netdev_queue_get_dma_dev() uses "compat" locking assert which wants
either the rtnl_lock or netdev instance lock. This is not right,
the callers are taking the instance lock unconditionally. All entry
points for queue config are purely instance locked.
In other words the callers use netdev_get_by_index_lock(), not
netdev_get_by_index_lock_ops_compat(). All the state we will
access is effectively instance lock protected (it's const for
devices which are not ops-locked).
Update the assert to avoid false positive warnings.
Cc: stable@vger.kernel.org
Fixes: b6c5f9454e ("io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock")
Reported-by: syzbot+a78926bdac2adb52dc0e@syzkaller.appspotmail.com
Reviewed-by: Simon Horman <horms@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://patch.msgid.link/20260806225627.3998672-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
macvlan devices inherit hard_header_len from lowerdev during macvlan_init(),
but leave needed_headroom and needed_tailroom set to 0.
When the underlying lowerdev requires extra headroom or tailroom for
headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx
headroom), upper layers calculating packet headroom and tailroom fail to
reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN
slab-use-after-free crashes when dev_hard_header() / macvlan_hard_header()
prepends header data or when lower devices append tailroom.
Fix this by:
1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init().
2. Propagating needed_headroom and needed_tailroom updates to attached macvlans
in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
Fixes: b863ceb7dd ("[NET]: Add macvlan driver")
Reported-by: Tangxin Xie <xietangxin@h-partners.com>
Closes: https://lore.kernel.org/netdev/CANn89i+1EW-sFNK8xoq98gMbPCeLS7e=+rs9gHfLg5Wj+4x0sw@mail.gmail.com/T/#m16adf0ff972cbfd8066c3a8e656e75eaeb12d021
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20260806141938.287660-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),
but leave needed_headroom and needed_tailroom set to 0.
When the underlying phy_dev (or stacked lower device) requires extra headroom
or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or
veth with rx headroom), upper layers calculating packet headroom and tailroom
fail to reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN
slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()
prepends header data or when lower devices append tailroom.
Fix this by:
1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().
2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans
in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
Fixes: 2ad7bf3638 ("ipvlan: Initial check-in of the IPVLAN driver.")
Reported-by: syzbot+1f9fd0f4b601cf88d6e6@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a720a21.40259c87.584f4.04bb.GAE@google.com/T/#u
Reported-by: Tangxin Xie <xietangxin@h-partners.com>
Closes: https://lore.kernel.org/netdev/CANn89i+1EW-sFNK8xoq98gMbPCeLS7e=+rs9gHfLg5Wj+4x0sw@mail.gmail.com/T/#mcc6307f115e500df23ea2980d5669fe95f20b6b4
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20260806103857.115541-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Jakub Kicinski says:
====================
eth: bnxt: fix IRQ notifier bugs
I was trying to make bnxt preserve IRQ mappings across reconfiguration.
While hacking on that I noticed 2 bugs in the notifiers that should
probably be fixed before development work.
First one is simple - TPH recofig makes aARFs not work. There can only
be one notifier per IRQ and TPH "steals" the callback from the rmap
updates. Fix by patches 1 and 2.
Second one is a deadlock between the affinity notifier and reconfig.
This one is a bit more involved (patch 3 and 4).
Unfortunately, I can't really verify the problem or test the fix.
I managed to get my hands on a system with an AMD Venice CPU which
is supposed to support TPH, but the ACPI is missing some bits to
actually advertise it. pcie_tph_get_cpu_st() returns -EINVAL.
====================
Link: https://patch.msgid.link/20260803193135.2030368-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Unregistering IRQ affinity notifiers waits for the callback synchronously.
bnxt takes the netdev instance lock in the notifier (to restart the queue)
and cancels the work under the same lock. This may obviously deadlock.
Move the restart to the async service task. The queue restart isn't
super time sensitive. Store the new TPH tag, schedule the task.
Safely canceling the service task is already ironed out.
In bnxt_request_irq() the order of registering notifier, affinity and
initial TPH programming has to be inverted. I think it was racy
previously since user may trigger an update as soon as notifier
is installed.
There's a small known gap - if pcie_tph_get_cpu_st() fails at init
and the target tag is 0 we may miss programming the entry.
This does not seem worth fixing, the code has skip-on-failure
all over the place, anyway.
Fixes: c214410c47 ("bnxt_en: Add TPH support in BNXT driver")
Tested-by: Vishvambar Panth S <vishvambar.panth-s@broadcom.com>
Link: https://patch.msgid.link/20260803193135.2030368-5-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
bnxt_request_irq() has unnecessary level of indentation.
Use continue instead. No need to re-fetch NUMA node for
each IRQ, move to the function level.
No functional changes.
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260803193135.2030368-4-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The TPH support must have broken aRFS in bnxt. IRQ can only have one
notifier, so installing the TPH notifier is overriding the one implicitly
installed by irq_cpu_rmap_add().
Make sure we call cpu_rmap_update() from the TPH notifier.
We need to be careful with the ordering and not free the rmap
until we unregistered the notifier. Note that moving the rmap
freeing after the early return in bnxt_free_irq() is fine -
there's no path that could leave rmap with irq_tbl being NULL.
Fixes: c214410c47 ("bnxt_en: Add TPH support in BNXT driver")
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/20260803193135.2030368-3-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
bnxt_irq_affinity_notify() copies into irq->cpu_mask.
