summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-09Merge branch 'selftests-bpf-fix-tests-for-llvm23-true-signature'Alexei Starovoitov
Yonghong Song says: ==================== selftests/bpf: Fix tests for llvm23 true signature LLVM23 ([1]) records the 'true' function signature in BTF, i.e. the signature inferred after optimization rather than the one written in C. This caused two kinds of selftest failures (see below). Case 1: keep int return type for tailcall subprogs The verifier requires any subprog that issues a bpf_tail_call to return an 'int' (see check_btf_func() in kernel/bpf/check_btf.c, which rejects it with "tail_call is only allowed in functions that return 'int'"). Several tailcall subprogs do 'return 0' (or another constant) whose result no caller uses. With llvm23 the compiler folds the constant and, since the return value is dead, optimizes the subprog to effectively return 'void' and records 'void' in BTF, so the program fails to load. Use barrier_var() and __sink() to prevent returned value from being optimized. Case 2: adjust tracing prog ctx layout for the true signature test_pkt_access_subprog2() has an unused argument that llvm optimizes away. Before llvm23 the BTF signature did not match the optimized assembly, so the verifier fell back to MAX_BPF_FUNC_REG_ARGS (5) u64 arguments and the fexit return value sat after args[5]. With llvm23 the true signature has a single argument, so the return value moves to the slot after args[1]. Select the matching ctx struct based on __clang_major__ so the test works with both old and new llvm. [1] https://github.com/llvm/llvm-project/pull/198426 Changelogs: v1 -> v2: - v1: https://lore.kernel.org/bpf/20260609163947.1717694-1-yonghong.song@linux.dev/ - Do not use bpf array map or bpf global var. Use __sink() instead. ==================== Link: https://patch.msgid.link/20260609233402.2711071-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-09selftests/bpf: Adjust fexit_bpf2bpf ctx layout for llvm23 true signatureYonghong Song
test_pkt_access_subprog2() is defined in C as int test_pkt_access_subprog2(int val, volatile struct __sk_buff *skb) but llvm optimizes away the unused 'int val' argument. Before llvm23 the BTF signature did not match the optimized assembly, so the verifier set attach_func_proto to NULL and fell back to MAX_BPF_FUNC_REG_ARGS (5) u64 arguments (see btf_ctx_access()). The fexit ctx struct therefore placed the return value after args[5]. With llvm23 the 'true' signature int test_pkt_access_subprog2(volatile struct __sk_buff *skb) is recorded in BTF, so nr_args becomes 1 and the return value moves to the slot right after args[1]. Select the matching args_subprog2 layout based on __clang_major__ so the test works with both old and new llvm. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260609233412.2712178-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-09selftests/bpf: Keep int return type for tailcall subprogsYonghong Song
LLVM23 ([1]) supports 'true' function signature in BTF. The return type of the caller of a tailcall must be an 'int'. Otherwise, verification will fail (see check_btf_func() in check_btf.c). So with llvm23, it is possible that the compiler may change the caller's return type from 'int' to 'void'. To prevent this, barrier_var() and __sink() are used to avoid returning a constant prone to be optimized. [1] https://github.com/llvm/llvm-project/pull/198426 Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260609233407.2711577-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-09Merge branch 'net-dsa-realtek-rtl8365mb-bridge-offloading-and-vlan-support'Jakub Kicinski
Luiz Angelo Daros de Luca says: ==================== net: dsa: realtek: rtl8365mb: bridge offloading and VLAN support This series introduces bridge offloading, FDB management, and VLAN support for the Realtek rtl8365mb DSA switch driver. The primary goal is to enable hardware frame forwarding between bridge ports, reducing CPU overhead and providing advanced features like VLAN and FDB isolation. Some of these patches are based on original work by Alvin Šipraga, subsequently adapted and updated for the current net-next state. I attempted to reach Alvin for review of the final version but was unable to establish contact. Any regressions in this version are my responsibility. ==================== Link: https://patch.msgid.link/20260606-realtek_forward-v13-0-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: add bridge port flagsLuiz Angelo Daros de Luca
Implement support for bridge port flags to control learning and flooding behavior. This patch maps hardware functionalities to the following bridge flags: - BR_LEARNING - BR_FLOOD - BR_MCAST_FLOOD - BR_BCAST_FLOOD By default, all flooding types are enabled during port setup to ensure standard bridge behavior. Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-9-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: add port_bridge_{join,leave}Alvin Šipraga
