summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-14devlink: expose devlink instance index over netlinkJiri Pirko
Each devlink instance has an internally assigned index used for xarray storage. Expose it as a new DEVLINK_ATTR_INDEX uint attribute alongside the existing bus_name and dev_name handle. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260312100407.551173-2-jiri@resnulli.us Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14Merge tag 'rust-fixes-7.0-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Remap paths to avoid absolute ones starting with the upcoming Rust 1.95.0 release. This improves build reproducibility, avoids leaking the exact path and avoids having the same path appear in two forms The approach here avoids remapping debug information as well, in order to avoid breaking tools that used the paths to access source files, which was the previous attempt that needed to be reverted - Allow 'unused_features' lint for the upcoming Rust 1.96.0 release. While well-intentioned, we do not benefit much from the new lint - Emit dependency information into '$(depfile)' directly to avoid a temporary '.d' file (it was an old approach) 'kernel' crate: - 'str' module: fix warning under '!CONFIG_BLOCK' by making 'NullTerminatedFormatter' public - 'cpufreq' module: suppress false positive Clippy warning 'pin-init' crate: - Remove '#[disable_initialized_field_access]' attribute which was unsound. This means removing the support for structs with unaligned fields (through the 'repr(packed)' attribute), for now And document the load-bearing fact of field accessors (i.e. that they are required for soundness) - Replace shadowed return token by 'unsafe'-to-create token in order to remain sound in the face of the likely upcoming Type Alias Impl Trait (TAIT) and the next trait solver in upstream Rust" * tag 'rust-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: kbuild: allow `unused_features` rust: cpufreq: suppress clippy::double_parens in Policy doctest rust: pin-init: replace shadowed return token by `unsafe`-to-create token rust: pin-init: internal: init: document load-bearing fact of field accessors rust: pin-init: internal: init: remove `#[disable_initialized_field_access]` rust: build: remap path to avoid absolute path rust: kbuild: emit dep-info into $(depfile) directly rust: str: make NullTerminatedFormatter public
2026-03-14Merge branch 'net-phy-further-decouple-provider-from-consumer-part'Jakub Kicinski
Heiner Kallweit says: ==================== net: phy: further decouple provider from consumer part This series aims at further decoupling the provider and consumer part in phylib. ==================== Link: https://patch.msgid.link/9d5724bc-e525-4f8f-b3f8-b16dd5a1164e@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: phy: move remaining provider code to mdio_bus_provider.cHeiner Kallweit
This moves definition of mdio_bus class and bus_type to the provider side, what allows to make them private to libphy. As a prerequisite MDIO statistics handling is moved to the provider side as well. Note: This patch causes a checkpatch error "Macros with complex values should be enclosed in parentheses" for MDIO_BUS_STATS_ADDR_ATTR_GROUP. I consider this a false positive here, in addition the patch just moves existing code. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/47b85676-b349-4aa0-a5ef-cd37769a4c69@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: phy: move registering mdio_bus_class and mdio_bus_type to libphyHeiner Kallweit
The MDIO consumer side shouldn't register class and bus_type. Therefore move this to libphy. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/b15b378a-fda2-44b9-9d63-bf82919b71b2@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: phy: move (of_)mdio_find_bus to mdio_bus_provider.cHeiner Kallweit
Functionality outside libphy shouldn't access mdio_bus_class directly. So move both functions to the provider side. This is a step towards making mdio_bus_class private to libphy. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/b6161c64-68ac-4524-82ec-5b7d81b86dbc@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: phy: make mdio_device.c part of libphyHeiner Kallweit
This patch - makes mdio_device.c part of libphy - makes mdio_device_(un)register_reset() static - moves mdiobus_(un)register_device() from mdio_bus.c to mdio_device.c, stops exporting both functions and makes them private to phylib This further decouples the MDIO consumer functionality from libphy. Note: This makes MDIO driver registration part of phylib, therefore adjust Kconfig dependencies where needed. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/c6dbf9b3-3ca0-434b-ad3a-71fe602ab809@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: phy: move mdio_device reset handling functions in the codeHeiner Kallweit
In preparation of a follow-up patch this moves reset-related functions in the code. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/8ea1a929-33b8-49ee-afe6-355f5a7d2bd1@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: usb: cdc-ether: unify error handling in probeOliver Neukum
