-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEH7ZpcWbFyOOp6OJbrB3Eaf9PW7cFAmo4560ACgkQrB3Eaf9P
W7fDNg//WWYvJgff2nGNHa0cqm2PGbwlfD8xEyc5d9nn/sz5yO+1BzN6junxAd7b
U9PE2Y1Zgh8E43TjqCsWebyv6D4/T6X/iIJXEzPoMZeJnBxLHxGf66ThKaQ8RuDH
sKaOBexllkfrluSyvdL3vpJUS04bbvyBpLFWsaKIsy0hFMSIBRYWv2Z+HF8RBzTb
YqAsG1bFOKhBxbbj5CXh6Wuc8PFRMoXlrzWjsMKa9KGkXDbIitvdO/t8cc3ZXo9g
YE5iz8+poJDy+Uvn74TJ5P5w6jhkTtBliJ13Hckoq5th/5USE92c9ZtVqqCCjB2h
TL3ChPRn3O2FfBaNYZBHqKXEBpgFF91FPlCTviZKtavDTuNVij432XeYKXU7ZBUW
dNVPHkbylYjNKaFftLFSKIj644aWLCSrit7Uoz07eeMOn7Ef7pkv6VAnDMBCrS5i
jwH7FJHyTH7cw21SqB20Q8rlpipeBbSl4Z4gCePBomXXgRkgQqQddOtfCTl25xtF
vLQiAEU8oVUNQ7z41CBR70S6psfxQn+Od9z2UACv1d8yOEt+cWnK/mmxYL8qq6Jz
2sx753Z7UWcPLOQVbpgh4CxJuA1wjqlip7Evi1bFdeY3NM+o9PZ2NfFzBOWS6ZXH
ZgEqHVHcYiKqUb59m6LDcLG+AzDmHBJUk7o3w9tr0rqVhN+eLkA=
=LFlA
-----END PGP SIGNATURE-----
Merge tag 'ipsec-2026-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
Steffen Klassert says:
====================
pull request (net): ipsec 2026-06-22
1) xfrm: use compat translator only for u64 alignment mismatch
Gate the XFRM_USER_COMPAT translator on COMPAT_FOR_U64_ALIGNMENT
so 32-bit compat tasks on arches whose 32-bit ABI already matches
the native 64-bit layout are no longer rejected with -EOPNOTSUPP.
From Sanman Pradhan.
2) net: af_key: initialize alg_key_len for IPComp states
Initialize the alg_key_len to 0 in the IPComp branch of
pfkey_msg2xfrm_state() so an uninitialized value cannot drive
xfrm_alg_len() into a slab-out-of-bounds kmemdup during
XFRM_MSG_MIGRATE. From Zijing Yin.
3) xfrm: Fix dev use-after-free in xfrm async resumption
Stash the original skb->dev and extend the RCU critical section
across xfrm_rcv_cb() and transport_finish() to prevent a
tunnel-device UAF and original-device refcount leak when a
callback replaces skb->dev. From Dong Chenchen.
4) xfrm: Fix xfrm state cache insertion race
Move the state-validity check inside xfrm_state_lock in the
input state cache insertion path so a state cannot be killed
between the check and the insert. From Herbert Xu.
5) xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
Add READ_ONCE()/WRITE_ONCE() annotations on xfrm_policy_count
and xfrm_policy_default to silence the KCSAN data race reported
on net->xfrm.policy_count. From Eric Dumazet.
6) espintcp: use sk_msg_free_partial to fix partial send
Replace the manual skmsg accounting in espintcp with
sk_msg_free_partial() so the skmsg stays consistent on every
iteration and the partial-send accounting bugs go away.
From Sabrina Dubroca.
7) xfrm: validate selector family and prefixlen during match
Reject mismatched address families in xfrm_selector_match() and
bound prefixlen in addr4_match()/addr_match() to prevent the
shift-out-of-bounds syzbot reported when an AF_UNSPEC selector
with a large prefixlen is matched against an IPv4 flow.
From Eric Dumazet.