Cancel the notifier before freeing irq->cpu_mask.
Fixes: c214410c47 ("bnxt_en: Add TPH support in BNXT driver")
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/20260803193135.2030368-2-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Two minor cleanups:
1. Replace __ASSEMBLY__ with __ASSEMBLER__ in headers to have
consistency with what compilers define.
2. Drop redundant mailing lists from Samsung MAINTAINERS entries (less
code).
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmp0Qv8QHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1x7wEACCF42NRjTz4mOnM3NcjdEeewSgw29wL0/C
eYSgc+iyE1filSBRe7nyHQn0+bAXmahnBAbChMHWjBYzXyuKKtPyRJDqIfouDgQK
L3VKRQQ03JLF4YuxcAfA2EZqDh1HIxaFs0PEq1vk2kfyk+0VmVvgg/nZAmheCUgz
yeL5CnxRRX3YRfOXEs1KXTht26rimLfDEmG/Krr8f6c3MxQ6DNrbryDXv8Dnc3AM
oANFEDhCDwfB2o7PvMXhbkmoQsE3qTJRgTDktsQ+QS1MvKsas3hjAB9XmD0zy1jk
nTzV9FK3rX0mZn68KzEf1guQ6PQ5VhD096zgZcgeBzMhsh646e2Pd5UPoQ0GIabf
musAZuRH9DjctycwfN48Wrbg7oG5zbNNuILgWQ42B3+Ful2rHkIOu3SejTXYsqXe
aDSGWOPaKKDJJNRc177b/Xj8Gklk57mOySAS6EEOci+vKXVP9LvnoWXLak0p/wxx
777OE8VuD+s8LYy1IeDPUMLO/jH6DgF9Cfup73NVmYTN6yzRBzf3agmlAl42M0eL
YHHCIJZOaVDinoZPGEACuxsZA5vkPyYBx0DtkOkmvfE6MjPuKL2mxPvujoIsHyDe
dPkxy1rXHF7ncvuEvVYGwLJJzYEygF2vEkX/K3QnbmIvdbJ/p/cCph0DHuIUu0Gc
iSRZsfjGpQ==
=JuRt
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp6MdEACgkQmmx57+YA
GNmCZg//YM3svxqpc7txzO7i8uoGtNNdmo8Pgh4pPYHj8NAVWv4lropo44OrbmT6
Bb6A0ccjyDNWG6ZL5YIj+PXzH/LwEyquaJwp53bnFy+NxbmOw/RxGYkxE+pfiHQX
M53yPDn23NzXV0z++ZpxQmr9JRF3yoO3Isbb0khlI2RQFgtNN/k4KAyx4eq1C26r
atA5OcySgat9msKgcnoThS5wuCf9Ii0iELW1dSw4xqELEkjwZ/VgF8QCW4KXGC8C
BDvuVQgPedjfd3St05WWAp5Kd/xYYR+Ml1HN5rHrsVng9sw7vqTxYyaOHi9kBZ3s
qdTvZAnZiJwzLtGWlOSbeCoTc86+mifNbqTl15mOu1eyZ3803hpA7v3I5oahs5Mm
pNGm71naS9lVPHOyzDaSAl3BpdV40/0HN1NIdd6xdJJCKa4P8KLtPncwUy5pM4yO
/cK/42RHDur6hfNrVInz4Opq3FRteIneXDHMcqKhUcPFvQ5hZTQTJ+Azf6y9C1zZ
ANtgOh1TWRdc/lLaEiaspMpXUhk6y3mVxAgEghZG6F5u7py3ADI0JYlTpyZUSdEP
TILIoi68GWBLG1dKOLAg3tULLebWk5h9hC3tPt8drqQGo0iRV3FLQAxBpJI86fBV
TFKR9CTojudMmsuZav7I9xXWSTAUDcV+34f73Ha7M5lJ/VTuzkI=
=RX5R
-----END PGP SIGNATURE-----
Merge tag 'samsung-soc-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/arm
Samsung mach/soc changes for v7.3
Two minor cleanups:
1. Replace __ASSEMBLY__ with __ASSEMBLER__ in headers to have
consistency with what compilers define.
2. Drop redundant mailing lists from Samsung MAINTAINERS entries (less
code).
* tag 'samsung-soc-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
MAINTAINERS: Drop redundant lists from various Samsung entries
ARM: s3c: Replace __ASSEMBLY__ with __ASSEMBLER__ in header files
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
If the auxiliary clock is disabled during tk_get_aux_ts64() but is enabled
before tks->clock_valid is checked, then uninitialized stackdata will be
used in the calculations and indirectly leaked to userspace.
The same race window also exists after this change and also for the core
timekeeper. But in these cases the only effect would be incorrect
adjustments and this is userspace's responsibility to avoid this.
Fixes: 4eca49d0b6 ("timekeeping: Prepare do_adtimex() for auxiliary clocks")
Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260731-timekeeping-aux-adjtimex-return-v1-1-b7fea4692886@linutronix.de
Fix the Eliza display clock controller to avoid RCG stall. Revert the
rework of the "PHY mux" clock, as this broke PCIe on several different
targets.
Drop (and correct one) bouncing maintainer email addresses in DeviceTree
bindings.