usbnet_generic_cdc_bind() is duplicating the error handling multiple times. That is bad. Unify it with jumps. V2: Update error logging with every cause a unique message Signed-off-by: Oliver Neukum <oneukum@suse.com> Link: https://patch.msgid.link/20260312084612.1469853-1-oneukum@suse.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14Merge branch ↵Jakub Kicinski
'net-macb-fix-ethernet-malfunction-on-amd-versal-board-after-suspend' Kevin Hao says: ==================== net: macb: Fix Ethernet malfunction on AMD Versal board after suspend On Versal boards, the tx/rx queue pointer registers are cleared after suspend, which causes Ethernet malfunction. This patch series addresses this issue by reinitializing the tx/rx queue pointer registers and the rx ring. ==================== Link: https://patch.msgid.link/20260312-macb-versal-v1-0-467647173fa4@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resumeKevin Hao
On certain platforms, such as AMD Versal boards, the tx/rx queue pointer registers are cleared after suspend, and the rx queue pointer register is also disabled during suspend if WOL is enabled. Previously, we assumed that these registers would be restored by macb_mac_link_up(). However, in commit bf9cf80cab81, macb_init_buffers() was moved from macb_mac_link_up() to macb_open(). Therefore, we should call macb_init_buffers() to reinitialize the tx/rx queue pointer registers during resume. Due to the reset of these two registers, we also need to adjust the tx/rx rings accordingly. The tx ring will be handled by gem_shuffle_tx_rings() in macb_mac_link_up(), so we only need to initialize the rx ring here. Fixes: bf9cf80cab81 ("net: macb: Fix tx/rx malfunction after phy link down and up") Reported-by: Quanyang Wang <quanyang.wang@windriver.com> Signed-off-by: Kevin Hao <haokexin@gmail.com> Tested-by: Quanyang Wang <quanyang.wang@windriver.com> Cc: stable@vger.kernel.org Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260312-macb-versal-v1-2-467647173fa4@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: macb: Introduce gem_init_rx_ring()Kevin Hao
Extract the initialization code for the GEM RX ring into a new function. This change will be utilized in a subsequent patch. No functional changes are introduced. Signed-off-by: Kevin Hao <haokexin@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260312-macb-versal-v1-1-467647173fa4@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy modeMeghana Malladi
Page recycling was removed from the XDP_DROP path in emac_run_xdp() to avoid conflicts with AF_XDP zero-copy mode, which uses xsk_buff_free() instead. However, this causes a memory leak when running XDP programs that drop packets in non-zero-copy mode (standard page pool mode). The pages are never returned to the page pool, leading to OOM conditions. Fix this by handling cleanup in the caller, emac_rx_packet(). When emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP, the caller now recycles the page back to the page pool. The zero-copy path, emac_rx_packet_zc() already handles cleanup correctly with xsk_buff_free(). Fixes: 7a64bb388df3 ("net: ti: icssg-prueth: Add AF_XDP zero copy for RX") Signed-off-by: Meghana Malladi <m-malladi@ti.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260311095441.1691636-1-m-malladi@ti.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14lib/crypto: x86/sha256: PHE Extensions optimized SHA256 transform functionAlanSong-oc
Zhaoxin CPUs have implemented the SHA(Secure Hash Algorithm) as its CPU instructions by PHE(Padlock Hash Engine) Extensions, including XSHA1, XSHA256, XSHA384 and XSHA512 instructions. The instruction specification is available at the following link. (https://gitee.com/openzhaoxin/zhaoxin_specifications/blob/20260227/ZX_Padlock_Reference.pdf) With the help of implementation of SHA in hardware instead of software, can develop applications with higher performance, more security and more flexibility. This patch includes the XSHA256 instruction optimized implementation of SHA-256 transform function. The table below shows the benchmark results before and after applying this patch by using CRYPTO_LIB_BENCHMARK on Zhaoxin KX-7000 platform, highlighting the achieved speedups. +---------+--------------------------+ | | SHA256 | +---------+--------+-----------------+ | Len | Before | After | +---------+--------+-----------------+ | 1* | 2 | 7 (3.50x) | | 16 | 35 | 119 (3.40x) | | 64 | 74 | 280 (3.78x) | | 127 | 99 | 387 (3.91x) | | 128 | 103 | 427 (4.15x) | | 200 | 123 | 537 (4.37x) | | 256 | 128 | 582 (4.55x) | | 511 | 144 | 679 (4.72x) | | 512 | 146 | 714 (4.89x) | | 1024 | 157 | 796 (5.07x) | | 3173 | 167 | 883 (5.28x) | | 4096 | 166 | 876 (5.28x) | | 16384 | 169 | 899 (5.32x) | +---------+--------+-----------------+ *: The length of each data block to be processed by one complete SHA sequence. **: The throughput of processing data blocks, unit is Mb/s. After applying this patch, the SHA256 KUnit test suite passes on Zhaoxin platforms. Detailed test logs are shown below. [ 7.767257] # Subtest: