mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,484,294 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
4e9a2de02f |
slab fixes for 7.3-rc5
-----BEGIN PGP SIGNATURE----- iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmq/c2obFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJELvgsHXSRYiaJYQH/ihZin6VQt7ya7uIOFko FrAaalrw62d72vi3oRTOf3aTJY+tZLnoimGYVzBFBo9E6I7J5wpDbCJM+T0XGnBU ri98rBwjJHGO0hY12lKAlgMAmo4TQyyWLJEj2lCmsThIP8YkU9e3D3GUzgBuDzU3 vo3/kKdppj4UkFJ1dYMj+lGHPw+47WY/fscfv9atYCqAzWG/em2y0zQ/ay5mfI7h X3yiwJxeR8EsIOwBEuqurBk9rz0yMErcsb9DVgyDU23Y9SxnDL5BEr4dBuUQnV+b kru/RuPJ2Ubs8ZrlCm6T6a3yjgXZOg3m/YqJPlYX1OY1MKmZ3gefBpwcth2QiEA7 nUE= =6OkX -----END PGP SIGNATURE----- Merge tag 'slab-for-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab Pull slab fixes from Vlastimil Babka: - Stable fix for a potential deadlock in kfree_rcu() when called from set_cpus_allowed_force() (Harry Yoo) - MAINTAINERS update of the slab.git URL * tag 'slab-for-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab: mm/slab: do not wake up kswapd in __kfree_rcu_sheaf() MAINTAINERS: update slab.git URL |
||
|
Linus Torvalds
|
5e0f8396d4 |
hid-for-linus-2026100201
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEoEVH9lhNrxiMPSyI7MXwXhnZSjYFAmq/Y/IACgkQ7MXwXhnZ SjbT/RAAj7UFMT0n8z0bIScwEwzBABlpSYJlqjIg7gLlPTTKA6QWHkK7JWMNjGbP fBLH74kYz4a5e+lCv/zUm+Knw31z6GTzSRjF7wvJB2g+pAFcAfBJp595CiRXMoqg fprWpk616wsyD/5P4auJFcFfJxKvQl4TppiIJF0DuDz+/t3ZQOCG9NHCu6fvVGRH kId+OdETHgSBakgdNCNDQpPDNTC1heF68lb4chhiwpH5SrRyIXrtM7x8jgYEv/Jk 5k+qKPh2OSSah5xZlqXtxlMPd2So0BKgBae3eLZNVdHmztnhpCC1EyRVNrkacFOS UF2V0iY+vO+GQIvm6ktd27UH4d9qCY0u4WG5FV2X2BciJHfhzCFk0W5VAESsEP8j IvL/c3O3dn8ZHqveR9vTqE59B5WG5JNXFNTkoux7Mz0r2sSqZl/T86njX+j1uapT i1rrkKsj9oDh2vQcuggBQXHe1N2L0qY712pZyD+97DkF1t9Salg1pYKsMQ8A4hcF Er8x0ksZ49k2UT2R3jrsDiNWLzoit89zYbfViBXVZWAyoBkrytiOh5W2TPzEScNW sYVi/Bk55hGujhHLb/xULUAHsAlGL+Z7J1TWeWwdwqYKrytTbtZlkljvtbvqymSH DjJpehscXtkz2+1EwmUF3PwHWnE2/h8ARDNLC5qIlWD/izYf8ms= =oV+e -----END PGP SIGNATURE----- Merge tag 'hid-for-linus-2026100201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - Revert of the Bolt integration into hid-logitech-dj (Benjamin Tissoires) - A couple of buffer overflow in Intel-thc-hid (Even Xu) - A couple of Sashiko findings fixes in hid-multitouch and HID-BPF (Aldo Ariel Panzardo and Benjamin Tissoires) * tag 'hid-for-linus-2026100201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: selftest/hid: add test for negative return codes for hid_bpf_hw_request HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request HID: Intel-thc-hid: Intel-quickspi: Fix buffer overflow HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow HID: universal-pidff: Add support for Turtle Beach VelocityOne Race HID: multitouch: stop the release timer from being rearmed on remove Revert "HID: logitech: add Bolt receiver support for Logitech HID++ devices" |
||
|
Linus Torvalds
|
17a5800975 |
Hi,
Please pull these bug fixes, which have landed after v7.3-rc1. Br, Jarkko -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRE6pSOnaBC00OEHEIaerohdGur0gUCar9DmQAKCRAaerohdGur 0sVVAQDxPpzxXpSI1RaGiLK/Xd30r0Oy+mMpjktACUHC4C0KtQEAl32hX/eiGt7k dg35RzAKtXfGDl0FOgXo6YnHAVQ5oA0= =76Ob -----END PGP SIGNATURE----- Merge tag 'for-next-tpm-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen. - tpm error handling and buffer size fixes * tag 'for-next-tpm-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: Disable TPM on null key name mismatch tpm: fix off-by-four bounds check in tpm2_get_random() tpm: Fix auth session leak in tpm2_get_random() error path tpm: Fix heap buffer overflow in tpm_transmit_cmd() |
||
|
Linus Torvalds
|
ce1e0223d8 |
Devicetree fixes for v7.3, part 2:
- Fix another case of refcount leaks in of_irq_init() - Avoid refcount leak in coreboot node check - Fix overlay handling of a root node target path - Various error path fixes in the overlay code -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEktVUI4SxYhzZyEuo+vtdtY28YcMFAmq+tXEACgkQ+vtdtY28 YcNyDhAAhm+jSoF9Ht/n77hO4aDyigFDJg/jazfQP8nDCgWBL5ZqgK/q92b6FN02 8cX/3D201/+SzYY64AJBPqakmIZQ+hX5TcNjri8k7zeyC7eLhe37yt8RD7dnkhlp 7lIbZTfxf8cst91YQml/iX9jCIrZnZu+U/2XA7CUnt2TCXAb6ZeArr7h1VrwKdUv zOxQCMaz6ULuK5xmyTKnpxyL/XhuZv4o1OJ0xVi7A7VKHiz1WyRTHCsUqmqBoatI tWxuap8VXfRP0r7rS1dV0Rpexl7hAMH0tnixmQVhnh60W+xMeGcYIIjlRGqPgxmA KnKb7g0Z+Ds8wky0nMuQhlwRy0OKvUoPcqz60kCZNwvBayY27vcZD8bin66Kz0NV PHnYhqXeF9CTgobRB8LllNTH6Z33ZqY9Z7I/FWkMlD0lNftSFV4JRW06VBgvfZzV DVgSL2oMnHs9T9Xr9alU7LvG/D4diuFBoHEoDJR5U7EbAT3XGyKaupBLT2hYc+5k rEv6alqyJCJtunVQcWPGrSFnObzCYBuq9vFQRlIlLRa58/7bwUITovI/W4kywHrd uW9qHx7z+kOdEuA4DKQOfFOuXuP7kR4m9zxqo7m3v+J165Ri7L18uYivKw0DcjHC lDVOzErZiDkhIecw0N09PUhwlzAHTVkpHMPGsgyjbbpOvhvOS+k= =u3lS -----END PGP SIGNATURE----- Merge tag 'devicetree-fixes-for-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix another case of refcount leaks in of_irq_init() - Avoid refcount leak in coreboot node check - Fix overlay handling of a root node target path - Various error path fixes in the overlay code * tag 'devicetree-fixes-for-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of/irq: Fix remaining refcount leaks in of_irq_init() of: Put coreboot node after compatibility check of/overlay: don't create "//" paths for fragments targeting the root of/overlay: don't leak fragment references when changeset init fails of/overlay: only treat a positive changeset id as registered of/overlay: put property on deadprops only after changeset add succeeds |