* tag 'ipsec-2026-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
xfrm: validate selector family and prefixlen during match
espintcp: use sk_msg_free_partial to fix partial send
xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
xfrm: Fix xfrm state cache insertion race
xfrm: Fix dev use-after-free in xfrm async resumption
net: af_key: initialize alg_key_len for IPComp states
xfrm: use compat translator only for u64 alignment mismatch
====================
Link: https://patch.msgid.link/20260622075726.29685-1-steffen.klassert@secunet.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
- Fix an MM-CID race that can cause an OOB write
(Rik van Riel)
- Fix a debugobjects OOM handling race (Thomas Gleixner)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmo6t3URHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1iXwg/8CPIGhMJBMG97dl+m3Iq6RlzSNCTU6+Ho
AClN/+jtduU/sEedvFC150Yvjhe1p78hHkVuFyu4hvZaevFg4v70vz0TpsfOWS4p
wvKxEZpuhmDJTPBx8ZWq8oD+ZgKr0VVr0PQcHHiHggDKbb5UEY4H8SDHSx8bcJqg
2iq4NuOYZX+PRAmsPg0MAhpnfHiYkz2HPoLwDXkol0G53WMAzsKxroLO9bXni7WJ
PI+ru3WmecjqTaDDUgQO0LabLnl7vuEjsIQEK4tfQqlMWwepsrURcxNuL/61S38d
cmn4b2vnJ8G2pjLiKKv4imVdfrUh1TsoG7JakezTad+OQeKlThbkmdIST/FW5ey7
roI8Ux1+/S1G9orgbI+buNC1G5/Bi4RH7Y20DzjvlWRXc89OVsybBJn6owIgZgSS
ksGnsfBxbds9ErtKdp5aGhtJ9IKfIAO9OsoJh9gNxIyuqV0F03FDI5Tq7zuw/zPz
faEFHH9uTlBjEQbJAlpJ2Z4M4nNyMj8OMhZgw/kxq6ogJDa49kr0hnGdhd2b18v6
kNXkXERPoreKdkjeRC4/qwuhIxMSLISHDZEEt2gk2Rrl8ly62rMhOfn7BV4ffHnO
6/YasPW1iBLH4h6l8yoi3k8YEmjO0s+mEoMINxkdChJWot7EplsxUyWcziRMxkpi
Be5441cyO9o=
=bywo
-----END PGP SIGNATURE-----
Merge tag 'core-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull misc core fixes from Ingo Molnar:
- Fix an MM-CID race that can cause an OOB write (Rik van Riel)
- Fix a debugobjects OOM handling race (Thomas Gleixner)
* tag 'core-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
debugobjects: Plug race against a concurrent OOM disable
sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path
kernel test robot report missing kernel-doc descriptions for the 'wait_ack'
and 'inc_epoch' parameters of smb2_lease_break_noti():
Warning: fs/smb/server/oplock.c:937 function parameter 'wait_ack' not
described in 'smb2_lease_break_noti'
Warning: fs/smb/server/oplock.c:937 function parameter 'inc_epoch' not
described in 'smb2_lease_break_noti'
Document both parameters to silence the warnings.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Detected by Smatch.
fs/smb/server/oplock.c:1446 smb_grant_oplock()
warn: inconsistent indenting
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
ksmbd_auth_ntlmv2() derives the NTLMv2 session key into
sess->sess_key before it verifies the NTLMv2 response.
ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even
when ksmbd_auth_ntlmv2() failed.
With SMB3 multichannel binding, the failed authentication operates on
an existing session and the session setup error path does not expire
binding sessions. A client can send a binding session setup with a
bad NT proof and KEY_XCH and still modify sess->sess_key before
STATUS_LOGON_FAILURE is returned.
Relevant path:
smb2_sess_setup()
-> conn->binding = true
-> ntlm_authenticate()
-> session_user()
-> ksmbd_decode_ntlmssp_auth_blob()
-> ksmbd_auth_ntlmv2()
-> calc_ntlmv2_hash()
-> hmac_md5_usingrawkey(..., sess->sess_key)
-> crypto_memneq() returns mismatch
-> KEY_XCH arc4_crypt(..., sess->sess_key, ...)
-> out_err without expiring the binding session
Derive the base session key into a local buffer and copy it to
sess->sess_key only after the proof matches. Return immediately on
authentication failure so KEY_XCH is only processed after successful
authentication.
Fixes: e2f34481b2 ("cifsd: add server-side procedures for SMB3")
Fixes: f9929ef6a2 ("ksmbd: add support for key exchange")
Cc: stable@vger.kernel.org
Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Bunch of new driver, device support in existing drivers/binding and few
updates to existing drivers
- New Support
- Qualcomm Eliza QMP PHY, Eliza Synopsys eUSB2 support, Eliza PCIe phy
support, Nord QMP UFS PHY, IPQ5210 USB3 PHY support
- Econet EN751221 and EN7528 PCIe phy support
- NXPs TJA1145 CAN transceiver phy support
- TI DS125DF111 retimer phy support
- Rockchip RK3528 usb phy support
- TI J722S phy support
- Axiado eMMC PHY driver
- EyeQ5 Ethernet PHY driver
- Generic PHY driver for Lynx 10G SerDes
- Spacemit K3 USB2 PHY support
- Updates
- Tomi helping maintian zynqmp phys
- lynx phy updates to support 25GBASER
- Rockchip GRF for RK3568/RV1108 support
- Qualcomm QSERDES COM v2 support
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmo6sKsACgkQfBQHDyUj
g0c8sg//c+sgoW7jH8FVtUH5gVOM9nEMV7ZhyowMZ02ebkYGp+i6Ks74iqld1WRp
4QzHVHYWRnVjF7UpJBo+bEFnLgO8kdsI5J1hn2TpAQiMziDV5jrfezY06s5N4pQ6
X2v1QPWhR1kgF0w3s2fjVVV+I9TQveTQHHEDGr7qhPr5lFRGc64UnJ21UHyCoAtm
BY9c20dCLAiFhEhdtkBqs4j0JD5Y9DxeeoBSVn347gzBG8lqPAstXgJOgUtGw92n
gPP0AkDfis0g/ezkrEZ2oMdxa75RxGEtIpFsz3vsG9+k1zZNwtOer83SOrny3UwS
