Replace six sprintf() calls that write to
SNDRV_CTL_ELEM_ID_NAME_MAXLEN-sized buffers with snprintf() to avoid
potential buffer overflows.
Signed-off-by: Bob Song <songxiebing@kylinos.cn>
Link: https://patch.msgid.link/20260812033030.635417-1-songxiebing@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
ca0132_free() and dbpro_free() call kfree(codec->spec) without
setting codec->spec to NULL afterward, leaving a dangling pointer.
Set it to NULL.
Signed-off-by: Bob Song <songxiebing@kylinos.cn>
Link: https://patch.msgid.link/20260812033019.635010-1-songxiebing@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
hda_bus_match() has an unreachable 'return 1' after an if/else that
covers both branches. Remove the superfluous return and simplify the
control flow by dropping the else branch.
hdac_codec_match() uses a redundant if/else to return 1 or 0.
Simplify to a single return statement.
Signed-off-by: Bob Song <songxiebing@kylinos.cn>
Link: https://patch.msgid.link/20260812033007.633564-1-songxiebing@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The fixed audio formats for the PreSonus AudioBox USB specify a discrete
rate mask but leave nr_rates at zero and rate_table unset. find_format()
therefore rejects every requested rate, preventing the playback and
capture streams from being opened.
Add the advertised 44100 and 48000 Hz rates to both streams and report
their 24 significant bits.
Fixes: 34fe4a9df2 ("ALSA: usb-audio: Add quirk for PreSonus AudioBox USB")
Cc: stable@vger.kernel.org
Signed-off-by: Trevor Vorhees <vorhees-work@proton.me>
Link: https://patch.msgid.link/20260811-audiobox-usb-fix-v1-1-13c8b7f071ea@proton.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
* Fix the incorrect parent number of the 32k clock on GXBB
* Add the AO and peripheral clock controllers for the new A9 chip
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE9OFZrhjz9W1fG7cb5vwPHDfy2oUFAmpspMEACgkQ5vwPHDfy
2oUc2BAAr4p6ygDoxRof6N/NjNlJebaYWviWhwaKDdM9a8UaKKtYeqQP1ye/1Nzv
qIUcLCMDqQP1UU4xsErIDcuOLBEZ9l9WWUvL8aMJwNWyZ+l1BFdxROhnHTqfUj+i
j636C+7/t9/c7PVu5C+v7i7cAMPCQQx48p1KQskmWiEJBfOt8fgIbfpdIpy9HM4V
FprCnyMZdqx9DjUB1n9LWFwAN2skEwplZp3Vg0UZCtKLxdW6RGJ9ALYlknrWTkKL
hqWMMQFofNBlBlMaXKrNKAlZfaegn/0pNrAeIpX3rSk8a/bdjQ7FVPtFfSfIHcw+
Z8uoxef3yuLI+c8x/SrRCPSLe83ZalOGtontmuWGT6prE7E89HqS1IqUbVoiMlDD
EwbPUEGxLMMJUa3IP5WMGOCqTtnbiI/8gQVC4EgxPxWHiMr8qYHNRwVCfZhzZIic
iinEU4UqehOoySapEZum/neBCbl9eJbr5bxxt2aKl60fQcXBJDEDUcju5JG56zuT
m3OQAcAcKQoPcA4Fggdvyzc1eZMiEGjdYepT1WFNFq8aAA/qct0nse5GWyvZ9ZU8
tWDFKGwBfI1BfvGnFV7r1CN+wwF77I8d0Yf/6tx64iLYG+OVoGT1764fq+xOp/wu
33BNxGNfW6+tPrHrQp6QHPaC/lTAGVKimGe7usDSomLjDpyZBfU=
=pzDk
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmp7/0AUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSU0QhAAhtpaF2R3Dnp2+rNaCBEnqmdEqU8f
LgK48CXz/a97wJi1QIXfVihajkEBrxi1+j01TJNzEQcFuW2UkXoRbn97ZaPathd+
GoOv+da5IU6e1FwctdHCWXff8Y6tkdkYTP7bAC6/n7m146muNt99MSO1Htkb3x5i
0klXsu+fHQQ+EYcUo31secuMJbC1R94JhF1Oz+MOsSygNbe64e6aJJS3XkZ1x1py
2TeP+/AF53AwYtUx1z0zdHP/xLsyIJnsPmt5Jfzbt3UtKTBOP/IAoyvDSjGRa9kb
E7wWnJ7z5GRwZAk4L7kbtrs7nruNSQT8QbHERw87b1uFA2N+gl5k7M+j3pEXdQgo
K63uzCoNPyoIsghgg0f5fXBz28eE2UsG9W4JkNfEGcjJK7cSAX7/68dsY4is/tJs
Rjy+uLRcBCLtcHOgMZQNTSISAqWt1RBdU6AElKviFNR1nw05xCN9jDRB9xEwYNo/
ZEW9hwjAVfjeD/Yrzs8vqBRYZqyD6lgZkGcM5cNUGTClPbrK+QmVQZXhuDH1HT4o
aw1mwFX6FFUrfYKm5nHUWIelh6hETFt2T6L8L3edxRAzC/NYVcrx7KFzTq5387eV
HXy/Y4xSimaaCR32tgkeUyv6ZRd8M/m7G4BW6q4ObJq/mKFYsv5VcQYgpAXHRxa8
mW1136cLsgBTRpk=
=Dxt8
-----END PGP SIGNATURE-----
Merge tag 'clk-meson-v7.3-1' of ssh://github.com/BayLibre/clk-meson into clk-amlogic
Pull Amlogic clk driver updates from Jerome Brunet:
- Fix the incorrect parent number of the 32k clock on Amlogic GXBB
- Add the AO and peripheral clock controllers for the new Amlogic A9 chip
* tag 'clk-meson-v7.3-1' of ssh://github.com/BayLibre/clk-meson:
clk: amlogic: Add A9 peripherals clock controller driver
dt-bindings: clock: Add Amlogic A9 peripherals clock controller
clk: amlogic: Add A9 AO clock controller driver
dt-bindings: clock: Add Amlogic A9 AO clock controller
clk: meson: align gxbb_32k_clk_sel number of parents with actual count
This patchset brings the support of the Other Logic Blocks (OLB)
found in the first Mobileye SoC based on the RISC-V architecture, the
EyeQ7H. Despite the change from MIPS to RISC-V, the Other Logic Blocks
provide similar clock and reset functions to the controllers of the
chip. This series introduces the device tree bindings of the SoC and
the necessary changes to the clock and reset eyeq drivers.
Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>
-----BEGIN PGP SIGNATURE-----
iQJPBAABCAA5FiEEy6c1E9KFcNpKUem2OLE8WZ9QiKgFAmpZ6HEbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyAAoJEDixPFmfUIioZPEP/3m6axQcd5jsnpGnIsjf
mR/5MbWEJFHjs4rxtWD9xeIqu2NEW1rz1lbw4wWr1Tp4KgrtOTFlkt7hRVzW7QV9
BHOMM85Ssaolk50iMSSDhINkBQtWBd4Xg+fVE18ZrZbMW781lnOsp5wlQK81KUy1
BST5QCIuEssJZkI2sDaI1DSf1hQkUPZmIgfA8i+QlQUq16u/e6mu9Y4eR4CWT0gr
VBSiFACjPnucSSVu9vxYvcrrq5QqKsvtsfAUucmI23JmuA65OTUuJLwdHqQod+6n
R99om1zc7z2CQITuTDrSQVO9yGmxpDaAu6jVl4SKTax+KJBVt05CWOle8kyO2Mew
2k+yGb2PgW87HwompCU6y1R7BcuStjxs11dWs9XP75rhzxD8/wluOr1Mah7w7Z/P
mkBoB0KLwtPZsfeEQwFTOWK6ox+joGGAN/7VoGSgQvzbK4rJbfVh+AEa81aV6MxV
J9kMZLC+Y7b/QqM1KG5p57IyVVeY7XWRQe/VPK/Uqvm1B8QwhGRPVI4ihnB+MLkp
WDli4KVlaWmXmS1jT29nVqWxjvCS0AnWe6hNgVIIFg+jwRtMhoQZx8xxRIEVcFai
YvjgX+0eG49f2MKtLssaQ6DyttqSGFMT6OTrMfWw/xM4Y0ehic+1oTz9APUow1WX
0RNW9PRZv9ylFpxAE8XfJ0FR
=w3Sh
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmp782EUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSVoWxAAmsUHIZEsHi+O+oKY5WIxBWzKk4d3
WarkDQcYYnL/YCK6N4luG35yVj52hAdrGT5sFERaNgq1dlfKrSvCOO3Tzwn8ZFzf
LMawqnQ5hdPigHQTiU9rj+ET77s9w/dXZ5NRP28+oX3Zs8uNszgrJqDKVuYyC3zJ
fzXJbhrL8W/JK1VSmX3IkEy9bAutX+Ct+CBF4dQfbwiEQZut6KZubPjWS78acu56
VL4hC0I4X/b3z4W8D3yAGPdH9asiUuKyghQTYjUF5xi68V+hTlMxMI2W8daLbdAQ
8chl96p5OARNzukNbM7rGf0SNywmHhWWaQYBNaVtj8gb1FjPv8lLyM1eEDaBrn8H
U3eVobyLtPsy6oAioN+qWU4a8npKqQvHL9Dmn2XyRq3kcLxDy8/8z3tbeAiwVMa4
v51PsPNnogfnefgrTKsPmOsLr+5Cg/d5mnTkqxIQYYYxliCERXquS3IoWB5iPHVD
uMfxpCaFRKqMEEtMmrBFPSPCwdhhHGHQDkKDcfEpCFCjC27BXWorcERruedrVMrZ
NM6TrYEYu69FFpWfpiGYy/ruuS6lRoqpBylH8aczyqNTwuIsUgq3FHhz3qLKD2iY
8eN25pu4C2D3O9FRr1lDEVuwVaH9JRY3Eq7izEUCQWq8pQ4kUf+aJ/3W3RE82bIW
BEdrCQp3pdv3EcU=
=izC9
-----END PGP SIGNATURE-----
Merge tag 'clk-eyeq7h-7.3' of ssh://github.com/benoitmonin/linux into clk-mobileye
Pull Mobileye clk driver updates from Benoît Monin:
- Add support for Mobileye EyeQ7H
This patchset brings the support of the Other Logic Blocks (OLB)
found in the first Mobileye SoC based on the RISC-V architecture, the
EyeQ7H. Despite the change from MIPS to RISC-V, the Other Logic Blocks
provide similar clock and reset functions to the controllers of the
chip. This series introduces the device tree bindings of the SoC and
the necessary changes to the clock and reset eyeq drivers.
Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>
* tag 'clk-eyeq7h-7.3' of ssh://github.com/benoitmonin/linux:
clk: eyeq: Add EyeQ7H compatibles
clk: eyeq: Drop PLL, dividers, and fixed factors structs
clk: eyeq: Convert clocks declaration to eqc_clock
clk: eyeq: Introduce a generic clock type
clk: eyeq: Prefix the PLL registers with the PLL type
clk: fixed-factor: Export __clk_hw_register_fixed_factor()
clk: fixed-factor: Rework initialization with parent clocks
reset: eyeq: Add EyeQ7H compatibles
dt-bindings: soc: mobileye: Add EyeQ7H OLB
There is just one change for this cycle. It allows COMPILE_TEST to
select the th1520 clk driver without having CONFIG_ARCH_THEAD enabled.