Implement hardware offloading of bridge functionality. This is achieved by using the per-port isolation registers, which contain a forwarding port mask. The switch will refuse to forward packets ingressed on a given port to a port which is not in its forwarding mask. For each bridge that is offloaded, use the DSA-provided bridge number for the Extended Filtering ID (EFID). When using Independent VLAN Learning (IVL), the forwarding database is keyed with the tuple {VID, MAC, EFID}. There are 8 EFIDs available (0~7), but we reserve the default EFID 0 for standalone ports where learning is disabled. This fits nicely because DSA indexes the bridge number starting from 1. Because of the limited number of EFIDs, we have to set the max_num_bridges property of our switch to 7: we can't offload more than that or we will fail to offer IVL as at least two bridges would end up having to share an EFID. All ports start isolated, forwarding exclusively to CPU ports, and with VLAN transparent, ignoring VLAN membership. Once a member in a bridge, the port isolation is expanded to include the bridge members. When that bridge enables VLAN filtering, the VLAN transparent feature is disabled, letting the switch filter based on VLAN setup. Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Co-developed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-8-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: add FDB supportAlvin Šipraga
Implement support for FDB and MDB management for the RTL8365MB series switches. The hardware supports IVL by keying the unicast forwarding database with the {MAC, VID, EFID} tuple. The Extended Filtering ID (EFID) is 3 bits wide, providing 8 unique filtering domains. This driver reserves EFID 0 for standalone ports, effectively limiting the hardware offload to a maximum of 7 bridges. The multicast database uses a {MAC, VID} key, with ports from different bridges sharing the same multicast group. Introduce a mutex lock (l2_lock) to protect concurrent L2 table updates. Add support for forwarding database operations, including unicast and multicast entry handling as well as fast aging support. Set DSA switch flags assisted_learning_on_cpu_port and fdb_isolation. Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Co-developed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-7-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: add VLAN supportAlvin Šipraga
Realtek RTL8365MB switches (a.k.a. RTL8367C family) use two different structures for VLANs: - VLAN4K: A full table with 4096 entries defining port membership and tagging. - VLANMC: A smaller table with 32 entries used primarily for PVID assignment. In this hardware, a port's PVID must point to an index in the VLANMC table rather than a VID directly. Since the VLANMC table is limited to 32 entries, the driver implements a dynamic allocation scheme to maximize resource usage: - VLAN4K is treated by the driver as the source of truth for membership. - A VLANMC entry is only allocated when a port is configured to use a specific VID as its PVID. - VLANMC entries are deleted when no longer needed as a PVID by any port. Although VLANMC has a members field, the switch only checks membership in the VLAN4K table. This driver will use VLANMC members field as way to track which ports are using that entry as PVID. VLANMC index 0, although a valid entry, is reserved in this driver as a neutral PVID value for ports not using a specific PVID. In the subsequent RTL8367D switch family, VLANMC table was removed and PVID assignment was delegated to a dedicated set of registers. The use of FIELD_PREP for reconstructing LO/HI values was suggested by Yury Norov. Fix for vlan_setup and vlan_filtering was suggested by Abdulkader Alrezej. Suggested-by: Yury Norov <ynorov@nvidia.com> Suggested-by: Abdulkader Alrezej <abdulkader.alrezej@gmail.com> Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Co-developed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-6-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: add table lookup interfaceAlvin Šipraga
Add a generic table lookup interface to centralize access to the RTL8365MB internal tables. This interface abstracts the low-level table access logic and will be used by subsequent commits to implement FDB and VLAN operations. Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Co-developed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-5-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: prepare for multiple source filesAlvin Šipraga
Rename rtl8365mb.c to rtl8365mb_main.c in preparation for subsequent commits which add additional source files to the driver. The trailing backslash in the Makefile is deliberate. It allows for new files to be added without clobbering git history. Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Co-developed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-4-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: use dsa helpers for port iterationLuiz Angelo Daros de Luca
Convert open-coded port iteration loops to use the DSA helpers and restructure rtl8365mb_setup() into clear blocking, user, and CPU port phases. As part of this refactoring, unused ports are explicitly placed into a blocked, isolated state with learning disabled, ensuring safe default hardware behavior. The driver also does not allocate a virtual IRQ mapping for unused ports. To accommodate this, a guard check is added to the interrupt handler (rtl8365mb_irq) to safely skip ports without a valid IRQ mapping. The irq domain teardown, however, does clean all ports as external PHYs may still map the IRQ. Furthermore, since the new initialization loop starts with all ports administratively isolated by default, CPU port forwarding and isolation masks are explicitly configured at the end of the setup phase to prevent egress traffic from being blocked. Suggested-by: Abdulkader Alrezej <abdulkader.alrezej@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-3-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: reject unsupported topologiesLuiz Angelo Daros de Luca