9xnsovKT6D8lXJc+CkFi4od07607ywb7+I5c7zwogjrp3+72Sa2teh8V5zkJA+od
XUAP2FlWUxjb44M0sHo4m5yviaRAE5FyDFA/yA+DFauIheGqAEaerGAGp3GSRSGy
abiXJ1MraAF26yUY8Dm4Rgde3L1C+0PMgrDb+MIPD6teIRkYR4kMEpBg4BcuJmv3
fmoVtn9NUBI3z2BJSLxxOIm0CkYH9JJ7JZZIfIsJFo92MP83QFyf3C/rRfqCLqIa
IHagKJAQZuSTNOsM3TGO1c+9yJHGna0JlNUVL/bv2w/u20R1dnVESwc0QyThS3xp
5bVD7NZBLT43emq5dJqpSFHYW89wYyCTJVAQ4qKOSQMpw4A3hQM=
=b6+n
-----END PGP SIGNATURE-----
Merge tag 'phy-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy
Pull phy updates from Vinod Koul:
"Bunch of new driver, device support in existing drivers/binding and
few updates to existing drivers
New Support:
- Qualcomm Eliza QMP PHY, Eliza Synopsys eUSB2 support, Eliza PCIe
phy support, Nord QMP UFS PHY, IPQ5210 USB3 PHY support
- Econet EN751221 and EN7528 PCIe phy support
- NXPs TJA1145 CAN transceiver phy support
- TI DS125DF111 retimer phy support
- Rockchip RK3528 usb phy support
- TI J722S phy support
- Axiado eMMC PHY driver
- EyeQ5 Ethernet PHY driver
- Generic PHY driver for Lynx 10G SerDes
- Spacemit K3 USB2 PHY support
Updates:
- Tomi helping maintian zynqmp phys
- lynx phy updates to support 25GBASER
- Rockchip GRF for RK3568/RV1108 support
- Qualcomm QSERDES COM v2 support"
* tag 'phy-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (87 commits)
phy: rockchip: inno-usb2: Add missing clkout_ctl_phy kerneldoc
phy: Move MODULE_DEVICE_TABLE next to the table itself
phy: add basic support for NXPs TJA1145 CAN transceiver
dt-bindings: phy: add support for NXPs TJA1145 CAN transceiver
phy: freescale: phy-fsl-imx8qm-lvds-phy: Fix missing pm_runtime_disable() on probe error path
dt-bindings: phy: qcom,qmp-usb: Add ipq5210 USB3 PHY
dt-bindings: phy: qcom,qusb2: Document IPQ5210 compatible
phy: freescale: phy-fsl-imx8qm-lvds-phy: Use synchronous PM runtime put in reset
MAINTAINERS: expand Lynx 28G entry to cover Lynx 10G SerDes
phy: lynx-10g: new driver
dt-bindings: phy: lynx-10g: initial document
phy: lynx-28g: improve phy_validate() procedure
phy: lynx-28g: optimize read-modify-write operation
phy: lynx-28g: add support for big endian register maps
phy: lynx-28g: common probe() and remove()
phy: lynx-28g: make lynx_28g_pll_read_configuration() callable per PLL
phy: lynx-28g: move struct lynx_info definitions downwards
phy: lynx-28g: provide default lynx_lane_supports_mode() implementation
phy: lynx-28g: generalize protocol converter accessors
phy: lynx-28g: common lynx_pll_get()
...
- Fix typos in documentation (josh ziegler)
- Use FIELD_MODIFY() instead of open-coding it (Hans Zhang)
* pci/misc:
PCI: Use FIELD_MODIFY() instead of open-coding it
Documentation: PCI: Fix typos
- Remove unused gpio.h include from amd-mdb, designware-plat, fu740,
visconti drivers (Andy Shevchenko)
* pci/controller/misc:
PCI: visconti: Drop unused include
PCI: fu740: Drop unused include
PCI: designware-plat: Drop unused include
PCI: amd-mdb: Use the right GPIO header
- Add common TLP Type macros (MRd/Wr, IORd/Wr, CfgRd/Wr 0, CfgRd/Wr 1, Msg)
and use them in aspeed, cadence, dwc, mediatek, tegra drivers (Hans
Zhang)
* pci/controller/tlp_macros:
PCI: cadence: Use common TLP type macros
PCI: dwc: Replace ATU type macros with common TLP type macros
PCI: Add common TLP type macros and convert aspeed/mediatek
- Protect root bus removal with rescan lock in altera, brcmstb, cadence,
dwc, iproc, mediatek, plda, rockchip to prevent use-after-free or crashes
when racing with sysfs rescan or hotplug (Hans Zhang)
* pci/controller/rescan_lock:
PCI: rockchip: Protect root bus removal with rescan lock
PCI: plda: Protect root bus removal with rescan lock
PCI: mediatek: Protect root bus removal with rescan lock
PCI: iproc: Protect root bus removal with rescan lock
PCI: dwc: Protect root bus removal with rescan lock
PCI: cadence: Protect root bus removal with rescan lock
PCI: brcmstb: Protect root bus removal with rescan lock
PCI: altera: Protect root bus removal with rescan lock
- Add pci_host_common_link_train_delay() for the mandatory delay after
> 5GT/s Link training completes and use it for cadence HPA, j721e, LGA;
dwc; aardvark, mediatek-gen3, rzg3s (Hans Zhang)
* pci/controller/link_train_delay:
PCI: rzg3s-host: Use common pci_host_common_link_train_delay() helper
PCI: mediatek-gen3: Add 100 ms delay after link up
PCI: aardvark: Add 100 ms delay after link training
PCI: dwc: Use common pci_host_common_link_train_delay() helper
PCI: cadence-hpa: Add post-link delay
PCI: cadence: Add post-link delay for LGA and j721e glue driver
PCI: Add pci_host_common_link_train_delay() helper
# Conflicts:
# drivers/pci/controller/pci-host-common.h
- Use fixed-width interrupt masks to avoid truncation in 64-bit builds
(Rosen Penev)
* pci/controller/mvebu:
PCI: mvebu: Use fixed-width interrupt masks to avoid truncation in 64-bit builds
- Deassert PCIE_PHY_RSTB so REFCLK is stable for at least 100ms
(PCIE_T_PVPERL_MS) before deasserting PERST# (Jian Yang)
- Add .shutdown() to assert PERST# before powering down device (Jian Yang)