-----BEGIN PGP SIGNATURE-----
iHUEABYIAB0WIQSy8G7QpEpV9aCf6Lbb7CzD2SixDAUCal/PFAAKCRDb7CzD2Six
DEWNAQChPTMeMYPSOzrEmnFodEFynvQUTfGaUXJWUHFC8DViJAD+PUViDmeX2rCq
mTcn6IONeO13d75VjZ8hFdDaZNoxZwI=
=57RB
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmp78vIUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSWBVhAAiM6LDFrutqtNaUF12epX8OZWB8J9
WS14AdTKBef25c4Ys2JN0FI62hXceD8kulh8mwpTjxBVtiRl686T4WbDrUWe7G4D
V9qGP2Mt2w550TcxgSb3xZ94icK5/Ap6cPAozCoYtklQvdJ+rzKhYTBIAgjv4O1L
FRK7hkscpHJZX2GRKUwCF2n1vDveLiTUh4fOilP+McEyHNrG4ByY8cQ0gosKhCAI
rJA7m+JQWHHl+5kp+G3dpSP783TevNFc25/Oiltgt4uYmoc4lEXnmVkw1KTbzmFD
IzvYzu3GQjzUNszyuQQCctwa96XN/xTLYZQhosO+6+e+Gt99kwhJuZw5CaE/MdmN
jEJZXZZmR6w94ta9eaqkWGAG7MU1XNmxtFQ7TkLmZ7EPzRqH8BGgVxB1nTMymPuh
qZHQVhAPOBm21ipehBy/37xF90QJcPMmyIlqQKjzFvMSiFCoEjIBMZQaA6eoFgs1
KxvXkoywHtHFIKEpFFIIa1ka4kNbzQB+wtb7v5Gex/kcdUf8QjfUAcMX0CSuod0r
lohcjsQZTvD8RdZfVngYueN7JAb4E6k/JRE5vOcy9aJ5giq/3blrJpDokcjLQUVx
EJQeL26tJp+FkLZFMR+N817dtxYGu5e6T0qm56KGXT2ohJGmyRhFWon5Q55fDH7G
lXTsjBuVWBTgb9w=
=rH/5
-----END PGP SIGNATURE-----
Merge tag 'thead-clk-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into clk-thead
Pull one T-HEAD clk driver update from Drew Fustini:
There is just one change for this cycle. It allows COMPILE_TEST to
select the th1520 clk driver without having CONFIG_ARCH_THEAD enabled.
* tag 'thead-clk-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux:
clk: thead: allow COMPILE_TEST builds
- Add RTC and display clocks on RZ/T2H and RZ/N2H,
- Add audio and display clocks and resets on RZ/G3E,
- Add SDHI, GPU, and USB2.0 clocks and resets on RZ/G3L,
- Update the maintainer for the VersaClock 7 driver,
- Add CAN-FD clocks and resets for RZ/G3S.
- Miscellaneous fixes and improvements.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCalijCgAKCRCKwlD9ZEnx
cD2YAQCsAFz3d2r1UpHBCtvrWJd9RFlb4XNaC+yPKHTPpUVMtQD/eCW8T81CLwMN
8ZIxfYm0xIrY9U6aYLu+jXVWG9XnxQs=
=7PgU
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmp78jIUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSUiyhAArODaLyJ/WGf6HYKzdkL1dTZfXOa7
1GKUY8TPivI6omCmRd4GwD2MdhRwmpOiNC5AV/qrn0IEQ3Rb8EnRp7DnHHaqkhzO
inJ4rZrB2GPqF/nzj10gWItvQDxhwsG2Ak1c34sKOyLoX6oRsiiPLq8Q0P9YfB5D
80/6T28qtObEIjKpWvN49jRudTKgPS5sgl99NSNppTdfiF40DOTNbWlxuoBvT7dQ
6LE259ZjWeqPRQghLQPPwJDj4Lss/wkc/Q2xm8rH8lBYhelXSMQMAcL20O1peBDs
yar/15YzAb8dqxHaFCwOdsL7hzDlvRAGtUYudGSFdqx++ujGx4ikIU/FDqyBRL2B
QPYRHV5guLGHaCHffL0/9JirZ2i++KL2sIbFkwWS0ia3n8Y0DNVvIhLABDXAgY7c
+p5enrwYU2dLBAiqNoSst+wTfyx0AbyhumMEeVk4PZqF79tRKKcJgF17KBhimAMU
hsfJ2LXoGE1Cx+4q0OH3kU5igy3id2LPp1k0c6VXYWnuIRAnU4xjnW9H2eKObon7
BCoxCPWHNV7LD4LZs2avATq0WLHuQl9t0TMpafJ8n0BaV5Z8RMrcxFsipyM+qg9l
zGSVxZ2Ik37v8DNajRqD9aP6bX+crKnuel0faQ7z89GaP/PZx8+Roxe9yqAXjFQ9
iKNcpwodTeB7kcA=
=KW+M
-----END PGP SIGNATURE-----
Merge tag 'renesas-clk-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas
Pull Renesas clk driver updates from Geert Uytterhoeven:
- Add RTC and display clocks on RZ/T2H and RZ/N2H
- Add audio and display clocks and resets on RZ/G3E
- Add SDHI, GPU, and USB2.0 clocks and resets on RZ/G3L
- Update the maintainer for the VersaClock 7 driver
- Add CAN-FD clocks and resets for RZ/G3S
* tag 'renesas-clk-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers:
clk: r9a08g045: Add clocks and resets for CAN-FD
dt-bindings: clock: renesas,versaclock7: Update maintainer
clk: renesas: r9a09g047: Add LVDS clocks and resets
clk: renesas: r9a09g077: Add LCDC and PLL3 clock support for RZ/T2H display pipeline
clk: renesas: rzv2h-cpg: Extract PLL calculation helpers into shared library
clk: renesas: rzv2h-cpg: Use per-SoC PLL reference frequency for calculations
clk: renesas: r9a08g046: Add USB2.0 clock and reset entries
clk: renesas: r9a09g077: Add RTC clocks
clk: renesas: cpg-mssr: Implement dedicated MSTP delay logic for RZ/T2H LCDC and RTC
clk: renesas: r9a08g046: Add clock and reset entries for GE3D
clk: renesas: r9a08g046: Add clock and reset entries for SDHI
clk: renesas: r9a09g047: Add audio clock and reset support
dt-bindings: clock: renesas: Add audio clock inputs for RZ/V2H family
dt-bindings: clock: renesas,r9a09g077/87: Add PCLKRTC clock ID
dt-bindings: clock: renesas,r9a09g077/87: Add LCDC_CLKD clock ID
pcie_aspm_cap_init() disables ASPM L0s/L1 on both ends of the Link
before touching L1SS config, then later restores the LNKCTL state
that was in effect beforehand. Both steps use raw
pcie_capability_write_word() calls: the disable step computes the
new value by hand from a snapshot taken earlier in the function, and
the restore step writes that same snapshot straight back.
Switch both steps to pcie_capability_clear_and_set_word(), masked to
PCI_EXP_LNKCTL_ASPMC, matching the accessor pcie_config_aspm_dev()
already uses elsewhere in this file for the exact same register. This
does a live read-modify-write of just the ASPM Control bits instead of
relying on a stale snapshot for the rest of the word, and is
consistent with how the rest of the file already touches this
register. No functional change.