-----BEGIN PGP SIGNATURE-----
iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmpnlToOHGJqb3JuQGty
eW8uc2UACgkQCx85Pw2ZrcWNXg//RN1nAKFwKalihovDtpk6wlkxdUEJl53E1dcU
t5BWTTPWqlSmlc/FWvIqe7EccWRkm/3/rzt1KKaTw6mqupm2pmvtHa/A1dIfzNuw
EMwcFZQssb4m56rS+hO8fvGTxSE8MEd+gl4UXet+neXGvmM7mLu+LotMIH0EbELT
QZetojCYtZQVezkiNy/BKiXLCER/FnuQU0S37cpOR6bEWiS0rzptPKAFX3qgoKZ/
I1ff7iCJ5DJSkIYgAZhFXvMk4V6GGP+HXBp5LnWyzxTt+J5+YER+L5Zmv0po8NFh
NzFxfC9nH+kihD9716FouII64QbwbmKdTc0qS1tLhH9u5OQmhTZEQ283kadpZIdc
nwIglsdmibgFixRDM6sI7CR3aYuFZVbaMCMKWRC9aE7Vxpf0KuRzJnmqxCOwqa1u
5E6+Ps5wb93+mDtYAdx+qRXzLh8ZGUZksoVOE2gC6aZGFkDHEAkQewww6nEQ5ikT
9dZlgnesgMux78Yn1H+PhTFtNXgJXFjWGgBm2YgVXOCvDyXaTF6LE3wlpSIeo9SV
mGAExhPm0OrBmxyN15ynQhVXrn4cKv5sY3rBRKPWtVi3pzWmp1y7KVBf/AL6UONj
c6VmCq1hFBPrV6IUPM8kHJK50Ju+yIrcqS2P6quEaEIT8RKCyunvurwHHjhUz7Ya
uUM7ZxI=
=yj29
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmp6GioUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSW9bA//SYbI1Mj6q2gMJyFZEL0Fz8P5pfWI
LAPPAFK+xhTQDl0POkv2/zzRYmXhuQFTD/v2asRmCyu/C9b+GMKVBTuAQWnybSy3
Mp6HjYRrAVpMbZE56lLGkgZXi6a3bZOh9K5m6wdd5frMQt131slBaiiK/U3ZyFKR
TQEIpNsbNa5mx614yCqobEDlGBIO0o4r2Z4iQD05ni2MH+ZYhVUKo+8gisEJledR
GK7ter1b04MCMaxLuW6GAj46DNUhXdXTaEunmgdimjhtSTCy09AulTZO477heQQj
PGXXxjuh7bxY0z8xorbWeqgz1nhr1L/nSDXPxTOyydBJ4FESqEtx8H4SaYiqdqxI
AGNMH7KQPPJTf9nB8lJWFW8tlUi71a/LlQHH8Gu55+N28nkTceQ02dR1eUSue43I
o2g6PMDUayX5SQRyQyEmO4Geusm5yENNHSxL7myDOsw3XIJbt9fjCTdulA50azK2
3QsFkXHy+fBOHxLa2njELKpga/AkUmmmfdj8u3nSe7z60Rjo0ZqUgPd61zO6HTf+
ncDjKlWHnihb7TnEQWyYSLZr9t/BOALDQXS8UFoxaNYu1ReNrV9OqxZFKN/igX77
HzYEmYURM5XeS3I/W8ignbxAXk6VBGvd91tv3By8o7fhlPfPQNCCcOJ9VvhdBkFb
Vrf6zvBdavldz3U=
=RZDP
-----END PGP SIGNATURE-----
Merge tag 'qcom-clk-fixes-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-fixes
Pull Qualcomm clock driver fixes from Bjorn Andersson:
- Fix the Eliza display clock controller to avoid RCG stall.
Revert the rework of the "PHY mux" clock, as this broke PCIe
on several different targets
- Drop (and correct one) bouncing maintainer email addresses in
Qualcomm clk DeviceTree bindings
* tag 'qcom-clk-fixes-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux:
dt-bindings: clock: Replace bouncing emails
Revert "clk: qcom: regmap-phy-mux: Rework the implementation"
clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
For bitmap this change makes no difference, because destructors are
called synchronously.
List type however calls them via call_rcu() so accounting decrement can
happen after list_set_flush() set ext_size to 0.
'set->elements = 0' can be removed for the same reason in the list type
case, it calls 'set->elements--' for each element.
Fixes: 9e41f26a50 ("netfilter: ipset: Count non-static extension memory for userspace")
Suggested-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
If list_set_uadd() calls list_set_replace() to swap an expired entry,
the element count remains the same, therefore the increment must be elided.
Fixes: 702b71e7c6 ("netfilter: ipset: Add element count to all set types header")
Link: https://sashiko.dev/#/patchset/20260806101947.2802-1-fw%40strlen.de
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nf_flow_table_iterate() only treats original-direction tuple nodes as
owning entries. Publishing the original node first lets GC observe and
free a flow while flow_offload_add() is still inserting the reply node.
Publish the reply node first and the original node last so GC never
sees a partially installed flow.
KASAN can trigger slab-use-after-free read and write reports in the
flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del,
flow_offload_lookup, etc.).
Fixes: ac2a66665e ("netfilter: add generic flow table infrastructure")
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Assisted-by: Codex:gpt-5
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
In nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every
error during rollback, including -ENOMEM. Memory allocation failures are
expected under low-memory conditions and do not indicate a kernel bug.
