summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-11Merge tag 'sunxi-clk-for-7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-allwinner Pull Allwinner clk driver updates from Chen-Yu Tsai: Some cleanups to the Allwinner clock driver library and support for the Allwinner A733 RTC clocks added. * tag 'sunxi-clk-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: sun6i-rtc: add a733 support clk: sunxi-ng: sun6i-rtc: split main oscillator div and gate clk: sunxi-ng: div: add read-only operation support clk: sunxi-ng: mux: fix determine helper rate propagation clk: sunxi-ng: mux: remove unneeded export clk: sunxi-ng: sun6i-rtc: Add feature bit for IOSC calibration clk: sunxi-ng: sun6i-rtc: clean up DT usage clk: sunxi-ng: fix ccu probe clock unregister on error dt-bindings: rtc: sun6i: add sun60i-a733 support dt-bindings: rtc: sun6i: no clock-output-names on h616/r329
2026-08-11Merge tag 'qcom-clk-for-7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: Add global, TCSR, RPMh, and video clock controller support for Maili. Add global, RPM, GPU, display, and audio core clock controller support for Shikra. Add display and graphics clock controllers for Nord. Add Glymur camera and EVA clock controllers, the IPQ9650 REFGEN clocks, and Hawi video clock controller support. Extend the IPQ5210 APSS PLL and RPM clock support for Agatti. Enable runtime PM and regulator-backed reference clock handling where needed. Update QCM2290 clock and power-domain handling, critical clock definitions, and arm architecture Kconfig defaults. Correct MDM9607, MSM8916, MSM8939, SM6115, QCS8300, Kaanapali, and Glymur clock and power-domain handling. Improve GDSC error propagation and teardown. Update bindings for the added controllers and required power and OPP properties. * tag 'qcom-clk-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (94 commits) clk: qcom: Add support for Qualcomm GPU Clock Controller on Shikra clk: qcom: Return expected ENOMEM error on dynamic allocation failure clk: qcom: apss-ipq-pll: Add IPQ5210 support dt-bindings: clock: qcom,a53pll: Add IPQ5210 compatible clk: qcom: Add support for videocc driver on Qualcomm Maili SoC dt-bindings: clock: qcom: Add Qualcomm Maili video clock controller dt-bindings: clock: qcom: Add Qualcomm Shikra GPU clock controller dt-bindings: clock: qcom: Add Qualcomm Shikra Display clock controller clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable clk: qcom: gpucc-qcm2290: Keep the critical clocks always-on from probe clk: qcom: gpucc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: gpucc-qcm2290: Drop pm_clk handling clk: qcom: qcm2290: Update DISPCC and GPUCC GDSC *wait_val values clk: qcom: qcm2290: Add RETAIN_FF_ENABLE flag for DISPCC and GPUCC GDSCs clk: qcom: qcm2290: Set POLL_CFG_GDSCR flag for DISPCC and GPUCC GDSCs clk: qcom: dispcc-qcm2290: Enable runtime PM support clk: qcom: dispcc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: gcc-qcm2290: Keep the critical clocks always-on from probe dt-bindings: clock: qcom,qcm2290-dispcc: Add missing power-domains property clk: qcom: Add Audio Core clock controller support on Qualcomm Shikra SoC ...
2026-08-11Merge tag 'samsung-clk-7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-samsung Pull Samsung SoC clk driver updates from Krzysztof Kozlowski: - Exynos990: Add few missing clocks and correct the gate clock parents in the PERIS clock controller. - Cleanup - Use kzalloc_flex for __counted_by checks in Samsung clk driver. * tag 'samsung-clk-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: clk: samsung: pll: use kzalloc_flex clk: samsung: cpu: use kzalloc_flex clk: samsung: use kzalloc_flex clk: samsung: exynos990: Fix PERIS gate clock parents clk: samsung: exynos990: Add PERIS TMU_SUB_PCLK gate dt-bindings: clock: exynos990: Add CLK_GOUT_PERIS_TMU_SUB_PCLK
2026-08-11Merge tag 'v7.3-rockchip-clk1' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull Rockchip clk driver updates from Heiko Stuebner: - Clock driver for Rockchip RV1106 - Fix for Rockchip rk3576 spi source mux - Better representing fractional PLL coefficients in Rockchip clk driver - Fix for the Rockchip dclk of the 3rd video-port to not affect other compoents when its rate gets changed * tag 'v7.3-rockchip-clk1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: rk3576: fix source muxes for SPI0..SPI4 clk: rockchip: Add clock controller for the RV1106 dt-bindings: clock: rockchip: Add RV1106 CRU support clk: rockchip: Fractional PLL coefficient on RK3588/RK3576 is two's complement clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs clk: rockchip: rk3588: Allow VP2 the same sourcing options as other VPs clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
2026-08-12clk: at91: Read "reg" with helperRob Herring (Arm)
The "reg" property is an address-sized DT cell property. The AT91 compat clock parser only uses a small bus id from it, but reading it with the u8 helper does not match the property encoding. Use of_property_read_reg() so the code goes through the helper for "reg" properties, then keep the existing range check before passing the bus id to the clock registration code. Assisted-by: Codex:gpt-5-5 Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: Brian Masney <bmasney@redhat.com> Link: https://patch.msgid.link/20260612215251.1888345-1-robh@kernel.org Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
2026-08-11Merge tag 'clk-imx-7.3' of ↵Stephen Boyd