Explicitly enforce the presence of a CPU port (-EINVAL) and reject DSA cascade links (-EOPNOTSUPP) during setup to prevent silent failures. These topologies were already non-functional. Without a CPU port, the driver does not activate CPU tagging. Additionally, the switch hardware was not designed to be cascaded, and DSA links never worked because CPU tagging is not enabled for them. Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-2-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: use ERR_PTRLuiz Angelo Daros de Luca
Convert numeric error codes into human-readable strings by using %pe together with ERR_PTR() in dev_err() messages. Also use dev_err_probe() instead of checking for -EPROBE_DEFER. Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-1-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: lan966x: restore RX state on reload failureGuangshuo Li
lan966x_fdma_reload() backs up rx->page_pool and rx->fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before restarting RX. However, the reload path also updates rx->page_order and rx->max_mtu before calling lan966x_fdma_rx_alloc(). These fields are not restored on failure, so RX can be restarted with the old pages, old FDMA state and old page pool, but with the page geometry from the failed new MTU. This can make the XDP path advertise a frame size derived from the new page_order while the actual RX pages still come from the old allocation. For example, after a failed reload to a jumbo MTU, xdp_init_buff() may be called with a frame size larger than the restored RX pages. lan966x_fdma_rx_alloc_page_pool() also registers the newly allocated page pool with each port's XDP RXQ before fdma_alloc_coherent() is called. If fdma_alloc_coherent() fails, the new page pool is destroyed, but the rollback path does not restore the per-port XDP RXQ mem model registration either. Save and restore rx->page_order and rx->max_mtu, and restore the old page pool registration for each port's XDP RXQ before RX is started again. This keeps the restored RX state consistent after a failed reload. Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: David Carlier <devnexen@gmail.com> Link: https://patch.msgid.link/20260607145747.1494514-1-lgs201920130244@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09ptp: ocp: fix resource freeing orderVadim Fedorenko
Commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") added a call to ptp_disable_all_events() which changes the configuration of pins if they support EXTTS events. In ptp_ocp_detach() pins resources are freed before ptp_clock_unregister() and it leads to use-after-free during driver removal. Fix it by changing the order of free/unregister calls. To avoid irq handler running on the other core while ptp device unregistering, call synchronize_irq() after HW is configured to stop producing irqs and no irqs are in-flight. Fixes: a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260608155952.240304-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: pse-pd: pd692x0: support disabling disable ports GPIORobert Marko
Microchip PSE controllers have a dedicated disable ports input that like it name says disables PoE on all ports. So lets support parsing that GPIO and using the GPIO flags to set it low by default and enable PoE on all ports during probe. Acked-by: Oleksij Rempel <o.rempel@pengutronix.de> Signed-off-by: Robert Marko <robert.marko@sartura.hr> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260607165600.1260210-2-robert.marko@sartura.hr Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09dt-bindings: net: pse-pd: microchip,pd692x0: add port disable GPIORobert Marko
Microchip PSE controllers have a dedicated port disable input that like it name suggest, will disable PoE on all ports. So, lets document that GPIO. Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Robert Marko <robert.marko@sartura.hr> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260607165600.1260210-1-robert.marko@sartura.hr Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09selftests: net: add getsockopt_iter binary to .gitignoreFernando Fernandez Mancera
The generated binary for getsockopt_iter.c shouldn't show up as an untracked git file after running: make -C tools/testing/selftests TARGETS=net install Let's just ignore it. Fixes: d39887f55d8e ("net: selftests: add getsockopt_iter regression tests") Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Link: https://patch.msgid.link/20260608112259.4022-1-fmancera@suse.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09tun: zero the whole vnet header in tun_put_user()Xiang Mei
tun_put_user() declares an on-stack struct virtio_net_hdr_v1_hash_tunnel without zeroing it. For a non-tunnel skb, virtio_net_hdr_tnl_from_skb() only initializes the first 10 bytes (sizeof(struct virtio_net_hdr)), leaving bytes 10..23 (num_buffers and the hash/tunnel fields) as stack garbage. An unprivileged user can set the vnet header size to 24 with TUNSETVNETHDRSZ, so __tun_vnet_hdr_put() copies all 24 bytes of the partially-initialized struct to userspace, leaking 14 bytes of kernel stack on every read of a non-tunnel packet. Fix it the same way tun_get_user() already does by zeroing the whole header right after declaration. Fixes: 288f30435132 ("tun: enable gso over UDP tunnel support.") Reported-by: Weiming Shi <bestswngs@gmail.com> Signed-off-by: Xiang Mei <xmei5@asu.edu> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260607054428.3050243-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completionWeiming Shi