Trace for example:
nft_flow_offload_chain() // FLOW_BLOCK_BIND
nft_flow_block_chain()
nft_chain_offload_cmd()
nft_block_offload_cmd()
->ndo_setup_tc()
nsim_setup_tc()
flow_block_cb_setup_simple()
flow_block_cb_alloc() // fails to -ENOMEM
The warning was reproduced on the 5.10 stable kernel under memory pressure
via fault injection, but the underlying bug exists in mainline as well,
as demonstrated by the ENOMEM trace above. The following splat was
triggered during nf_tables transaction processing:
WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]
WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591
Modules linked in:
CPU: 0 PID: 8567 Comm: syz-executor.0 Not tainted 5.10.260-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]
RIP: 0010:nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591
Call Trace:
nf_tables_commit+0x3bd/0x4bd0 net/netfilter/nf_tables_api.c:8604
nfnetlink_rcv_batch+0xb1e/0x1f20 net/netfilter/nfnetlink.c:509
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:579 [inline]
nfnetlink_rcv+0x3b3/0x420 net/netfilter/nfnetlink.c:597
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x6cd/0xa00 net/netfilter/af_netlink.c:1340
netlink_sendmsg+0x906/0xe10 net/netfilter/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
__sock_sendmsg+0x155/0x190 net/socket.c:663
____sys_sendmsg+0x705/0x870 net/socket.c:2379
___sys_sendmsg+0x100/0x170 net/socket.c:2433
__sys_sendmsg+0xe9/0x1c0 net/socket.c:2462
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
Change the condition to WARN_ON_ONCE(err && err != -ENOMEM) so that
warnings are only emitted for unexpected errors. This aligns with the
common kernel practice of not warning on -ENOMEM.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 63b48c73ff ("netfilter: nf_tables_offload: undo updates if transaction fails")
Signed-off-by: Alexey Velichayshiy <a.velichayshiy@ispras.ru>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
While the outer IP header is already pulled into the skb head,
we must be careful and revalidate the embedded headers after
reading them from the skb frags to prevent out-of-bounds
access.
One such place reported by Sashiko is ip_vs_nat_icmp() where
local process can change the ihl field and after
skb_ensure_writable() we can see larger value which is a
problem for the ip_send_check(cih) calls.
Add check to drop the packet if the ihl field is changed.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Link: https://sashiko.dev/#/patchset/20260730183506.87473-1-ja%40ssi.bg
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the
quoted original request before passing it to icmp_send(). However,
IPCB(skb)->opt still describes the outer IPv4 header.
A timestamp option in the outer header can therefore leave an offset
that points into the quoted transport header after the rebase.
__ip_options_echo() treats a byte at that stale location as the option
length and copies it into the fixed-size option storage on the
__icmp_send() stack, causing a stack out-of-bounds write.
Clear the stale option metadata after resetting the network header.
Keep the remaining control block fields, including the ingress
interface used by the ICMP response path.
Fixes: f2edb9f770 ("ipvs: implement passive PMTUD for IPIP packets")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which
clears the logger pointer without an RCU grace period. Immediately after,
ops_free_list() frees the per-net state while concurrent packets might
still be executing nf_log_packet() under rcu_read_lock()."
Clear the pointer via .pre_exit to make sure rcu readers have completed
before pernet storage is free'd. The change in nf_log_syslog.c is only
done for consistency: it doesn't use pernet data.
Link: https://sashiko.dev/#/patchset/20260731151806.849724-1-pablo%40netfilter.org
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock
is still held.
When invalid logging is routed to nfnetlink_log and conntrack export is
enabled, the log path can re-enter conntrack netlink glue and dump the
same conntrack again. Protocol attribute dumping may take ct->lock, so
logging while holding that lock can deadlock.
Defer the TCP invalid logs by storing only the minimal log context while
ct->lock is held and emitting the log after unlocking. Also make the TCP
timeout-lowering invalid path return whether a log is needed, then emit
that log after unlocking.
Do the same for the SCTP invalid state-transition log that can be reached
while ct->lock is held.
Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers
that log invalid conntracks while holding ct->lock are caught outside TCP
and SCTP as well.
Fixes: 628d694344 ("netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst")
Fixes: d9a6f0d0df ("netfilter: conntrack: prepare tcp_in_window for ternary return value")
Fixes: f71cb8f45d ("netfilter: conntrack: sctp: use nf log infrastructure for invalid packets")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zihan Xi <zihanx@nebusec.ai>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
IPVS configuration paths update destination availability while connection
accounting updates destination overload state. The two independent states
share dest->flags, so their read-modify-write updates can race and lose one
another.
Keep OVERLOAD in flags, where the preceding patch serializes its updates
with dst_lock, and move AVAILABLE to cflags. This keeps configuration-
controlled availability out of the scheduler hot cacheline until a
scheduler needs to check it. It also prevents availability updates from
clobbering overload state.
The destination status bits are not exposed through the IPVS sockopt or
netlink interfaces, so keep their definitions in the internal IPVS header.