git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux into clk-imx Pull i.MX clk driver updates from Abel Vesa: - Add audio PLL debugfs support for K-divider control. - Add missing MODULE_DEVICE_TABLE() declarations for i.MX8QXP clock drivers. - Add PCIe FUNC_OUTPUT_EN clock gate support on i.MX95. - Configure the i.MX95 PCIe transmitter current reference to fix REFCLK rise-fall timing. * tag 'clk-imx-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux: clk: imx95-blk-ctl: Fix REFCLK rise-fall mismatch on i.MX95 clk: imx95-blk-ctl: Add func_out_en clock for i.MX9x PCIe clk: imx: imx8qxp: add missing MODULE_DEVICE_TABLE() clk: imx: imx8qxp-lpcg: add missing MODULE_DEVICE_TABLE() clk: imx: Add audio PLL debugfs for K-divider control
2026-08-12ALSA: hda/ca0132: replace sprintf() with snprintf()Bob Song
Replace six sprintf() calls that write to SNDRV_CTL_ELEM_ID_NAME_MAXLEN-sized buffers with snprintf() to avoid potential buffer overflows. Signed-off-by: Bob Song <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260812033030.635417-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-12ALSA: hda/ca0132: set codec->spec to NULL after freeingBob Song
ca0132_free() and dbpro_free() call kfree(codec->spec) without setting codec->spec to NULL afterward, leaving a dangling pointer. Set it to NULL. Signed-off-by: Bob Song <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260812033019.635010-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-12ALSA: hda: simplify match functions and remove unreachable returnBob Song
hda_bus_match() has an unreachable 'return 1' after an if/else that covers both branches. Remove the superfluous return and simplify the control flow by dropping the else branch. hdac_codec_match() uses a redundant if/else to return 1 or 0. Simplify to a single return statement. Signed-off-by: Bob Song <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260812033007.633564-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-12ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USBTrevor Vorhees
The fixed audio formats for the PreSonus AudioBox USB specify a discrete rate mask but leave nr_rates at zero and rate_table unset. find_format() therefore rejects every requested rate, preventing the playback and capture streams from being opened. Add the advertised 44100 and 48000 Hz rates to both streams and report their 24 significant bits. Fixes: 34fe4a9df247 ("ALSA: usb-audio: Add quirk for PreSonus AudioBox USB") Cc: stable@vger.kernel.org Signed-off-by: Trevor Vorhees <vorhees-work@proton.me> Link: https://patch.msgid.link/20260811-audiobox-usb-fix-v1-1-13c8b7f071ea@proton.me Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-11Merge tag 'spacemit-clk-for-7.3-1' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux into clk-spacemit Pull RISC-V SpacemiT clk driver updates from Yixun Lan: - Add clock for SpacemiT UFS controller - Add SpacemiT I2S clock and fixes * tag 'spacemit-clk-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux: clk: spacemit: k3: fix missing /2 factor in i2s sysclk dividers clk: spacemit: k3: fix i2s clock topology dt-bindings: soc: spacemit: k3: add i2s_sysclk, i2s_bclk_factor and i2s1_sysclk_src IDs clk: spacemit: k3: Add UFS refclk clock dt-bindings: soc: spacemit: k3: Add clock ID for UFS refclk clk: spacemit: k3: fix parent clock of UFS aclk
2026-08-11Merge tag 'clk-meson-v7.3-1' of ssh://github.com/BayLibre/clk-meson into ↵Stephen Boyd
clk-amlogic Pull Amlogic clk driver updates from Jerome Brunet: - Fix the incorrect parent number of the 32k clock on Amlogic GXBB - Add the AO and peripheral clock controllers for the new Amlogic A9 chip * tag 'clk-meson-v7.3-1' of ssh://github.com/BayLibre/clk-meson: clk: amlogic: Add A9 peripherals clock controller driver dt-bindings: clock: Add Amlogic A9 peripherals clock controller clk: amlogic: Add A9 AO clock controller driver dt-bindings: clock: Add Amlogic A9 AO clock controller clk: meson: align gxbb_32k_clk_sel number of parents with actual count
2026-08-11Merge tag 'clk-eyeq7h-7.3' of ssh://github.com/benoitmonin/linux into ↵Stephen Boyd
clk-mobileye Pull Mobileye clk driver updates from Benoît Monin: - Add support for Mobileye EyeQ7H This patchset brings the support of the Other Logic Blocks (OLB) found in the first Mobileye SoC based on the RISC-V architecture, the EyeQ7H. Despite the change from MIPS to RISC-V, the Other Logic Blocks provide similar clock and reset functions to the controllers of the chip. This series introduces the device tree bindings of the SoC and the necessary changes to the clock and reset eyeq drivers. Signed-off-by: Benoît Monin <benoit.monin@bootlin.com> * tag 'clk-eyeq7h-7.3' of ssh://github.com/benoitmonin/linux: clk: eyeq: Add EyeQ7H compatibles clk: eyeq: Drop PLL, dividers, and fixed factors structs clk: eyeq: Convert clocks declaration to eqc_clock clk: eyeq: Introduce a generic clock type clk: eyeq: Prefix the PLL registers with the PLL type clk: fixed-factor: Export __clk_hw_register_fixed_factor() clk: fixed-factor: Rework initialization with parent clocks reset: eyeq: Add EyeQ7H compatibles dt-bindings: soc: mobileye: Add EyeQ7H OLB
2026-08-11Merge tag 'thead-clk-for-v7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into clk-thead Pull one T-HEAD clk driver update from Drew Fustini: There is just one change for this cycle. It allows COMPILE_TEST to select the th1520 clk driver without having CONFIG_ARCH_THEAD enabled. * tag 'thead-clk-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: clk: thead: allow COMPILE_TEST builds
2026-08-11Merge tag 'renesas-clk-for-v7.3-tag2' of ↵Stephen Boyd
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull more Renesas clk driver updates from Geert Uytterhoeven: - Add initial support for the R-Car X5H (R8A78000) SoC * tag 'renesas-clk-for-v7.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: Add R-Car X5H CPG driver dt-bindings: clock: Document Renesas R-Car X5H Clock Pulse Generator
2026-08-11Merge tag 'renesas-clk-for-v7.3-tag1' of ↵Stephen Boyd