Fixes: 7447990137 ("PCI/ASPM: Disable L1 before disabling L1 PM Substates")
Closes: https://lore.kernel.org/all/20260721143945.86E7D1F000E9@smtp.kernel.org/
Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260727-aspm-v6-1-2ebb3ee7ef71@oss.qualcomm.com
Add a test case to REMOTE_TEST_MATRIX covering the bug fixed by
commit 345f401666 ("cgroup/cpuset: Return only actually allocated
CPUs during partition invalidation"). The test verifies that when a
sibling partition root changes its cpuset.cpus to overlap with another
partition root, only actually allocated CPUs (effective_xcpus) are
returned to the parent, not all CPUs in cpus_allowed.
Signed-off-by: Shaojie Sun <sunshaojie@kylinos.cn>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Commit 16a1d96835 ("mm/slab: remove mm/slab.c and slab_def.h")
removed the SLAB allocator, the only allocator that implemented cpuset
slab spreading. Commit 61a182ab61 ("cgroup/cpuset: Remove
cpuset_do_slab_mem_spread()") then removed the last task_spread_slab()
caller. Commit 3ab67a9ce8 ("cgroup/cpuset: Mark memory_spread_slab as
obsolete") marked the legacy control obsolete.
cpuset still updates PFA_SPREAD_SLAB when tasks attach to a legacy
cpuset and walks all tasks in a cpuset when memory_spread_slab changes.
Remove the unused task flag and its helpers, and make spread task
updates depend only on memory_spread_page.
Keep the memory_spread_slab control and CS_SPREAD_SLAB state so legacy
users retain the existing write, readback and inheritance behavior.
Update the comments and documentation to describe only page-cache
spreading as functional.
Assisted-by: LLM
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Matthieu Baerts says:
====================
mptcp: out-of-order queue pruning
Under memory pressure, a pruning of the MPTCP-level OoO queue might be
required as last resort, to avoid too long recoveries, or even stalls.
Geliang and Gang managed to reproduce this behaviour, and Paolo
improved the situation thanks to the following patches:
- Patches 1-3: improve the MPTCP-level retransmission schema to make
recoveries from memory pressure/after MPTCP-level drop significantly
faster.
- Patches 4-5: make the admission check way stricter for incoming
packets exceeding the memory limits, with some exceptions for fallback
sockets.
- Patches 6-7: implement OoO queue pruning for MPTCP.
====================
Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-0-dbc1eb853cc3@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
When moving incoming skbs in the msk receive queue and the latter
is above limits, prune it as needed quite alike what TCP is doing
at the subflow level. The main difference relies in the stop condition:
since MPTCP does not perform collapsing, it's better off dropping the
bare minimum to fit the (newer) incoming packet.
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Gang Yan <yangang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-7-dbc1eb853cc3@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Alike TCP, MPTCP handles in-sequence packets and partially overlapping
ones in a very similar way: we can use the same path to handle both,
avoiding some code duplication.
This will also make the next patch simpler.
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-6-dbc1eb853cc3@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Currently a wild producer could keep the backlog flushing operation
spinning for an unbound time.
Since the previous patch, the amount of data present in the backlog is
hard-limited. Move the backlog len update at the end of the flush loop to
prevent it spinning forever.
Also, no need to splice back the remaining skbs list into the backlog, as
such list is always empty after each backlog processing loop.
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-5-dbc1eb853cc3@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Currently the enforcement of the rcvbuf constraint is implemented
when moving the skbs into the msk receive or OoO queue, keeping the
incoming skbs in the subflow queue when over limits.
Under significant memory pressure the above can cause permanent data
transfer stalls, as the skb needed to make forward progress can be
stuck in a subflow queue.
Over memory limits, drop the incoming skb, relying on MPTCP-level
retransmissions.
Note that fallback socket must perform the limit before the skb reaches
the subflow-level queue, as dropping an in-sequence already acked skb
would break the stream.
This is not a complete fix for the stall issue, as the drop strategy
needs refinements that will come in the next patches.
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-4-dbc1eb853cc3@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Currently the MPTCP core enforces that when MPTCP-level retrans timer
fires, at most a single dfrag is retransmitted. In some corner-cases, it
may be necessary to retransmit multiple dfrags, and the MPTCP socket
will need to wait multiple retrans timeout to accomplish that.
Remove the mentioned constraint, allowing to transmit multiple dfrags
per retrans period, as long as the scheduler keeps selecting subflows
for retransmissions and pending data is available in the rtx queue.
The default scheduler will transmit a dfrag per available subflow.
Tested-by: Gang Yan <yangang@kylinos.cn>
Tested-by: Geliang Tang <geliang@kernel.org>
Acked-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-3-dbc1eb853cc3@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This allow separating the stale logic invocation and the retrans
scheduler, and will simplify the next patch.
It's also a cleaner design as the retrans scheduler has currently
too many side effects. As a possible downside, the retrans work will
now traverse the subflows list additional times; that does not matter
much, as this is slowpath.
While at it, pick more accurate names for the involved helpers and
explicitly note that the per subflow stale data is under msk socket
lock protection.
The scheduler and the stale logic may observe different subflow
statues, as no subflow lock is acquired. This is intentional and not
harmful, worst case leading to slower retransmissions.
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-2-dbc1eb853cc3@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This is a cleanup in order to make the next patch simpler.
No functional change intended.
Tested-by: Gang Yan <yangang@kylinos.cn>
Tested-by: Geliang Tang <geliang@kernel.org>
Acked-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-1-dbc1eb853cc3@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Core scheduling's pick_next_task() picks what to run on every SMT sibling of
the core in a single pass under the shared core-wide rq lock. The selection
state is consistent only while the lock is held continuously, so
->pick_task() originally could not release it. However, since 4c95380701
("sched/ext: Fold balance_scx() into pick_task_scx()"), sched_ext runs
dispatch from inside the pick and dispatching can drop the rq lock. To
support this, pick_next_task() has been updated to restart the whole
selection when a pick returns RETRY_TASK after releasing the lock.
When selections on the same core interleave through the dropped lock, they
corrupt each other's state: one clears the other's rq->core_pick leading to
a NULL deref, or invalidates its keep-the-previous-task decision leaving a
dequeued task running, which deadlocks the next wakeup and matches the
reported hard hangs. A cookied ping-pong load on an SMT machine makes the
interleavings frequent and kills the kernel within seconds.