Readers can still observe stale destination state; this does not provide a
cross-field snapshot.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Link: https://lore.kernel.org/all/8913381c-1e02-35c7-0ec4-61de5a12fd35@ssi.bg/
Assisted-by: Claude-Code:GLM-5.2
Suggested-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
The upper/lower connection thresholds for dest can be changed,
so use ip_vs_dest_update_overload() to properly update the
dest overload flag.
The thresholds were not limited, fit them in the 0 .. INT_MAX
range as already done in ipvsadm.
As the thresholds are also read when connections are created
and expired, use WRITE_ONCE/READ_ONCE to access them.
As the lower threshold is optional, use (u - (u >> 2)) to
calculate the 75% default value based on the upper threshold
by preserving the integer rounding, as suggested by Yizhou Zhao.
Trigger flag update when totalconns reaches one of the
thresholds and use dst_lock to serialize the updating.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Replace the inactconns dest counter with totalconns, now
inactconns can be obtained from totalconns - activeconns.
This reduces the atomic inc/dec ops for TCP/SCTP from
6 to 4 if the connection is established and then closed.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
A bridge nftables ct zone set rule can attach a conntrack template to
an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6
EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with
IP_CT_UNTRACKED without releasing the existing template reference.
That makes the per-cpu template, and any temporary templates allocated
for concurrent use, unreachable and leaks memory until the host runs out
of slab.
Reset the skb conntrack state before marking the frame untracked so the
existing template reference is dropped on the non-IP path.
Fixes: 3c171f496e ("netfilter: bridge: add connection tracking system")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
__ip_set_put_byindex() resolved the index to a set pointer under RCU,
then took ip_set_ref_lock in __ip_set_put() to decrement set->ref.
ip_set_swap() holds that same lock while swapping both the ip_set_list
slots and the two sets' ref counters, so it can interleave between the
dereference and the lock acquisition, leaving the caller to decrement a
set whose reference already moved to the other index and hit
BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq,
which the nfnl mutex does not serialize against swap: an expiring
list:set member calls list_set_del() -> ip_set_put_byindex() while
IPSET_CMD_SWAP runs on the referenced sets.
Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap()
already does, keeping the refcount tied to the index rather than to a
stale set pointer.
kernel BUG at net/netfilter/ipset/ip_set_core.c:685!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870)
Call Trace:
<IRQ>
list_set_del (net/netfilter/ipset/ip_set_list_set.c:159)
set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181)
list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578)
call_timer_fn (kernel/time/timer.c:1748)
__run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374)
run_timer_softirq (kernel/time/timer.c:2405)
</IRQ>
Kernel panic - not syncing: Fatal exception in interrupt
Fixes: 9076aea765 ("netfilter: ipset: Increase the number of maximal sets automatically")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
DQS is a typical SPI memory signal used to help with reading the data on
the bus at high speeds (especially in DTR mode) by avoiding clock
skews. The chip generates a clock signal synchronized with its data
output fronts, also called data strobe.
SPI NOR and SPI NAND cores must set this flag in order to indicate to
other layers that DQS is available.
Create a getter and a setter to reach this capability.
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20260810-winbond-nand-next-phy-tuning-v3-1-a97c3a61e675@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
- Initial M3 Pro, Max and Ultra device trees, which are responsible for
the majority of the diffstat. These include CPU cores, interrupt
controller, power state, watchdog, serial pin/gpio controller, i2c and
the boot framebuffer. They are now on par with the base M3 device
trees.
- HWMON sensors for M1/M2
- "pmgr-misc" nodes for M1/2 Pro/Max/Ultra which saves about 1W of power
on these machines. The corresponding driver and dt-binding are part of
the Apple SoC driver changes tag for this cycle.
Signed-off-by: Sven Peter <sven@kernel.org>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQS3vz815OHsEaWy0u9EEX0kKnUe6QUCanYC3AAKCRBEEX0kKnUe
6TjhAP48U0pnqD5rIzUKiXvrsf0kYgbUg4fuvxYTKAfTU2WXvgEApHwB/aS9W+EC
AzBgYldnbJlVg5MhsBqG49l8+B7rPwo=
=odXF
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp5/PkACgkQmmx57+YA
GNnWORAAlI7DAtGIPtoHaJNSQGVCyylEPgY23ZpIB6vraFnsBhHDdNY+sBEd1jI1
2M388XJmJ9dAbKf51pAAWiOtmW7TuuKclZWxekAZ37i+LBeL2E4034l/jLAR8ZHJ
P37ogQlOpR7C/YOV2Ro4wQ3qST2OjjANOIYCzCp390ujzqsvBPPVo5U9sF+pVSCQ
vHtXiPFck9CmxQAEfkg8XULhwc7NYLWg2aNtJ9YPmHI7+IGSjJgiXaX6JsZdPJwz
tjCrOtCWJ3RVOT18vdD1TnDBQdrpk1yquGQkk/LMEZhqXAplprKdasqegdIvgUyC
qXGZ62wiWKAg6QRlIQDCOw4Uj7mgjOeay83XgIOA+H4vRYd11SM0cMqaXlfn8DeH
n0Wqt35X0/pNVIEUEIvCmPRdMw+qSAjr4JN005eEoG76Q4Ouaf9xvqvvbtnWWgql
VYV5vSFKbkhhWuJcIwifB7d3eEk321dJHvdwuSpexLlFdM8nVu+1gHHeUn+VHBYC
xXgv9K5ou8qvIeGHXqxFYoj6lvm1jwGijgc51ROHEfPuZmBDhr3Cin2H+I+imv6q
+fc/aAX0MPoTgkdx9W/+qPZql73W+vmhlu0eYGbhSAOmtm68prrdDu6ckOaXVRbF
w8lvAFd7Wa/RBulDZxieMzU/W6Z+FZ3BSBj4H1EqqfHrp7CoaPg=
=azbS
-----END PGP SIGNATURE-----
Merge tag 'apple-soc-dt-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/dt
Apple SoC DTS changes for 7.3
- Initial M3 Pro, Max and Ultra device trees, which are responsible for
the majority of the diffstat. These include CPU cores, interrupt
controller, power state, watchdog, serial pin/gpio controller, i2c and
the boot framebuffer. They are now on par with the base M3 device
trees.