- Do full device power down on removal, including asserting PERST#, when
removing driver (Chen-Yu Tsai)
- Fix a 'failed to create pwrctrl devices' error message that was
inadvertently skipped (Chen-Yu Tsai)
* pci/controller/mediatek-gen3:
PCI: mediatek-gen3: Fix incorrectly skipped pwrctrl error message
PCI: mediatek-gen3: Do full device power down on removal
PCI: mediatek-gen3: Add a .shutdown() callback to control PERST# signal
PCI: mediatek-gen3: Fix PERST# control timing during system startup
- Use FIELD_PREP() to fix incorrect operator precedence in PCIE_FTS_NUM_L0
(Li RongQing)
- Fix IRQ domain leak when port fails to enable (Manivannan Sadhasivam)
- Use actual physical address for MSI message address instead of
virt_to_phys() (Manivannan Sadhasivam)
- Add EcoNet EN7528 to DT binding (Caleb James DeLisle)
* pci/controller/mediatek:
dt-bindings: PCI: mediatek: Add support for EcoNet EN7528
PCI: mediatek: Use actual physical address instead of virt_to_phys()
PCI: mediatek: Fix IRQ domain leak when port fails to enable
PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
- Ignore downstream devices only on internal bridges to avoid Loongson
hardware issue (Rong Zhang)
- Quirk old Loongson-3C6000 bridges that advertise incorrect supported link
speeds (Ziyao Li)
* pci/controller/loongson:
PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
PCI: loongson: Do not ignore downstream devices on external bridges
- Restore .map_irq() assignment that broke INTx on the iproc platform bus
driver (Mark Tomlinson)
* pci/controller/iproc-bcma:
PCI: iproc: Restore .map_irq() for the platform bus driver
- Program the DesignWare PORT_AFR L1 entrance latency based on the
'aspm-l1-entry-delay-ns' DT property (Manikanta Maddireddy)
* pci/controller/dwc-tegra194:
PCI: tegra194: Use aspm-l1-entry-delay-ns DT property for L1 entrance latency
- Set max OPP during resume so DBI register accesses don't fail with NoC
errors (Qiang Yu)
- Add pci_host_common_d3cold_possible() to determine whether downstream
devices are already in D3hot and wakeup-enabled devices are capable of
generating PME from D3cold (Krishna Chaitanya Chundru)
- Add a .get_ltssm() callback to get the LTSSM status without DBI, since
DBI may be inaccessible after PME_Turn_Off (Krishna Chaitanya Chundru)
- Power down PHY via PARF_PHY_CTRL before disabling rails/clocks to avoid
power leakage (Krishna Chaitanya Chundru)
- Decide whether suspend should put the link in L2 and power down using
pci_host_common_d3cold_possible() instead of checking whether ASPM L1 is
enabled (Krishna Chaitanya Chundru)
- Add qcom D3cold support to tear down interconnect bandwidth and OPP votes
(Krishna Chaitanya Chundru)
- Handle unsupported mixed PERST#/PHY DT configurations, e.g., PHY in RP
node while PERST# is in the RC node, but warn about the DT issue (Qiang
Yu)
- Add pcie_encode_t_power_on() to encode L1SS T_POWER_ON fields (Krishna
Chaitanya Chundru)
- Add dw_pcie_program_t_power_on() to program T_POWER_ON (Krishna Chaitanya
Chundru)
- Program qcom T_POWER_ON based on DT 't-power-on-us' property in case
hardware advertises incorrect values (Krishna Chaitanya Chundru)
- Disable ASPM L0s for SA8775P (Shawn Guo)
- Initialize DWC MSI lock for firmware-managed ECAM hosts, which don't use
the dw_pcie_host_init() path that initializes the lock (Yadu M G)
* pci/controller/dwc-qcom:
PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
PCI: qcom: Disable ASPM L0s for SA8775P
PCI: qcom: Program T_POWER_ON
PCI: dwc: Add dw_pcie_program_t_power_on() to program T_POWER_ON
PCI/ASPM: Add pcie_encode_t_power_on() helper to encode L1SS T_POWER_ON fields
PCI: qcom: Handle mixed PERST#/PHY DT configuration
PCI: qcom: Add D3cold support
PCI: dwc: Use common D3cold eligibility helper in suspend path
PCI: qcom: Power down PHY via PARF_PHY_CTRL before disabling rails/clocks
PCI: qcom: Add .get_ltssm() callback to query LTSSM status
PCI: host-common: Add pci_host_common_d3cold_possible() helper
PCI: qcom: Set max OPP before DBI access during resume
# Conflicts:
# drivers/pci/controller/pci-host-common.c
- Enable clock before PHY init for correct ordering (Florian Eckert)
- Add .start_link() callback so the driver works again (Florian Eckert)
- Stop overwriting the ATU base address discovered by
dw_pcie_get_resources() (Florian Eckert)
- Add DT 'atu' region since this is hardware-specific, and fall back to
driver default if lacking (Florian Eckert)
* pci/controller/dwc-intel-gw:
dt-bindings: PCI: intel,lgm-pcie: Add 'atu' resource
PCI: intel-gw: Fix ATU base address setup and add optional DT 'atu' region
PCI: intel-gw: Add .start_link() callback
PCI: intel-gw: Enable clock before PHY init
PCI: intel-gw: Move interrupt enable to own function
PCI: intel-gw: Remove unused PCIE_APP_INTX_OFST definition
- Move IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling into the core reset
functions (Richard Zhu)
- Add pci_host_common_parse_ports() for use by any native driver to parse
