summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-11selftests/net/openvswitch: add flow modify testMinxi Hou
Add mod_flow() and the mod-flow CLI command to ovs-dpctl.py, exercising OVS_FLOW_CMD_SET. Add test_flow_set which first modifies an existing flow with new actions and verifies the change via traffic, then modifies the same flow without actions and verifies the kernel handles the no-actions case gracefully. The no-actions path is unreachable from userspace OVS tools (dpctl mod-flow requires actions) but reachable via raw netlink. This is the code path where Adrian Moreno found a possible kfree_skb of ERR_PTR when reply allocation fails after locking. Make parse() skip OVS_FLOW_ATTR_ACTIONS when actstr is None so the kernel enters the post-lock allocation branch in ovs_flow_cmd_set(). After the no-actions set, verify via dump-flows that the flow retained its drop action. Suggested-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Minxi Hou <houminxi@gmail.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260609165725.107484-1-houminxi@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: bcmgenet: convert RX path to page_poolNicolai Buchwitz
Replace the per-packet __netdev_alloc_skb() + dma_map_single() in the RX path with page_pool. SKBs are built from pool pages via napi_build_skb() with skb_mark_for_recycle() so the network stack returns pages to the pool, and DMA mapping happens once per page instead of once per packet. Reject HW-reported lengths smaller than the RSB so a runt cannot underflow the SKB build path. Drop the now-unused priv->rx_buf_len field and the rx_dma_failed soft MIB counter (nothing increments it after the conversion). This removes the "rx_dma_failed" entry from ethtool -S, which is a user-visible change for monitoring tools that key on stat names. Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Justin Chen <justin.chen@broadcom.com> Tested-by: Justin Chen <justin.chen@broadcom.com> Link: https://patch.msgid.link/20260610114835.2225423-1-nb@tipi-net.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: airoha: move get_sport() callback at the beginning of ↵Lorenzo Bianconi
airoha_enable_gdm2_loopback() Move the get_sport() callback invocation at the beginning of airoha_enable_gdm2_loopback() routine in order to avoid leaving the hardware in a partially configured state if get_sport() fails. Previously, get_sport() was called after GDM2 forwarding, loopback, channel, length, VIP and IFC registers had already been programmed. A failure at that point would return an error leaving GDM2 with loopback enabled but WAN port, PPE CPU port and flow control mappings not configured. Performing the get_sport() lookup before any register write guarantees the routine either completes the full configuration sequence or exits with no side effects on the hardware. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260608-airoha_enable_gdm2_loopback-minor-change-v1-1-1787a0f42b31@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11Merge branch 'mptcp-pm-drop-tcp-ts-with-add_addrv6-port'Jakub Kicinski
Matthieu Baerts says: ==================== mptcp: pm: drop TCP TS with ADD_ADDRv6 + port Up to this series, it was possible to add a "signal" MPTCP endpoint with an IPv6 address and a port, or to directly request to send an ADD_ADDR with a v6 address and a port, but the expected ADD_ADDR wasn't sent when TCP timestamps was used for the connection. In fact, such signalling option cannot be sent when TCP timestamps is used due to a lack of option space: the limit is at 40 bytes, and, with padding, TCP timestamps is taking 12 bytes, while an ADD_ADDR IPv6 + port is taking 30 bytes. The selected solution here is to simply drop the TCP timestamps option when such ADD_ADDR of 30 bytes needs to be sent. - Patches 1-3: small cleanups to avoid computing ADD/RM_ADDR twice. - Patches 4-7: the new feature, controlled by a new sysctl knob. - Patch 8: extra checks in the MPTCP Join selftests. - Patches 9-15: A bunch of refactoring: renamed confusing helpers and variables, and prevent future misused functions. ==================== Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-0-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: options: rst: drop unused skb parameterMatthieu Baerts (NGI0)
It was passed since its introduction in commit dc87efdb1a5c ("mptcp: add mptcp reset option support"), but never used. Simply removes it. Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-15-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: pm: avoid using del_timer directlyMatthieu Baerts (NGI0)
mptcp_pm_announced_del_timer() removes the matched ADD_ADDR entry (if found) from the ADD_ADDR list only if check_id is false. That's dangerous, and not clear, because it means the caller should be free the entry only in some cases, and it easy to miss that. Instead, make it static, and call it from mptcp_pm_add_addr_echoed, which is the only other case where mptcp_pm_add_addr_del_timer should be called with check_id set to true. Bonus with that: a second call to mptcp_pm_add_addr_lookup_by_addr() can be avoided. Note that instead of adding the signature above to avoid a compilation issue because this helper is called before the definition of the function, the whole helper is moved above where it is first called. Its content is untouched, except the addition of the 'static' keyboard. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-14-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: pm: make mptcp_pm_add_addr_send_ack staticMatthieu Baerts (NGI0)