Fix it by making the pick return RETRY_TASK whenever dispatch released the
rq lock, so that a selection only ever commits picks made under a
continuously held lock. The previous patch's rq->scx.lock_drop_seq counts
the releases. A dispatch that touched nothing never releases the lock and
its verdict, including "nothing to run", stands: retries are bounded, each
following a dispatch that actually did something, and an idle CPU does not
loop.
If another dispatch is already in flight on the rq, skip dispatching and
pick from what is already queued locally - the in-flight dispatch has
released the lock, so its own selection will retry and re-pick this rq,
while returning RETRY_TASK here would only spin on the lock that dispatch
needs to finish.
Balance callbacks must run in the context that queued them, so they can only
be queued on the CPU's own rq. When dispatching for another rq, run the
deferred work directly instead - that rq may consume all its picks through
the core-sched fast path and never queue the callback itself.
The put_prev_task_scx() warning about a runnable task being left behind
assumed that dispatch ran as part of the very pick that is switching away.
That now only holds on the non-core path, so gate it and drop the
cookie-match test, which is always true without core scheduling, from its
condition.
Fixes: 4c95380701 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Reported-by: ElXreno <elxreno@gmail.com>
Link: https://github.com/sched-ext/scx/issues/3715
Signed-off-by: Tejun Heo <tj@kernel.org>
Under core scheduling, pick_next_task() selects for all SMT siblings under
one continuous hold of the shared core-wide rq lock, and sched_ext's
dispatch can release that lock from inside the pick. In preparation for
making the core-sched pick detect the releases and retry, add
rq->scx.lock_drop_seq and bump it at every site that can release an rq lock
while a dispatch may be in flight. The counter is only maintained while core
scheduling is enabled. No functional changes.
Fixes: 4c95380701 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Tejun Heo <tj@kernel.org>
Under core scheduling, dispatch runs from within the core-wide pick and can
target a sibling rq, so ops.dispatch() may execute on a CPU different from
the dispatched rq's. Several kfunc paths assumed the two always coincide:
- scx_dsq_move() decided whether an rq lock is held by testing this_rq()'s
rq flags and lock-danced accordingly. A dispatch for a sibling took the
unlocked-context branch and acquired the source rq lock on top of the
already held dispatched rq lock which could deadlock.
- scx_bpf_sub_dispatch() dispatched this_rq() with its stashed
sub_dispatch_prev, which is NULL when dispatching for a sibling.
- finish_dispatch(), scx_bpf_dsq_reenq() and scx_bpf_dsq_nr_queued()
resolved SCX_DSQ_LOCAL to this CPU's local DSQ rather than the dispatched
rq's. The latter two are callable from other rq-locked operations too,
where SCX_DSQ_LOCAL now likewise resolves to the op's rq. This changes
behavior also without core scheduling, e.g. for ops.enqueue() running a
remote wakeup on the waking CPU, and is intended: which CPU happens to
execute an operation is incidental, the op's rq is what it is operating
on, and the resolution now matches the insert side where SCX_DSQ_LOCAL
dispatches land on the task's rq.
Use the rq tracked by scx_locked_rq(), which is set to the dispatched rq
around ops invocations and NULL in unlocked contexts.
Fixes: 4c95380701 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Tejun Heo <tj@kernel.org>
SCX_RQ_BAL_KEEP tells the pick to keep running the previous task, a leftover
from when balancing and picking were separate operations. An rq-level flag
only works while dispatches and picks pair up one to one, which core
scheduling breaks: selections interleave through dispatch's lock drops and a
pick can consume a stale flag, keeping a task that has since been dequeued.
Fixing core scheduling support requires the decision to travel with the
dispatch that made it. Make scx_dispatch_sched() and balance_one() return an
explicit verdict instead and drop the flag's plumbing from the tools autogen
enum headers.
Also factor the pick-side invocation, its follow-up queueing and the
post-dispatch checks out of do_pick_task_scx() into dispatch_pick(). No
functional changes intended.
v2: Drop the SCX_RQ_BAL_KEEP plumbing from the tools autogen enum headers
as well (Andrea).
Fixes: 4c95380701 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Tejun Heo <tj@kernel.org>
Core scheduling's pick_next_task() operates on all sibling rqs under one
acquisition of the shared core-wide lock. A ->pick_task() that releases the
rq lock leaves every sibling __lock momentarily free, letting
__sched_core_flip(false) complete mid-selection and rebind rq_lockp() under
it. The selection resumes on the split locks, touching sibling state it no
longer protects, and __schedule() finally releases a lock that was never
taken while leaking the one that was.
Count in-flight core-wide selections in the leader's rq->core_pick_in_flight
and make __sched_core_flip() wait for the count to drain. The count only
changes under the shared lock, which the flip holds while sampling, so no
other ordering is needed. The wait can repeat while selections overlap, but
the flip backs off between samples and flips are rare cookie-lifetime
events.
sched_core_cpu_deactivate() moves the count to the new leader - a stale copy
left behind would bias it forever if that CPU later returns as its own
leader.
Fixes: 539f65125d ("sched: Add core wide task selection and scheduling")
Cc: stable@vger.kernel.org # v5.14+
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Core scheduling's pick_next_task() breaks when a ->pick_task()
implementation can release the rq lock. The selection state derived on entry
is only valid while the lock is held continuously. Once a pick can drop the
lock, an interleaving selection can invalidate all of it: the single-CPU
fast path can commit an uncookied pick although the core went cookied during
the release, and forceidle committed by the interleaving selection skews the
restarted pass's accounting.
Fix it by restarting the whole selection when a pick returns RETRY_TASK
after releasing the lock: a single restart point above the state derivation
replaces the per-loop restart labels, so a retry picks up state committed by
interleaving selections and accounts and resets forceidle like a fresh
selection would.
need_sync and fi_before latch across retries. Clock validity can't be
re-derived - there is no program-ordered way to tell whether the own and
core rq clocks are still updated after the lock was released, as other
lockers' pin cycles may or may not have invalidated them. When restarting,
clear core_clock_updated so that the sibling loop re-updates the core rq,
and update the own rq clock if invalidated.