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull Renesas clk driver updates from Geert Uytterhoeven: - Add RTC and display clocks on RZ/T2H and RZ/N2H - Add audio and display clocks and resets on RZ/G3E - Add SDHI, GPU, and USB2.0 clocks and resets on RZ/G3L - Update the maintainer for the VersaClock 7 driver - Add CAN-FD clocks and resets for RZ/G3S * tag 'renesas-clk-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: r9a08g045: Add clocks and resets for CAN-FD dt-bindings: clock: renesas,versaclock7: Update maintainer clk: renesas: r9a09g047: Add LVDS clocks and resets clk: renesas: r9a09g077: Add LCDC and PLL3 clock support for RZ/T2H display pipeline clk: renesas: rzv2h-cpg: Extract PLL calculation helpers into shared library clk: renesas: rzv2h-cpg: Use per-SoC PLL reference frequency for calculations clk: renesas: r9a08g046: Add USB2.0 clock and reset entries clk: renesas: r9a09g077: Add RTC clocks clk: renesas: cpg-mssr: Implement dedicated MSTP delay logic for RZ/T2H LCDC and RTC clk: renesas: r9a08g046: Add clock and reset entries for GE3D clk: renesas: r9a08g046: Add clock and reset entries for SDHI clk: renesas: r9a09g047: Add audio clock and reset support dt-bindings: clock: renesas: Add audio clock inputs for RZ/V2H family dt-bindings: clock: renesas,r9a09g077/87: Add PCLKRTC clock ID dt-bindings: clock: renesas,r9a09g077/87: Add LCDC_CLKD clock ID
2026-08-11PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restoreKrishna Chaitanya Chundru
pcie_aspm_cap_init() disables ASPM L0s/L1 on both ends of the Link before touching L1SS config, then later restores the LNKCTL state that was in effect beforehand. Both steps use raw pcie_capability_write_word() calls: the disable step computes the new value by hand from a snapshot taken earlier in the function, and the restore step writes that same snapshot straight back. Switch both steps to pcie_capability_clear_and_set_word(), masked to PCI_EXP_LNKCTL_ASPMC, matching the accessor pcie_config_aspm_dev() already uses elsewhere in this file for the exact same register. This does a live read-modify-write of just the ASPM Control bits instead of relying on a stale snapshot for the rest of the word, and is consistent with how the rest of the file already touches this register. No functional change. Fixes: 7447990137bf ("PCI/ASPM: Disable L1 before disabling L1 PM Substates") Closes: https://lore.kernel.org/all/20260721143945.86E7D1F000E9@smtp.kernel.org/ Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260727-aspm-v6-1-2ebb3ee7ef71@oss.qualcomm.com
2026-08-11cgroup/cpuset: Add test for partition root invalidation returning wrong CPUsShaojie Sun
Add a test case to REMOTE_TEST_MATRIX covering the bug fixed by commit 345f40166694 ("cgroup/cpuset: Return only actually allocated CPUs during partition invalidation"). The test verifies that when a sibling partition root changes its cpuset.cpus to overlap with another partition root, only actually allocated CPUs (effective_xcpus) are returned to the parent, not all CPUs in cpus_allowed. Signed-off-by: Shaojie Sun <sunshaojie@kylinos.cn> Reviewed-by: Waiman Long <longman@redhat.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11cgroup/cpuset: Remove obsolete PFA_SPREAD_SLAB task flagGuopeng Zhang
Commit 16a1d968358a ("mm/slab: remove mm/slab.c and slab_def.h") removed the SLAB allocator, the only allocator that implemented cpuset slab spreading. Commit 61a182ab61a6 ("cgroup/cpuset: Remove cpuset_do_slab_mem_spread()") then removed the last task_spread_slab() caller. Commit 3ab67a9ce82f ("cgroup/cpuset: Mark memory_spread_slab as obsolete") marked the legacy control obsolete. cpuset still updates PFA_SPREAD_SLAB when tasks attach to a legacy cpuset and walks all tasks in a cpuset when memory_spread_slab changes. Remove the unused task flag and its helpers, and make spread task updates depend only on memory_spread_page. Keep the memory_spread_slab control and CS_SPREAD_SLAB state so legacy users retain the existing write, readback and inheritance behavior. Update the comments and documentation to describe only page-cache spreading as functional. Assisted-by: LLM Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn> Reviewed-by: Waiman Long <longman@redhat.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11Merge branch 'mptcp-out-of-order-queue-pruning'Jakub Kicinski
Matthieu Baerts says: ==================== mptcp: out-of-order queue pruning Under memory pressure, a pruning of the MPTCP-level OoO queue might be required as last resort, to avoid too long recoveries, or even stalls. Geliang and Gang managed to reproduce this behaviour, and Paolo improved the situation thanks to the following patches: - Patches 1-3: improve the MPTCP-level retransmission schema to make recoveries from memory pressure/after MPTCP-level drop significantly faster. - Patches 4-5: make the admission check way stricter for incoming packets exceeding the memory limits, with some exceptions for fallback sockets. - Patches 6-7: implement OoO queue pruning for MPTCP. ==================== Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-0-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: implemented OoO queue pruningPaolo Abeni
When moving incoming skbs in the msk receive queue and the latter is above limits, prune it as needed quite alike what TCP is doing at the subflow level. The main difference relies in the stop condition: since MPTCP does not perform collapsing, it's better off dropping the bare minimum to fit the (newer) incoming packet. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Gang Yan <yangang@kylinos.cn> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-7-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: avoid code duplication in __mptcp_move_skb()Paolo Abeni