Only used in pm.c. Note that the signature is added above: it is easier than moving the code around, because this helper depends on mptcp_pm_schedule_work which is declared below. While at it, explicitly mark it as to be called while pm->lock is held. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-13-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: pm: remove add_ prefix from timerMatthieu Baerts (NGI0)
Similar to the two previous commits, using the 'add' prefix is confusing, also confirmed by [1]. Now that the structure has been renamed to include 'add_addr' in its name, easier to know the timer is linked to the ADD_ADDR, no need to add the confusing prefix, or an unneeded longer one. While at it, also update the ADD_ADDR timer helper to clearly specify it is linked to ADD_ADDR, and it is not there to add a new timer. Link: https://lore.kernel.org/20251117100745.1913963-1-edumazet@google.com [1] Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-12-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: pm: uniform announced addresses helpersMatthieu Baerts (NGI0)
Similar to the previous commit, only using the 'add' or 'anno' prefixes is confusing -- generally associated to the action of adding something, or the Latin name for "year" -- and lack of uniformity. This has been causing issues in the past, e.g. del_add_timer seemed to suggest the goal is to delete a previously added timer. Instead, use the mptcp_pm_announced_ prefix. While at it, slightly improves some helpers: - mptcp_lookup_anno_list_by_saddr: no need to specify what is used to do the lookup: mptcp_pm_announced_lookup. - mptcp_pm_sport_in_anno_list: it doesn't just compare the port, but the whole address linked to the sublow: mptcp_pm_announced_has_ssk. - mptcp_pm_alloc_anno_list: it allocates one item of the list, not a whole list: mptcp_pm_announced_alloc. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-11-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: pm: rename add_entry structure to add_addrMatthieu Baerts (NGI0)
Using only the 'add' prefix is confusing: does it refer to a generic added entry or address, or specifically to ADD_ADDRs. Using add_addr removes this confusion. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-10-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: pm: use for_each_subflow helperMatthieu Baerts (NGI0)
Similar to most places in the MPTCP code. So instead of passing the subflow list and use list_for_each_entry(subflow, list, node), pass the msk and use mptcp_for_each_subflow(msk, subflow). That's clearer and more uniform with the rest. While at it, add 'pm_' prefix for the exported one to easily identify the origin. Plus replace 'lookup' by 'has', because a bool is returned. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-9-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11selftests: mptcp: always check sent/dropped ADD_ADDRsMatthieu Baerts (NGI0)
Before, they were only checked on demand, but it seems better to check them each time received ADD_ADDRs are checked. Errors are only reported when the counter exists, and the value is not the expected one. This is similar to what is done in chk_join_nr: it reduces the output, and avoids a lot of 'skip' when validating older kernels. Also here, some tests need to adapt the default expected counters, e.g. when ADD_ADDR echo are dropped on the reception side, or it is not possible to send an ADD_ADDR due to the limited option space. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-8-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11selftests: mptcp: validate ADD_ADDRv6 + TS + portMatthieu Baerts (NGI0)
This validates the feature added by parent commit, where it is now possible to send an ADD_ADDR with a v6 IP address and a port number, while the connection is using TCP Timestamps. This test is simply a copy of the previous one: "signal address with port", but using IPv6 addresses. This test is only executed if the add_addr_v6_port_drop_ts sysctl knob is available. If not, it means the kernel doesn't support this feature. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-7-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: pm: drop TCP TS with ADD_ADDRv6 + portMatthieu Baerts (NGI0)
With TCP-timestamps (padded) taking 12 bytes and ADD_ADDR IPv6 + port taking 30 bytes, the 40-byte limit for the TCP options is reached. In this case, it is then not possible to send the signal. To be able to send this ADD_ADDR, the TCP timestamps option can now be dropped. This is done, when needed by setting the *drop_ts parameter from mptcp_established_options. This feature is controlled by a new net.mptcp.add_addr_v6_port_drop_ts sysctl knob, enabled by default. It is important to keep in mind that dropping the TCP timestamps option for one packet of the connection could eventually disrupt some middleboxes: even if it should be unlikely, they could drop the packet or even block the connection. That's why this new feature can be controlled by a sysctl knob. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/448 Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-6-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11tcp: allow mptcp to drop TS for some packetsMatthieu Baerts (NGI0)