- HWMON sensors for M1/M2
- "pmgr-misc" nodes for M1/2 Pro/Max/Ultra which saves about 1W of power
on these machines. The corresponding driver and dt-binding are part of
the Apple SoC driver changes tag for this cycle.
Signed-off-by: Sven Peter <sven@kernel.org>
* tag 'apple-soc-dt-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: (22 commits)
arm64: dts: apple: Initial T6030 (M3 Pro) device trees
arm64: dts: apple: Initial T603[124] (M3 Max and Ultra) device trees
dt-bindings: pwm: apple,s5l-fpwm: Add t6030 and t6031 compatibles
dt-bindings: i2c: apple,i2c: Add t6030 and t6031 compatibles
dt-bindings: power: apple,pmgr-pwrstate: Add t6030 and t6031 compatibles
dt-bindings: arm: apple: apple,pmgr: Add t6030 and t6031 compatibles
dt-bindings: interrupt-controller: apple,aic2: Add apple,t6031-aic3 compatible
dt-bindings: interrupt-controller: apple,aic2: Invert #interrupt-cells condition
dt-bindings: arm: apple: Add M3 Pro/Max/Ultra devices (T603x)
arm64: dts: apple: t60xx: jxxx: Add device-specific SMC hwmon sensors
arm64: dts: apple: t8112: jxxx: Add device-specific SMC hwmon sensors
arm64: dts: apple: t8103: jxxx: Add device-specific SMC hwmon sensors
arm64: dts: apple: t602x: Add common SMC hwmon sensors
arm64: dts: apple: t600x: Add common SMC hwmon sensors
arm64: dts: apple: t8112: Add common SMC hwmon sensors
arm64: dts: apple: t8103: Add common SMC hwmon sensors
arm64: dts: apple: Add common SMC hwmon infrastructure
arm64: dts: apple: t602x: Add SMC hwmon node
arm64: dts: apple: t600x: Add SMC hwmon node
arm64: dts: apple: t8103: Add SMC hwmon node
...
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Qualcomm Arm32 DeviceTree updates for v7.3
Add initial device tree support for the MSM8926-based Sony Xperia M2 and
the MSM8226-based Motorola Moto G2 (2014).
Add touchscreen, Bluetooth pin configuration, NFC, and multicolor status LED
support to the MSM8974-based HTC One M8 device tree.
Add the coreriver,tc360-touchkey compatible touchkey node to the MSM8960
Samsung ExpressATT device tree and label PM8921 XOADC channels.
Consolidate shared IPA properties in the SDX55 device tree.
* tag 'qcom-arm32-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux:
ARM: dts: qcom: msm8926-sony-xperia-yukon-eagle: add initial device tree
ARM: dts: qcom: msm8960: expressatt: Add coreriver,tc360-touchkey
ARM: dts: qcom: msm8226: Support Motorola Moto G2 (2014)
ARM: dts: qcom: pm8921: add labels for ADC channels
ARM: dts: qcom: sdx55: consolidate IPA properties
ARM: dts: qcom: msm8974pro-htc-m8: add touchscreen
ARM: dts: qcom: msm8974pro-htc-m8: add Bluetooth pins
ARM: dts: qcom: msm8974pro-htc-m8: add NFC support
ARM: dts: qcom: msm8974pro-htc-m8: add status LEDs
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
These patches fix some issues which were noticed in some drivers where
caches were not fully resynced after suspend. Drivers are supposed to
be sorting the table of register defaults they provide to the core and
the core was relying on that but it turns out there are many cases where
this does not happen, it's easy to get wrong when using named defines
for registers rather than numbers. It is more robust to remove the
requirement for sorting and instead have the core ensure everything it
needs sorting is sorted so do that.
There will be patches during the merge window sorting the tables in
drivers since it is more efficient to do that but this will just be a
minor performance win rather than a correctness fix.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp5yXcACgkQJNaLcl1U
h9AdhQf+OuDvmAGl6VpkbUBQqK/E9YO7mXqEOKGpbhi5e4CDUN+pY1HsMIgChMC7
e2gvLNwUY1zYUlon2RzXAYJ3fV/JmIZmz/8qp65VN2qljltAS+PT47qYpZb0WKKa
RAGdUOCthmaNwGou/ofO/MpAqRbgXY89H3AlBBRfR5jGsVJTqyvMsKVCR2h/X7SN
7rlEV6/a9gubTGrZEXaNEl6SvCsI1JmTidQHO4A9ROvo38alrYU4fMCgbSJ/W7cA
U5oBbO0qIixgR/xGNkMrLMKoIRfXElJ2he9idOQDcfbAMzlUeyZkj2xHqF9gHNRs
Zx/l0QrCagcLjUNVDMhpgE85Q+dfqQ==
=7QwV
-----END PGP SIGNATURE-----
Merge tag 'regmap-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fixes from Mark Brown:
"These fix some issues which were noticed in some drivers where caches
were not fully resynced after suspend. Drivers are supposed to be
sorting the table of register defaults they provide to the core and
the core was relying on that but it turns out there are many cases
where this does not happen, it's easy to get wrong when using named
defines for registers rather than numbers. It is more robust to remove
the requirement for sorting and instead have the core ensure
everything it needs sorting is sorted so do that.
