linux-stable.git/include/linux, branch v7.2.6

virtio-net: Ensure that TCP packets don't overflow gso_segs

2026-09-14T11:41:09+00:00

[ Upstream commit c27c449d455aafd9018a3cbab150f1c42c87923f ]

The user can specify any gso_size in a packet crafted with an AF_PACKET
PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the
same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user
crafts a packet with gso_size < 8, there is a risk for partial GSO to
overflow the 16-bit gso_segs field when dividing the SKB length by
gso_size.

Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep
gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly
tested at tools/testing/selftests/net/tun.c:649.

Fixes: 7c6d2ecbda83 ("net: be more gentle about silly gso requests coming from user")
Signed-off-by: Alice Mikityanska 
Suggested-by: Eric Dumazet 
Link: https://patch.msgid.link/20260822120117.1163423-2-alice.kernel@fastmail.im
Signed-off-by: Paolo Abeni 
Signed-off-by: Sasha Levin

maple_tree: fix argument name in header

2026-09-14T11:41:07+00:00

[ Upstream commit 00f67814a14e614b749ebe54076ef1e3e6454f2b ]

The mas_prev_range() function takes a min and not a max.

Link: https://lore.kernel.org/20260821192627.4085470-18-liam@infradead.org
Fixes: 6b9e93e01020 ("maple_tree: add mas_prev_range() and mas_find_range_rev interface")
Signed-off-by: Liam R. Howlett (Oracle) 
Cc: Boqun Feng 
Cc: Breno Leitao 
Cc: Chris Mason 
Cc: Chuck Lever 
Cc: Ingo Molnar 
Cc: Jason Gunthorpe 
Cc: Joe Perches 
Cc: Peter Zijlstra 
Cc: Rik van Riel 
Cc: Waiman Long 
Cc: Will Deacon 
Signed-off-by: Andrew Morton 
Signed-off-by: Sasha Levin

mm/memcontrol: avoid false sharing between vmstats and events

2026-09-14T11:41:06+00:00

[ Upstream commit c1afbd5de131f5e3c4fc7559acf055f8d9d86868 ]

Moving v1 userspace eventfd handling into memcontrol-v1.c shrank struct
vmpressure from 112 to 24 bytes when CONFIG_MEMCG_V1 is disabled.  This
moved memory_events_local[MEMCG_SWAP_FAIL] and the hot vmstats_percpu
pointer onto the same cacheline.

The stress-ng mremap stressor exercises MADV_PAGEOUT with swap disabled,
generating about 20 million MEMCG_SWAP_FAIL updates per 60-second run on a
176-CPU test system.  Those writes bounce the line while memcg statistics
paths load vmstats_percpu.

Move cgwb_list into the existing alignment gap and cacheline-align
vmstats_percpu.  This separates the pointer from the event counters
without increasing the size of struct mem_cgroup in the tested
configuration.

The blamed commit reduced median mremap throughput by 4.38% on the test
system with one socket.  The patched kernel brings the performance to
within 0.5% of the parent which is within the observed boot-to-boot spread
(up to 1.2%).

Link: https://lore.kernel.org/20260817103835.2937733-1-usama.arif@linux.dev
Fixes: ea928e9e18da ("mm/vmpressure: move v1 userspace eventfd code into memcontrol-v1.c")
Signed-off-by: Usama Arif 
Reported-by: kernel test robot 
Closes: https://lore.kernel.org/oe-lkp/202608131743.c6a7dda4-lkp@intel.com
Tested-by: kernel test robot 
  Link: http://lore.kernel.org/aoAABX59IzUXz/Rv@ly-workstation
Acked-by: Shakeel Butt 
Acked-by: Michal Hocko 
Cc: David Hildenbrand 
Cc: Johannes Weiner 
Cc: Muchun Song 
Cc: Roman Gushchin 
Cc: Yi Lai 
Signed-off-by: Andrew Morton 
Signed-off-by: Sasha Levin

net: enetc: improve MAFT entry management with bitmap tracking

2026-09-14T11:41:05+00:00

[ Upstream commit 6228fc9c2bbe224a376c77e309bcf90158e0595c ]

Replace the counter-based MAFT entry tracking (num_mfe/mac_filter_num)
with a bitmap (maft_eid_bitmap) stored in struct ntmp_user, which is a
more appropriate place for NTMP resource management.

The bitmap approach brings two improvements. First, the entry deletion
in enetc4_pf_clear_maft_entries() now checks the return value of
ntmp_maft_delete_entry() and only clears the corresponding bit on
success, keeping hardware and software state in sync. Previously, the
counter was reset unconditionally regardless of whether the hardware
deletion actually succeeded.