Root Port properties (currently only reset GPIOs) (Sherry Sun)
- Assert PERST# before enabling regulators to ensure that even if power is
enabled, endpoint stays inactive until REFCLK is stable (Sherry Sun)
- Parse reset properties in Root Port nodes (falling back to host bridge)
to help support Key E connectors and the pwrctrl framework (Sherry Sun)
- Configure i.MX95 REF_USE_PAD before PHY reset (Richard Zhu)
- Assert i.MX95 ref_clk_en after reference clock stabilizes (Richard Zhu)
- Integrate new pwrctrl API for DTs with Root Port-level power supplies
(Sherry Sun)
* pci/controller/dwc-imx6:
PCI: imx6: Integrate new pwrctrl API
PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95
PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95
PCI: imx6: Parse 'reset-gpios' in Root Port nodes
PCI: imx6: Assert PERST# before enabling regulators
PCI: host-generic: Add common helpers for parsing Root Port properties
dt-bindings: PCI: fsl,imx6q-pcie: Add reset GPIO in Root Port node
PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
- Assert PERST# on shutdown so any connected Endpoints are held in reset
during shutdown (Sai Krishna Musham)
* pci/controller/dwc-amd-mdb:
PCI: amd-mdb: Assert PERST# on shutdown
- Apply ECRC TLP Digest workaround for all DesignWare cores prior to 5.10a,
not just 4.90a and 5.00a (Manikanta Maddireddy)
- Use common struct dw_pcie 'mode' rather than duplicating it in artpec6,
dra7xx, dwc-pcie, and keembay driver structs (Hans Zhang)
- Use DEFINE_SHOW_ATTRIBUTE for ltssm_status debugfs to reduce boilerplate
and fix a seq_file memory leak by including a .release() callback (Hans
Zhang)
- Fix a signedness bug in fault injection test code (Dan Carpenter)
- Avoid NULL pointer dereference when tearing down debugfs for controller
that lacks RAS DES capability (Shuvam Pandey)
* pci/controller/dwc:
PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability
PCI: dwc: Fix signedness bug in fault injection test code
PCI: dwc: Use DEFINE_SHOW_ATTRIBUTE for ltssm_status debugfs
PCI: keembay: Use common mode field in struct dw_pcie
PCI: dwc: Use common mode field in struct dw_pcie
PCI: artpec6: Use common mode field in struct dw_pcie
PCI: dra7xx: Use common mode field in struct dw_pcie
PCI: dwc: Apply ECRC workaround for DesignWare cores prior to 5.10a
- Do not dispose of the parent IRQ mapping, which belongs to the parent
interrupt controller (Mahesh Vaidya)
- Fix chained IRQ handler ordering issue and resource leaks on probe
failure (Mahesh Vaidya)
* pci/controller/altera:
PCI: altera: Fix resource leaks on probe failure
PCI: altera: Do not dispose parent IRQ mapping
- Request bus reassignment when not probe-only to fix an enumeration
regression on Marvell CN106XX and possibly other DT-based systems
(Ratheesh Kannoth)
* pci/controller/host-common:
PCI: host-common: Request bus reassignment when not probe-only
- Add endpoint controller APIs for use by function drivers to discover
auxiliary blocks like DMA engines (Koichiro Den)
- Remember DesignWare eDMA engine base/size and expose them via the EPC
aux-resource API (Koichiro Den)
- Refactor endpoint doorbell allocation to allow non-MSI doorbells
(Koichiro Den)
- Add endpoint embedded doorbell fallback, used if MSI allocation fails
(Koichiro Den)
- Validate BAR index and remove dead BAR read in endpoint doorbell test
(Carlos Bilbao)
- Unwind MSI/MSI-X vectors if NTB initialization fails part-way through
(Koichiro Den)
- Cache sleepable pci_irq_vector() value at ISR setup to avoid calling it
from hardirq context (Koichiro Den)
- Validate doorbell count when configuring NTB and vNTB doorbells
(Manivannan Sadhasivam)
- Call sleepable pci_epc_raise_irq() from a work item instead of atomic
context, e.g., when setting bits in NTB peer doorbells in the
ntb_peer_db_set() path (Koichiro Den)
- Report 0-based vNTB doorbell vector to account for link event 0 and
historically skipped slot 1 (Koichiro Den)
- Reject unusable vNTB doorbell counts, e.g., if they don't allow space for
link event 0 and historically skipped slot 1 (Koichiro Den)
- Prevent configfs writes to vNTB db_count and other values that are
already in use after EPC attach (Koichiro Den)
- Account for vNTB db_valid reserved slots (link event 0 and historically
skipped slot 1) so they don't appear as valid doorbells (Koichiro Den)
- Implement vNTB .db_vector_count()/mask() for doorbells so clients can use
multiple vectors and avoid thundering herds (Koichiro Den)
- Report 0-based NTB doorbell vector to account for link event 0 and
historically skipped slot 1 (Koichiro Den)
- Fix doorbell bitmask and IRQ vector handling to clear only specified
bits, use the correct vector for non-contiguous Linux IRQ numbers, and
validate incoming vectors (Koichiro Den)
- Implement NTB .db_vector_count()/mask() for doorbells so clients can use
multiple vectors (Koichiro Den)
* pci/endpoint:
NTB: epf: Implement .db_vector_count()/mask() for doorbells
NTB: epf: Fix doorbell bitmask and IRQ vector handling