Alike TCP, MPTCP handles in-sequence packets and partially overlapping ones in a very similar way: we can use the same path to handle both, avoiding some code duplication. This will also make the next patch simpler. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-6-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: enforce hard limit on backlog flushingPaolo Abeni
Currently a wild producer could keep the backlog flushing operation spinning for an unbound time. Since the previous patch, the amount of data present in the backlog is hard-limited. Move the backlog len update at the end of the flush loop to prevent it spinning forever. Also, no need to splice back the remaining skbs list into the backlog, as such list is always empty after each backlog processing loop. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-5-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: explicitly drop over memory limitsPaolo Abeni
Currently the enforcement of the rcvbuf constraint is implemented when moving the skbs into the msk receive or OoO queue, keeping the incoming skbs in the subflow queue when over limits. Under significant memory pressure the above can cause permanent data transfer stalls, as the skb needed to make forward progress can be stuck in a subflow queue. Over memory limits, drop the incoming skb, relying on MPTCP-level retransmissions. Note that fallback socket must perform the limit before the skb reaches the subflow-level queue, as dropping an in-sequence already acked skb would break the stream. This is not a complete fix for the stall issue, as the drop strategy needs refinements that will come in the next patches. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-4-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: let the retrans scheduler do its jobPaolo Abeni
Currently the MPTCP core enforces that when MPTCP-level retrans timer fires, at most a single dfrag is retransmitted. In some corner-cases, it may be necessary to retransmit multiple dfrags, and the MPTCP socket will need to wait multiple retrans timeout to accomplish that. Remove the mentioned constraint, allowing to transmit multiple dfrags per retrans period, as long as the scheduler keeps selecting subflows for retransmissions and pending data is available in the rtx queue. The default scheduler will transmit a dfrag per available subflow. Tested-by: Gang Yan <yangang@kylinos.cn> Tested-by: Geliang Tang <geliang@kernel.org> Acked-by: Geliang Tang <geliang@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-3-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: move the stale logic out of retrans schedulerPaolo Abeni
This allow separating the stale logic invocation and the retrans scheduler, and will simplify the next patch. It's also a cleaner design as the retrans scheduler has currently too many side effects. As a possible downside, the retrans work will now traverse the subflows list additional times; that does not matter much, as this is slowpath. While at it, pick more accurate names for the involved helpers and explicitly note that the per subflow stale data is under msk socket lock protection. The scheduler and the stale logic may observe different subflow statues, as no subflow lock is acquired. This is intentional and not harmful, worst case leading to slower retransmissions. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-2-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: move the retrans loop to a separate helperPaolo Abeni
This is a cleanup in order to make the next patch simpler. No functional change intended. Tested-by: Gang Yan <yangang@kylinos.cn> Tested-by: Geliang Tang <geliang@kernel.org> Acked-by: Geliang Tang <geliang@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-1-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11sched_ext: Fix rq->core_pick corruption under core schedulingTejun Heo
Core scheduling's pick_next_task() picks what to run on every SMT sibling of the core in a single pass under the shared core-wide rq lock. The selection state is consistent only while the lock is held continuously, so ->pick_task() originally could not release it. However, since 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()"), sched_ext runs dispatch from inside the pick and dispatching can drop the rq lock. To support this, pick_next_task() has been updated to restart the whole selection when a pick returns RETRY_TASK after releasing the lock. When selections on the same core interleave through the dropped lock, they corrupt each other's state: one clears the other's rq->core_pick leading to a NULL deref, or invalidates its keep-the-previous-task decision leaving a dequeued task running, which deadlocks the next wakeup and matches the reported hard hangs. A cookied ping-pong load on an SMT machine makes the interleavings frequent and kills the kernel within seconds. Fix it by making the pick return RETRY_TASK whenever dispatch released the rq lock, so that a selection only ever commits picks made under a continuously held lock. The previous patch's rq->scx.lock_drop_seq counts the releases. A dispatch that touched nothing never releases the lock and its verdict, including "nothing to run", stands: retries are bounded, each following a dispatch that actually did something, and an idle CPU does not loop. If another dispatch is already in flight on the rq, skip dispatching and pick from what is already queued locally - the in-flight dispatch has released the lock, so its own selection will retry and re-pick this rq, while returning RETRY_TASK here would only spin on the lock that dispatch needs to finish. Balance callbacks must run in the context that queued them, so they can only be queued on the CPU's own rq. When dispatching for another rq, run the deferred work directly instead - that rq may consume all its picks through the core-sched fast path and never queue the callback itself. The put_prev_task_scx() warning about a runnable task being left behind assumed that dispatch ran as part of the very pick that is switching away. That now only holds on the non-core path, so gate it and drop the cookie-match test, which is always true without core scheduling, from its condition. Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()") Cc: stable@vger.kernel.org # v6.19+ Reported-by: ElXreno <elxreno@gmail.com> Link: https://github.com/sched-ext/scx/issues/3715 Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11sched_ext: Count rq lock releases in rq->scx.lock_drop_seqTejun Heo