sha256 [ 7.770542] # module: sha256_kunit [ 7.770544] 1..15 [ 7.777383] ok 1 test_hash_test_vectors [ 7.788563] ok 2 test_hash_all_lens_up_to_4096 [ 7.806090] ok 3 test_hash_incremental_updates [ 7.813553] ok 4 test_hash_buffer_overruns [ 7.822384] ok 5 test_hash_overlaps [ 7.829388] ok 6 test_hash_alignment_consistency [ 7.833843] ok 7 test_hash_ctx_zeroization [ 7.915191] ok 8 test_hash_interrupt_context_1 [ 8.362312] ok 9 test_hash_interrupt_context_2 [ 8.401607] ok 10 test_hmac [ 8.415458] ok 11 test_sha256_finup_2x [ 8.419397] ok 12 test_sha256_finup_2x_defaultctx [ 8.424107] ok 13 test_sha256_finup_2x_hugelen [ 8.451289] # benchmark_hash: len=1: 7 MB/s [ 8.465372] # benchmark_hash: len=16: 119 MB/s [ 8.481760] # benchmark_hash: len=64: 280 MB/s [ 8.499344] # benchmark_hash: len=127: 387 MB/s [ 8.515800] # benchmark_hash: len=128: 427 MB/s [ 8.531970] # benchmark_hash: len=200: 537 MB/s [ 8.548241] # benchmark_hash: len=256: 582 MB/s [ 8.564838] # benchmark_hash: len=511: 679 MB/s [ 8.580872] # benchmark_hash: len=512: 714 MB/s [ 8.596858] # benchmark_hash: len=1024: 796 MB/s [ 8.612567] # benchmark_hash: len=3173: 883 MB/s [ 8.628546] # benchmark_hash: len=4096: 876 MB/s [ 8.644482] # benchmark_hash: len=16384: 899 MB/s [ 8.649773] ok 14 benchmark_hash [ 8.655505] ok 15 benchmark_sha256_finup_2x # SKIP not relevant [ 8.659065] # sha256: pass:14 fail:0 skip:1 total:15 [ 8.665276] # Totals: pass:14 fail:0 skip:1 total:15 [ 8.670195] ok 7 sha256 Signed-off-by: AlanSong-oc <AlanSong-oc@zhaoxin.com> Link: https://lore.kernel.org/r/20260313080150.9393-3-AlanSong-oc@zhaoxin.com Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-03-14crypto: padlock-sha - Disable for Zhaoxin processorAlanSong-oc
For Zhaoxin processors, the XSHA1 instruction requires the total memory allocated at %rdi register must be 32 bytes, while the XSHA1 and XSHA256 instruction doesn't perform any operation when %ecx is zero. Due to these requirements, the current padlock-sha driver does not work correctly with Zhaoxin processors. It cannot pass the self-tests and therefore does not activate the driver on Zhaoxin processors. This issue has been reported in Debian [1]. The self-tests fail with the following messages [2]: alg: shash: sha1-padlock-nano test failed (wrong result) on test vector 0, cfg="init+update+final aligned buffer" alg: self-tests for sha1 using sha1-padlock-nano failed (rc=-22) alg: shash: sha256-padlock-nano test failed (wrong result) on test vector 0, cfg="init+update+final aligned buffer" alg: self-tests for sha256 using sha256-padlock-nano failed (rc=-22) Disable the padlock-sha driver on Zhaoxin processors with the CPU family 0x07 and newer. Following the suggestion in [3], support for PHE will be added to lib/crypto/ instead. [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1113996 [2] https://linux-hardware.org/?probe=271fabb7a4&log=dmesg [3] https://lore.kernel.org/linux-crypto/aUI4CGp6kK7mxgEr@gondor.apana.org.au/ Fixes: 63dc06cd12f9 ("crypto: padlock-sha - Use API partial block handling") Cc: stable@vger.kernel.org Signed-off-by: AlanSong-oc <AlanSong-oc@zhaoxin.com> Link: https://lore.kernel.org/r/20260313080150.9393-2-AlanSong-oc@zhaoxin.com Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-03-14net: mdio: remove selecting FIXED_PHY for FWNODE_MDIOHeiner Kallweit
Fwnode MDIO has never used the fixed PHY code, therefore don't select symbol FIXED_PHY. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/880ca62b-a5d3-4865-bbce-2d2210928239@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering ↵Dipayaan Roy
teardown A potential race condition exists in mana_hwc_destroy_channel() where hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt handler to dereference freed memory, leading to a use-after-free or NULL pointer dereference in mana_hwc_handle_resp(). mana_smc_teardown_hwc() signals the hardware to stop but does not synchronize against IRQ handlers already executing on other CPUs. The IRQ synchronization only happens in mana_hwc_destroy_cq() via mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler() can dereference freed caller_ctx (and rxq->msg_buf) in mana_hwc_handle_resp(). Fix this by reordering teardown to reverse-of-creation order: destroy the TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This ensures all in-flight interrupt handlers complete before the memory they access is freed. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/abHA3AjNtqa1nx9k@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14selftests/arm64: Implement cmpbr_sigill() to hwcap testYifan Wu
The function executes a CBEQ instruction which is valid if the CPU supports the CMPBR extension. The CBEQ branches to skip the following UDF instruction, and no SIGILL is generated. Otherwise, it will generate a SIGILL. Signed-off-by: Yifan Wu <wuyifan50@huawei.com> Reviewed-by: Mark Brown <broonie@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-14ipv4: validate IPV4_DEVCONF attributes properlyFernando Fernandez Mancera