rds_ib_xmit_atomic() always programs a masked atomic opcode (IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD) for every RDS atomic cmsg. But the completion-side switch in rds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked atomic completion falls through to default and returns rm == NULL while send->s_op is left set. rds_ib_send_cqe_handler() then dereferences the NULL rm via rm->m_final_op, oopsing in softirq context. An unprivileged AF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection triggers it; on hardware that natively accepts masked atomics (mlx4, mlx5) no extra setup is needed. RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR! Oops: general protection fault [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282) Call Trace: <IRQ> rds_ib_send_cqe_handler (net/rds/ib_send.c:282) poll_scq (net/rds/ib_cm.c:274) rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294) tasklet_action_common (kernel/softirq.c:943) handle_softirqs (kernel/softirq.c:573) run_ksoftirqd (kernel/softirq.c:479) </IRQ> Kernel panic - not syncing: Fatal exception in interrupt Handle the masked atomic opcodes in the same case as the non-masked ones: they map to the same struct rds_message.atomic union member, so the existing container_of()/rds_ib_send_unmap_atomic() body is correct for them. Fixes: 20c72bd5f5f9 ("RDS: Implement masked atomic operations") Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260606192447.1179255-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: guard timestamp cmsgs to real error queue skbsKyle Zeng
skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET instead of struct sock_exterr_skb. If such an skb is received with timestamping enabled, the generic timestamp cmsg path can read AF_PACKET control-buffer state as sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop counter overlaps opt_stats. An odd drop count makes the path emit SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear skbs this copies past the linear head and can trigger hardened usercopy or disclose adjacent heap contents. Keep skb_is_err_queue() local to net/socket.c, but make it verify that the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal receive ownership and no longer pass as error-queue skbs, while legitimate sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free ownership. Fixes: 8605330aac5a ("tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs") Signed-off-by: Kyle Zeng <kylebot@openai.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260607021819.49698-1-kylebot@openai.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09sctp: validate embedded INIT chunk and address list lengths in cookieXin Long
sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/75af23a89adf881a0895d511775e4770da367cbf.1780873427.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09Merge branch 'net-add-retry-mechanism-to-ndo_set_rx_mode_async'Jakub Kicinski
Stanislav Fomichev says: ==================== net: add retry mechanism to ndo_set_rx_mode_async Original async ndo_set_rx_mode work left one place where we do netdev_WARN in response to a ENOMEM. The intent was to see whether actual real users can hit that (adding uc/mc under memory pressure seems like a very unlikely thing to do). However, it was quickly triggered by syzbot's failslab. Add a retry mechanism and downgrade netdev_WARN to netdev_err. The retry logic is a typical exponential backoff: 1, 2, 4, 8 seconds, 15 in total, hopefully enough for a system to resolve memory pressure. ==================== Link: https://patch.msgid.link/20260608154014.227538-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09ip6_vti: set netns_immutable on the fallback device.Eric Dumazet
john1988 and Noam Rathaus reported that vti6_init_net() does not set the netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0). Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel) correctly set this flag during their fallback device initialization to prevent them from being moved to another network namespace. Fixes: 61220ab34948 ("vti6: Enable namespace changing") Reported-by: Noam Rathaus <noamr@ssd-disclosure.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Steffen Klassert <steffen.klassert@secunet.com> Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Link: https://patch.msgid.link/20260608155918.787644-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09bnxt: convert to core rx_mode retry mechanismStanislav Fomichev