Fixes: 4c95380701 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEjF9xRqF1emXiQiqU1w0aZmrPKyEFAmp6Gj8ACgkQ1w0aZmrP
KyEx1g//bypx1snnipwTemj5j+X/X+GXgM69s6uwgTWsgSzV8pcJMJHRHPiN4K7J
1S7oDX/M0Rzy2vmapOHvSulS2cOqXdaMPNRu+Ck0OAEAMCEEUBPA/wQDaxAT977z
0UulzQi0c29JAsWGvHWO0LeLJ9+EFT6/piLxoAdd9R7LHsqkNQl+oxeiuetSm7F7
y2A4x7coLHC5EkrLXg++7H/kGI62I/UloKpwaqx5dCzktQxLaOYdINtmdTGD2A2v
L5xO+ptegjJjrUL8ogopY1O/Dek3BMLtAbWyJ3qjx9Qe20Ts5yG9bmy4WmpoZC5S
QVBjKcdOkhkhjg/dQVtRRyF6KxUjFm6cvCgxfw2XEHCYk6wyLWpdXxuPkAuwjoO2
Jig/BZDm3GEdUqBvXVPGbak8Kv7kcQAwgxhqIsEUgQ77zgxNZDBzK3VyEa7Zpydq
xF2LL4zGEL4QCojD+JtjRXqdXr4F+WgzMIFNLQrIvNzwDyDpwdUMuj+MilOyFEJo
xIcSgJnkpr5mtD3ib7+rUnxKhZfhag5IIUyAwq/16+UXa9aM4qbqrm2JScevm789
e+0iArkAYXaaOzmRmu5iiDqldt5gG3gAELLs50YFT+KwU/yZYyLJNMTIMSR/eO3w
7wZhDBe2fOXdj5NY/qTRFbdAnF4VAPXfSob7/E7nRch8VT75YIU=
=p0hS
-----END PGP SIGNATURE-----
Merge tag 'nf-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says:
====================
Netfilter/IPVS fixes for net
The following patchset contains Netfilter/IPVS fixes for net. Still
large batch for this late -rc cycle but at least half of these fixes
in this batch have been cooking for several weeks before:
1) Fix race between ipset list:set GC and swap, use write_lock instead
of rcu read lock section when accessing the index to ensure
interference with ip_set_swap(), from Xiang Mei.
2) Release template conntrack in bridge conntrack when packet is
neither IPv4 nor IPv6 before setting skb as untracked.
From Zhiling Zou.
3) A series of 3 patches for IPVS to address sashiko reports:
Schedulers read destination overload state while connection
accounting and destination configuration can update it concurrently.
The first patch adds a single total connection counter. The second
patch uses it to identify threshold crossings precisely, and updates
OVERLOAD at the crossings and on a threshold edit under dst_lock.
The third patch moves configuration-controlled AVAILABLE to a
separate cflags word, so it cannot clobber OVERLOAD through an
unrelated read-modify-write update.
4) Log invalid packets in TCP and SCTP connection tracking to address
a deadlock when nfnetlink_log is used as logging backend and the
nfnetlink_log conntrack glue support is used. From Zihan Xi.
5) Wait for rcu grace period before releasing pernet state in
nfnetlink_log, otherwise packets can end up access already released
memory, triggering UaF. From Florian Westphal.
6) IPVS needs to reset IP information in control buffer in skbuff when
encapsulating IP packets in ICMP, from Kyle Zeng.
7) IPVS needs to validate ihl field of inner headers in when handling
ICMP response, from Julian Anastasov.
8) Remove a WARN_ON_ONCE reachable from the nf_tables hardware offload
when triggering ENOMEM on GFP_KERNEL allocation,
from Alexey Velichayshiy.
9) Publish reply tuple into the flowtable hashtable first, otherwise
GC might walk over a released tuple when insertion of the original
tuple fail. From Jeremy Jean.
10) Elide counter increment when replacing an ipset element,
from Florian Westphal.
11) Remove unneeded ipset accounting resets on destruction/flush,
from Florian Westphal.
* tag 'nf-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
netfilter: ipset: let destroy callbacks adjust ext mem size
netfilter: ipset: fix list type element drift bug
netfilter: flowtable: publish GC-visible tuple last
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
ipvs: revalidate ihl to prevent out-of-bounds access
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
netfilter: nf_conntrack: defer invalid log until after unlock
ipvs: separate destination availability state
ipvs: properly update the overload flag on dest edit
ipvs: add totalconns for dest
netfilter: bridge: release template ct on non-IP path
netfilter: ipset: fix refcount race between list:set GC and swap
====================
Link: https://patch.msgid.link/20260810190621.894119-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The devlink port_split test has limited applicability.
NICs (as opposed to switches) require at least a re-probe
to apply the split configuration.
On top of that the test is not compatible with our driver env,
it just splits all ports on the system, not only what NETIF
points at.
Long term we may want to add some indication in devlink whether
the port splitting is runtime (cmode of sorts), and fix the
test to follow driver env. But since no (known) NIC driver can
support runtime anyway let's just hide the test from the selftest
framework by moving it to extra files.
Having this test randomly break unrelated NICs within the DUT
makes people implement allow-lists for ksft, which then means
their setups don't run new tests. It's very useful during test
review to see whether the test works across all the runners.
Reviewed-by: Petr Machata <petrm@nvidia.com>
Link: https://patch.msgid.link/20260811004645.1072124-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode
through the walker callback. u32_bind_class() unconditionally casts the
passed fh to tc_u_knode and accesses &n->res, so when fh is actually a
tc_u_hnode, which has no tcf_result member, this results in a
slab-out-of-bounds read of res->classid in tc_cls_bind_class().
The issue can be reproduced with the following commands:
tc qdisc add dev lo root handle 1: hfsc
tc class add dev lo parent 1: classid 1:1 hfsc sc rate 1000kbit
tc filter add dev lo parent 1:1 protocol ip prio 1 u32 match u32 0 0 flowid 1:1
tc class add dev lo parent 1: classid 1:2 hfsc sc rate 2000kbit
Fix this by skipping hash tables via the TC_U32_KEY(handle) check.
Fixes: 07d79fc7d9 ("net_sched: add reverse binding for tc class")
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/1786089038-36366-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The patch mentioned in Fixes missed one main point of implementing
proper PTM support. To make it fully operational it has to be explicitly
enabled. Add missing call in probe callback and disable it in teardown
callback.
Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Link: https://patch.msgid.link/20260806201849.3161402-1-vadim.fedorenko@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Harshitha Ramamurthy says:
====================
gve: Bug fixes for header-split and PTP
This series contains 2 bug fixes for gve.