Under core scheduling, pick_next_task() selects for all SMT siblings under one continuous hold of the shared core-wide rq lock, and sched_ext's dispatch can release that lock from inside the pick. In preparation for making the core-sched pick detect the releases and retry, add rq->scx.lock_drop_seq and bump it at every site that can release an rq lock while a dispatch may be in flight. The counter is only maintained while core scheduling is enabled. No functional changes. Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()") Cc: stable@vger.kernel.org # v6.19+ Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11sched_ext: Fix this_rq() assumptions in dispatch kfuncsTejun Heo
Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch() may execute on a CPU different from the dispatched rq's. Several kfunc paths assumed the two always coincide: - scx_dsq_move() decided whether an rq lock is held by testing this_rq()'s rq flags and lock-danced accordingly. A dispatch for a sibling took the unlocked-context branch and acquired the source rq lock on top of the already held dispatched rq lock which could deadlock. - scx_bpf_sub_dispatch() dispatched this_rq() with its stashed sub_dispatch_prev, which is NULL when dispatching for a sibling. - finish_dispatch(), scx_bpf_dsq_reenq() and scx_bpf_dsq_nr_queued() resolved SCX_DSQ_LOCAL to this CPU's local DSQ rather than the dispatched rq's. The latter two are callable from other rq-locked operations too, where SCX_DSQ_LOCAL now likewise resolves to the op's rq. This changes behavior also without core scheduling, e.g. for ops.enqueue() running a remote wakeup on the waking CPU, and is intended: which CPU happens to execute an operation is incidental, the op's rq is what it is operating on, and the resolution now matches the insert side where SCX_DSQ_LOCAL dispatches land on the task's rq. Use the rq tracked by scx_locked_rq(), which is set to the dispatched rq around ops invocations and NULL in unlocked contexts. Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()") Cc: stable@vger.kernel.org # v6.19+ Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict returnTejun Heo
SCX_RQ_BAL_KEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while dispatches and picks pair up one to one, which core scheduling breaks: selections interleave through dispatch's lock drops and a pick can consume a stale flag, keeping a task that has since been dequeued. Fixing core scheduling support requires the decision to travel with the dispatch that made it. Make scx_dispatch_sched() and balance_one() return an explicit verdict instead and drop the flag's plumbing from the tools autogen enum headers. Also factor the pick-side invocation, its follow-up queueing and the post-dispatch checks out of do_pick_task_scx() into dispatch_pick(). No functional changes intended. v2: Drop the SCX_RQ_BAL_KEEP plumbing from the tools autogen enum headers as well (Andrea). Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()") Cc: stable@vger.kernel.org # v6.19+ Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11sched/core: Make core-sched flips wait for in-flight selectionsTejun Heo
Core scheduling's pick_next_task() operates on all sibling rqs under one acquisition of the shared core-wide lock. A ->pick_task() that releases the rq lock leaves every sibling __lock momentarily free, letting __sched_core_flip(false) complete mid-selection and rebind rq_lockp() under it. The selection resumes on the split locks, touching sibling state it no longer protects, and __schedule() finally releases a lock that was never taken while leaking the one that was. Count in-flight core-wide selections in the leader's rq->core_pick_in_flight and make __sched_core_flip() wait for the count to drain. The count only changes under the shared lock, which the flip holds while sampling, so no other ordering is needed. The wait can repeat while selections overlap, but the flip backs off between samples and flips are rare cookie-lifetime events. sched_core_cpu_deactivate() moves the count to the new leader - a stale copy left behind would bias it forever if that CPU later returns as its own leader. Fixes: 539f65125d20 ("sched: Add core wide task selection and scheduling") Cc: stable@vger.kernel.org # v5.14+ Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
2026-08-11sched/core: Handle pick_task() releasing the rq lockTejun Heo
Core scheduling's pick_next_task() breaks when a ->pick_task() implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held continuously. Once a pick can drop the lock, an interleaving selection can invalidate all of it: the single-CPU fast path can commit an uncookied pick although the core went cookied during the release, and forceidle committed by the interleaving selection skews the restarted pass's accounting. Fix it by restarting the whole selection when a pick returns RETRY_TASK after releasing the lock: a single restart point above the state derivation replaces the per-loop restart labels, so a retry picks up state committed by interleaving selections and accounts and resets forceidle like a fresh selection would. need_sync and fi_before latch across retries. Clock validity can't be re-derived - there is no program-ordered way to tell whether the own and core rq clocks are still updated after the lock was released, as other lockers' pin cycles may or may not have invalidated them. When restarting, clear core_clock_updated so that the sibling loop re-updates the core rq, and update the own rq clock if invalidated. Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()") Cc: stable@vger.kernel.org # v6.19+ Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