Remove the driver-specific BNXT_STATE_L2_FILTER_RETRY + timer + sp_task retry mechanism and rely on the core stack's ndo_set_rx_mode_async retry instead. bnxt_cfg_rx_mode() now returns errors instead of swallowing them. The PF-unavailable case (-ENODEV from HWRM on a VF) is normalized to -EAGAIN at the boundary so callers can match on a single "retry me" errno without re-implementing the VF/-ENODEV check. Other errors propagate unchanged. This removes: - BNXT_STATE_L2_FILTER_RETRY state bit - BNXT_RX_MASK_SP_EVENT sp_event bit - Retry trigger from bnxt_timer() - BNXT_RX_MASK_SP_EVENT handling from bnxt_sp_task() bnxt_init_chip() still calls bnxt_cfg_rx_mode() directly during open. On a fresh open dev->uc is empty and the call effectively cannot fail on the unicast path. But on FW reset reopen (bnxt_fw_reset_task -> bnxt_open) a VF may have a populated dev->uc and the PF may be transiently unavailable; since that path doesn't go through __dev_open(), the follow-up rx_mode call that would otherwise drive the core retry doesn't fire. On -EAGAIN, swallow the error and call netif_rx_mode_schedule_retry() explicitly. The unicast filter loop truncates vnic->uc_filter_count on failure, so the retry's delta check sees pending work and reinstalls. Cc: Pavan Chebbi <pavan.chebbi@broadcom.com> Signed-off-by: Stanislav Fomichev <sdf@fomichev.me> Reviewed-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260608154014.227538-4-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: add retry mechanism to ndo_set_rx_mode_asyncStanislav Fomichev
When ndo_set_rx_mode_async returns an error, schedule a retry with exponential backoff (1s, 2s, 4s, 8s -- 15s total). Give up after the 4th retry and log an error via netdev_err(). This moves retry logic from individual drivers into the core stack. Timer callback does not hold a ref on dev. Safe because the timer can only be armed when dev is IFF_UP, and __dev_close_many runs timer_delete_sync before clearing IFF_UP. Unregister always closes IFF_UP devices first, so by the time dev can be freed the timer is dead and cannot be re-armed. Reviewed-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20260608154014.227538-3-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: change ndo_set_rx_mode_async return type to intStanislav Fomichev
Change the return type of ndo_set_rx_mode_async from void to int to allow drivers to report failures back to the core stack. This is a prerequisite for adding retry logic in the core when drivers fail to program RX filters (e.g. bnxt VF when PF is unavailable). All existing implementations return 0 for now, maintaining current behavior. Signed-off-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20260608154014.227538-2-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09sctp: fix uninit-value in __sctp_rcv_asconf_lookup()Michael Bommarito
__sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 ("net: sctp: fix KMSAN uninit-value in sctp_inq_pop"). Fixes: df2185771439 ("[SCTP]: Update association lookup to look at ASCONF chunks as well") Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Acked-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/20260608122234.459098-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09atm: drv: Replace strcpy() + strlcat() with snprintf()David Laight
Avoid string function that are due to be deprecated. Signed-off-by: David Laight <david.laight.linux@gmail.com> Link: https://patch.msgid.link/20260608095523.2606-36-david.laight.linux@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: eth: benet: Use strscpy() to copy strings into arraysDavid Laight
Replacing strcpy() with strscpy() ensures that overflow of the target buffer cannot happen. Signed-off-by: David Laight <david.laight.linux@gmail.com> Link: https://patch.msgid.link/20260608095500.2567-4-david.laight.linux@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queriesErni Sri Satya Vennela
mana_query_link_cfg() sends an HWC command to firmware on every call, but the link speed and QoS values it returns only change when the driver explicitly calls mana_set_bw_clamp(). This function is called not only by userspace via ethtool get_link_ksettings, but also periodically by hv_netvsc through netvsc_get_link_ksettings and by the sysfs speed_show attribute via dev_attr_show, resulting in unnecessary HWC traffic every few minutes. Add a link_cfg_error field to mana_port_context to cache the query result. The field uses three states: 1 (not yet queried, initial value set during mana_probe_port), 0 (success, speed/max_speed are valid), or a negative errno for permanent errors like -EOPNOTSUPP when the hardware does not support the command. Transient errors and qos_unconfigured responses are not cached so that subsequent calls will retry. MANA is ops-locked because it implements net_shaper_ops, so the core already takes netdev_lock() around all ethtool_ops and net_shaper_ops entry points. Reuse that lock to serialize mana_query_link_cfg() and mana_set_bw_clamp(). This prevents a concurrent mana_set_bw_clamp() from racing with an in-flight query and publishing stale pre-clamp speed/max_speed. Invalidate the cache inside mana_set_bw_clamp() on success, so all current and future callers that change the link configuration automatically trigger a fresh query on the next mana_query_link_cfg() call. Also reset link_cfg_error during resume in mana_probe() under netdev_lock(), so that any query already in flight cannot later store 0 and silently overwrite the post-resume invalidation. Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com> Link: https://patch.msgid.link/20260606133301.2180073-1-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: mscc: ocelot: validate netdev belongs to switch in .netdev_to_port()David Yang
The .netdev_to_port() currently takes only a net_device and returns the port index, without verifying the netdev actually belongs to the switch being operated on. This can cause flower rule parsing to silently resolve to a wrong port on the local hardware. Update both implementations felix_netdev_to_port() and ocelot_netdev_to_port() to validate ownership. Also update the callers in ocelot_flower.c to pass through the ocelot context. Signed-off-by: David Yang <mmyangfl@gmail.com> Link: https://patch.msgid.link/20260606125247.305167-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09bnxt_en: Fix NULL pointer dereferenceKyle Meyer