NTB: epf: Report 0-based doorbell vector via ntb_db_event()
NTB: epf: Make db_valid_mask cover only real doorbell bits
NTB: epf: Document legacy doorbell slot offset in ntb_epf_peer_db_set()
PCI: endpoint: pci-epf-vntb: Implement .db_vector_count()/mask() for doorbells
PCI: endpoint: pci-epf-vntb: Exclude reserved slots from db_valid_mask
PCI: endpoint: pci-epf-vntb: Guard configfs writes after EPC attach
PCI: endpoint: pci-epf-vntb: Reject unusable doorbell counts
PCI: endpoint: pci-epf-vntb: Report 0-based doorbell vector via ntb_db_event()
PCI: endpoint: pci-epf-vntb: Defer pci_epc_raise_irq() out of atomic context
PCI: endpoint: pci-epf-vntb: Document legacy MSI doorbell offset
PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
NTB: epf: Avoid calling pci_irq_vector() from hardirq context
NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
misc: pci_endpoint_test: Remove dead BAR read before doorbell trigger
misc: pci_endpoint_test: Validate BAR index in doorbell test
PCI: endpoint: pci-ep-msi: Add embedded doorbell fallback
PCI: endpoint: pci-epf-test: Reuse pre-exposed doorbell targets
PCI: endpoint: pci-epf-vntb: Reuse pre-exposed doorbells and IRQ flags
PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends
PCI: dwc: ep: Expose integrated eDMA resources via EPC aux-resource API
PCI: dwc: Record integrated eDMA register window
PCI: endpoint: Add auxiliary resource query API
- Avoid FLR for MediaTek MT7925 WiFi, where FLR fails after a VM terminates
uncleanly (Jose Ignacio Tornos Martinez)
- Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems, which
seem not to support it correctly (Jose Ignacio Tornos Martinez)
* pci/virtualization:
PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
PCI: Avoid FLR for MediaTek MT7925 WiFi
- Require CAP_SYS_ADMIN to write to sysfs 'resourceN_resize' attributes
(Krzysztof Wilczyński)
- Convert PCI resource files to static attributes to avoid races that cause
'duplicate filename' warnings and boot panics (Krzysztof Wilczyński)
- Remove pci_create_sysfs_dev_files() and pci_remove_sysfs_dev_files(),
which are obsolete after converting to static attributes (Krzysztof
Wilczyński)
- Add security_locked_down(LOCKDOWN_PCI_ACCESS) to alpha PCI resource mmap
path to match the generic path (Krzysztof Wilczyński)
- Convert sysfs 'legacy_io' and 'legacy_mem' to static attributes
(Krzysztof Wilczyński)
- Remove pci_create_legacy_files() and pci_sysfs_init(), which are obsolete
after converting to static attributes (Krzysztof Wilczyński)
- Expose sysfs 'resourceN_resize' attributes only on platforms with PCI
mmap (Krzysztof Wilczyński)
- Use kstrtobool() to parse the 'rom' attribute input to avoid the
unexpected behavior of enabling the ROM when writing '0' with no trailing
newline (Krzysztof Wilczyński)
* pci/sysfs:
PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
PCI/sysfs: Limit BAR resize attribute scope to platforms with PCI mmap
PCI/sysfs: Remove pci_create_legacy_files() and pci_sysfs_init()
PCI/sysfs: Convert legacy I/O and memory attributes to static definitions
PCI/sysfs: Add __weak pci_legacy_has_sparse() helper
alpha/PCI: Compute legacy size in pci_mmap_legacy_page_range()
PCI: Add macros for legacy I/O and memory address space sizes
PCI/sysfs: Remove pci_{create,remove}_sysfs_dev_files()
alpha/PCI: Convert resource files to static attributes
alpha/PCI: Add static PCI resource attribute macros
alpha/PCI: Remove WARN from __pci_mmap_fits() and __legacy_mmap_fits()
alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
alpha/PCI: Use PCI resource accessor macros
alpha/PCI: Use BAR index in sysfs attr->private instead of resource pointer
alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
PCI/sysfs: Limit pci_sysfs_init() late_initcall compile scope
PCI/sysfs: Add stubs for pci_{create,remove}_sysfs_dev_files()
PCI/sysfs: Warn about BAR resize failure in __resource_resize_store()
PCI/sysfs: Convert PCI resource files to static attributes
PCI/sysfs: Add static PCI resource attribute macros
PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()
PCI/sysfs: Split pci_llseek_resource() for device and legacy attributes
PCI/sysfs: Only allow supported resource types in I/O and MMIO helpers
PCI: Add pci_resource_is_io() and pci_resource_is_mem() helpers
PCI/sysfs: Use PCI resource accessor macros
- Check option ROM header signatures and lengths before accessing to avoid
page faults and alignment faults (Guixin Liu)
* pci/rom:
PCI: Check ROM header and data structure addr before accessing
PCI: Introduce named defines for PCI ROM
- Log device readiness timeouts as errors, not warnings (Bjorn Helgaas)
- Wait for device readiness after soft reset (D3hot -> D0uninitialized
transition), when the device may respond with Request Retry Status if it
needs more time to initialize (Bjorn Helgaas)
- Drop unnecessary retries when restoring BARs (Lukas Wunner)
* pci/reset:
PCI: Drop unnecessary retries when restoring BARs