Patch 1 fixes an issue which causes TX timeouts due to HW detection of
an illegal descriptor. This happens when receiving header-only packets
with header split enabled - this produces an SKB with a zero-length
fragment.
Patch 2 prevents a kernel NULL pointer dereference by stubbing the PTP
adjfine callback.
====================
Link: https://patch.msgid.link/20260807224315.234152-1-hramamurthy@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
When header split is enabled and a header-only packet is
received such as a pure TCP ACK, GVE will indicate an
RX SKB with a zero-length fragment. If this SKB is then
hairpinned and sent back out, the GVE TX path will emit
a zero-length descriptor. Hardware considers this
an illegal descriptor and stops the queue, causing a
TX timeout and interface reset.
Fix it by not adding the zero-length skb frag.
Cc: stable@vger.kernel.org
Fixes: 5e37d8254e ("gve: Add header split data path")
Suggested-by: Praveen Kaligineedi <pkaligineedi@google.com>
Co-developed-by: Ziwei Xiao <ziweixiao@google.com>
Signed-off-by: Ziwei Xiao <ziweixiao@google.com>
Signed-off-by: Jordan Rhee <jordanrhee@google.com>
Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
Link: https://patch.msgid.link/20260807224315.234152-2-hramamurthy@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Marcelo Mendes Spessoto Junior says:
====================
net: selftests: adjustments to ipv6_flowlabel_mgr
The ipv6_flowlabel_mgr test file was lacking coverage for the
IPV6_FL_A_RENEW action, and the IPV6_FL_F_REMOTE and IPV6_FL_F_REFLECT
flags. The first two patches from this set aim to add a proper test
case for RENEW and REMOTE.
The third patch was added to insert network namespace creation inside
the test suite, instead of relying on external wrapper scripts. This
change conforms to other net test implementations, such as
tools/testing/selftests/net/icmp_rfc4884.c, and it is important for
the fourth and fifth patches.
The fourth patch adds the IPV6_FL_F_REFLECT test.
The fifth patch proposes the adoption of "kselftest_harness.h" helpers,
improving code readability and conforming to the implementation of the most
recent selftests.
====================
Link: https://patch.msgid.link/20260807220942.421382-1-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The kselftest_harness.h file contains modern helpers to build tests
for kselftest. Dropping the custom test helpers in ipv6_flowlabel_mgr
in favor of the harness makes tests more legible and conforms to the
structure of the latest selftests. It also enforces the TAP standard.
Another change made to the structure of the ipv6_flowlabel_mgr test
file was the removal of parse_opts. The supported opts were already
unused: the binary is listed in TEST_GEN_FILES, and is driven solely
by ipv6_flowlabel.sh via "./ipv6_flowlabel_mgr", which never passed -l
or -v. Dropping the -l gate means the two checks it previously guarded
(each with a 13-second sleep, ~26 seconds total) are now
unconditionally enabled on every run instead of never running at all.
The TH_LOG calls and code comments now cover the information that the
removed, custom -v flag used to print.
Finally, FIXTURE_SETUP(flowlabel) ensures each test gets its own
isolated network namespace. The previously added setup() helper was
dropped to conform to the netns setup pattern used in icmp_rfc4884.c.
disable_flowlabel_consistency() was moved next to reflect_flag, the
only test that calls it, and now uses SKIP() instead of an ad hoc
[INFO] message when the sysctl cannot be disabled.
Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
Link: https://patch.msgid.link/20260807220942.421382-6-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
According to the source code, flowlabel_consistency must be
deactivated for the IPV6_FL_F_REFLECT flag to work. Since
ipv6_flowlabel_mgr now runs in its own network namespace, do this
directly from the test binary. Attempt to disable
net.ipv6.flowlabel_consistency and skip the reflect test if that
fails. A disabled flowlabel_consistency does not affect the remaining
features being tested on the file, and failing to disable is not fatal
and skips the reflect test only.
The previously defined tcp_listen and tcp_connect helpers were reused,
since the connection flow required for REFLECT validation is very
similar to REMOTE.
Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
Link: https://patch.msgid.link/20260807220942.421382-5-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Have ipv6_flowlabel_mgr create and configure its own network
namespace (unshare(CLONE_NEWNET) + bring up lo), the same way
ipv6_fragmentation.c and icmp_rfc4884.c already do, instead of
relying on the in_netns.sh wrapper script.
The setup can then be reused across tests through fixtures and
provide isolated network environments for each test in the case
of a future adoption of kselftest_harness.
It also avoids the leak of modifications to the netns in case the
user runs the test file directly, outside the wrapper and without
the in_netns.sh file.
Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
Link: https://patch.msgid.link/20260807220942.421382-4-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This flag retrieves the flow label seen by the socket at connection
setup via a getsockopt query. Therefore, the validation of this flag
requires a brief connection setup (source code for flow label shows
it must be TCP).
The simple TCP connection logic was wrapped inside two simple helpers,
because there are other uncovered features of flow label mgr that
could benefit from it (such as IPV6_FL_F_REFLECT).
Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
Link: https://patch.msgid.link/20260807220942.421382-3-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
RENEW was the only flow label action without selftests coverage.
Assert renew returns no error on correct usage and fails for labels
that do not exist.
This test is based on the previously implemented EXCL share test,
which demonstrates that a new flow label with the same value can be
created after the linger period. Renew is used here to show that a
flow label can last longer and block a new flow label creation after
the previous linger time. This test, however, demands sleep during
execution, and should be placed as a conditional test under the -l
option.
The addition of the expect_fail_errno helper is necessary to assert
the corresponding error when a function can fail in multiple ways.
Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
Link: https://patch.msgid.link/20260807220942.421382-2-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking
rcu_access_pointer(a->goto_chain) and then calling
tcf_action_goto_chain_exec(), which does a second, independent
rcu_dereference_bh(a->goto_chain) read and immediately dereferences
chain->filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact
replace path) can clear a->goto_chain between the two reads, so the second
read returns NULL and tcf_action_goto_chain_exec() dereferences NULL.
Fix the race by doing a single rcu_dereference_bh() read of a->goto_chain
in tcf_action_exec(), checking it once for NULL, and passing the resulting
chain pointer into tcf_action_goto_chain_exec(). This turns the split
check/use into a single check/use on one value.