With TCP-timestamps (padded) taking 12 bytes and ADD_ADDR IPv6 + port taking 30 bytes, the 40-byte limit for the TCP options is reached. In this case, it is then not possible to send the address signal. The idea is to let MPTCP dropping the TCP-timestamps option for some specific packets, to be able to send some specific pure ACK carrying >28 bytes of MPTCP options, like with this specific ADD_ADDR. A new parameter is passed from tcp_established_options to the MPTCP side to indicate if the TCP TS option is used, and if it should be dropped. The next commit implements the part on MPTCP side, but split into two patches to help TCP maintainers to identify the modifications on TCP side. This feature will be controlled by a new add_addr_v6_port_drop_ts MPTCP sysctl knob. It is important to keep in mind that dropping the TCP timestamps option for one packet of the connection could eventually disrupt some middleboxes: even if it should be unlikely, they could drop the packet or even block the connection. That's why this new feature will be controlled by a sysctl knob. Note that it would be technically possible to squeeze both options into the header if the ADD_ADDR is first written, and then the TCP timestamps without the NOPs preceding it. But this means more modifications on TCP side, plus some middleboxes could still be disrupted by that. In this implementation, an unused bit is used in mptcp_out_options structure to avoid passing an address to a local variable. Reading and setting it needs CONFIG_MPTCP, so the whole block now has this #if condition: mptcp_established_options() is then no longer used without CONFIG_MPTCP. About alternatives, instead of passing a new boolean (has_ts), another option would be to pass the whole option structure (opts), but 'struct tcp_out_options' is currently defined in tcp_output.c, and it would need to be exported. Plus that means the removal of the TCP TS option would be done on the MPTCP side, and not here on the TCP side. It feels clearer to remove other TCP options from the TCP side, than hiding that from the MPTCP side. Yet an other alternative would be to pass the size already taken by the other TCP options, and have a way to drop them all when needed. But this feels better to target only the timestamps option where dropping it should be safe, even if it is currently the only option that would be set before MPTCP, when MPTCP is used. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-5-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: introduce add_addr_v6_port_drop_ts sysctl knobMatthieu Baerts (NGI0)
This sysctl is going to be used in the next commits to drop TCP timestamps option, to be able to send an ADD_ADDR with a v6 IP address and a port number. It is enabled by default. This knob is explicitly disabled in the MPTCP Join selftest, with the "signal addr list progresses after tx drop" subtest, to continue verifying the previous behaviour where the ADD_ADDR is not sent due to a lack of space. While at it, move syn_retrans_before_tcp_fallback down from struct mptcp_pernet, to avoid creating another 3 bytes hole. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-4-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: pm: avoid computing add_addr size twiceMatthieu Baerts (NGI0)
mptcp_add_addr_len helper was called twice: in mptcp_pm_add_addr_signal, then just after in mptcp_established_options_add_addr. Both to check the remaining space. The second call is not needed: if there is not enough space, mptcp_pm_add_addr_signal will return false, and the caller, mptcp_established_options_add_addr, will do the same without re-checking the size again. Instead, mptcp_pm_add_addr_signal can directly set the size. Note that the returned size can be negative when other suboptions are dropped, e.g. to send an echo ADD_ADDR with a v4 address, and no port. While at it: - move mptcp_add_addr_len to pm.c, as it is now only used from there - use 'int' in mptcp_add_addr_len for the size, instead of having a mix - use a bool for 'ret' in mptcp_pm_add_addr_signal Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-3-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: pm: avoid computing rm_addr size twiceMatthieu Baerts (NGI0)
mptcp_rm_addr_len helper was called twice: in mptcp_pm_rm_addr_signal, then just after in mptcp_established_options_rm_addr. Both to check the remaining space. The second call is not needed: if there is not enough space, mptcp_pm_rm_addr_signal will return false, and the caller, mptcp_established_options_rm_addr, will do the same without re-checking the size again. Instead, mptcp_pm_rm_addr_signal can directly set the size. While at it, move mptcp_rm_addr_len to pm.c, as it is now only used there, once. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-2-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mptcp: options: suboptions sizes can be negativeMatthieu Baerts (NGI0)
Use a signed int for the returned size, because when other options are dropped, the size can be negative, e.g. to send an echo ADD_ADDR with a v4 address, and no port. The behaviour is not changed, because it was working as expected with an overflow. But it is clearer like this, and it will help later on. Even if, for the moment, only the ADD_ADDR size can be negative in some cases, a signed int is now used for all mptcp_established_options_*() helpers, not to mismatch the type, and as a question of uniformity. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-1-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11Merge branch 'ipq5018-add-and-enable-gephy-rx-and-tx-clocks'Jakub Kicinski