2026-08-11Merge tag 'nf-26-08-10' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter/IPVS fixes for net. Still large batch for this late -rc cycle but at least half of these fixes in this batch have been cooking for several weeks before: 1) Fix race between ipset list:set GC and swap, use write_lock instead of rcu read lock section when accessing the index to ensure interference with ip_set_swap(), from Xiang Mei. 2) Release template conntrack in bridge conntrack when packet is neither IPv4 nor IPv6 before setting skb as untracked. From Zhiling Zou. 3) A series of 3 patches for IPVS to address sashiko reports: Schedulers read destination overload state while connection accounting and destination configuration can update it concurrently. The first patch adds a single total connection counter. The second patch uses it to identify threshold crossings precisely, and updates OVERLOAD at the crossings and on a threshold edit under dst_lock. The third patch moves configuration-controlled AVAILABLE to a separate cflags word, so it cannot clobber OVERLOAD through an unrelated read-modify-write update. 4) Log invalid packets in TCP and SCTP connection tracking to address a deadlock when nfnetlink_log is used as logging backend and the nfnetlink_log conntrack glue support is used. From Zihan Xi. 5) Wait for rcu grace period before releasing pernet state in nfnetlink_log, otherwise packets can end up access already released memory, triggering UaF. From Florian Westphal. 6) IPVS needs to reset IP information in control buffer in skbuff when encapsulating IP packets in ICMP, from Kyle Zeng. 7) IPVS needs to validate ihl field of inner headers in when handling ICMP response, from Julian Anastasov. 8) Remove a WARN_ON_ONCE reachable from the nf_tables hardware offload when triggering ENOMEM on GFP_KERNEL allocation, from Alexey Velichayshiy. 9) Publish reply tuple into the flowtable hashtable first, otherwise GC might walk over a released tuple when insertion of the original tuple fail. From Jeremy Jean. 10) Elide counter increment when replacing an ipset element, from Florian Westphal. 11) Remove unneeded ipset accounting resets on destruction/flush, from Florian Westphal. * tag 'nf-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: ipset: let destroy callbacks adjust ext mem size netfilter: ipset: fix list type element drift bug netfilter: flowtable: publish GC-visible tuple last netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path ipvs: revalidate ihl to prevent out-of-bounds access ipvs: clear IPv4 options after rebasing tunnel ICMP errors netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state netfilter: nf_conntrack: defer invalid log until after unlock ipvs: separate destination availability state ipvs: properly update the overload flag on dest edit ipvs: add totalconns for dest netfilter: bridge: release template ct on non-IP path netfilter: ipset: fix refcount race between list:set GC and swap ==================== Link: https://patch.msgid.link/20260810190621.894119-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11selftests: drv-net: hide the devlink port_split testJakub Kicinski
The devlink port_split test has limited applicability. NICs (as opposed to switches) require at least a re-probe to apply the split configuration. On top of that the test is not compatible with our driver env, it just splits all ports on the system, not only what NETIF points at. Long term we may want to add some indication in devlink whether the port splitting is runtime (cmode of sorts), and fix the test to follow driver env. But since no (known) NIC driver can support runtime anyway let's just hide the test from the selftest framework by moving it to extra files. Having this test randomly break unrelated NICs within the DUT makes people implement allow-lists for ksft, which then means their setups don't run new tests. It's very useful during test review to see whether the test works across all the runners. Reviewed-by: Petr Machata <petrm@nvidia.com> Link: https://patch.msgid.link/20260811004645.1072124-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11net/sched: cls_u32: skip hash tables in u32_bind_class()Zhang Changzhong
u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode through the walker callback. u32_bind_class() unconditionally casts the passed fh to tc_u_knode and accesses &n->res, so when fh is actually a tc_u_hnode, which has no tcf_result member, this results in a slab-out-of-bounds read of res->classid in tc_cls_bind_class(). The issue can be reproduced with the following commands: tc qdisc add dev lo root handle 1: hfsc tc class add dev lo parent 1: classid 1:1 hfsc sc rate 1000kbit tc filter add dev lo parent 1:1 protocol ip prio 1 u32 match u32 0 0 flowid 1:1 tc class add dev lo parent 1: classid 1:2 hfsc sc rate 2000kbit Fix this by skipping hash tables via the TC_U32_KEY(handle) check. Fixes: 07d79fc7d94e ("net_sched: add reverse binding for tc class") Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://patch.msgid.link/1786089038-36366-1-git-send-email-zhangchangzhong@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11bnxt_en: enable PTM functionVadim Fedorenko