||
|
Linus Torvalds
|
100638f0f0 |
Power management fix for 7.3-rc6
Restore the previous behavior on systems where the cpufreq pressure was not visible in the scheduler and is not expected to be visible there, but it became visible after a change made during the 7.2 development cycle that had gone too far. -----BEGIN PGP SIGNATURE----- iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmq+o/MSHHJqd0Byand5 c29ja2kubmV0AAoJEO5fvZ0v1OO18NYH/0E2ahrPVP/InY9OIuXKy9GejDnqJBb/ UdV2bZb76txHhTDXkw9idY7Ke8LdhOpDyPuJci3n9E60NzEY/1GRq794yT/8apz1 jeSzR29fjdSLh7BCyPlRNsaYVBBPlFLtKaShRyik81Z4IGF9GKrnHRRNyTtJKOBV zV2F7fFE1RVXL2QhpVFCOtJ+D1R0ygfffo1mTql87eoNj0YPBFBZ183/Ssb4S/4g CROWsw/sg9RfQ7uXyOZYxZowpqDyHrUn/LnTkVoq8dYW2mHV2tSQddzQOU8uW6oV XupbLRs5b2V9w11FZInvs6CJWfTa6kRwvUkVUcu1A5encyRtnIhO5LQ= =Kp/y -----END PGP SIGNATURE----- Merge tag 'pm-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Restore the previous behavior on systems where the cpufreq pressure was not visible in the scheduler and is not expected to be visible there. It became visible after a change made during the 7.2 development cycle that had gone too far" * tag 'pm-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: intel_pstate: Fix max_freq fallback in cpufreq_update_pressure() |
||
|
Linus Torvalds
|
bd35955b08 |
Crypto library fixes for v7.3-rc6
- Fix a performance regression in certain AES encryption modes on certain architectures, introduced this cycle. - Fix a small performance regression in the x86_64 optimized AES-GCM code, introduced in 6.15. -----BEGIN PGP SIGNATURE----- iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCar6ZLxQcZWJpZ2dlcnNA a2VybmVsLm9yZwAKCRDzXCl4vpKOKzYvAQDtb68vX+UySUeUo+dGaaZWZv03zKEZ QxnsS78p1jvKZgD9FkcqZ6oe2wDPMnpZGV0tg5OpTBfwm+agX08I83tZjQU= =gSeD -----END PGP SIGNATURE----- Merge tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: - Fix a performance regression in certain AES encryption modes on certain architectures, introduced this cycle - Fix a small performance regression in the x86_64 optimized AES-GCM code, introduced in 6.15 * tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: crypto: aes - Fix undesired override of some optimized AES modes crypto: x86/aes-gcm - fix always true check for last AAD segment |
||
|
Linus Torvalds
|
a940b03cee |
ARM:
- Take a reference on the last IRQ loaded into an LR to prevent it from being freed while running the guest (Marc Zyngier) - Ensure that the ITS MOVALL command only affects LPIs that were previously affined to the source redistributor (Marc Zyngier) - Fix + test for honoring the host's trap configuration when running non-protected VMs while KVM is in protected mode (Fuad Tabba) - Use the host stage-1 mapping granularity for VM_PFNMAP mappings at stage-2 (Mostafa Saleh) x86: Various bugfixes where the guest could do stupid things on purpose to cause problems in the host: - Failed VMRUNs can cause pending TLB flushes to be dropped, and in general some actions done through VMCB control fields have to be redone if VMRUN fails - Toggling MSR interceptions or eVMCS execution controls can cause the host to use a stale MSR permission bitmap - Bad page tables can cause a WARN. Also fix issues in last week's pull request (my fault, for changing email workflow and thus missing feedback sent to kvm@ but not LKML). Generic: - Take kvm_lock when creating vCPUs. For almost two decades everybody thought it was not done for some unspecified performance reasons, but in reality it was only done because kvm_lock was originally a spinlock. This is a better fix than |
||
Paolo Bonzini
|
f9bfc323e7 |
KVM/arm64 fixes for 7.3, round #2
- Take a reference on the last IRQ loaded into an LR to prevent it
from being freed while running the guest (Marc Zyngier)
- Ensure that the ITS MOVALL command only affects LPIs that were
previously affined to the source redistributor (Marc Zyngier)
- Fix + test for honoring the host's trap configuration when running
non-protected VMs while KVM is in protected mode (Fuad Tabba)
- Use the host stage-1 mapping granularity for VM_PFNMAP mappings at
stage-2 (Mostafa Saleh)
-----BEGIN PGP SIGNATURE-----
iI0EABYKADUWIQSNXHjWXuzMZutrKNKivnWIJHzdFgUCar6KFRccb2xpdmVyLnVw
dG9uQGxpbnV4LmRldgAKCRCivnWIJHzdFoQxAP4lpoLN5+XlRshepgo+t/hZnhqj
4X6A8t7gtKv1iSp9WgD9FOeekzRH8HunEyjTyez/SmIb4ZZ9yYSMd5wIXX7uqgE=
=FD18
-----END PGP SIGNATURE-----
Merge tag 'kvmarm-fixes-7.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD
KVM/arm64 fixes for 7.3, round #2
- Take a reference on the last IRQ loaded into an LR to prevent it
from being freed while running the guest (Marc Zyngier)
- Ensure that the ITS MOVALL command only affects LPIs that were
previously affined to the source redistributor (Marc Zyngier)
- Fix + test for honoring the host's trap configuration when running
non-protected VMs while KVM is in protected mode (Fuad Tabba)
- Use the host stage-1 mapping granularity for VM_PFNMAP mappings at
stage-2 (Mostafa Saleh)
|
||
Mostafa Saleh
|
71cc2c67fb |
KVM: arm64: Use stage-1 leaf size for VM_PFNMAP
When commit |
||
|
Linus Torvalds
|
d24e8ac715 |
Including fixes from Bluetooth, WiFi and netfilter.
We are actively retargeting several non-urgent fixes towards next, but
the traffic on the ML looks ever-increasing, and propagating the
push-back towards subsystems is not immediate.
No known outstanding regressions.