George Moussalem says: ==================== IPQ5018: Add and enable GEPHY RX and TX clocks This patch series addresses a missing hardware description issue for the Qualcomm IPQ5018 Internal Ethernet PHY, where the data paths fail to function correctly unless their dedicated RX and TX clocks are explicitly enabled. Further testing revealed that leaving these clocks unmanaged by the kernel, they were inadvertently left enabled by the bootloader / QSDK platform, which masked the issue. Testing a fresh network configuration path exposed that the data link fails to work without explicit software gating. To correctly introduce the required multi-clock properties, the IPQ5018 binding definition must first be split away from the shared qca,ar803x.yaml schema. This isolation is required because ar803x references the generic ethernet-phy.yaml, which enforces a strict single-clock limit constraint. - Patch 1: Moves the clocks property and its restriction out of the generic ethernet-phy.yaml schema to individual bindings files that need it to allow for PHYs that require multiple clocks. - Patch 2: Add clocks property to qca,ar803x.yaml for the IPQ5018 PHY. - Patch 3: Updates the Qualcomm AT803x PHY driver framework to acquire, enable, and gate these clocks upon link state changes for runtime power optimization. ==================== Link: https://patch.msgid.link/20260608-ipq5018-gephy-clocks-v4-0-fb2ccd56894b@outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: phy: at803x: add RX and TX clock management for IPQ5018 PHYGeorge Moussalem
Acquire and enable the RX and TX clocks for the IPQ5018 PHY. These clocks are required for the PHY's datapath to function correctly. Signed-off-by: George Moussalem <george.moussalem@outlook.com> Link: https://patch.msgid.link/20260608-ipq5018-gephy-clocks-v4-4-fb2ccd56894b@outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11dt-bindings: net: qca,ar803x: Add clocks for IPQ5018 PHYGeorge Moussalem
Further testing revealed that the RX and TX clocks of the IPQ5018 PHY need to be explicitly enabled. As such, add the required clocks to the schema. Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: George Moussalem <george.moussalem@outlook.com> Link: https://patch.msgid.link/20260608-ipq5018-gephy-clocks-v4-2-fb2ccd56894b@outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11dt-bindings: net: ethernet-phy: increase max clock count to twoGeorge Moussalem
The clocks property has a restriction to maximum one. Yet, some PHYs may require more than 1 clock such as the IPQ5018 PHY which requires two clocks for RX and TX. As such, increase maxItems to two. Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: George Moussalem <george.moussalem@outlook.com> Link: https://patch.msgid.link/20260608-ipq5018-gephy-clocks-v4-1-fb2ccd56894b@outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-116lowpan: fix NHC entry use-after-free on error pathYizhou Zhao
lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops the lock before printing nhc->name. lowpan_nhc_del() removes descriptors under the same lock and then relies on synchronize_net() before the owning module can be unloaded. That only waits for net RX RCU readers. lowpan_header_decompress() is also exported and can be reached from callers that are not necessarily covered by the net core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive path. This leaves a race where one task drops lowpan_nhc_lock in the error path, another task unregisters and frees the matching descriptor after synchronize_net() returns, and the first task then dereferences nhc->name for the warning. With the post-unlock window widened, KASAN reports: BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220 Read of size 8 lowpan_nhc_do_uncompression lowpan_header_decompress Fix this by printing the warning before dropping lowpan_nhc_lock, so the descriptor name is read while unregister is still excluded. The malformed packet is still rejected with -ENOTSUPP. Fixes: 92aa7c65d295 ("6lowpan: add generic nhc layer interface") Cc: stable@vger.kernel.org Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn> Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn> Reported-by: Ao Wang <wangao@seu.edu.cn> Reported-by: Xuewei Feng <fengxw06@126.com> Reported-by: Qi Li <qli01@tsinghua.edu.cn> Reported-by: Ke Xu <xuke@tsinghua.edu.cn> Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn> Acked-by: Alexander Aring <aahringo@redhat.com> Link: https://patch.msgid.link/20260609080054.4541-1-zhaoyz24@mails.tsinghua.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: fec: remove reference to nonexistent CONFIG_GILBARCONAP optionEthan Nelson-Moore
The CONFIG_GILBARCONAP option has never been defined by the kernel, but is referred to by drivers/net/ethernet/freescale/fec_main.c. Remove this reference to eliminate dead code. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Reviewed-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260609045200.32606-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: pfcp: allocate per-cpu tstats for PFCP netdevsSamuel Moelius