As the IPV4_DEVCONF netlink attributes are not being validated, it is possible to use netlink to set read-only values like mc_forwarding. In addition, valid ranges are not being validated neither but that is less relevant as they aren't in sysctl. To avoid similar situations in the future, define a NLA policy for IPV4_DEVCONF attributes which are nested in IFLA_INET_CONF. Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Link: https://patch.msgid.link/20260312142637.5704-1-fmancera@suse.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14Merge tag 'usb-7.0-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here is a large chunk of USB driver fixes for 7.0-rc4. Included in here are: - usb gadget reverts due to reported issues, and then a follow-on fix to hopefully resolve the reported overall problem - xhci driver fixes - dwc3 driver fixes - usb core "killable" bulk message api addition to fix a usbtmc driver bug where userspace could hang the driver for forever - small USB driver fixes for reported issues - new usb device quirks All except the last USB device quirk change have been in linux-next with no reported issues. That one came in too late, and is 'obviously correct' :)" * tag 'usb-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (35 commits) USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed usb: roles: get usb role switch from parent only for usb-b-connector Revert "tcpm: allow looking for role_sw device in the main node" usb: gadget: f_ncm: Fix net_device lifecycle with device_move Revert "usb: gadget: u_ether: add gether_opts for config caching" Revert "usb: gadget: u_ether: use <linux/hex.h> header file" Revert "usb: gadget: u_ether: Add auto-cleanup helper for freeing net_device" Revert "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind" Revert "usb: legacy: ncm: Fix NPE in gncm_bind" Revert "usb: gadget: f_ncm: Fix atomic context locking issue" usb: typec: altmode/displayport: set displayport signaling rate in configure message usb: dwc3: pci: add support for the Intel Nova Lake -H usb/core/quirks: Add Huawei ME906S-device to wakeup quirk usb: gadget: uvc: fix interval_duration calculation xhci: Fix NULL pointer dereference when reading portli debugfs files usb: xhci: Prevent interrupt storm on host controller error (HCE) usb: xhci: Fix memory leak in xhci_disable_slot() usb: class: cdc-wdm: fix reordering issue in read code path usb: renesas_usbhs: fix use-after-free in ISR during device removal usb: cdc-acm: Restore CAP_BRK functionnality to CH343 ...
2026-03-14net: stmmac: avoid passing pci_devRussell King (Oracle)
The pci_dev is only used to provide the ethtool bus_info using pci_name(priv->plat->pdev). This is the same as dev_name(priv->device). Thus, rather than passing the pci_dev, make use of what we already have. To avoid unexpectedly exposing the device name through ethtool where it wasn't provided before, add a flag priv->plat->provide_bus_info to enable this, which only dwmac-intel needs to set. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/E1w0evI-0000000CzY7-1fyo@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: bcmgenet: increase WoL poll timeoutJustin Chen
Some systems require more than 5ms to get into WoL mode. Increase the timeout value to 50ms. Fixes: c51de7f3976b ("net: bcmgenet: add Wake-on-LAN support code") Signed-off-by: Justin Chen <justin.chen@broadcom.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://patch.msgid.link/20260312191852.3904571-1-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14Merge tag 'char-misc-7.0-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc / IIO driver fixes from Greg KH: "Here are some char/misc/iio/binder fixes for 7.0-rc4. Nothing major in here, just the usual: - lots of iio driver fixes for reported issues - rust binder fixes for problems found - gpib driver binding to the wrong device fix - firmware driver fix All of these have been in linux-next with no reported issues" * tag 'char-misc-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (28 commits) gpib: lpvo_usb: fix unintended binding of FTDI 8U232AM devices firmware: stratix10-svc: Add Multi SVC clients support rust_binder: use lock_vma_under_rcu() in use_page_slow() rust_binder: call set_notification_done() without proc lock rust_binder: avoid reading the written value in offsets array rust_binder: check ownership before using vma rust_binder: fix oneway spam detection firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled iio: imu: adis: Fix NULL pointer dereference in adis_init iio: imu: inv_icm45600: fix regulator put warning when probe fails iio: buffer: Fix wait_queue not being removed iio: gyro: mpu3050-core: fix pm_runtime error handling iio: gyro: mpu3050-i2c: fix pm_runtime error handling iio: adc: ad7768-1: Fix ERR_PTR dereference in ad7768_fill_scale_tbl iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() iio: magnetometer: tlv493d: remove erroneous shift in X-axis data iio: proximity: hx9023s: Protect against division by zero in set_samp_freq iio: proximity: hx9023s: fix assignment order for __counted_by iio: chemical: bme680: Fix measurement wait duration calculation ...