Current release - regressions:
- netfilter: nft_set_rbtree: skip transaction elements during GC
Previous releases - regressions:
- sched: cls_api: reclaim an empty proto on the error path
- core:
- fix checksum offsets in skb_splice_from_iter()
- cap skb->queue_mapping when the tx queue is picked
- page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
- wifi:
- mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()
- mac80211: drop oversized fragments to avoid extra_len overflow
- netfilter:
- flowtable: restore ieee80211 forward path
- bluetooth: hci_conn: Lock parent access during enhanced SCO setup
- eth: bcmgenet: allocate RX buffers as page fragments
- eth: stmmac: fix rx Scatter-Gather support
- eth: octeontx2-pf: fix aura BPID assignment when CONFIG_DCB is enabled
- eth: gve: DQO: accept TSO packets with non-protocol gso_type bits
- eth: r8169: disable EEE on RTL8168h/8111h
Previous releases - always broken:
- tcp: refresh TS.Recent for accepted old ACKs
- wifi:
- ath11k: reset ar->num_stations on hardware start
- cfg80211: fix RTS threshold setting for single-radio PHY
- bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
- eth: bcmgenet: fix NULL dereference in set_coalesce before first open
Misc:
- Eric is retiring from google and updating his contact info
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmq+W8kWHHBhb2xvLmFi
ZW5pQGdtYWlsLmNvbQAKCRApJHmNzI8TpJOcD/sEIpwXo719H+APa+djEAPm17PO
7KpZ6TwbjObitFGSA23O6ZSKVdK6sM8AKkV11Ps8n+4yTS/vGDiNWHzjRdo1cB5F
kQAxOBsOeiIitoka+2zwxjn0J1RkKmKRpWvLt7hIKL2f/qbckBfhEUHsza7YhAny
Cl9/pkBsBI/aMKzOWnybPBxsxXqF/jrfmujhnXIMKvOxKc11E/J+3RZQTtMFPuZK
f+ihqrCWRb8iZOxmzdenSIwDCbof+J2toxXEZde0LM4hfDzdWXNwurSRH0osNU1E
U1SwmRf8jwrfBGsNlfAJQaIqBeWqUEq9cNYDFemx0SSerxIZWt/d19ilusFabZiX
SvpcqlOywsOMXthoD3hNPAurOehy8zRkPMM1PYJnkpF8wHmO0mlygxDjjF6vU094
9stuIM07TTrcIM2S+ZukEttxYvduY6GF1p/eQ9rRx14ErRtuUPvHpD4l2tTxg9Tx
TmfDM1+e7vGhIlQk0EeutRd3ROyYeLBSpgGty66gZOH6NoYx7AESpayuLjlpOx8D
8HjZxwIA6pmJOdNL9rkd2GjFzl0uNfFDgoNnVAOYmuUVwmWMwCD9hQ4Q9sjPNNbi
lZeppmsvaEe6Yjbwt9mvuLWQAaWiAVhcGPlAx9P2h1qRPNe2P8oK7iRWB6RPBCah
JEje/5JwhRnJFoXfbA==
=xAyd
-----END PGP SIGNATURE-----
Merge tag 'net-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from Bluetooth, WiFi and netfilter.
We are actively retargeting several non-urgent fixes towards next,
but the traffic on the ML looks ever-increasing, and propagating the
push-back towards subsystems is not immediate.
No known outstanding regressions.
Current release - regressions:
- netfilter: nft_set_rbtree: skip transaction elements during GC
Previous releases - regressions:
- sched: cls_api: reclaim an empty proto on the error path
- core:
- fix checksum offsets in skb_splice_from_iter()
- cap skb->queue_mapping when the tx queue is picked
- page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
- wifi:
- mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()
- mac80211: drop oversized fragments to avoid extra_len overflow
- netfilter:
- flowtable: restore ieee80211 forward path
- bluetooth: hci_conn: Lock parent access during enhanced SCO setup
- eth:
- bcmgenet: allocate RX buffers as page fragments
- stmmac: fix rx Scatter-Gather support
- octeontx2-pf: fix aura BPID assignment when CONFIG_DCB is enabled
- gve: DQO: accept TSO packets with non-protocol gso_type bits
- r8169: disable EEE on RTL8168h/8111h
Previous releases - always broken:
- tcp: refresh TS.Recent for accepted old ACKs
- wifi:
- ath11k: reset ar->num_stations on hardware start
- cfg80211: fix RTS threshold setting for single-radio PHY
- bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
- eth: bcmgenet: fix NULL dereference in set_coalesce before first open
Misc:
- Eric is retiring from google and updating his contact info"
* tag 'net-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (96 commits)
net: phy: aquantia: fix system interface type not updated in forced mode
net: usb: qmi_wwan: add Rolling Wireless RN947R
net: mvneta: clear XDP pfmemalloc flag between frames
ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
r8169: disable EEE on RTL8168h/8111h
octeontx2-pf: Fix RSS indirection table size
sctp: check RCV_SHUTDOWN after the sendmsg connect wait
net: sparx5: make ports inherit the switch base mac address type
net: microchip: vcap: stop scanning after deleting key field
netfilter: flowtable: restore ieee80211 forward path
netfilter: flowtable: generalize pending status bit
netfilter: bpf: reject invalid NAT manipulation types
netfilter: nft_set_rbtree: skip transaction elements during GC
ipvs: filter some flags received in the backup server
ipvs: do not create invisible templates
ipvs: bound LBLCR and LBLC cache growth
ipvs: fix missing counter decrement in lblc
netfilter: nft_flow_offload: drop flowtable reference on init error path
selftests: net: check timestamp echo after an old ACK
...
|
||
|
Linus Torvalds
|
703033e235 |
Summary
* Fix sysctl jiffies conversions errors introduced in |
||
Paolo Abeni
|
e23a64eb24 |
netfilter pull request 26-09-30
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEjF9xRqF1emXiQiqU1w0aZmrPKyEFAmq8vB8ACgkQ1w0aZmrP KyFFVRAAodpV3MdxxjHIk4FOU6IY7e4PGx4HCqbRtEE9/WKDFKjUCpGxJuTNwuKS HIdU9W0ypdwyuNKTBhWcgbCqg9GbbZkmwJM3wBbsjPtBMJ13TcI0SYoJNp+MUCNu WlcrJrsdfkwMD3rNilx8iuCKrFcLx/l8qe6JWZNdP0lRu9dhkxEiqXgkKP+XB4CI mlV3TnP6MkG25GI9QmtKEtbIYrH4688bxO3LemzoVLm2vOvvrMG7cwqGr2XU7fYB IH8VocIVdzp6/w8JAxLbJNGR0bwGjdqJorz3ysmQ8jQPOt19PyP4WLmCbNuAoGMm XdLZPlDMqdoEe+KQhjlb7isPedoun7koNiOtqBQhjRvcCv03MH7LTmMgmV702+ex Hfm6EuaWINHeVGxNDADWebUyLy7jx3xYPqEpMA+UhgnbIicVGTJGGYiq5dGvObZE ek68iqmaoMRNay94sReakOtvHVz8iaXUhO60xdF0efrsDRnr7Yv6Ztxdl9nPCRIW fUz1/l7Z4j3gfTbmO1CKDK8aHlnibseYpQygLo53nkKWPcexJzYHbVl2tnjYUDZ6 dryGhLokthdAZW4W7hONvwlU+zT/eKfa4IesxgDglwGC9Hjxtwq2kuPrIuehMH/0 oEdVw6x4L+SBIrhnM9PaBBgp/dQarXZJQss3XfUxzmMPViScSxg= =cSG8 -----END PGP SIGNATURE----- Merge tag 'nf-26-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following batch contains Netfilter fixes for net. This batch fixes crashes as recent feature regression, one of the due to a dependency that has been pulled into -stable: 1) Expand existing ipset fix for bitmap sets to disallow comments updates from kernel-side adds, from Florian Westphal. 2) Drop flowtable reference if nf_ct_netns_get() fails, otherwise flowtable cannot ever be removed, from Aohan Mei. 3) nft_rbtree GC should collect end elements that contained in this transaction batch, new or deleted elements are never expired. From Weiming Shi. 4) Restrict nf_nat_bpf so it does not set unknown NF_NAT_MANIP_* values, from Fernando F. Mancera. 5) Flowtable GC must skip flows that are pending hardware updates, generalize the PENDING flag and use it to inhibit GC. 6) Restore flowtable with ieee80211 which broke due to a relatively recent commit, which was pulled in by -stable, causing a regression in 6.18 kernels. And the following IPVS fixes: 1) Fix accounting of cache entries in IPVS LBLC for destinations, which eventually fills up the table and trigger recurrent resizing, from Julian Anastasov. 2) Limit IPVS cache growth for LBLCR and LBLC schedulers, from Zhiling Zou. 3) Restrict IP_VS_CONN_F_ONE_PACKET for normal connections, do not allow to use it with templates. Also from Julian. 4) Sanitize flags in IPVS sync messages received in the backup. From Julian Anastasov. netfilter pull request 26-09-30 * tag 'nf-26-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: flowtable: restore ieee80211 forward path netfilter: flowtable: generalize pending status bit netfilter: bpf: reject invalid NAT manipulation types netfilter: nft_set_rbtree: skip transaction elements during GC ipvs: filter some flags received in the backup server ipvs: do not create invisible templates ipvs: bound LBLCR and LBLC cache growth ipvs: fix missing counter decrement in lblc netfilter: nft_flow_offload: drop flowtable reference on init error path netfilter: ipset: do not update comments from kernel-side adds ==================== Link: https://patch.msgid.link/20260930074142.298353-1-pablo@netfilter.org Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
Bartosz Golaszewski
|
6e0022b5ae |
net: phy: aquantia: fix system interface type not updated in forced mode
aqr_gen1_read_status() decodes the MDIO_PHYXS_VEND_IF_STATUS register
to determine which SerDes interface the PHY is currently using on its
system side and stores the result in phydev->interface. phylink relies
on this value to configure the MAC.