PFCP uses dev_get_tstats64() as its ndo_get_stats64 callback, but pfcp_link_setup() does not request NETDEV_PCPU_STAT_TSTATS. The net core therefore leaves dev->tstats NULL for PFCP devices. Creating a PFCP rtnetlink device can immediately ask the new netdev for stats while building the RTM_NEWLINK notification. That reaches dev_get_tstats64() and dereferences the NULL dev->tstats pointer. Set pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS during PFCP link setup so the net core allocates the storage expected by dev_get_tstats64(). Fixes: 76c8764ef36a ("pfcp: add PFCP module") Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com> Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Link: https://patch.msgid.link/20260609232244.1602027.c569f6c530f6.pfcp-missing-tstats-link-create-oops@trailofbits.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11sctp: validate embedded address parameter lengthXin Long
sctp_verify_asconf() and sctp_verify_param() only validate ADD_IP, DEL_IP, and SET_PRIMARY parameters against a fixed minimum size of sizeof(struct sctp_addip_param) + sizeof(struct sctp_paramhdr). This ensures the outer parameter is large enough to contain an embedded address parameter header, but does not verify that the embedded address parameter's declared length fits within the bounds of the outer parameter. Later, sctp_process_param() and sctp_process_asconf_param() extract the embedded address parameter and pass it to af->from_addr_param(), which uses the address parameter length to parse the variable-length address payload. A malformed peer can therefore advertise an embedded address parameter length that exceeds the remaining bytes in the enclosing parameter. Validate that addr_param->p.length does not exceed the space available after the sctp_addip_param header before processing the embedded address parameter. Reject malformed parameters when the embedded address length extends beyond the enclosing parameter bounds. This prevents out-of-bounds reads when parsing malformed parameters carried in INIT or ASCONF processing paths. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: sashiko <sashiko-bot@kernel.org> Signed-off-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/7838b86b69f52add28808fb59034c8f992e97b2d.1781043268.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11ipmr: Convert mr_table.cache_resolve_queue_len to u32.Kuniyuki Iwashima
mr_table.cache_resolve_queue_len is always updated under spin_lock_bh(&mfc_unres_lock). Let's convert it to u32. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260609222013.1550355-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11bridge: cfm: reject invalid CCM interval at configuration timeXiang Mei
ccm_tx_work_expired() re-arms itself via queue_delayed_work() using the configured exp_interval converted by interval_to_us(). When exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range, interval_to_us() returns 0, causing the worker to fire immediately in a tight loop that allocates skbs until OOM. Fix this by validating exp_interval at configuration time: - Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the netlink policy so userspace cannot set an invalid value. - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has not yet been configured (defaults to 0 from kzalloc). Fixes: 2be665c3940d ("bridge: cfm: Netlink SET configuration Interface.") Reported-by: Weiming Shi <bestswngs@gmail.com> Signed-off-by: Xiang Mei <xmei5@asu.edu> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260609065116.2818837-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11Merge branch 'net-fib-fix-two-use-after-free-in-drivers-during-rcu-dump'Jakub Kicinski
Kuniyuki Iwashima says: ==================== net: fib: Fix two use-after-free in drivers during RCU dump. syzbot reported fib_info UAF in netdevsim, and the same bug exists in rocker and mlxsw. Patch 1 fixes it, and Patch 2 fixes the same type of bug of fib_rule. ==================== Link: https://patch.msgid.link/20260610061744.2030996-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().Kuniyuki Iwashima
rocker_router_fib_event() calls fib_rule_get() during RCU dump. If the fib_rule is dying, refcount_inc() will complain about it. Let's call refcount_inc_not_zero() in fib_rules_dump(). Fixes: 5d7bfd141924 ("ipv4: fib_rules: Dump FIB rules when registering FIB notifier") Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260610061744.2030996-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().Kuniyuki Iwashima