PCIe errors detected by a Root Port or Downstream Port cause error recovery services to run on all subordinate devices regardless of administrative state. The .error_detected() callback, bnxt_io_error_detected(), disables and synchronizes IRQs via bnxt_disable_int_sync(), which calls bnxt_cp_num_to_irq_num() to map completion rings to IRQs using bp->bnapi. Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe error recovery on a closed NIC can dereference a NULL pointer. Check if bp->bnapi is NULL before disabling and synchronizing IRQs. Fixes: e5811b8c09df ("bnxt_en: Add IRQ remapping logic.") Cc: stable@vger.kernel.org Signed-off-by: Kyle Meyer <kyle.meyer@hpe.com> Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Link: https://patch.msgid.link/aiNM1CY2-StPilxW@hpe.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: mana: Add support for PF device 0x00C1Haiyang Zhang
Update the device id table to include the new device id 0x00C1. This device's BAR layout is similar to VF's, update the function, mana_gd_init_registers(), accordingly. Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com> Link: https://patch.msgid.link/20260605212302.2135499-1-haiyangz@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: qca8k: Add support for force mode for fixed link topologyGeorge Moussalem
A fixed link topology is commonly used to connect this switch (on port 0 or 6) to a SoC's MAC over SGMII. When inband negotiation is not used, the switch needs to be configured to operate in force mode. As such, enable support for force mode. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: George Moussalem <george.moussalem@outlook.com> Link: https://patch.msgid.link/20260605-qca8337-force-mode-v2-1-d9a6b6545bfa@outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09Merge branch 'add-motorcomm-8531s-set-ds-func-and-8522-driver'Jakub Kicinski
Minda Chen says: ==================== Add motorcomm 8531s set ds func and 8522 driver This patch is for Starfive JHB100 EVB board. JHB100 contain 1 RGMII/RMII and 1 RMII synopsys GMAC cores. In the EVB board, RGMII interface connect with YT8531s Ethernet PHY. RMII interface connect with YT8522 ethernet PHY. So patch 1-2 is for RGMII interface patch 3 is RMII is for RMII interface. JHB100 is a Starfive new RISC-V SoC for datacenter BMC (BaseBoard Managent Controller). Similar with Aspeed 27x0. The JHB100 minimal system upstream is in progress: https://patchwork.kernel.org/project/linux-riscv/cover/20260508053632.818548-1-changhuang.liang@starfivetech.com/ ==================== Link: https://patch.msgid.link/20260605060212.41895-1-minda.chen@starfivetech.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: phy: motorcomm: Add YT8522 100M RMII PHY supportMinda Chen
Add YT8522 100M RMII ethernet PHY base driver support, including PHY ID and base config init function. Signed-off-by: Minda Chen <minda.chen@starfivetech.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260605060212.41895-4-minda.chen@starfivetech.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: motorcomm: phy: set drive strength in YT8531s RGMIIMinda Chen
Set RXD and RX CLK pin drive strength while in YT8531s connect with RGMII. Need to check 8531s PHY ID because 8521 and 8531s pin drive strength is different, 8521 can not call yt8531_set_ds(). Signed-off-by: Minda Chen <minda.chen@starfivetech.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260605060212.41895-3-minda.chen@starfivetech.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: phy: motorcomm: move mdio lock out from yt8531_set_ds()Minda Chen
yt8531_set_ds() default set register with mdio lock and only called with YT8531 PHY. But new type YT8531s support RGMII and has the same pin strength setting with YT8531, YT8531s need to call yt8531_set_ds() setting pin drive strength. But YT8531s config init function yt8521_config_init() already get the mdio lock with phy_select_page(). If calling yt8521_config_init() with mdio lock will cause dead lock. Need to get the lock before calling yt8531_set_ds() and move mdio lock out from it for YT8531s. Signed-off-by: Minda Chen <minda.chen@starfivetech.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260605060212.41895-2-minda.chen@starfivetech.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09sctp: stream: fully roll back denied add-stream stateWyatt Feng
When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions. Fixes: 637784ade221 ("sctp: introduce priority based stream scheduler") Cc: stable@kernel.org Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Reported-by: Zhengchuan Liang <zcliangcn@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Acked-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/d78954ecd94954653ee299400e98d74a03a6f7d3.1780603399.git.bronzed_45_vested@icloud.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09Merge branch 'mana-per-vport-eq'Jakub Kicinski