There will be patches during the merge window sorting the tables in
drivers since it is more efficient to do that but this will just be a
minor performance win rather than a correctness fix"
* tag 'regmap-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regcache: Sort the local copy of an unsorted reg_defaults array
regcache: Use a consistent sort for defaults table
Several non-functional (white-space and style) changes to match with DTS
coding style as reported by recent dt-check-style tool. Goal is to get
to no `dt-check-style --mode strict` warnings over time.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmp0RMQQHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1wL5D/9pJn/QpXraZ9Mo6aY80EO6Ufun1uz+f2lM
Jp9V/O3cUFoc3+EgGcp4oh7JbwGdfEnad2pVm+CQjpSZL6uuBNCHO9WtIcGeL63t
k9xL1/7KttPmZBSCNfB2AUKFPPyhbUr+Fk3CjYUR5mAxsa5PgivJZSIE+JQ8RN6t
rByp6qip9cyfguuQLi7xVUou5n5nQcSJPqntCsgVm0Wk1nD/gyTxuyxDp2SGt9Rs
U9CobD6YuQi8TGpjFtBNALq98isZmuAF75mgYz2RHEtjYKmXGDl/a4TZ7K3295Qc
/ZkeLvnmWaLVnoQAaGKlb3cuEgvuuZumFThPj0jwmVQn153B6UPN/M9TVfrqgpG4
Scbh2+CEb3DGRCjsmEaDtT5qZnb+xv42wW79V/MDqVQaDN8kiUxAaT0/DNPaBCJN
A3J9BnJgEN6qXDt5ZTMo7OqQB2GUra4SOoWD+6F92zWBLHyAagfc39V9IlTA1I2b
i0kfmYPRr3ooqYf2eNQPnuftUqPqlvWeJKK+tczn1GPQnaDmcvIC6V0M8qTiW3CK
UJlogvgQqYfap2Cq9ZhjyYrVXZ0H+VqlSw2xCoezdggDQBmzP9K3JsvMe8DmCRXK
uOoKEXLrAJ5krINZuVbY0L9VYH4lYtV5Kof0WXPumyYmmpIObQrGtipJKdc4CFSQ
ymzW0L79Aw==
=GPP3
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp59ekACgkQmmx57+YA
GNkT8RAAkONJBU/GkXcmT+RclfTwZ19FZO9Pq7p7gtOLkJg1GrE1//gIcG8stpp6
1Z9OPoF3PIonN36O8in7PARSmQlltqojSFdJ6lA26g9U8DwsMTQ9g7VKgewCxMDi
23zFVCOpKxSHsQlw8nGpIWKcrceUyTsZlyPG3mete95LeoJncxr63uf9NJOGTfWq
gYtC5/amVCyl2ZvXE8YTaWVXNZBa8D/9Ea4y5ZtoLT37vSqkRjE1bFo2qWfTLT5Q
Iex7iormr+jnIP+FSeMNWQomWpeKuE7O5NhkLrygCZsguPe5pgDDx11GYFZW541N
OKhtYe02A7PVnfkapwRG2vPchytSCWVVzcRnVfzNEqjIec2WjZQ+BkeSD3uLL+lu
DyZGAKmuWcMIdFQ6xsZolRpqkHb2CLnmMbiUDf5mNisa3uqJHqHyxv4jft7mRK2k
tNawkqFsOnf440yP8pPYB8FIP+79+LTaU4rIg54X8aC0SXpj8ImARG8ud10pwy7C
6Jj8nBGHqTFQgKrVfwC53MGw876/iW09ZK0ZFBdCwmH5MtKBX7cTA8Y1Tk8DYvdt
dVKUQFAKeK80J/M52ARQPcG+BPVagej6cSyvp2cMUvinhxGczrW3SpGn3nhG2iZK
QmPjhGUydB20d+Gah6e2YP7sH0MZn66E/FyodhuRgGTURqZjpKM=
=mVJT
-----END PGP SIGNATURE-----
Merge tag 'dt64-cleanup-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt into soc/dt
Minor improvements in arm64 DTS for v7.3
Several non-functional (white-space and style) changes to match with DTS
coding style as reported by recent dt-check-style tool. Goal is to get
to no `dt-check-style --mode strict` warnings over time.