syzbot reported use-after-free in nsim_fib4_prepare_event(). [0] The problem is that the following functions call fib_info_hold() / refcount_inc() while dumping fib_info under RCU, which is unsafe. * mlxsw_sp_router_fib4_event() * rocker_router_fib_event() * nsim_fib4_prepare_event() refcount_inc_not_zero() must be used, but it would be too late there. Let's guarantee the lifetime of fib_info in fib_leaf_notify(). Note that IPv6 does not need the corresponding change since fib6_table_dump() holds fib6_table.tb6_lock. [0]: refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#0: kworker/u8:15/3420 Modules linked in: CPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: netns cleanup_net RIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25 Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 1b f1 22 fd 48 8d 3d 84 cb f1 0a 67 48 0f b9 3a eb 4a e8 08 f1 22 fd 48 8d 3d 81 cb f1 0a <67> 48 0f b9 3a eb 37 e8 f5 f0 22 fd 48 8d 3d 7e cb f1 0a 67 48 0f RSP: 0018:ffffc9000f2c7270 EFLAGS: 00010293 RAX: ffffffff84a18858 RBX: 0000000000000002 RCX: ffff888032ff9ec0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f9353e0 RBP: 0000000000000000 R08: ffff888032ff9ec0 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880570cc000 R13: dffffc0000000000 R14: ffff88802b40563c R15: ffff8880570cc000 FS: 0000000000000000(0000) GS:ffff888126173000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb1f4d5d000 CR3: 000000006072a000 CR4: 00000000003526f0 Call Trace: <TASK> __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] fib_info_hold include/net/ip_fib.h:629 [inline] nsim_fib4_prepare_event drivers/net/netdevsim/fib.c:930 [inline] nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:1000 [inline] nsim_fib_event_nb+0x1055/0x1240 drivers/net/netdevsim/fib.c:1043 call_fib_notifier+0x45/0x80 net/core/fib_notifier.c:25 call_fib_entry_notifier net/ipv4/fib_trie.c:90 [inline] fib_leaf_notify net/ipv4/fib_trie.c:2176 [inline] fib_table_notify net/ipv4/fib_trie.c:2194 [inline] fib_notify+0x36b/0x5e0 net/ipv4/fib_trie.c:2217 fib_net_dump net/core/fib_notifier.c:70 [inline] register_fib_notifier+0x184/0x360 net/core/fib_notifier.c:108 nsim_fib_create+0x85d/0x9f0 drivers/net/netdevsim/fib.c:1596 nsim_dev_reload_create drivers/net/netdevsim/dev.c:1604 [inline] nsim_dev_reload_up+0x374/0x7c0 drivers/net/netdevsim/dev.c:1058 devlink_reload+0x501/0x8d0 net/devlink/dev.c:475 devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:558 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x187/0x940 net/core/net_namespace.c:234 cleanup_net+0x56e/0x800 net/core/net_namespace.c:702 process_one_work kernel/workqueue.c:3314 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Fixes: 0ae3eb7b4611 ("netdevsim: fib: Perform the route programming in a non-atomic context") Fixes: c3852ef7f2f8 ("ipv4: fib: Replay events when registering FIB notifier") Reported-by: syzbot+cb2aa2390ac024e25f5c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a290011.39669fcc.33b062.00b1.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260610061744.2030996-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11bnx2x: fix resource leaks in bnx2x_init_one() error pathsHaoxiang Li
bnx2x_init_one() falls through to the common memory cleanup path for several failures after probe has already acquired additional resources. If register_netdev() fails after bnx2x_set_int_mode(), MSI/MSI-X remains enabled. If later failures happen after bnx2x_iov_init_one(), PF SR-IOV state can be left allocated. Also, failures after bnx2x_vfpf_acquire() must release the PF resources before freeing the VF-PF mailbox allocated by bnx2x_vf_pci_alloc(). Add error labels matching the resource acquisition order so probe failure disables MSI/MSI-X, removes SR-IOV state, releases VF-PF resources, deallocates VF PCI resources, and then frees the common driver memory. Also clear PCI drvdata before freeing the netdev on probe failure. Cc: stable+noautosel@kernel.org # untested fix to unlikely error path Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260609074610.1968721-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no ↵Shuvam Pandey
RAS DES capability dwc_pcie_rasdes_debugfs_init() returns success when the controller has no RAS DES capability, leaving pci->debugfs->rasdes_info unset. The common debugfs teardown path still calls dwc_pcie_rasdes_debugfs_deinit(), which dereferences rasdes_info unconditionally. Return early when no RAS DES state was allocated. In that case no RAS DES mutex was initialized, so there is nothing to destroy. Fixes: 4fbfa17f9a07 ("PCI: dwc: Add debugfs based Silicon Debug support for DWC") Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com> [mani: reworded subject] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/0f97352506d8d813f70f441de4d63fcd5b7d1c3e.1779123847.git.shuvampandey1@gmail.com
2026-06-11net/sched: cls_flow: Dont expose folded kernel pointersJamal Hadi Salim
The flow classifier falls back to addr_fold() for fields that are missing from packet headers. In map mode, userspace controls mask, xor, rshift, addend and divisor, and can observe the resulting classid through class statistics. This allows a tc classifier in a user/network namespace to recover the 32-bit folded value of skb->sk, skb_dst() or skb_nfct(). Align with standard kernel practices for pointer hashing and replace the XOR folding with a keyed siphash (which is cryptographically secure) Fixes: e5dfb815181f ("[NET_SCHED]: Add flow classifier") Reported-by: Kyle Zeng <kylebot@openai.com> Tested-by: Kyle Zeng <kylebot@openai.com> Tested-by: Victor Nogueira <victor@mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260610101839.14135-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: dsa: qca8k: fix led devicename when using external mdio busGeorge Moussalem