PCI: Wait for device readiness after D3hot -> D0uninitialized transition
PCI: Log device readiness timeouts as errors
- Don't try to power on/off devices unless we know they actually support
power control (Manivannan Sadhasivam)
* pci/pwrctrl:
PCI/pwrctrl: Lock device when calling device_is_bound()
PCI/pwrctrl: Do not try to power on/off devices that don't need pwrctrl
PCI/pwrctrl: Move pci_pwrctrl_is_required() earlier in file
- Fix race between pci_proc_init() and pci_bus_add_device() (Krzysztof
Wilczyński)
* pci/procfs:
PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device()
- Set power state to 'unknown' for all devices, not just those with
drivers, during suspend (Lukas Wunner)
- Skip restoring Resizable BARs and VF Resizable BARs if device doesn't
respond to config reads, to avoid invalid array accesses (Marco
Nenciarini)
- Add pci_suspend_retains_context() so drivers can tell whether devices may
be reset while resuming from suspend due to platform issues; use this in
nvme to avoid issues on Qcom RCs (Manivannan Sadhasivam)
* pci/pm:
nvme-pci: Use pci_suspend_retains_context() during suspend
PCI: qcom: Indicate broken L1SS exit during resume from system suspend
PCI: Indicate context lost if L1SS exit is broken during resume from system suspend
PCI: Add pci_suspend_retains_context() to check if device state is preserved during suspend
PCI/IOV: Skip VF Resizable BAR restore on read error
PCI: Skip Resizable BAR restore on read error
PCI: Stop setting cached power state to 'unknown' on unbind
- Prevent P2PDMA as well as CPU access to non-mappable BARs, e.g., s390 ISM
BARs (Matt Evans)
- Add Intel QAT, DSA, IAA devices to whitelist (Lukas Wunner)
* pci/p2pdma:
PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist
PCI/P2PDMA: Avoid returning a provider for non_mappable_bars
- Remove MPS/MRRS Kconfig settings (CONFIG_PCIE_BUS_*) that worked around a
WiFi device defect (Bjorn Helgaas)
- Always lift 2.5GT/s restriction in PCIe failed link retraining to avoid
clamping a link to 2.5GT/s after hot-plug changes the device (Maciej W.
Rozycki)
- Don't bother trying to retrain a 2.5GT/s link at 2.5GT/s since nothing
would be gained by the retrain (Maciej W. Rozycki)
* pci/enumeration:
PCI: Bail out early for 2.5GT/s devices in PCIe failed link retraining
PCI: Use pcie_get_speed_cap() in PCIe failed link retraining
PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
PCI: Remove MPS/MRRS Kconfig settings (CONFIG_PCIE_BUS_*)
- Don't reconfigure ASPM when entering low-power state; only do it
when returning back to D0 (Carlos Bilbao)
* pci/aspm:
PCI/ASPM: Don't reconfigure ASPM entering low-power state
Configured VLANs intermittently stop receiving traffic after a link
down/up cycle, e.g. when the network cable is unplugged and plugged back
in. VLAN filtering stays enabled but all VLAN-tagged frames are dropped
until a VLAN is added or removed again.
The LAN7801 datasheet (DS00002123E) states:
"A portion of the MAC operates on clocks generated by the Ethernet
PHY. During a PHY reset event, this portion of the MAC is designed to
not be taken out of reset until the PHY clocks are operational"
(section 8.10, MAC Reset Watchdog Timer)
"After a reset event, the RFE will automatically initialize the
contents of the VHF to 0h."
(section 7.1.4, VHF Organization)
Thus a link down/up cycle stops and restarts the PHY clock, resets the
PHY-clocked portion of the MAC, and the RFE clears its VLAN/DA hash
filter (VHF) memory. The VHF holds both the VLAN filter table and the
multicast hash table, but the driver never reprograms either from its
shadow copy once the link is back, so both stay empty.
Reprogram the VLAN filter and multicast hash tables on link up.
Reported-by: Sven Schuchmann <schuchmann@schleissheimer.de>
Closes: https://lore.kernel.org/netdev/BEZP281MB224501E38B30BFDC4BD3D364D9E32@BEZP281MB2245.DEUP281.PROD.OUTLOOK.COM/T/#u
Tested-by: Sven Schuchmann <schuchmann@schleissheimer.de>
Fixes: 55d7de9de6 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20260622102911.484045-1-nb@tipi-net.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
During XDP enablement in veth, if xdp_rxq_info_reg() or
xdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.
However, the rollback loop:
for (i--; i >= start; i--) {
decrements the loop index 'i' before the first iteration. This
correctly skips unregistering the rxq for the failed index 'i' (as
registration failed or was already cleaned up), but it also
erroneously skips calling netif_napi_deli() for rq[i].xdp_napi.
Since netif_napi_add() was already called for index 'i', this leaves
a dangling napi_struct in the device's napi_list. When the veth
device is later destroyed, the freed queue memory (which contains the
leaked NAPI structure) can be reused.
The subsequent device teardown iterates the NAPI list and
corrupts the reallocated memory, leading to UAF.
Fix this by explicitly deleting the NAPI association for the failed
index 'i' before rolling back the successfully configured queues.