The patch mentioned in Fixes missed one main point of implementing proper PTM support. To make it fully operational it has to be explicitly enabled. Add missing call in probe callback and disable it in teardown callback. Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Link: https://patch.msgid.link/20260806201849.3161402-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11Merge branch 'gve-bug-fixes-for-header-split-and-ptp'Jakub Kicinski
Harshitha Ramamurthy says: ==================== gve: Bug fixes for header-split and PTP This series contains 2 bug fixes for gve. Patch 1 fixes an issue which causes TX timeouts due to HW detection of an illegal descriptor. This happens when receiving header-only packets with header split enabled - this produces an SKB with a zero-length fragment. Patch 2 prevents a kernel NULL pointer dereference by stubbing the PTP adjfine callback. ==================== Link: https://patch.msgid.link/20260807224315.234152-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11gve: fix NULL dereference due to missing ptp adjfineJordan Rhee
Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows: sudo ./testptp -d /dev/ptp0 -f 0 [ 551.943697] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] [ 552.061946] Call Trace: [ 552.064487] <TASK> [ 552.066681] ptp_clock_adjtime+0x1c0/0x2c0 [ 552.070874] ? get_clock_desc+0x6b/0xb0 [ 552.074825] pc_clock_adjtime+0x78/0xc0 [ 552.078755] __do_sys_clock_adjtime+0x85/0x110 [ 552.083293] do_syscall_64+0xea/0x610 Cc: stable@vger.kernel.org Fixes: acd16380523b ("gve: Add initial PTP device support") Signed-off-by: Jordan Rhee <jordanrhee@google.com> Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260807224315.234152-3-hramamurthy@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11gve: fix zero-length skb frag with header-splitJordan Rhee
When header split is enabled and a header-only packet is received such as a pure TCP ACK, GVE will indicate an RX SKB with a zero-length fragment. If this SKB is then hairpinned and sent back out, the GVE TX path will emit a zero-length descriptor. Hardware considers this an illegal descriptor and stops the queue, causing a TX timeout and interface reset. Fix it by not adding the zero-length skb frag. Cc: stable@vger.kernel.org Fixes: 5e37d8254e7f ("gve: Add header split data path") Suggested-by: Praveen Kaligineedi <pkaligineedi@google.com> Co-developed-by: Ziwei Xiao <ziweixiao@google.com> Signed-off-by: Ziwei Xiao <ziweixiao@google.com> Signed-off-by: Jordan Rhee <jordanrhee@google.com> Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com> Link: https://patch.msgid.link/20260807224315.234152-2-hramamurthy@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11Merge branch 'net-selftests-adjustments-to-ipv6_flowlabel_mgr'Jakub Kicinski
Marcelo Mendes Spessoto Junior says: ==================== net: selftests: adjustments to ipv6_flowlabel_mgr The ipv6_flowlabel_mgr test file was lacking coverage for the IPV6_FL_A_RENEW action, and the IPV6_FL_F_REMOTE and IPV6_FL_F_REFLECT flags. The first two patches from this set aim to add a proper test case for RENEW and REMOTE. The third patch was added to insert network namespace creation inside the test suite, instead of relying on external wrapper scripts. This change conforms to other net test implementations, such as tools/testing/selftests/net/icmp_rfc4884.c, and it is important for the fourth and fifth patches. The fourth patch adds the IPV6_FL_F_REFLECT test. The fifth patch proposes the adoption of "kselftest_harness.h" helpers, improving code readability and conforming to the implementation of the most recent selftests. ==================== Link: https://patch.msgid.link/20260807220942.421382-1-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11selftests: net: adopt harness for flow label mgrMarcelo Mendes Spessoto Junior
The kselftest_harness.h file contains modern helpers to build tests for kselftest. Dropping the custom test helpers in ipv6_flowlabel_mgr in favor of the harness makes tests more legible and conforms to the structure of the latest selftests. It also enforces the TAP standard. Another change made to the structure of the ipv6_flowlabel_mgr test file was the removal of parse_opts. The supported opts were already unused: the binary is listed in TEST_GEN_FILES, and is driven solely by ipv6_flowlabel.sh via "./ipv6_flowlabel_mgr", which never passed -l or -v. Dropping the -l gate means the two checks it previously guarded (each with a 13-second sleep, ~26 seconds total) are now unconditionally enabled on every run instead of never running at all. The TH_LOG calls and code comments now cover the information that the removed, custom -v flag used to print. Finally, FIXTURE_SETUP(flowlabel) ensures each test gets its own isolated network namespace. The previously added setup() helper was dropped to conform to the netns setup pattern used in icmp_rfc4884.c. disable_flowlabel_consistency() was moved next to reflect_flag, the only test that calls it, and now uses SKIP() instead of an ad hoc [INFO] message when the sysctl cannot be disabled. Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com> Link: https://patch.msgid.link/20260807220942.421382-6-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11selftests: net: test IPV6_FL_F_REFLECTMarcelo Mendes Spessoto Junior
According to the source code, flowlabel_consistency must be deactivated for the IPV6_FL_F_REFLECT flag to work. Since ipv6_flowlabel_mgr now runs in its own network namespace, do this directly from the test binary. Attempt to disable net.ipv6.flowlabel_consistency and skip the reflect test if that fails. A disabled flowlabel_consistency does not affect the remaining features being tested on the file, and failing to disable is not fatal and skips the reflect test only. The previously defined tcp_listen and tcp_connect helpers were reused, since the connection flow required for REFLECT validation is very similar to REMOTE. Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com> Link: https://patch.msgid.link/20260807220942.421382-5-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11selftests: net: create own netns in ipv6_flowlabel_mgrMarcelo Mendes Spessoto Junior