The autoneg == AUTONEG_DISABLE check is not correct:
MDIO_PHYXS_VEND_IF_STATUS is set by the PHY firmware based on the
negotiated link speed, not based on whether autoneg was used to reach
it. When the link comes up at 1G in forced mode, the register correctly
reads SGMII, but the early return prevents phydev->interface from being
updated. It stays at whatever value it held before (typically 2500BASE-X
from the initial autoneg run), so phylink configures the MAC for the
wrong interface and the link cannot come up.
Remove the autoneg guard so that the system interface type is always
decoded when the link is up.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Linus Torvalds
|
5cd9813d84 |
audit/stable-7.3 PR 20260930
-----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmq9uDwUHHBhdWxAcGF1 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXPJLA//fX34uv5DfBWSgIj6BxoeCWYqgRuX nb8kWQQa5lF8u8WhK2z3z8017Pg5aZmQruy+VvLhGf+1L6JmFA8hi9CflGi4RQfB Tii/HQkjxRms+uU4vAManTEyXMGwix6fBTz2S1cfwgfsigBvfrp7xaN9cm7szx19 xd5n7WQHByohz4GFVL0A14S/jmGyLseeLmjB/rbI/gaPRQ+MWL+KfMtM1yigAuf9 RQtJTS7gXw2119m3YGzrMAKqci54acjYWyR7NDB8uGktPI4AKnRA9cNIQWE4c+e6 MCRwHhfjMHKeS54C37CZRvuDh9NAn8DQmhO8SKllfnVlk4T9dYuC0VdbMUTT5IDg r0MFh8hKUibW30pFlJdWembJWsHF94ukDcX2lgwPY/LTnzf3wGaccNKYmuCj3fMR QclScMwg+Hq42PwY8v7aVYICK8B/PHsMULu+GRPSzMXFD7gdxSyFGtMEMSWD/5GV DZdHyGxnOtjVPzc2CEUyMdPWTGUU0QaH6hPSRPmiSuL50TAefh58Rq33fkHZb1X9 15wMvauJPuGeqvyaAqifusof8M0f9uuxGdrbN4T/jnFhzHe58PyogNh/5PychFjC 3fuPW4ByvbXQuLWl80czmxkJ+IVE0p30P4/JRtHwuOcEEKP4+mXhAaMkl0KWd3+d 4s7N0Px8M6pMoNE= =Npw9 -----END PGP SIGNATURE----- Merge tag 'audit-pr-20260930' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit fix from Paul Moore: "A single audit fix for a potential UAF error in some audit filter configurations" * tag 'audit-pr-20260930' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: fix exe mark UAF in kill_rules() |
||
Reinhard Speyerer
|
7375d38364 |
net: usb: qmi_wwan: add Rolling Wireless RN947R
Add Rolling Wireless RN947R 0x9300 composition: DIAG + ADB + NMEA + MODEM + RMNET + QDSS + ADPL T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=9300 Rev= 0.00 S: Manufacturer=Rolling Wireless S: Product=RN947R S: SerialNumber=xxxxxxxxxxx C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#=21 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#=22 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Reinhard Speyerer <rspmn@arcor.de> Link: https://patch.msgid.link/arZzuOOvLUZtdOlv@arcor.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Lorenzo Bianconi
|
8f1c2a1050 |
net: mvneta: clear XDP pfmemalloc flag between frames
mvneta_swbm_add_rx_fragment() sets XDP_FLAGS_FRAGS_PF_MEMALLOC on the
xdp_buff when a fragment page is a pfmemalloc one (page under memory
pressure). The xdp_buff is reused for the next frame, but only the
XDP_FLAGS_HAS_FRAGS bit was cleared at frame start, so the pfmemalloc
bit leaked from one frame into the following ones. mvneta_swbm_build_skb()
propagates the flag to skb->pfmemalloc through xdp_update_skb_frags_info(),
so the skb of a subsequent fragmented frame could be wrongly marked as
pfmemalloc even if none of its pages are under pressure.
Clear all the xdp_buff flags in mvneta_swbm_rx_frame(), which is invoked
for each new frame, instead of just the XDP_FLAGS_HAS_FRAGS bit.
Fixes:
|
||
Eric Dumazet
|
8ec454dcd0 |
ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
Since commit |
||
Prathamesh Deshpande
|
7b97273cbe |
net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
During XSK TX queue teardown, outstanding descriptors are completed
without a CQE. If one requested a TX timestamp, the completion path
passes that NULL CQE to mlx5e_xsk_fill_timestamp(), which dereferences
it.
Return zero when no CQE is available, indicating that teardown did not
produce a TX timestamp.
Fixes:
|
||
Oleksij Rempel
|
3cdeaef175 |
r8169: disable EEE on RTL8168h/8111h
Force EEE off on the RTL8168h/8111h (RTL_GIGA_MAC_VER_46) at PHY connect with phy_disable_eee(). Commit |
||
Jari Seppälä
|
9e79290141 |
octeontx2-pf: Fix RSS indirection table size
The conversion to the dedicated RSS context operations replaced the
pointer to struct otx2_rss_ctx with an inline u32 ind_tbl[] array.
However, otx2_rss_init() still uses sizeof(*rss->ind_tbl) to set rss_size.
This now yields the size of one u32 (4), rather than the 256 entries in
the indirection table.
The RSS initialization and hardware programming loops use rss_size,
so only four entries are initialized and programmed despite the NIX LF
being allocated a 256-entry table. On an OCTEON CN102 with eight RX
queues, the table contained 0, 1, 2, 3 followed by zeros. Traffic was
concentrated on queue 0 and ethtool -X equal 8 did not correct the table.
Use ARRAY_SIZE() to count the indirection table entries. On the same
hardware, this restores the full table repeating queue numbers 0 through
7, and bidirectional multi-flow traffic increments multiple RX queues.
Runtime testing on an Asterfusion ET2500 (OCTEON CN102 A0).