2026-03-14Merge tag 'staging-7.0-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are three small staging driver fixes for 7.0-rc4 that resolve some reported problems. They are: - two rtl8723bs data validation bugfixes - sm750fb removal path bugfix All of these have been in linux-next for many weeks with no reported issues" * tag 'staging-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() staging: sm750fb: add missing pci_release_region on error and removal
2026-03-14riscv: dts: thead: lichee-pi-4a: enable HDMIIcenowy Zheng
Lichee Pi 4A board features a HDMI Type-A connector connected to the HDMI TX controller of TH1520 SoC. Add a device tree node describing the connector, connect it to the HDMI controller, and enable everything on this display pipeline. Signed-off-by: Icenowy Zheng <uwu@icenowy.me> Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Tested-by: Han Gao <gaohan@iscas.ac.cn> Tested-by: Michal Wilczynski <m.wilczynski@samsung.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Reviewed-by: Drew Fustini <fustini@kernel.org> Signed-off-by: Drew Fustini <fustini@kernel.org>
2026-03-14riscv: dts: thead: add DPU and HDMI device tree nodesIcenowy Zheng
T-Head TH1520 SoC contains a Verisilicon DC8200 display controller (called DPU in manual) and a Synopsys DesignWare HDMI TX controller. Add device tree nodes to them. Signed-off-by: Icenowy Zheng <uwu@icenowy.me> Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Tested-by: Han Gao <gaohan@iscas.ac.cn> Tested-by: Michal Wilczynski <m.wilczynski@samsung.com> Reviewed-by: Drew Fustini <fustini@kernel.org> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Drew Fustini <fustini@kernel.org>
2026-03-14net: enetc: remove stray semicolonWei Fang
Remove stray semicolon from ntmp_table_name(). Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260313112454.427191-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14Merge tag 'nf-26-03-13' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net This is a much earlier pull request than usual, due to the large backlog. We are aware of several unfixed issues, in particular in ctnetlink, patches are being worked on. The following patchset contains Netfilter fixes for *net*: 1) fix a use-after-free in ctnetlink, from Hyunwoo Kim, broken since v3.10. 2) add missing netlink range checks in ctnetlink, broken since v2.6 days. 3) fix content length truncation in sip conntrack helper, from Lukas Johannes Möller. Broken since 2.6.34. 4) Revert a recent patch to add stronger checks for overlapping ranges in nf_tables rbtree set type. Patch is correct, but several nftables version have a bug (now fixed) that trigger the checks incorrectly. 5) Reset mac header before the vlan push to avoid warning splat (and make things functional). From Eric Woudstra. 6) Add missing bounds check in H323 conntrack helper, broken since this helper was added 20 years ago, from Jenny Guanni Qu. 7) Fix a memory leak in the dynamic set infrastructure, from Pablo Neira Ayuso. Broken since v5.11. 8+9) a few spots failed to purge skbs queued to userspace via nfqueue, this causes RCU escape / use-after-free. Also from Pablo. broken since v3.4 added the CT target to xtables. 10) Fix undefined behaviour in xt_time, use u32 for a shift-by-31 operation, not s32, from Jenny Guanni Qu. 11) H323 conntrack helper lacks a check for length variable becoming negative after decrement, causes major out-of-bounds read due to cast to unsigned size later, also from Jenny. Both issues exist since 2.6 days. * tag 'nf-26-03-13' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() netfilter: xt_time: use unsigned int for monthday bit shift netfilter: xt_CT: drop pending enqueued packets on template removal netfilter: nft_ct: drop pending enqueued packets on removal nf_tables: nft_dynset: fix possible stateful expression memleak in error path netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case netfilter: nf_flow_table_ip: reset mac header before vlan push netfilter: revert nft_set_rbtree: validate open interval overlap netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() netfilter: conntrack: add missing netlink policy validations netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ==================== Link: https://patch.msgid.link/20260313150614.21177-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14arm64/mm: Directly use TTBRx_EL1_CnPAnshuman Khandual
Replace all TTBR_CNP_BIT macro instances with TTBRx_EL1_CNP_BIT which is a standard field from tools sysreg format. Drop the now redundant custom macro TTBR_CNP_BIT. No functional change. Cc: Will Deacon <will@kernel.org> Cc: Marc Zyngier <maz@kernel.org> Cc: Oliver Upton <oupton@kernel.org> Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Cc: kvmarm@lists.linux.dev Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-14arm64/mm: Directly use TTBRx_EL1_ASID_MASKAnshuman Khandual
Replace all TTBR_ASID_MASK macro instances with TTBRx_EL1_ASID_MASK which is a standard field mask from tools sysreg format. Drop the now redundant custom macro TTBR_ASID_MASK. No functional change. Cc: Will Deacon <will@kernel.org> Cc: Marc Zyngier <maz@kernel.org> Cc: Oliver Upton <oupton@kernel.org> Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Cc: kvmarm@lists.linux.dev Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-14arm64/mm: Describe TTBR1_BADDR_4852_OFFSETAnshuman Khandual