Have ipv6_flowlabel_mgr create and configure its own network namespace (unshare(CLONE_NEWNET) + bring up lo), the same way ipv6_fragmentation.c and icmp_rfc4884.c already do, instead of relying on the in_netns.sh wrapper script. The setup can then be reused across tests through fixtures and provide isolated network environments for each test in the case of a future adoption of kselftest_harness. It also avoids the leak of modifications to the netns in case the user runs the test file directly, outside the wrapper and without the in_netns.sh file. Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com> Link: https://patch.msgid.link/20260807220942.421382-4-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11selftests: net: test IPV6_FL_F_REMOTEMarcelo Mendes Spessoto Junior
This flag retrieves the flow label seen by the socket at connection setup via a getsockopt query. Therefore, the validation of this flag requires a brief connection setup (source code for flow label shows it must be TCP). The simple TCP connection logic was wrapped inside two simple helpers, because there are other uncovered features of flow label mgr that could benefit from it (such as IPV6_FL_F_REFLECT). Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com> Link: https://patch.msgid.link/20260807220942.421382-3-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11selftests: net: test IPV6_FL_A_RENEWMarcelo Mendes Spessoto Junior
RENEW was the only flow label action without selftests coverage. Assert renew returns no error on correct usage and fails for labels that do not exist. This test is based on the previously implemented EXCL share test, which demonstrates that a new flow label with the same value can be created after the linger period. Renew is used here to show that a flow label can last longer and block a new flow label creation after the previous linger time. This test, however, demands sleep during execution, and should be placed as a conditional test under the -l option. The addition of the expect_fail_errno helper is necessary to assert the corresponding error when a function can fail in multiple ways. Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com> Link: https://patch.msgid.link/20260807220942.421382-2-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11net/sched: act_api: fix TOCTOU NULL deref on a->goto_chainJamal Hadi Salim
tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking rcu_access_pointer(a->goto_chain) and then calling tcf_action_goto_chain_exec(), which does a second, independent rcu_dereference_bh(a->goto_chain) read and immediately dereferences chain->filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact replace path) can clear a->goto_chain between the two reads, so the second read returns NULL and tcf_action_goto_chain_exec() dereferences NULL. Fix the race by doing a single rcu_dereference_bh() read of a->goto_chain in tcf_action_exec(), checking it once for NULL, and passing the resulting chain pointer into tcf_action_goto_chain_exec(). This turns the split check/use into a single check/use on one value. Fixes: ee3bbfe806cd ("net/sched: let actions use RCU to access 'goto_chain'") Reported-by: vega@nebusec.ai Tested-by: Victor Nogueira <victor@mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Reviewed-by: Davide Caratti <dcaratti@redhat.com> Link: https://patch.msgid.link/20260809090928.868186-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11Merge branch 'devlink-add-generic-device-max_sfs-parameter'Jakub Kicinski
Tariq Toukan says: ==================== devlink: add generic device max_sfs parameter This series by Nikolay introduces a new generic devlink device parameter, max_sfs, to control the number of light-weight NIC subfunctions (SFs) that can be created on a device. The first patch adds the generic devlink parameter and infrastructure support. The second patch implements support for the parameter in the mlx5 driver. With this addition, users can enable or disable SF creation directly via devlink, without relying on external vendor-specific tools. ==================== Link: https://patch.msgid.link/20260806073037.3001886-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11net/mlx5: implement max_sfs parameterNikolay Aleksandrov
Implement max_sfs generic parameter to allow users to control the total light-weight NIC subfunctions that can be created using devlink instead of external vendor tools. A value of 0 will effectively disable creation of new subfunction devices. A warning is sent to user-space via extack (returning extack without error code is interpreted as a warning by user-space tools). The maximum value is capped at U16_MAX. Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260806073037.3001886-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11devlink: add generic device max_sfs parameterNikolay Aleksandrov
Add a new generic devlink device parameter (max_sfs) to control if and how many light-weight NIC subfunctions can be created. Subfunctions are a light-weight network functions backed by an underlying PCI function. Their lifecycle can already be managed by devlink, but currently users cannot enable them in the device. They can be enabled/disabled only via external vendor tools. This parameter allows subfunctions to be enabled (>0) or disabled (0) via devlink. A subsequent patch will add support for max_sfs to the mlx5 driver. Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260806073037.3001886-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>