Fixes:
|
||
Jun Yang
|
4f1da630d1 |
sctp: check RCV_SHUTDOWN after the sendmsg connect wait
sctp_wait_for_connect() drops the socket lock while it sleeps. An
out-of-the-blue ABORT can then be processed from the socket backlog and
unlink the association. If a concurrent shutdown(fd, SHUT_RD) sets
RCV_SHUTDOWN, the waiter breaks with err == 0 before checking
asoc->base.dead. Its final sctp_association_put() can then free the
association, leaving sctp_sendmsg_to_asoc() to continue with a dangling
pointer.
Check RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc()
before using the association again. The check only accesses the socket,
so it needs no additional association reference. Return the existing
-ESRCH so that sctp_sendmsg() skips freeing a new association that may
already have been destroyed.
Keep sctp_wait_for_connect() unchanged to preserve its behavior for the
connect() caller.
Fixes:
|
||
Quentin Freimanis
|
5642b1648d |
net: sparx5: make ports inherit the switch base mac address type
When the switch uses a random base MAC address it does not mark each
port's address as random:
$ dmesg | grep "MAC addr"
sparx5-switch e00c0000.switch: MAC addr was not set, use random MAC
$ cat /sys/class/net/eth0/addr_assign_type
0
0 is NET_ADDR_PERM, so userspace thinks this is a stable address.
With a random MAC reported as NET_ADDR_PERM, systemd's
MACAddressPolicy=persistent [1] leaves it unchanged, so a DHCP client
gets a new IP address every boot and a static reservation can't be used.
Reporting it as NET_ADDR_RANDOM makes systemd replace it with a stable
address derived from the interface name and machine-id.
Fixes:
|
||
Wentao Liang
|
30724547b2 |
of/irq: Fix remaining refcount leaks in of_irq_init()
Successfully initialized controllers are moved to intc_parent_list,
but the final cleanup only frees the descriptors. The device node
references taken with of_node_get() and the interrupt parent
references are therefore leaked on the normal return path. Drop both
before kfree(), as the intc_desc_list cleanup already does.
Fixes:
|
||
Jakub Kicinski
|
be35a3e003 |
Still more fixes coming in, notably:
- ath11k: avoid running out of stations on HW restart
- mac80211:
- drop too large fragmented MPDUs
- mesh path handling fixes
- validation improvements
- reject CSA with bad 320 MHz bandwidth
- cfg80211: fix RTS for single radio devices
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmq9AkAACgkQ10qiO8sP
aAD8mBAAhYUPz08049fTa9JV2yYjuSpeQPk6G0GgEWCxCeAFN/2MvYYB+/dP1lST
4hNUMq3b8JWh3n7jJopkpmFsiMRP2yslXq7osTrDuliuv2cTgRJiUaEF+jVplANQ
kMPvOgeGhks9MAZSD5tLf2wBHNJ3hk7OR8YniUxymvSxh51yg4j4eFvklVgd1m5S
5TJAQeT8iUkDjo08SHkhEab8D4tkkapdXJA4itnKD9kvT/jM/HPc7FjRdDE23zmD
2jbF+oiUDfcUqQ81sBhCTUfU+MdeWLiNvMz6kvMOl9jhH2tBoVSaDgiL20vU9a4N
1rdbHowwb6bGdl857q2ET+X5UhR3ygpF8wsUlAykJmKpCSk9KRfHSCOhd28CikIm
sDJO9+gU3tqiGPjYH344XM5NGXs18QM/v6SVnsKxyEtDVK9sXc09JKcAMF1rM+0u
YRIF7+Rl4cbfmO0ys7wKG7gJV48iZPFJbtFwU80aDizpfGk/eGkCLpEc3z4UROHL
YfRpziOD2QNbj8MuGbRYUMQYudYcV7FCaBmbzRYrbtuyC0SYJwBquXOcG+GTJy6d
tZ6ZahMc3o8oHjIxf9lfJ594DAw42ClL4PT/yhuP72TQR1oIoFq+pKYhLK5oc/Qt
mIDjZ6LMzGd3Ob0pk0kVHvpjKq509sLUAXoW6k2pHSne5EU3YRs=
=2Up4
-----END PGP SIGNATURE-----
Merge tag 'wireless-2026-09-30' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
Johannes Berg says:
====================
Still more fixes coming in, notably:
- ath11k: avoid running out of stations on HW restart
- mac80211:
- drop too large fragmented MPDUs
- mesh path handling fixes
- validation improvements
- reject CSA with bad 320 MHz bandwidth
- cfg80211: fix RTS for single radio devices
* tag 'wireless-2026-09-30' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (27 commits)
wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()
wifi: mac80211: reject invalid 320 MHz CSA bandwidth
wifi: mac80211: set info->band for 802.3 encap offload frames
wifi: mac80211: prevent AP VLAN tx from other interfaces
wifi: cfg80211: preserve hidden-group beacon IE ownership
wifi: mac80211: keep fallback association elements alive
wifi: mac80211: shut down RX BA session timer on teardown
wifi: mac80211: validate TX status rate metadata
wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
wifi: ath9k: reject short WMI command responses
wifi: ath9k: Clean up device initialisation guards
wifi: ath11k: reset ar->num_stations on hardware start
wifi: cfg80211: fix RTS threshold setting for single-radio PHY
wifi: mac80211: handle empty FILS association request payload
wifi: mac80211: minstrel_ht: validate fixed rate index
wifi: p54: validate firmware record lengths
wifi: mac80211: fix mesh fast xmit path deletion UAF
wifi: mac80211: drop oversized fragments to avoid extra_len overflow
wifi: wlcore: Fix runtime PM leak in wlcore_remove()
wifi: mac80211: drain PS delivery work during station teardown
...
====================
Link: https://patch.msgid.link/20260930124440.224799-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||
Yuho Choi
|
77f21a59e8 |
of: Put coreboot node after compatibility check
of_find_compatible_node() returns a referenced device node, but
EXCLUDED_DEFAULT_CELLS_PLATFORMS used the result only as a boolean and
discarded the reference. This leaked a reference each time the
address-cells or size-cells warning condition was evaluated on a
coreboot system.
Use a helper that checks for the coreboot node with a scoped reference,
so the reference is dropped once the check is done.
Fixes:
|
||
Eric Biggers
|
572af6872e |
crypto: aes - Fix undesired override of some optimized AES modes
The new library APIs for AES encryption modes were wired up to the traditional crypto API via crypto/aes.c. However, for now the kernel is still in a transitional state where various architectures still have architecture-optimized implementations of AES modes in arch/*/crypto/, wired up to the traditional crypto API only. Because of that, the crypto/aes.c algorithms were given a cra_priority of only 110 to prevent them from overriding arch/*/crypto/ in the traditional crypto API. However, because of how the traditional crypto API works, the cra_priority trick doesn't work in cases where the relevant algorithm isn't directly implemented by arch/*/crypto/ but rather is provided by a template instance using other code in arch/*/crypto/. For example, x86 doesn't have its own "ccm(aes)" but rather relies on the "ccm" template constructing it from the x86-optimized "ctr(aes)". The existence of the library-based "ccm(aes)" prevents that, even though its priority is lower than what the template would produce. Thus, "ccm(aes)" ends up using the slower single-block AES code. Therefore, skip wiring up the relevant library-based code to the traditional crypto API on architectures where this problem can occur, as determined by what exists in arch/*/crypto/ for each architecture. This is ugly, but it's also temporary: these conditions will go away as architecture-optimized implementations of AES modes are migrated into the library. But until then, we need to prevent performance regressions by ensuring that the optimized code continues to be used. Fixes: |
||
Harshit Mogalapalli
|
99b43ede9e |
net: microchip: vcap: stop scanning after deleting key field
The only call outside the KUnit tests is in
sparx5_tc_add_rule_copy(), which passes a fixed key list with no
duplicate entries. Therefore, the potential double-free is not
currently reachable in tree.