Long Li says: ==================== net: mana: Per-vPort EQ and MSI-X management This series moves EQ ownership from the shared mana_context to per-vPort mana_port_context, enabling each vPort to have dedicated MSI-X vectors when the hardware provides enough vectors. When vectors are limited, the driver falls back to sharing MSI-X among vPorts. The series introduces a GDMA IRQ Context (GIC) abstraction with reference counting to manage interrupt context lifecycle. This allows both Ethernet and RDMA EQs to dynamically acquire dedicated or shared MSI-X vectors at vPort creation time rather than pre-allocating all vectors at probe time. ==================== Link: https://patch.msgid.link/20260605005717.2059954-1-longli@microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09RDMA/mana_ib: Allocate interrupt contexts on EQsLong Li
Use the GIC functions to allocate interrupt contexts for RDMA EQs. These interrupt contexts may be shared with Ethernet EQs when MSI-X vectors are limited. The driver now supports allocating dedicated MSI-X for each EQ. Indicate this capability through driver capability bits. The RDMA EQs pass use_msi_bitmap=false to share MSI-X vectors with Ethernet, while the capability flag advertises that the driver supports per-vPort EQ separation when hardware has sufficient vectors. Populate eq.irq on all RDMA EQs for consistency with the Ethernet path. Also relocate the GDMA_DRV_CAP_FLAG_1_HW_VPORT_LINK_AWARE define to its numeric BIT(6) position among the other capability flags. Signed-off-by: Long Li <longli@microsoft.com> Acked-by: Leon Romanovsky <leon@kernel.org> Link: https://patch.msgid.link/20260605005717.2059954-7-longli@microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: mana: Allocate interrupt context for each EQ when creating vPortLong Li
Use GIC functions to create a dedicated interrupt context or acquire a shared interrupt context for each EQ when setting up a vPort. The caller now owns the GIC reference across the EQ create/destroy lifecycle: mana_create_eq() calls mana_gd_get_gic() before creating each EQ and mana_destroy_eq() calls mana_gd_put_gic() after destroying it. The msix_index invalidation is moved from mana_gd_deregister_irq() to the mana_gd_create_eq() error path so that mana_destroy_eq() can read the index before teardown. Signed-off-by: Long Li <longli@microsoft.com> Link: https://patch.msgid.link/20260605005717.2059954-6-longli@microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: mana: Use GIC functions to allocate global EQsLong Li
Replace the GDMA global interrupt setup code with the new GIC allocation and release functions for managing interrupt contexts. This changes the per-queue interrupt names in /proc/interrupts from mana_q0, mana_q1, ... to mana_msi1, mana_msi2, ... to reflect the MSI-X index rather than a zero-based queue number. The HWC interrupt name (mana_hwc) is unchanged. Signed-off-by: Long Li <longli@microsoft.com> Link: https://patch.msgid.link/20260605005717.2059954-5-longli@microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: mana: Introduce GIC context with refcounting for interrupt managementLong Li
To allow Ethernet EQs to use dedicated or shared MSI-X vectors and RDMA EQs to share the same MSI-X, introduce a GIC (GDMA IRQ Context) with reference counting. This allows the driver to create an interrupt context on an assigned or unassigned MSI-X vector and share it across multiple EQ consumers. Signed-off-by: Long Li <longli@microsoft.com> Link: https://patch.msgid.link/20260605005717.2059954-4-longli@microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: mana: Query device capabilities and configure MSI-X sharing for EQsLong Li
When querying the device, adjust the max number of queues to allow dedicated MSI-X vectors for each vPort. The per-vPort queue count is clamped towards MANA_DEF_NUM_QUEUES but will not exceed the hardware maximum reported by the device. MSI-X sharing among vPorts is enabled when there are not enough MSI-X vectors for dedicated allocation, or when the platform does not support dynamic MSI-X allocation (in which case all vectors are pre-allocated at probe time and sharing is always used). The msi_sharing flag is reset at the top of mana_gd_query_max_resources() so it is recomputed from current hardware state on each probe or resume cycle. Clamp apc->max_queues to gc->max_num_queues_vport in mana_init_port() so that on resume, if max_num_queues_vport has decreased due to fewer MSI-X vectors, num_queues is reduced accordingly before EQ allocation. A device reporting zero ports now results in a fatal probe error since the per-vPort MSI-X math requires at least one port. Rename mana_query_device_cfg() to mana_gd_query_device_cfg() as it is used at GDMA device probe time for querying device capabilities. Signed-off-by: Long Li <longli@microsoft.com> Link: https://patch.msgid.link/20260605005717.2059954-3-longli@microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: mana: Create separate EQs for each vPortLong Li
