax_mtu.\n\n[1]\n # ip -j -d link show $DEV | jq \u0027.[0].max_mtu\u0027\n 16356\n\n[2]\n iavf 0000:00:05.0 enp0s5: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5692 ms\n iavf 0000:00:05.0 enp0s5: NIC Link is Up Speed is 10 Gbps Full Duplex\n iavf 0000:00:05.0 enp0s5: NETDEV WATCHDOG: CPU: 6: transmit queue 3 timed out 5312 ms\n iavf 0000:00:05.0 enp0s5: NIC Link is Up Speed is 10 Gbps Full Duplex\n ...\n\nFixes: 5fa4caff59f2 (\"iavf: switch to Page Pool\")\nSigned-off-by: Kohei Enju \u003ckohei@enjuk.jp\u003e\nReviewed-by: Alexander Lobakin \u003caleksander.lobakin@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "636cc3bd12f499c74eaf5dc9a7d5b832f1bb24ed", "tree": "7ec64483bd26ad7e21933903a060a40e8aa8d8f6", "parents": [ "fe868b499d16f55bbeea89992edb98043c9de416" ], "author": { "name": "Michal Swiatkowski", "email": "michal.swiatkowski@linux.intel.com", "time": "Wed Feb 11 10:11:40 2026 +0100" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Mar 03 13:06:04 2026 -0800" }, "message": "libie: don\u0027t unroll if fwlog isn\u0027t supported\n\nThe libie_fwlog_deinit() function can be called during driver unload\neven when firmware logging was never properly initialized. This led to call\ntrace:\n\n[ 148.576156] Oops: Oops: 0000 [#1] SMP NOPTI\n[ 148.576167] CPU: 80 UID: 0 PID: 12843 Comm: rmmod Kdump: loaded Not tainted 6.17.0-rc7next-queue-3oct-01915-g06d79d51cf51 #1 PREEMPT(full)\n[ 148.576177] Hardware name: HPE ProLiant DL385 Gen10 Plus/ProLiant DL385 Gen10 Plus, BIOS A42 07/18/2020\n[ 148.576182] RIP: 0010:__dev_printk+0x16/0x70\n[ 148.576196] Code: 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 41 55 41 54 49 89 d4 55 48 89 fd 53 48 85 f6 74 3c \u003c4c\u003e 8b 6e 50 48 89 f3 4d 85 ed 75 03 4c 8b 2e 48 89 df e8 f3 27 98\n[ 148.576204] RSP: 0018:ffffd2fd7ea17a48 EFLAGS: 00010202\n[ 148.576211] RAX: ffffd2fd7ea17aa0 RBX: ffff8eb288ae2000 RCX: 0000000000000000\n[ 148.576217] RDX: ffffd2fd7ea17a70 RSI: 00000000000000c8 RDI: ffffffffb68d3d88\n[ 148.576222] RBP: ffffffffb68d3d88 R08: 0000000000000000 R09: 0000000000000000\n[ 148.576227] R10: 00000000000000c8 R11: ffff8eb2b1a49400 R12: ffffd2fd7ea17a70\n[ 148.576231] R13: ffff8eb3141fb000 R14: ffffffffc1215b48 R15: ffffffffc1215bd8\n[ 148.576236] FS: 00007f5666ba6740(0000) GS:ffff8eb2472b9000(0000) knlGS:0000000000000000\n[ 148.576242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 148.576247] CR2: 0000000000000118 CR3: 000000011ad17000 CR4: 0000000000350ef0\n[ 148.576252] Call Trace:\n[ 148.576258] \u003cTASK\u003e\n[ 148.576269] _dev_warn+0x7c/0x96\n[ 148.576290] libie_fwlog_deinit+0x112/0x117 [libie_fwlog]\n[ 148.576303] ixgbe_remove+0x63/0x290 [ixgbe]\n[ 148.576342] pci_device_remove+0x42/0xb0\n[ 148.576354] device_release_driver_internal+0x19c/0x200\n[ 148.576365] driver_detach+0x48/0x90\n[ 148.576372] bus_remove_driver+0x6d/0xf0\n[ 148.576383] pci_unregister_driver+0x2e/0xb0\n[ 148.576393] ixgbe_exit_module+0x1c/0xd50 [ixgbe]\n[ 148.576430] __do_sys_delete_module.isra.0+0x1bc/0x2e0\n[ 148.576446] do_syscall_64+0x7f/0x980\n\nIt can be reproduced by trying to unload ixgbe driver in recovery mode.\n\nFix that by checking if fwlog is supported before doing unroll.\n\nFixes: 641585bc978e (\"ixgbe: fwlog support for e610\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Michal Swiatkowski \u003cmichal.swiatkowski@linux.intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Rinitha S \u003csx.rinitha@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" } ], "next": "fe868b499d16f55bbeea89992edb98043c9de416" }