However, vcap_filter_rule_keys() is exported and does not require its
key list entries to be unique. If a future or external caller supplies
the same key at another position that the inner loop visits, it calls
list_del() and kfree() a second time on the freed field, leading to a
potential double-free.
Break the inner loop after removing a matching field. The outer safe
list traversal continues to process the remaining rule fields.
Fixes:
|
||
Pablo Neira Ayuso
|
3ae37eafd3 |
netfilter: flowtable: restore ieee80211 forward path
Before commit |
||
|
Pablo Neira Ayuso
|
7c549fb7ee |
netfilter: flowtable: generalize pending status bit
Rename NF_FLOW_HW_PENDING to NF_FLOW_PENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nf_flow_offload_stats() can schedule work to retrieve stats while the flow is being removed by GC. And this bit can also be used in a follow up patch to disable GC until the flow has been fully added in both directions. Revert the reordering done in commit |
||
Fernando Fernandez Mancera
|
16d464013e |
netfilter: bpf: reject invalid NAT manipulation types
As bpf_ct_set_nat_info() is not validating the NAT manipulation type a
wrong value can be passed directly to nf_nat_setup_info(). This triggers
the WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn't set,
then IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack
cleanup tries to unlink an uninitialized hlist node.
Fix this by checking that NAT manipulation type is correct before
calling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return
NF_DROP instead of continuing with the processing to avoid similar
situations in the future.
Reported-by: VEGA <vega@nebusec.ai>
Fixes:
|
||
Weiming Shi
|
86b6471e69 |
netfilter: nft_set_rbtree: skip transaction elements during GC
Since nft_set_commit_update() runs set commit callbacks before processing
NEWSETELEM transactions, nft_rbtree_gc_scan() can observe elements added by
the transaction being committed.
The scan records an interval end in rbe_end without checking the element's
transaction state. A later, unrelated expired start then moves both
elements to the expired list. The synchronous GC queue can free the new end
element before the transaction subsequently activates it, causing a
use-after-free.
Only consider elements that are fully active in both generations. This
keeps transaction-state elements out of the GC scan and preserves interval
pairing across skipped elements.
KASAN reports:
BUG: KASAN: slab-use-after-free in nft_setelem_activate
nft_setelem_activate net/netfilter/nf_tables_api.c:7047
nf_tables_commit net/netfilter/nf_tables_api.c:11137
Allocated by task 130:
nft_set_elem_init net/netfilter/nf_tables_api.c:6794
nft_add_set_elem net/netfilter/nf_tables_api.c:7523
Freed by task 130:
nft_trans_gc_trans_free net/netfilter/nf_tables_api.c:10506
rcu_core kernel/rcu/tree.c:2919
Fixes:
|
||
Julian Anastasov
|
f96e91748f |
ipvs: filter some flags received in the backup server
While the IPVS SYNC protocol is not secure by design
we can still protect the backup server from messages that
can wreak havoc.
This commit addresses problems from received connection flags
or their combinations. We now drop messages as follows:
1. the NO_CPORT+TEMPLATE combination allows lookups for normal
connections to hit template which can break in many ways.
While the master does not sync connections with NO_CPORT flag,
i.e. before they are established, we still accept NO_CPORT
without TEMPLATE.
2. ONE_PACKET: it is not sent by master, so we do not
expect it in backup. Before now it was ignored by
IP_VS_CONN_F_BACKUP_MASK for protocol v1 while protocol
v0 created connections that are not hashed and dropped
immediately. Better to apply the IP_VS_CONN_F_BACKUP_MASK
also to the flags from v0 messages for consistency with v1.
Fixes:
|
||
|
Julian Anastasov
|
616cf5c069 |
ipvs: do not create invisible templates
The IP_VS_CONN_F_ONE_PACKET flag was implemented for normal
connections. When conn template inherits this flag from
dest->conn_flags it will not be hashed. As result, we will
create new template for every new normal connection.
Fix it to allow one template to be used by many normal
connections.
Fixes:
|
||
Zhiling Zou
|
2a3c3de660 |
ipvs: bound LBLCR and LBLC cache growth
ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for
every previously unseen destination address. The table max_size only
tells the periodic collector to reclaim entries after the cache has
already exceeded the limit. It does not reclaim entries that the
attacker continues to use.
Reject new cache entries once either table reaches max_size * 3 / 2.
The extra headroom lets the periodic collector catch up while the
existing scheduler fallback continues to use the selected destination
when cache creation fails. New traffic therefore stays serviceable
without growing the tables further.
Fixes:
|
||
|
Julian Anastasov
|
bdac17779f |
ipvs: fix missing counter decrement in lblc
LBLC may delete cache entries for destinations that are
removed or overloaded and replace them with available ones.
But ip_vs_lblc_new() forgets to decrement the tbl->entries
counter after calling ip_vs_lblc_del(). This can lead to
increased shrinking of the cache with every new garbage
collection.
Fixes:
|
||
Aohan Mei
|
747928b5d4 |
netfilter: nft_flow_offload: drop flowtable reference on init error path
nft_flow_offload_init() bumps the flowtable use count with
nft_use_inc() before calling nf_ct_netns_get(). When the latter
fails, the error is returned as-is and the reference is leaked.
The upper layers do not balance it either: nf_tables_newexpr()
clears expr->ops when the expression init callback fails, so the
nft_expr_more() iteration in nft_rule_expr_deactivate() and
nf_tables_rule_destroy() stops right before the failed expression
and its ->destroy callback, which would drop the reference, never
runs.
Each failed rule addition therefore leaks one flowtable reference
and the flowtable can no longer be removed: NFT_MSG_DELFLOWTABLE
keeps reporting -EBUSY even though no rule references it.
Save the nf_ct_netns_get() return value and undo the nft_use_inc()
when it fails, restoring the inc/dec pairing within
nft_flow_offload_init() itself.
Fixes:
|
||
David S. Miller
|
2e7ea988a0 |
Merge branch 'tcp-old-acks'
tcp: correct timestamp echo for accepted old ACKs Linux can acknowledge newly received data while echoing an outdated TCP timestamp. This happens when a reordered packet fills a receive gap but carries an older acknowledgment for traffic in the other direction. If the sender uses this echo to measure round-trip time after a long idle period, the stale timestamp can inflate its estimate and slow its sending. Changes in v2, following Eric Dumazet's review: - Remove the redundant SYN_RECV condition and unused flag accumulation. - Replace the log-parsing wrapper with a plain packetdrill test that checks the timestamp echo directly, using the existing selftest runner. - Rebase on net |
||
Jeff Jo
|
81fe707ae5 |
selftests: net: check timestamp echo after an old ACK
Add a regression test for a gap-filling packet whose acknowledgment has
become old. Linux first sends data to the peer. Deliver two peer data
packets out of order: the later packet acknowledges Linux's data, while
the delayed packet still carries the earlier acknowledgment.
Require the ACK that closes the receive gap to echo the delayed packet's
timestamp, 301000. Without the fix, Linux accepts the data but still echoes
the previously saved timestamp, 1000. Also check that the application can
read all 34 bytes.