Fixes: b02e5a0ebb ("xsk: Propagate napi_id to XDP socket Rx path")
Reported-by: Guenter Roeck <groeck@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Björn Töpel <bjorn.topel@intel.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Link: https://patch.msgid.link/20260622111825.88337-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
emac_xsk_xmit_zc() handles tx xmit for zero copy and gets called
inside napi context. User application wakes up the kernel while
initiating the transmit which triggers napi to start processing
the tx packets. The num_tx check inside emac_tx_complete_packets()
returns early if no packet transfer happen hindering the call
to emac_xsk_xmit_zc(). Remove this check to let application
wakeup initiate zero copy xmit traffic.
Add __netif_tx_lock() to ensure that the TX queue is protected
from concurrent access during the transmission of XDP frames.
This fixes netdev watchdog timeout for long runs.
Fixes: e2dc7bfd67 ("net: ti: icssg-prueth: Move common functions into a separate file")
Signed-off-by: Meghana Malladi <m-malladi@ti.com>
Link: https://patch.msgid.link/20260618100348.2209907-1-m-malladi@ti.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
pin_duration is converted from the user-provided period to SJA1105
clock ticks and is later passed as the cycle_time argument to
future_base_time().
Very small period values may become zero after the conversion,
which can lead to a division by zero in future_base_time().
Round zero pin_duration up to 1 tick so that the smallest unsupported
periods use the minimum non-zero hardware duration instead of passing
zero to future_base_time().
Fixes: 747e5eb31d ("net: dsa: sja1105: configure the PTP_CLK pin as EXT_TS or PER_OUT")
Signed-off-by: Aleksandrova Alyona <aga@itb.spb.ru>
Link: https://patch.msgid.link/20260618110508.53094-1-aga@itb.spb.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Marek Szyprowski reported a deadlock during system resume when virtio_net
driver is used.
The deadlock occurs because netif_device_attach() is called while holding
dev->tx_global_lock (via netif_tx_lock_bh() in virtnet_restore_up()).
netif_device_attach() calls __netdev_watchdog_up(), which now also tries
to acquire dev->tx_global_lock to synchronize with dev_watchdog().
This recursive lock acquisition results in a deadlock.
Fix this by removing the tx_global_lock acquisition from netdev_watchdog_up().
The critical state (watchdog_timer and watchdog_ref_held) is already
protected by dev->watchdog_lock, which was introduced in the blamed commit.
Fixes: 8eed5519e4 ("net: watchdog: fix refcount tracking races")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Closes: https://lore.kernel.org/netdev/a443376e-5187-4268-93b3-58047ef113a8@samsung.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260622110108.69541-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
- Improvements in handling of soundwire groups
- Additional checks flagged by various tools
- Intel driver updates for ghost Realtek device handling in firmware and
adding devices to wake lists
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmo6rhwACgkQfBQHDyUj
g0dYtBAAiEa7b58duDNxl2lf4YlZBqa/MvMfMWVMbW5ZtYd00aokv2QBIEVubb22
a5l+7T7X5wHA1meS3mrsYktWInjJTe257b3qpwghfhbBkbLnbMs7esmZES03p9eg
9lcmznhJnWSFddO8/CTch3EALGjmqN1WnCjwCaqjFXeQc36qxWILbEzShKtu88CE
IU8MAvMyj4TWtklbZh6Y/VKKc+tcah2KgdHmKhv+z/ypiDUH5k5fHORQOsHo+Hxt
rukFL4hQvdBA1B7//Q6u6Usvu7yKQQRsYQ6ybZi9ZXa7+GJ5BOznfM5fTVU5mQjS
+xbPH/CMrdDH/HxdoKns72DQvC2n18tAGobS0UiadpTLSWkZ9PypW3VfYUb5Z+Ur
iWt+plzYXceM8viq3KcmgV07gzTwLXopBWv0iVDP9fEBzVnpJbX/l5+yUwtfabq0
IJMzSILlKoqwIJgP69rN3SScTm1G3biB6m+Y3GCzeUBbEEQs4JQB6mjkPVvpP7/I
qp9pz5mQJwVBoInlKzYWlNmAEjWRqmQUoEYU0g35vI7bcWjtbtemFzuDFXkqZMp9
wk784sXlXOvUoBudBuJFy2OG/tdELarmVj/Pk7U1XNPAzh39nf9tMfQnj9CzOxVR
trzkPKoR7m65WbuIFt8nlC81JOSunDRBmXvBSzbXvVvdVqd9Vn0=
=dF8L
-----END PGP SIGNATURE-----
Merge tag 'soundwire-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire
Pull soundwire updates from Vinod Koul:
- Improvements in handling of soundwire groups
- Additional checks flagged by various tools
- Intel driver updates for ghost Realtek device handling in firmware
and adding devices to wake lists
* tag 'soundwire-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
soundwire: dmi-quirks: Disable ghost Realtek devices
soundwire: only handle alert events when the peripheral is attached
soundwire: intel_ace2x: release bpt_stream when close it
soundwire: intel: Move suspend tracking from trigger to pm suspend
soundwire: intel_auxdevice: Add es9356 to wake_capable_list
soundwire: use krealloc_array to prevent integer overflow
soundwire: increase group->max_size after allocation
soundwire: fix bug in sdw_add_element_group_count found by syzkaller
soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral
soundwire: validate DT compatible before parsing it
soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list
soundwire: stream: sdw_stream_remove_slave(): Check stream is valid