Second, entry allocation in enetc4_pf_add_maft_entries() uses
ntmp_lookup_free_eid() to find available IDs dynamically, with an
upfront capacity check via bitmap_weight() to avoid partial failures.

The MAFT entry count is moved into ntmp_user.maft_num_entries and
initialized once during enetc4_init_ntmp_user(). Helper functions
enetc4_ntmp_bitmap_init() and enetc4_ntmp_bitmap_free() manage the
bitmap lifetime. The debugfs show function is updated accordingly to
iterate over set bits under rtnl_lock().

Signed-off-by: Wei Fang 
Link: https://patch.msgid.link/20260720014317.1059359-5-wei.fang@oss.nxp.com
Signed-off-by: Jakub Kicinski 
Stable-dep-of: fa1a8457b858 ("net: enetc: restore RX ring congestion mode for ENETC v4")
Signed-off-by: Sasha Levin

NFSv4.2: fix LAYOUTSTATS send buffer exhaustion

2026-09-14T11:41:02+00:00

[ Upstream commit c75ef2137e749f2673f0617cfdaae53b2bb7195a ]

encode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LAYOUTSTATS_MAXSIZE),
i.e. 256 bytes, for the layoutupdate4 body written by the layout driver.
The flexfiles record can exceed that.

ff_layout_encode_ff_layoutupdate() emits, per data server, a netaddr4,
an nfs_fh4, two ff_io_latency4, an nfstime4 and a bool.  A data server
whose filehandle is NFS_MAXFHSIZE bytes long already accounts for 132 of
those bytes, and the two ff_io_latency4 at 64 bytes each, the nfstime4
and the bool add a further 144, so the body passes 256 bytes before the
netaddr4 is encoded at all.  encode_layoutstats() additionally writes
the deviceid4 and the layoutupdate4 lou_type word, neither of which the
macro accounts for.

The filehandle and the address are both chosen by the server, through
LAYOUTGET and GETDEVICEINFO, so it can drive the encoder past the
end of the send buffer.  xdr_reserve_space() returns NULL once that
happens, and the two ff_layout_encode_io_latency() calls run with
dss_info->mirror->lock held, so a NULL return there leaves the lock
permanently held.

Raise PNFS_LAYOUTSTATS_MAXSIZE to 384 so that the record fits inside the
reservation.

Fixes: 27c430644369 ("pnfs/flexfiles: encode LAYOUTSTATS flexfiles specific data")
Reported-by: Yuhao Jiang 
Assisted-by: Claude:claude-opus-5
Signed-off-by: Junrui Luo 
Signed-off-by: Trond Myklebust 
Signed-off-by: Sasha Levin

net/mlx5: Move vport DOWN state check out of mlx5_query_vport_max_tx_speed()

2026-09-14T11:41:01+00:00

[ Upstream commit 20f11b5cfa429ba3a2b8ef463d47e820687b4d2e ]

mlx5_query_vport_max_tx_speed() was introduced to serve the
query_port_speed path, which uses max_tx_speed == 0 when port is down.

This is incorrect for callers that need the actual configured speed
regardless of vport state, such as modify-vport-state helpers
that must preserve the speed across state transitions.

Move this logic to the caller function in the verb flow and let
mlx5_query_vport_max_tx_speed() return the raw firmware value
unconditionally.

Fixes: aaecff5e13cd ("RDMA/mlx5: Implement query_port_speed callback")
Signed-off-by: Or Har-Toov 
Reviewed-by: Shay Drori 
Signed-off-by: Tariq Toukan 
Reviewed-by: Simon Horman 
Link: https://patch.msgid.link/20260816065015.3280733-3-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski 
Signed-off-by: Sasha Levin

sched/topology: Add a cpus_read_lock to rebuild_sched_domains()

2026-09-14T11:40:59+00:00

[ Upstream commit 666a32836c8f9daf9b0067c49b04d5201fb8f3ba ]

A read from /proc/sys/kernel/sched_rt_runtime_us leads to backtrace due
to missing cpu_hotplug_lock with CONFIG_CPUSETS=n. The callchain is
sched_rt_handler() -> partition_sched_domains() -> sched_cache_set() ->
static_key_enable_cpuslocked(&sched_cache_present).

sched_cache_set() itself is also invoked from sched_init_domains() which
is early during the boot, holding just the sched_domains_mutex_lock().
Here is no warning because it happens before user space is running (and
hotplug operations are not possible).

There is also sched_cache_active_set() which acquires the hotplug lock
before invoking any of the _cpuslocked() functions.

This is only a problem with CONFIG_CPUSETS=n because in the =y case the
other implementation of rebuild_sched_domains acquires the CPU-hotplug
lock.