* tag 'dt64-cleanup-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt:
arm64: dts: Correct white-space style
arm64: dts: amd: seattle: Remove useless xgbe DTSI include
arm64: dts: amd: seattle: Remove useless clocks DTSI include
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Propagate errors such as -EPROBE_DEFER and -EINVAL instead of continuing
probe without the IRQ.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260810082606.42623-1-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Instead of only checking for -EPROBE_DEFER, propagate all error codes
returned by platform_get_irq_optional() other than -ENXIO, so that
failures are properly reported to the caller.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260810105101.55945-1-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Propagate errors such as -EPROBE_DEFER and -EINVAL instead of continuing
probe without the IRQ.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260807081652.38692-4-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Propagate errors such as -EPROBE_DEFER and -EINVAL instead of continuing
probe without the IRQ.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260807080447.35479-2-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Instead of only checking for -EPROBE_DEFER, propagate all error codes
returned by platform_get_irq_optional() other than -ENXIO, so that
failures are properly reported to the caller.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260807081652.38692-3-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
platform_get_irq_optional() returns a positive IRQ number on success or
a negative error code on failure. For an optional IRQ, -ENXIO indicates
that no IRQ is available, while other errors should be propagated.
Instead of only checking for -EPROBE_DEFER, propagate all error codes
returned by platform_get_irq_optional() other than -ENXIO, so that
failures are properly reported to the caller.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://lore.kernel.org/r/20260807081652.38692-2-phucduc.bui@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
'struct watchdog_ops' and 'struct watchdog_info' are not modified in this
driver.
Constifying these structure moves some data to a read-only section, so
increases overall security, especially when the structure holds some
function pointers.
On a x86_64, with allmodconfig:
Before:
======
text data bss dec hex filename
7319 1768 0 9087 237f drivers/watchdog/apple_wdt.o
After:
=====
text data bss dec hex filename
7543 1544 0 9087 237f drivers/watchdog/apple_wdt.o
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/99019b7e560c2d9c087be340e68f9cce4db1988e.1786283336.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Commit 645ad41da8b2 ("watchdog: pretimeout: Add "dump" pretimeout
governor") added the "dump" watchdog pretimeout governor, but restricted
it to built-in code because trigger_all_cpu_backtrace() was not exported
to loadable modules.
Now that CPU backtrace APIs are supported for loadable kernel modules
via cpumask_backtrace(), convert WATCHDOG_PRETIMEOUT_GOV_DUMP to
tristate. This allows kernels to deliver the pretimeout governor as a
loadable kernel module.
Signed-off-by: Mayank Rungta <mrungta@google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Link: https://lore.kernel.org/r/20260730-export-cpu-backtrace-apis-v1-2-bace8e1cb817@google.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Currently, CPU backtrace functions cannot be called from loadable
modules because the underlying helper arch_trigger_cpumask_backtrace()
is not exported.
Instead of exporting arch_trigger_cpumask_backtrace() individually
across every supported architecture, introduce and export a common
helper, cpumask_backtrace(), in lib/nmi_backtrace.c. Update the four
inline CPU backtrace macros in include/linux/nmi.h to route through this
centralized helper.
Signed-off-by: Mayank Rungta <mrungta@google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Link: https://lore.kernel.org/r/20260730-export-cpu-backtrace-apis-v1-1-bace8e1cb817@google.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
scripts/kernel-doc -none reports:
Warning: drivers/watchdog/booke_wdt.c:158 function parameter 'data'
not described in '__booke_wdt_disable'
__booke_wdt_disable() is invoked through on_each_cpu(), so it takes a
void * argument that it does not use. Its kernel-doc comment does not
describe the parameter at all.
Document it as unused.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
Link: https://lore.kernel.org/r/20260730060617.7-3-bbnpreetsingh@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Some firmwares describe WDAT registers inside memory ranges marked as
ACPI NVS in the E820 map, failing with -EBUSY during probe, leaving the
hardware watchdog unserviced and triggering periodic system resets.
This issue was observed on a OnLogic Karbon 524 device (when watchdog is
enabled in BIOS):
wdat_wdt wdat_wdt: error -EBUSY: can't request region for resource [mem 0x63df7a98]
wdat_wdt wdat_wdt: probe with driver wdat_wdt failed with error -16
Check whether the region falls inside ACPI NVS before requesting it and,
if so, map it without reservation.
Signed-off-by: Renê de Souza Pinto <rene@renesp.com.br>
Link: https://lore.kernel.org/r/20260804103958.3684195-1-rene@renesp.com.br
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Add driver support for the Watchdog Timer (WDT) integrated in
Nuvoton MA35D1 SoC. This driver provides standard watchdog functionality,
including timeout configuration, ping, and system reset support via
the watchdog framework.
Signed-off-by: Zi-Yu Chen <zychennvt@gmail.com>
Link: https://lore.kernel.org/r/20260804070351.1846165-3-zychennvt@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Add device tree binding documentation for the watchdog timer (WDT)
controller found on Nuvoton MA35D1 SoC.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Zi-Yu Chen <zychennvt@gmail.com>
Link: https://lore.kernel.org/r/20260804070351.1846165-2-zychennvt@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Report bootstatus on IPQ5332 and IPQ9574. These SoCs use different
restart-reason values from IPQ5424 for watchdog reset and powerunder
reset events, so add separate match data for them and use it when
decoding the restart reason.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260728-qcom_wdt_powerunder-v1-2-de8d9e964e7d@oss.qualcomm.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
On IPQ platforms, identify the restart reason as POWERUNDER, similar to
CARDRESET, and expose it via the bootstatus sysfs interface.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260728-qcom_wdt_powerunder-v1-1-de8d9e964e7d@oss.qualcomm.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