To prepare for assigning vPorts to dedicated MSI-X vectors, remove EQ sharing among the vPorts and create dedicated EQs for each vPort. Move the EQ definition from struct mana_context to struct mana_port_context and update related support functions. Export mana_create_eq() and mana_destroy_eq() for use by the MANA RDMA driver. RSS QPs now take a vport reference via pd->vport_use_count to ensure EQs outlive all QP consumers. The vport must already be configured by a raw QP before an RSS QP can be created. EQs are only destroyed when the last QP (raw or RSS) on the PD releases its reference. Restrict each vport to a single RSS QP. The hardware only supports one steering configuration (indirection table / hash key) per vport, and mana_disable_vport_rx() on QP destroy disables RX globally for the vport. Previously, creating a second RSS QP would silently overwrite the first QP's steering config and destroy would blackhole all traffic. This is now explicitly rejected with -EBUSY. Existing applications (DPDK being the primary RDMA consumer) always create one RSS QP per vport, so no real-world flows are affected. Reject cross-port PD sharing for both raw and RSS QPs. Since EQs and vport configuration are per-port, a PD is bound to the port used by its first raw QP. Subsequent QPs on the same PD must use the same port or the creation fails with -EINVAL. Previously this was silently broken: with shared EQs it appeared to work, but with per-vPort EQs a cross-port PD would cause wrong-port EQ teardown and corruption. DPDK creates one PD per port so no existing flows are affected. Serialize mana_set_channels() and the async per-port queue reset handler against RDMA vport configuration to prevent RDMA from claiming the vport during the detach/attach window. A channel_changing flag is set under apc->vport_mutex before detach and checked by mana_cfg_vport() when called from the RDMA path, blocking RDMA from grabbing the vport during the entire window. When the port is down and RDMA already holds the vport, the channel change is rejected with -EBUSY. Signed-off-by: Long Li <longli@microsoft.com> Link: https://patch.msgid.link/20260605005717.2059954-2-longli@microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09Merge tag 'trace-rv-v7.1-rc6-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull runtime verifier fixes from Steven Rostedt: - Fix reset ordering on per-task destruction Reset the task before dropping the slot instead of after, which was causing out-of-bound memory accesses. - Fix HA monitor synchronization and cleanup Ensure synchronous cleanup for HA monitors by running timer callbacks in RCU read-side critical sections and using synchronize_rcu() during destruction. - Avoid armed timers after tasks exit Add automatic cleanup for per-task HA monitors to prevent timers from firing after task exit. - Fix memory ordering for DA/HA monitors Fix race conditions during monitor start by using release-acquire semantics for the monitoring flag. - Fix initialization for DA/HA monitors Ensure monitors are not initialized relying on potentially corrupted state like the monitoring flag, that is not reset by all monitors type and may have an unknown state in monitors reusing the storage (per-task). - Fix memory safety in per-task and per-object monitors Prevent use-after-free and out-of-bounds access by synchronizing with in-flight tracepoint probes using tracepoint_synchronize_unregister() before freeing monitor storage or releasing task slots. - Adjust monitors for preemptible tracepoints Fix monitors that relied on tracepoints disabling preemption. Explicitly disable task migration when per-CPU monitors handle events to avoid accessing the wrong state and update the opid monitor logic. - Fix incorrect __user specifier usage Remove __user from a non-pointer variable in the extract_params() helper. - Fix bugs in the rv tool Ensure strings are NUL-terminated, fix substring matching in monitor searches, and improve cleanup and exit status handling. - Fix several bugs in rvgen Fix LTL literal stringification, subparsers' options handling, and suffix stripping in dot2k. * tag 'trace-rv-v7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: verification/rvgen: Fix ltl2k writing True as a literal verification/rvgen: Fix options shared among commands verification/rvgen: Fix suffix strip in dot2k tools/rv: Fix cleanup after failed trace setup tools/rv: Fix substring match when listing container monitors tools/rv: Fix substring match bug in monitor name search tools/rv: Ensure monitor name and desc are NUL-terminated rv: Use 0 to check preemption enabled in opid rv: Prevent task migration while handling per-CPU events rv: Ensure synchronous cleanup for HA monitors rv: Add automatic cleanup handlers for per-task HA monitors rv: Do not rely on clean monitor when initialising HA rv: Fix monitor start ordering and memory ordering for monitoring flag rv: Ensure all pending probes terminate on per-obj monitor destroy rv: Prevent in-flight per-task handlers from using invalid slots rv: Reset per-task DA monitors before releasing the slot rv: Fix __user specifier usage in extract_params()
2026-06-09net: ncsi: Set ncsi_stop_dev() to inline while NET_NCSI not enabledMinda Chen
While NET_NCSI not enabled, ncsi_stop_dev() is not inline and call with it, casue compile waring: linux/include/net/ncsi.h:63:13: warning: 'ncsi_stop_dev' defined but not used [-Wunused-function] static void ncsi_stop_dev(struct ncsi_dev *nd) Setting ncsi_stop_dev() to inline like other function to remove compile warnings. Signed-off-by: Minda Chen <minda.chen@starfivetech.com> Link: https://patch.msgid.link/20260605033607.37630-1-minda.chen@starfivetech.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09Merge tag 'trace-tools-v7.1-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull RTLA fix from Steven Rostedt: - Fix multi-character short option parsing Fix regression in parsing of multiple-character short options (eg -p100 /= -p 100/, -un /= -u -n/) caused by getopt_long() internal state corruption after a refactoring. * tag 'trace-tools-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla: Fix parsing of multi-character short options