TTBR1_BADDR_4852_OFFSET is a constant offset which gets added into kernel page table physical address for TTBR1_EL1 when kernel is build for 52 bit VA but found to be running on 48 bit VA capable system. Although there is no explanation on how the macro is computed. Describe TTBR1_BADDR_4852_OFFSET computation in detail via deriving from all required parameters involved thus improving clarity and readability. Cc: Will Deacon <will@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-14hinic3: Fix spelling mistake "capbility" -> "capability"Colin Ian King
There is a spelling mistake in a dev_dbg message. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260312235922.3442120-1-colin.i.king@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14Merge tag 'for-net-2026-03-12' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sync: Fix hci_le_create_conn_sync - MGMT: Fix list corruption and UAF in command complete handlers - L2CAP: Disconnect if received packet's SDU exceeds IMTU - L2CAP: Disconnect if sum of payload sizes exceed SDU - L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - L2CAP: Validate L2CAP_INFO_RSP payload length before access - L2CAP: Fix use-after-free in l2cap_unregister_user - ISO: Fix defer tests being unstable - HIDP: Fix possible UAF - SMP: make SM/PER/KDU/BI-04-C happy - qca: fix ROM version reading on WCN3998 chips * tag 'for-net-2026-03-12' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: qca: fix ROM version reading on WCN3998 chips Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user Bluetooth: HIDP: Fix possible UAF Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Bluetooth: hci_sync: Fix hci_le_create_conn_sync Bluetooth: ISO: Fix defer tests being unstable Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU ==================== Link: https://patch.msgid.link/20260312200655.1215688-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14Merge branch 'net-add-skb_drop_reason_recursion_limit'Jakub Kicinski
Eric Dumazet says: ==================== net: add SKB_DROP_REASON_RECURSION_LIMIT Add a new drop reason : SKB_DROP_REASON_RECURSION_LIMIT Used for packets dropped in a too deep virtual device chain, from tunnels and __dev_queue_xmit() __dev_queue_xmit() can also return SKB_DROP_REASON_DEV_READY ==================== Link: https://patch.msgid.link/20260312201824.203093-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: plumb drop reasons to __dev_queue_xmit()Eric Dumazet
Add drop reasons to __dev_queue_xmit(): - SKB_DROP_REASON_DEV_READY : device is not UP. - SKB_DROP_REASON_RECURSION_LIMIT : recursion limit on virtual device is hit. Also add an unlikely() for the SKB_DROP_REASON_DEV_READY case, and reduce indentation level. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260312201824.203093-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14net: dropreason: add SKB_DROP_REASON_RECURSION_LIMITEric Dumazet
ip[6]tunnel_xmit() can drop packets if a too deep recursion level is detected. Add SKB_DROP_REASON_RECURSION_LIMIT drop reason. We will use this reason later in __dev_queue_xmit(). Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260312201824.203093-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14sunrpc: fix cache_request leak in cache_releaseJeff Layton
When a reader's file descriptor is closed while in the middle of reading a cache_request (rp->offset != 0), cache_release() decrements the request's readers count but never checks whether it should free the request. In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the cache_request is removed from the queue and freed along with its buffer and cache_head reference. cache_release() lacks this cleanup. The only other path that frees requests with readers == 0 is cache_dequeue(), but it runs only when CACHE_PENDING transitions from set to clear. If that transition already happened while readers was still non-zero, cache_dequeue() will have skipped the request, and no subsequent call will clean it up. Add the same cleanup logic from cache_read() to cache_release(): after decrementing readers, check if it reached 0 with CACHE_PENDING clear, and if so, dequeue and free the cache_request. Reported-by: NeilBrown <neilb@ownmail.net> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@kernel.org Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-03-14NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fdChuck Lever
The /proc/fs/nfs/exports proc entry is created at module init and persists for the module's lifetime. exports_proc_open() captures the caller's current network namespace and stores its svc_export_cache in seq->private, but takes no reference on the namespace. If the namespace is subsequently torn down (e.g. container destruction after the opener does setns() to a different namespace), nfsd_net_exit() calls nfsd_export_shutdown() which frees the cache. Subsequent reads on the still-open fd dereference the freed cache_detail, walking a freed hash table. Hold a reference on the struct net for the lifetime of the open file descriptor. This prevents nfsd_net_exit() from running -- and thus prevents nfsd_export_shutdown() from freeing the cache -- while any exports fd is open. cache_detail already stores its net pointer (cd->net, set by cache_create_net()), so exports_release() can retrieve it without additional per-file storage. Reported-by: Misbah Anjum N <misanjum@linux.ibm.com> Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ibm.com/ Fixes: 96d851c4d28d ("nfsd: use proper net while reading "exports" file") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: NeilBrown <neil@brown.name> Tested-by: Olga Kornievskaia <okorniev@redhat.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-03-14NFSD: Defer sub-object cleanup in export put callbacksChuck Lever