Use a large jump in peer timestamps to represent the idle interval, with
no real wait, loss or retransmission. The test directly checks the outgoing
timestamp echo. It requires packetdrill's merged TSecr verification fix
(linked below); older tools incorrectly pass on an unfixed kernel.
Use the existing packetdrill selftest runner for IPv4, IPv6 and
IPv4-mapped IPv6.
Link:
|
||
|
Jeff Jo
|
1b92780ae4 |
tcp: refresh TS.Recent for accepted old ACKs
A TCP packet can carry new data while acknowledging traffic in the
opposite direction. With overlapping traffic in both directions, a
delayed packet's acknowledgment can be older than one Linux has already
accepted, even when that packet fills a gap in the received data.
Linux accepts the data, but tcp_ack() takes the old_ack path and skips
updating TS.Recent, the timestamp saved for outgoing acknowledgments.
The reply therefore echoes an older timestamp. If the sender uses this
echo to measure round-trip time after a long idle period, its estimate
includes the idle time and can reduce its sending rate.
Update TS.Recent in old_ack using tcp_replace_ts_recent(), before SACK
processing can trigger a transmission. This reuses the existing timestamp
and sequence checks, including PAWS protection against old duplicate
packets. ACK validation already rejects old ACKs in SYN_RECV before this
path, so no additional state check is needed.
Echoing the timestamp of the packet that fills the receive gap follows
RFC 7323 section 4.3. In a socket reproduction with 300 seconds idle,
controlled reordering and retransmission to exercise timestamp-based RTT
sampling, the sender's smoothed round-trip time was 37.5 seconds without
the fix and 15.5 ms with it.
Fixes:
|
||
|
Linus Torvalds
|
551c722f40 |
RTC fixes for 7.3
Subsystem: - fix a possible information leak Drivers: - efi: restore alarm support with runtime capability probe -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEBqsFVZXh8s/0O5JiY6TcMGxwOjIFAmq8M7wACgkQY6TcMGxw OjLsyRAAok6cbdHolkK3tK2hwS3WrAKtuvGn47GX4KR3cEgHGDzBOZICgX9S7Mkc 1+dKL5eCe0ty6jekdx9IH1uPnpXZF1qZKJVE70J4T+Wm52/3EeEN9bPh8myjN4fR OTrCDFvaTOZzGnoOXmkB9pvw/hXaYh8J7jEqXh9zRVAoBvZ+z+k0BL+ItDRMFu+d wDUOY+VM08Yxao0k86elhbZCfoKxGAwZ/FUhyX6w8gkiavyq6NdECn/otU6c1qsh HWI9KbDW48ucOx54BNZsgOFnavFMPAPNv9BB+Q+ZKUT1J1+CDPOMZaxkcjne9QjC xPunTMPIMBEox+KErRhlLw6D2roux/Djgq1GPXRSACYzDKbbaWyKVsGRD6M9eE0e CAo86I1EAPSleYkJ9cb2+VkVIPtuBZNfqfl7eUYkV5NXiEnAclk7iHV+lqOUfPx2 FP+TenVtYzrDoFzjj+aOD6KLZA7WibG64dB9C+vfng75gr9tvaDXGGFSiW5AoLQr vp81NuNLh/Mgf4Mb5D3SAKJij3cxlrxFNWpEnBz1Fe8QakIuHPkl2VTdPVEK/rRQ BXrwOQkyO79ZIZuk0xL443IhtwrPEfbvHbUBk6qzeHVH91/4oULuEfMhGj+wWfl3 hPkfNBMT8Z6tnPA5QoAB5OBzxg0EcKE26I/kRbst7BhSKtNTe/I= =S5pP -----END PGP SIGNATURE----- Merge tag 'rtc-7.3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC fixes from Alexandre Belloni: "Mostly small issues found using AI. The efi change is to avoid a regression on some platforms Subsystem: - fix a possible information leak Drivers: - efi: restore alarm support with runtime capability probe" * tag 'rtc-7.3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: spear: initialize IRQ state before requesting alarm IRQ rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() rtc: ac100: Fix clock provider use-after-free on probe failure rtc: ac100: Assign .num before accessing .hws rtc: efi: restore alarm support with runtime capability probe rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak |
||
|
Quentin Freimanis
|
0d2c49915b |
net: sparx5: skip ptp deinit if init was skipped
sparx5_ptp_init() returns early on the base lan969x variants
because they do not have the SPX5_FEATURE_PTP flag. It also returns early
when no "ptp" interrupt is described. Unbinding the driver then causes a
NULL pointer dereference when cleaning up uninitialized tx_skbs queues:
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000008
Call trace:
skb_queue_purge_reason+0x68/0x120 (P)
sparx5_ptp_deinit+0x64/0xc0
mchp_sparx5_remove+0x38/0x70
platform_remove+0x20/0x30
device_remove+0x4c/0x80
Before per-port tx_skbs were added, a NULL dereference would have happened
when calling ptp_clock_unregister() on the never-registered PTP clocks.
Fix by returning early in sparx5_ptp_deinit() if PTP is not used.
Fixes:
|
||
Yongzhao Chen
|
20f3599d85 |
net: phy: qcom: at803x: Fix IPQ5018 short-cable DAC values
When "qcom,dac-preset-short-cable" is set, ipq5018_config_init()
programs the MDAC (MMD1 0x8100) and EDAC (debug 0x4380) fields. Both
fields occupy bits 15:8 (IPQ5018_PHY_DAC_MASK), but the value 0x10 is
passed unshifted as the set argument of phy_modify_mmd() and
at803x_debug_reg_mask(). Neither helper shifts or masks that argument,
so both fields are cleared to 0x00 instead of being set to 0x10, and
bit 4 of the low byte, which is outside the field, is set.
Use FIELD_PREP() to place the value in the field. This matches the
vendor SDK, which clears bits 15:8 and ORs in the value shifted left
by 8.
On a Redmi AX5400 board, where the IPQ5018 internal PHY connects to a
QCA8337 switch PHY without a cable, MDAC and EDAC read 0x6868 and
0x7800 before the write. With this change they read back 0x1068 and
0x1000, with the low byte preserved. Without it, the same writes would
leave 0x0078 and 0x0010.
No in-tree DTS sets this property yet, but it is documented in
qca,ar803x.yaml and used by several IPQ5018 boards in OpenWrt.
Fixes:
|
||
Sandeep Haemoon
|
6f0c2c4f5e |
net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
The RX rings and the shared NAPI are carried by an internal "dummy" netdev
(eth->dummy_dev). mtk_probe() creates that dummy device, and adds the
shared tx/rx NAPI to it, only after the MAC netdevs have been registered.
That order has been there since the MT7623 support was added and leaves a
window in which the netdevs are visible to the network core before the
shared NAPI and the dummy device exist.
If anything brings the first netdev up during that window (e.g. netifd
opening the WAN link the instant the interface is registered), the
first-open path runs without them. On NETSYS v2 and later SoCs
mtk_rx_alloc() -> __xdp_rxq_info_reg() then dereferences eth->dummy_dev ==
NULL:
WARNING: CPU: ... Missing net_device from driver
in net/core/xdp.c and mtk_open() fails with -ENODEV. On NETSYS v1 SoCs
(MT7621/MT7622/MT7623/MT7629) there is no page pool, so the same open
instead calls napi_enable() on a napi_struct that netif_napi_add() has not
initialised yet and dereferences a NULL napi->dev.