The qca8k dsa switch can use either an external or internal mdio bus. This depends on whether the mdio node is defined under the switch node itself. Upon registering the internal mdio bus, the internal_mdio_bus of the dsa switch is assigned to this bus. When an external mdio bus is used, the driver still uses the internal_mdio_bus id which is used to create the device names of the leds. This leads to the leds being prefixed with '(efault)' as the internal_mii_bus is null. So let's fix this by adding a null check and use the devicename of the external bus instead when an external bus is configured. Fixes: 1e264f9d2918 ("net: dsa: qca8k: add LEDs basic support") Signed-off-by: George Moussalem <george.moussalem@outlook.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260608-qca8k-leds-fix-v3-1-a915bb2f37ae@outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.1-rc8). Conflicts: drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c f67aead16e85 ("net: txgbe: rework service event handling") 57d39faed4c9 ("net: txgbe: improve functions of AML 40G devices") net/rds/info.c 512db8267b73 ("rds: mark snapshot pages dirty in rds_info_getsockopt()") 6e94eeb2a2a6 ("rds: convert to getsockopt_iter") Adjacent changes: include/net/sock.h 1ee90b77b727 ("net: guard timestamp cmsgs to real error queue skbs") f0de88303d5e ("net: make is_skb_wmem() available to modules") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11Merge tag 'dma-mapping-7.1-2026-06-11' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fix from Marek Szyprowski: "Three more fixes for the DMA-mapping code, related to PCI P2PDMA, DMA debug and DMA link ranges API (Li RongQing and Jason Gunthorpe)" * tag 'dma-mapping-7.1-2026-06-11' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: iommu/dma: Do not try to iommu_map a 0 length region in swiotlb dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments
2026-06-11Merge tag 'sunxi-dt-for-7.2-2' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner device tree changes for 7.2 - Take 2 Some changes for old chips and some for recent ones. - A83T gained the MIPI CSI-2 receiver - overlays enabled for Pine64 boards - D1s / T113 and H616 gained the high speed timer - T113s watchdog enabled (for reboot) - H616 gained proper SRAM regions - A523 family gained EL2 virtual timer interrupt and GPADC - A523 pinctrl IRQ fix * tag 'sunxi-dt-for-7.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: a523: Add missing GPIO interrupt arm64: dts: allwinner: a523: add gpadc node arm64: dts: allwinner: Add EL2 virtual timer interrupt ARM: dts: sun8i: a83t: Add MIPI CSI-2 controller node dt-bindings: media: sun6i-a31-isp: Add optional interconnect properties dt-bindings: media: sun6i-a31-csi: Add optional interconnect properties arm64: dts: allwinner: sun50i-a64: Enable DT overlays arm: dts: allwinner: t113s: enable watchdog for reboot arm64: dts: allwinner: h616: add hstimer node riscv: dts: allwinner: d1s-t113: add hstimer node arm64: dts: allwinner: sun50i-h616: Add SRAM nodes Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-06-11MAINTAINERS: add Onur Özkan as Rust reviewerMiguel Ojeda
Onur has been involved with the Rust for Linux project for a year now. He works on the Tyr driver for Arm Mali GPUs [1] and has been driving the `ww_mutex` series and the SRCU abstractions, as well as improving the core Rust support in several areas. In addition, he is already a reviewer of the `RUST [SYNC]` entry and has been involved with upstream Rust -- for instance, he led the bootstrap team for two years. His expertise with the language and its toolchain will be very useful to have around in the future. Thus add him to the `RUST` entry as reviewer. Link: https://rust-for-linux.com/tyr-gpu-driver [1] Acked-by: Onur Özkan <work@onurozkan.dev> Acked-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260611055538.61425-4-ojeda@kernel.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-06-11MAINTAINERS: add Alexandre Courbot as Rust reviewerMiguel Ojeda
Alexandre has been involved with the Rust for Linux project for more than a year now. He is one of the main contributors to Nova [1], the Rust driver for NVIDIA GPUs, and has authored core Rust infrastructure motivated by that work, such as the `num` module with the `Bounded` integer type, the `register!` and `bitfield!` macros, as well as improvements to abstractions like DMA. He maintains the nova-core driver, as well as the `RUST [NUM]`, `RUST [BITFIELD]` and `RUST [INTEROP]` entries. In addition, he has been very active reviewing Rust code in the mailing list. He also proposed and implemented the `int_lowest_highest_one` feature in the Rust standard library [2], which we should eventually use in the kernel. His experience maintaining a major Rust GPU driver and the abstractions it needs will be very useful to have around in the future. Thus add him to the `RUST` entry as reviewer. Link: https://rust-for-linux.com/nova-gpu-driver [1] Link: https://github.com/rust-lang/rust/issues/145203 [2] Acked-by: Alexandre Courbot <acourbot@nvidia.com> Acked-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260611055538.61425-3-ojeda@kernel.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-06-11MAINTAINERS: add Tamir Duberstein as Rust reviewerMiguel Ojeda