Fixes: ee3bbfe806 ("net/sched: let actions use RCU to access 'goto_chain'")
Reported-by: vega@nebusec.ai
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Link: https://patch.msgid.link/20260809090928.868186-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Tariq Toukan says:
====================
devlink: add generic device max_sfs parameter
This series by Nikolay introduces a new generic devlink device
parameter, max_sfs, to control the number of light-weight NIC
subfunctions (SFs) that can be created on a device.
The first patch adds the generic devlink parameter and infrastructure
support.
The second patch implements support for the parameter in the mlx5
driver.
With this addition, users can enable or disable SF creation directly via
devlink, without relying on external vendor-specific tools.
====================
Link: https://patch.msgid.link/20260806073037.3001886-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Implement max_sfs generic parameter to allow users to control the total
light-weight NIC subfunctions that can be created using devlink instead
of external vendor tools. A value of 0 will effectively disable creation
of new subfunction devices. A warning is sent to user-space via extack
(returning extack without error code is interpreted as a warning by
user-space tools). The maximum value is capped at U16_MAX.
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260806073037.3001886-3-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Add a new generic devlink device parameter (max_sfs) to control if and
how many light-weight NIC subfunctions can be created. Subfunctions are
a light-weight network functions backed by an underlying PCI function.
Their lifecycle can already be managed by devlink, but currently users
cannot enable them in the device. They can be enabled/disabled only via
external vendor tools. This parameter allows subfunctions to be enabled
(>0) or disabled (0) via devlink. A subsequent patch will add support
for max_sfs to the mlx5 driver.
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260806073037.3001886-2-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
List all the files of the QCA8K DSA Switch driver and add myself as
maintainer.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20260810143740.652804-1-ansuelsmth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Tung Quang Nguyen has been working as the de facto TIPC maintainer
for a few years now. Make sure the MAINTAINERS file reflects this
reality. Dealing with the flood of AI patches is a significant
effort, and Tung's work and responsiveness is exemplary.
Link: https://patch.msgid.link/20260810180148.680425-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():
skb_assert_len
WARNING: at include/linux/skbuff.h:2753 skb_assert_len
WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781
Call Trace:
<TASK>
dev_queue_xmit include/linux/netdevice.h:3448 [inline]
packet_xmit+0x243/0x310 net/packet/af_packet.c:276
tpacket_snd net/packet/af_packet.c:2907 [inline]
packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134
When sending 0-byte packets via TPACKET ring buffer on devices with no
hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb()
populates an skb with skb->len == 0 and returns 0. tpacket_snd() then
forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to
hit skb_assert_len(skb).
Similar checks exist in packet_snd() via commit dc633700f0
("net/af_packet: check len when min_header_len equals to 0") and in
packet_sendmsg_spkt() via commit 6a341729fb ("af_packet: Don't send
zero-byte data in packet_sendmsg_spkt().").
Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject
zero-length packets in tpacket_snd().
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+30b93b6845b19cc38581@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a79e807.01d0871a.3a0d52.00ac.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260810150447.1220864-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
In the cleanup_srcu_struct() function, when iterating over per-cpu's
srcu_data, timer_delete_sync(&sdp->delay_work) is called to cancel the
delayed work before doing flush_work(&sdp->work).
However, suppose that timer_delete_sync() returns 1, which means that it
successfully deleted an pending timer before it had a chance to fire.
But this also means that the sdp->work will not be queued, so that the
subsequent flush_work(&sdp->work) will returns immediately without waiting
for anything. Taken together, all of this means that any recently queued
SRCU callbacks to not be invoked, which can result in memory leaks,
hangs, or worse.
Fix this by checking the return value of timer_delete_sync(), if it
returns 1, explicitly queue sdp->work so that the callbacks will be
invoked and the following flush_work() will correctly wait for all of
those callbacks to finish executing.
[ Zqiang: Apply feedback from Breno Leitao and kernel test robot. ]
Signed-off-by: Zqiang <qiang.zhang@linux.dev>
Tested-by: kernel test robot <oliver.sang@intel.com>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
According to PCIe r7.0, sec 5.3.3.2, two link wakeup mechanisms are
defined: Beacon and WAKE#. Beacon is a hardware-only mechanism and is
invisible to software (sec 4.2.7.8.1). This change adds support for the
WAKE# mechanism in the PCI core.
According to the PCIe specification, multiple WAKE# signals can exist in a
system or several components in the hierarchy may share a single WAKE#
signal. In configurations involving a PCIe switch, each downstream port
(DSP) of the switch may be connected to a separate WAKE# line, allowing
each endpoint to signal WAKE# independently. From figure 5.4 in sec
5.3.3.2, WAKE# can also be terminated at the switch itself. Such topologies
are typically not described in Device Tree, therefore it is out of scope
for this series.
To support this, the WAKE# should be described in the device tree node of
the endpoint/bridge. If all endpoints share a single WAKE# line, then each
endpoint node shall describe the same WAKE# signal or a single WAKE# in the
Root Port node.
In pci_device_add(), PCI framework will search for the WAKE# in device
node. Once found, register for the wake IRQ through
dev_pm_set_dedicated_wake_irq() associates a wakeup IRQ with a device and
requests it, but the PM core keeps the IRQ disabled by default. The IRQ is
enabled by the PM core, only when the device is permitted to wake the
system, i.e. during system suspend and after runtime suspend, and only when
device wakeup is enabled.
If the same WAKE# GPIO is described in multiple device tree nodes, only the
first device that successfully registers the wake IRQ will succeed, while
subsequent registrations may fail. This limitation does not affect
functional correctness, since WAKE# is only used to bring the link to D0,
and endpoint-specific wakeup handling is resolved later through PME
detection (PME_EN is set in suspend path by PCI core by default).
When the wake IRQ fires, the wakeirq handler invokes pm_runtime_resume() to
bring the device back to an active power state, such as transitioning from
D3cold to D0. Once the device is active and the link is usable, the
endpoint may generate a PME, which is then handled by the PCI core through
PME polling or the PCIe PME service driver to complete the wakeup of the
endpoint.
WAKE# is added in dts schema and merged based on below links.
Link: https://lore.kernel.org/all/20250515090517.3506772-1-krishna.chundru@oss.qualcomm.com/
Link: https://github.com/devicetree-org/dt-schema/pull/170
Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Acked-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260707-wakeirq_support-v12-1-b4453f5bcc97@oss.qualcomm.com