Allocate the dummy netdev and add the shared tx/rx NAPI to it before the
register_netdev() loop. Both the dummy-allocation failure and a
register_netdev() failure now unwind through mtk_unreg_dev(), which
unregisters the net_device notifiers and the netdevs registered so far,
stopping a concurrently-opened netdev (ndo_stop) and its NAPI before the
dummy carrier is freed.
A netdev that opened during the window can also have queued the
frame-engine reset worker (via the tx watchdog or phylink), so the probe
error path now cancels eth->pending_work before freeing the shared state,
as mtk_cleanup() already does on remove.
Fixes:
|
||
Willem de Bruijn
|
5f0764cb1c |
net: extend IPv6 exthdr detection of tunneled packets
Commit |
||
Jamal Hadi Salim
|
ea4d4b5ddd |
net: cap skb->queue_mapping when the tx queue is picked
skbedit can set skb->queue_mapping and raise the per-CPU skip_txqueue flag so __dev_queue_xmit() honours the mapping. __dev_queue_xmit() cleared the flag before sch_handle_egress() and only read it afterwards, so the flag was not confined to the xmit that set it: a nested xmit (mirred redirect or mirror, or a drop after skbedit) could set the flag and the outer xmit would consume it for an skb that never went through skbedit. A forwarded packet still carries the ingress NIC's rx_queue + 1 in skb->queue_mapping, so the outer device then indexes its tx queue state with that stale value. Taprio's child array q->qdiscs[] is sized to the device's queue count, so taprio_enqueue() indexes past its allocation and dereferences the result as a struct Qdisc *. We (ab)use the skb->nf_skip_egress which means "skip netfilter egress for this packet" to tag to "am I in tc egress?". Despite the overload I dont see it as a conflict since the marker is set only around the single sch_handle_egress() call and ingress path is guarded by tc_at_ingress. I will send a followup(net-next) patch once this hits net-next to rename the skb->nf_skip_egress bit/flag to skb->skip_egress Arm the flag only from the egress classifier that can use it: raise skip_txqueue from tcf_skbedit_act() only when it runs inside sch_handle_egress(), thanks to skb->nf_skip_egress. An egress qdisc classifier runs in q->enqueue(), after the tx queue has been picked, so a mapping it sets cannot affect the current packet; arming the flag there only pollutes it for a later xmit. Then own the flag for the xmit frame the egress hook runs in: save the incoming value and clear it just before sch_handle_egress(), and restore it after the hook - on the consumed (drop) path, or, in the same call that reads it, on the surviving path. The save and the restores stay inside the egress_needed_key static branch, so a packet pays for them only when egress hooks are active ( |
||
Nicolai Buchwitz
|
19419faf58 |
net: bcmgenet: fix NULL dereference in set_coalesce before first open
The Rx ring priv and index are only set in bcmgenet_init_rx_ring(),
which runs at open. Setting the Rx coalescing parameters on an interface
that was never opened, e.g. "ethtool -C eth0 rx-usecs 50", dereferences
a NULL ring->priv. The oops happens with RTNL held, so networking
stays stuck until a reboot:
Unable to handle kernel paging request at virtual address 0000000000002788
pc : bcmgenet_set_rx_coalesce.isra.0+0x10/0x88
lr : bcmgenet_set_coalesce+0xe8/0x180
Call trace:
bcmgenet_set_rx_coalesce.isra.0+0x10/0x88 (P)
__ethnl_set_coalesce.isra.0+0x490/0x570
ethnl_set_coalesce+0x48/0xc0
ethnl_default_set_doit+0xf4/0x230
genl_family_rcv_msg_doit+0xe8/0x160
genl_rcv_msg+0x220/0x2a0
netlink_rcv_skb+0x68/0x140
genl_rcv+0x40/0x60
netlink_unicast+0x338/0x3c0
netlink_sendmsg+0x19c/0x3f8
__sock_sendmsg+0x64/0xc0
__sys_sendto+0x124/0x198
__arm64_sys_sendto+0x30/0x48
Set priv and index at probe. Writing the registers while the interface
is down is harmless because open resets the MAC and
bcmgenet_init_rx_coalesce() reapplies the stored values.
It was observed on a Raspberry Pi CM4, but should apply to all other
genet devices.
Fixes:
|
||
Yoshihisa Yamamoto
|
8b99934374 |
net: pcs: rzn1-miic: Clear MIIC protection state before unprotect sequence
On RZ/T2H and RZ/N1D MIIC, writing 0x0000 to the MIIC protection
register clears the protection state machine.
The initial protection state cannot be assumed to be constant,
as it may be influenced by previous activity before the driver
takes ownership of the hardware.
Clear the protection state before issuing the unprotect sequence
so that register access always starts from a known state, regardless
of any previous activity.
Fixes:
|
||
|
Jakub Kicinski
|
38b7c47069 |
Merge branch 'fix-udp-splice-checksum-alignment-across-fragments'
Alireza Asgari via says: ==================== Fix UDP splice checksum alignment across fragments When skb_splice_from_iter() appends several pipe fragments, it updates skb->len only after the loop. The software-checksum helper nevertheless uses that unchanged length as the checksum position for each fragment. An odd number of bytes already appended during the call therefore gives later fragments the wrong checksum alignment. A standalone reproducer primes a UDP socket with sendto(MSG_MORE), splices distinct pipe buffers, then uncorks the datagram. The send succeeds, but the receiver drops the packet and increments its checksum-error counter. Patch 1 passes the actual cumulative offset to the checksum helper without changing the final length update or partial-progress handling. Patch 2 adds a loopback selftest covering IPv4, IPv6, IPv4-mapped destinations, connected and unconnected sockets, prefixes and fragment boundaries. ==================== Link: https://patch.msgid.link/20260924-fix-udp-splice-checksum-v1-0-fe61d65447a8@asgari.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Alireza Asgari
|
1221246d3b |
selftests: net: cover UDP splice checksum fragment alignment
Exercise software UDP checksums when splice() transfers multiple pipe fragments into a corked datagram. Use separate source pipes so short writes cannot merge, and use odd fragment lengths to expose checksum-position errors between fragments. Cover IPv4, IPv6 and IPv4-mapped destinations, connected and unconnected sockets, resident prefixes, even and odd fragment lengths, and a fragment starting near a page boundary. Ordinary sends provide a control. Check the complete payload and reject extra datagrams after a successful send. Keep receive waits bounded and skip unavailable address families or pipe capacities. The test uses only loopback sockets with ephemeral ports and has no dependency on the application that exposed the regression. Signed-off-by: Alireza Asgari <alireza@asgari.net> Link: https://patch.msgid.link/20260924-fix-udp-splice-checksum-v1-2-fe61d65447a8@asgari.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Alireza Asgari
|
febec6a707 |
net: fix checksum offsets in skb_splice_from_iter()
skb_splice_from_iter() appends multiple page fragments before updating
skb->len. However, skb_splice_csum_page() uses that unchanged length as the
offset for every fragment checksum. If bytes already appended during the
call have an odd total length, a later fragment's checksum is combined
with the wrong parity.
For example, prime a UDP socket with sendto(MSG_MORE) and splice two
distinct pipe buffers containing "abc" and "DEFGH". Uncorking reports
success, but the receiver discards the packet for a bad checksum.
This also affects IPv6 and fragments beginning near a page boundary.
Pass the initial skb length plus the bytes already spliced to the checksum
helper. Keep the existing final length update and partial-progress error
handling unchanged. CHECKSUM_PARTIAL does not use this helper and remains
unaffected.
Fixes:
|