svc_export_put() calls path_put() and auth_domain_put() immediately when the last reference drops, before the RCU grace period. RCU readers in e_show() and c_show() access both ex_path (via seq_path/d_path) and ex_client->name (via seq_escape) without holding a reference. If cache_clean removes the entry and drops the last reference concurrently, the sub-objects are freed while still in use, producing a NULL pointer dereference in d_path. Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or ex_stats") moved kfree of ex_uuid and ex_stats into the call_rcu callback, but left path_put() and auth_domain_put() running before the grace period because both may sleep and call_rcu callbacks execute in softirq context. Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the callback until after the RCU grace period and executes it in process context where sleeping is permitted. This allows path_put() and auth_domain_put() to be moved into the deferred callback alongside the other resource releases. Apply the same fix to expkey_put(), which has the identical pattern with ek_path and ek_client. A dedicated workqueue scopes the shutdown drain to only NFSD export release work items; flushing the shared system_unbound_wq would stall on unrelated work from other subsystems. nfsd_export_shutdown() uses rcu_barrier() followed by flush_workqueue() to ensure all deferred release callbacks complete before the export caches are destroyed. Reported-by: Misbah Anjum N <misanjum@linux.ibm.com> Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ibm.com/ Fixes: c224edca7af0 ("nfsd: no need get cache ref when protected by rcu") Fixes: 1b10f0b603c0 ("SUNRPC: no need get cache ref when protected by rcu") Cc: stable@vger.kernel.org Reviwed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: NeilBrown <neil@brown.name> Tested-by: Olga Kornievskaia <okorniev@redhat.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-03-14atm: lec: fix use-after-free in sock_def_readable()Deepanshu Kartikey
A race condition exists between lec_atm_close() setting priv->lecd to NULL and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send(). When the socket is freed via RCU while another thread is still using it, a use-after-free occurs in sock_def_readable() when accessing the socket's wait queue. The root cause is that lec_atm_close() clears priv->lecd without any synchronization, while callers dereference priv->lecd without any protection against concurrent teardown. Fix this by converting priv->lecd to an RCU-protected pointer: - Mark priv->lecd as __rcu in lec.h - Use rcu_assign_pointer() in lec_atm_close() and lecd_attach() for safe pointer assignment - Use rcu_access_pointer() for NULL checks that do not dereference the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and lecd_attach() - Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(), lec_handle_bridge() and lec_atm_send() to safely access lecd - Use rcu_assign_pointer() followed by synchronize_rcu() in lec_atm_close() to ensure all readers have completed before proceeding. This is safe since lec_atm_close() is called from vcc_release() which holds lock_sock(), a sleeping lock. - Remove the manual sk_receive_queue drain from lec_atm_close() since vcc_destroy_socket() already drains it after lec_atm_close() returns. v2: Switch from spinlock + sock_hold/put approach to RCU to properly fix the race. The v1 spinlock approach had two issues pointed out by Eric Dumazet: 1. priv->lecd was still accessed directly after releasing the lock instead of using a local copy. 2. The spinlock did not prevent packets being queued after lec_atm_close() drains sk_receive_queue since timer and workqueue paths bypass netif_stop_queue(). Note: Syzbot patch testing was attempted but the test VM terminated unexpectedly with "Connection to localhost closed by remote host", likely due to a QEMU AHCI emulation issue unrelated to this fix. Compile testing with "make W=1 net/atm/lec.o" passes cleanly. Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925 Link: https://lore.kernel.org/all/20260309093614.502094-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260309155908.508768-1-kartikey406@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14Merge branch 'tcp-rfc-7323-compliant-window-retraction-handling'Jakub Kicinski
Simon Baatz says: ==================== tcp: RFC 7323-compliant window retraction handling this series implements the receiver-side requirements for TCP window retraction as specified in RFC 7323 and adds packetdrill tests to cover the new behavior. Please see the first patch for background and implementation details. Since MPTCP adjusts the TCP receive window on subflows, the relevant MPTCP code paths are updated accordingly. ==================== Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-0-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14selftests/net: packetdrill: add tcp_rcv_neg_window.pktSimon Baatz
The test ensures we correctly apply the maximum advertised window limit when rcv_nxt advances past rcv_mwnd_seq, so that the "usable window" is properly clamped to zero rather than becoming negative. Signed-off-by: Simon Baatz <gmbnomis@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-6-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14selftests/net: packetdrill: add tcp_rcv_wnd_shrink_allowed.pktSimon Baatz
This test verifies the sequence number checks using the maximum advertised window sequence number when net.ipv4.tcp_shrink_window is enabled. Signed-off-by: Simon Baatz <gmbnomis@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-5-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14selftests/net: packetdrill: add tcp_rcv_wnd_shrink_nomem.pktSimon Baatz