Tamir has been involved with the Rust for Linux project for more than a year and a half now. He has been working on improving the integration between the kernel and the Rust language and tooling: he led the effort to replace the kernel's own `CStr` type with the standard library's, and reworked the rust-analyzer integration, among other things. He is already the maintainer of the `RUST [RUST-ANALYZER]` and `XARRAY API [RUST]` entries. In addition, he has been active reviewing Rust code in the mailing list. He is also a long-time contributor to the upstream Rust project, including on topics that matter for the Linux kernel [1]. His expertise with the language and its tooling will be very useful to have around in the future. Thus add him to the `RUST` entry as reviewer. Link: https://github.com/rust-lang/rust/pull/139994 [1] Acked-by: Tamir Duberstein <tamird@kernel.org> Acked-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260611055538.61425-2-ojeda@kernel.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-06-11MAINTAINERS: add Daniel Almeida as Rust reviewerMiguel Ojeda
Daniel has been involved with the Rust for Linux project for more than three years now. He is the lead of the Tyr driver for Arm Mali GPUs [1] and submitted many of the core abstractions that drivers need: the `irq` module, system resources, `IoMem`, the regulator API, the `bits` module, the basic USB abstractions... He is also working on the initial Rust V4L2 support [2]. He is already a maintainer and reviewer of several Rust-related entries, and he has been very active reviewing Rust code in the mailing list. His experience building Rust drivers and the APIs they require will be very useful to have around in the future. Thus add him to the `RUST` entry as reviewer. Link: https://rust-for-linux.com/tyr-gpu-driver [1] Link: https://lore.kernel.org/rust-for-linux/20250818-v4l2-v1-0-6887e772aac2@collabora.com/ [2] Acked-by: Daniel Almeida <daniel.almeida@collabora.com> Acked-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260611055538.61425-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-06-11Merge tag 'imx-binding-7.2' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt i.MX DT Binding for 7.2 - Add compatible string for TI SN65LVDS93. * tag 'imx-binding-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: dt-bindings: display/lvds-codec: add ti,sn65lvds93 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-06-11Input: ipaq-micro-keys - add length check in micro_key_receiveDmitry Torokhov
The driver accesses the message payload (msg[0]) without checking if the length is greater than zero. The parent MFD driver can produce a payload with a length of 0, in which case msg[0] would be uninitialized or stale. Add a check to return early if len is less than 1. Reported-by: sashiko-bot@kernel.org Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/aintAvTyw4CVb5hG@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-11Input: ipaq-micro-keys - fix potential deadlockDmitry Torokhov
The driver acquires the micro->lock spinlock in process context (in micro_key_start() and micro_key_stop()) without disabling interrupts. However, this lock is also acquired in hardirq context by the MFD core rx handler (micro_rx_msg()) which is called from the serial ISR. This can lead to a lock inversion deadlock if the interrupt fires on the same CPU while the process context holds the lock. Fix this by using guard(spinlock_irq) instead of guard(spinlock) in micro_key_start() and micro_key_stop() to disable interrupts while holding the lock. Reported-by: sashiko-bot@kernel.org Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/aij-pfaKK-Nna7wf@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-11ASoC: SOF: topology: fix memory leak in snd_sof_load_topologyZhao Dongdong
When the topology filename contains "dummy" and tplg_cnt is 0, the function returns -EINVAL directly without freeing the tplg_files allocated by kcalloc() at line 2497. This leaks memory on every such topology load attempt. Fix this by setting ret = -EINVAL and jumping to the out: label, which already handles the kfree(tplg_files) cleanup. Fixes: 99c159279c6d ("ASoC: SOF: don't check the existence of dummy topology") Cc: stable@vger.kernel.org Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn> Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://patch.msgid.link/tencent_3EED6D778DC52C3703A2D1EE8119372E8E08@qq.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-11MAINTAINERS: Add Axiado reviewer and MaintainersPrasad Bolisetty
Adding 3 new maintainers Prasad,Tzu-Hao, and Karthikeyan Removed previous maintainer as the previous maintainer moved from project Signed-off-by: Prasad Bolisetty <pbolisetty@axiado.com> Acked-by: Harshit Shah <hshah@axiado.com> Signed-off-by: Tzu-Hao Wei <twei@axiado.com> Signed-off-by: Karthikeyan Mitran <kmitran@axiado.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-06-11ASoC: mediatek: Use guard() for mutex & spin locksMark Brown
bui duc phuc <phucduc.bui@gmail.com> says: This series converts mutex and spinlock handling in Mediatek ASoC drivers to use guard() helpers. Most patches are straightforward conversions to guard() helpers with no functional change intended. One exception is mt8192-afe-gpio, where the mutex release point moves from immediately before dev_warn() to scope exit. However, the affected path only emits a warning and immediately returns -EINVAL, without any further processing. Compile-tested only. Link: https://patch.msgid.link/20260610102021.83273-1-phucduc.bui@gmail.com
2026-06-11ASoC: mediatek: mt8195: mt8365-dai-i2s: Use guard() for spin locksbui duc phuc
Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260610102021.83273-11-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>