Acquire CPU hotplug lock before in rebuild_sched_domains(), before
partition_sched_domains() is invoked for the CONFIG_CPUSETS=n case.

Fixes: a7660ce1590fc ("sched/cache: Fix has_multi_llcs iff at least one partition has multiple LLCs")
Signed-off-by: Sebastian Andrzej Siewior 
Reivewed-by: Ridong Chen 
Signed-off-by: Peter Zijlstra (Intel) 
Reviewed-by: Chen Yu 
Reviewed-by: Tim Chen 
Reviewed-by: Waiman Long 
Reviewed-by: Valentin Schneider 
Reviewed-by: Shrikanth Hegde 
Reviewed-by: Aaron Tomlin 
Tested-by: Dietmar Eggemann 
Link: https://patch.msgid.link/20260813073855.ji2UrtVh@linutronix.de
Signed-off-by: Sasha Levin

irqchip/gic-v5: Release IRS iomem region on driver init failure

2026-09-14T11:40:59+00:00

[ Upstream commit dc2eae1620bdb4562aa43f1c34c8427308ab4436 ]

In gicv5_irs_of_init(), an IRS is set-up using of_io_request_and_map() to
request its memory region (corresponding to the configuration frame) and
map the IRS configuration frame.

On gicv5_irs_of_init() failure, the driver unmaps the IRS iomem region but
does not release the requested memory region leaving it allocated in the
iomem resource tree.

Fix it by releasing the iomem region on gicv5_irs_of_init() probe failure.

Likewise, on both OF and ACPI driver init failure, IRS iomem regions are
requested but never released in gicv5_irs_remove().

Stash a copy of the IRS iomem region in a struct resource in
struct gicv5_irs_chip_data and use it to release the requested region in
gicv5_irs_remove() if the driver probe fails.

Fixes: 5cb1b6dab2de ("irqchip/gic-v5: Add GICv5 IRS/SPI support")
Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Signed-off-by: Lorenzo Pieralisi 
Signed-off-by: Thomas Gleixner 
Link: https://sashiko.dev/#/message/20260810104747.E5CE71F000E9%40smtp.kernel.org
Link: https://patch.msgid.link/20260812-gicv5-7-2-fixes-v1-5-3743e82c69a4@kernel.org
Signed-off-by: Sasha Levin

virtio: add virtio_device_shutdown() helper

2026-09-14T11:40:57+00:00

[ Upstream commit 0d8aebe089b4ba887e792884cf041ce9f1040ff4 ]

The generic virtio bus .shutdown handler, virtio_dev_shutdown(), breaks
and resets a device once it has established that the driver has no
.shutdown of its own. A driver that does implement .shutdown, to quiesce
its own activity first, still needs the same break and reset afterwards
and would otherwise have to open code it.

Factor the break + synchronize_cbs + reset sequence out of
virtio_dev_shutdown() into an exported virtio_device_shutdown() helper so
such drivers can reuse it instead of duplicating the core logic.

No functional change.

Signed-off-by: Denis V. Lunev 
Reviewed-by: David Hildenbrand (Arm) 
Signed-off-by: Michael S. Tsirkin 
Message-ID: <20260624140846.2616797-2-den@openvz.org>
Stable-dep-of: 7e17eef04600 ("virtio_balloon: quiesce balloon work before device shutdown")
Signed-off-by: Sasha Levin

iomap: add ->iomap_next()

2026-09-14T11:40:57+00:00

[ Upstream commit 26dfed9c7a289089b76cff9ab9e4c66b6f90e872 ]

Have one ->iomap_next() callback instead of ->iomap_begin() and
->iomap_end(). ->iomap_next() finishes the previous mapping if needed,
and produces the next mapping.

Collapsing to a single callback lets a performance-critical caller
inline its iteration loop and pass its ->iomap_next() function as a
compile-time constant, so the compiler can devirtualize that callback
into a direct call instead of an indirect call through a function
pointer.

iomap_iter() uses ->iomap_next() when the filesystem provides that
callback and otherwise falls back to the ->iomap_begin()/->iomap_end()
path, so filesystems can be converted one at a time.

Suggested-by: Christoph Hellwig 
Suggested-by: Matthew Wilcox (Oracle) 
Reviewed-by: "Darrick J. Wong" 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Joanne Koong 
Link: https://patch.msgid.link/20260729192737.3190206-6-joannelkoong@gmail.com
Signed-off-by: Christian Brauner (Amutable) 
Stable-dep-of: d9e00c457d4a ("ntfs: serialize resident iomap reads with mrec_lock")
Signed-off-by: Sasha Levin