This test verifies - the sequence number checks using the maximum advertised window sequence number and - the logic for handling received data in tcp_data_queue() for the cases: 1. The window is reduced to zero because of memory 2. The window grows again but still does not reach the originally advertised window Signed-off-by: Simon Baatz <gmbnomis@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-4-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14tcp: increase LINUX_MIB_BEYOND_WINDOW for SKB_DROP_REASON_TCP_OVERWINDOWSimon Baatz
Since commit 9ca48d616ed7 ("tcp: do not accept packets beyond window"), the path leading to SKB_DROP_REASON_TCP_OVERWINDOW in tcp_data_queue() is probably dead. However, it can be reached now when tcp_max_receive_window() is larger than tcp_receive_window(). In that case, increment LINUX_MIB_BEYOND_WINDOW as done in tcp_sequence(). Signed-off-by: Simon Baatz <gmbnomis@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-3-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14mptcp: keep rcv_mwnd_seq in sync with subflow rcv_wndSimon Baatz
MPTCP shares a receive window across subflows and applies it at the subflow level by adjusting each subflow's rcv_wnd when needed. With the new TCP tracking of the maximum advertised window sequence, rcv_mwnd_seq must stay consistent with these subflow-level rcv_wnd adjustments. Signed-off-by: Simon Baatz <gmbnomis@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-2-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14tcp: implement RFC 7323 window retraction receiver requirementsSimon Baatz
By default, the Linux TCP implementation does not shrink the advertised window (RFC 7323 calls this "window retraction") with the following exceptions: - When an incoming segment cannot be added due to the receive buffer running out of memory. Since commit 8c670bdfa58e ("tcp: correct handling of extreme memory squeeze") a zero window will be advertised in this case. It turns out that reaching the required memory pressure is easy when window scaling is in use. In the simplest case, sending a sufficient number of segments smaller than the scale factor to a receiver that does not read data is enough. - Commit b650d953cd39 ("tcp: enforce receive buffer memory limits by allowing the tcp window to shrink") addressed the "eating memory" problem by introducing a sysctl knob that allows shrinking the window before running out of memory. However, RFC 7323 does not only state that shrinking the window is necessary in some cases, it also formulates requirements for TCP implementations when doing so (Section 2.4). This commit addresses the receiver-side requirements: After retracting the window, the peer may have a snd_nxt that lies within a previously advertised window but is now beyond the retracted window. This means that all incoming segments (including pure ACKs) will be rejected until the application happens to read enough data to let the peer's snd_nxt be in window again (which may be never). To comply with RFC 7323, the receiver MUST honor any segment that would have been in window for any ACK sent by the receiver and, when window scaling is in effect, SHOULD track the maximum window sequence number it has advertised. This patch tracks that maximum window sequence number rcv_mwnd_seq throughout the connection and uses it in tcp_sequence() when deciding whether a segment is acceptable. rcv_mwnd_seq is updated together with rcv_wup and rcv_wnd in tcp_select_window(). If we count tcp_sequence() as fast path, it is read in the fast path. Therefore, rcv_mwnd_seq is put into rcv_wnd's cacheline group. The logic for handling received data in tcp_data_queue() is already sufficient and does not need to be updated. Signed-off-by: Simon Baatz <gmbnomis@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-1-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-14Merge branch 'io_uring-7.0' into for-7.1/io_uringJens Axboe
Merge upstream io_uring fixes to avoid conflicts in later patches. * io_uring-7.0: io_uring/kbuf: check if target buffer list is still legacy on recycle io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops io_uring/eventfd: use ctx->rings_rcu for flags checking io_uring: ensure ctx->rings is stable for task work flags manipulation io_uring/bpf_filter: use bpf_prog_run_pin_on_cpu() to prevent migration io_uring/register: fix comment about task_no_new_privs
2026-03-14xtensa: uapi: Reuse asm-generic ucontext.hThomas Weißschuh
Drop the custom non-uapi definition which is the same as the generic uapi one. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Message-ID: <20260314-uapi-ucontext-xtensa-v1-1-08dceca7e6a2@weissschuh.net> [Max: Move new generic-y line to the arch/xtensa/include/uapi/asm/Kbuild] Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2026-03-14ublk: report BLK_SPLIT_INTERVAL_CAPABLECaleb Sander Mateos
The ublk driver doesn't access request integrity buffers directly, it only copies them to/from the ublk server in ublk_copy_user_integrity(). ublk_copy_user_integrity() uses bio_for_each_integrity_vec() to walk all the integrity segments. ublk devices are therefore capable of handling requests with integrity intervals split across segments. Set BLK_SPLIT_INTERVAL_CAPABLE in the struct blk_integrity flags for ublk devices to opt out of the integrity-interval dma_alignment limit. Reviewed-by: Ming Lei <ming.lei@redhat.com> Reviewed-by: Keith Busch <kbusch@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Signed-off-by: Keith Busch <kbusch@kernel.org> Link: https://patch.msgid.link/20260313144701.1221652-3-kbusch@meta.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-17 05:02:29 +0000