summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2026-03-27net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatchDavid Carlier
emac_dispatch_skb_zc() allocates a new skb via napi_alloc_skb() but never copies the packet data from the XDP buffer into it. The skb is passed up the stack containing uninitialized heap memory instead of the actual received packet, leaking kernel heap contents to userspace. Copy the received packet data from the XDP buffer into the skb using skb_copy_to_linear_data(). Additionally, remove the skb_mark_for_recycle() call since the skb is backed by the NAPI page frag allocator, not page_pool. Marking a non-page_pool skb for recycle causes the free path to return pages to a page_pool that does not own them, corrupting page_pool state. The non-ZC path (emac_rx_packet) does not have these issues because it uses napi_build_skb() to wrap the existing page_pool page directly, requiring no copy, and correctly marks for recycle since the page comes from page_pool_dev_alloc_pages(). Fixes: 7a64bb388df3 ("net: ti: icssg-prueth: Add AF_XDP zero copy for RX") Signed-off-by: David Carlier <devnexen@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2026-03-27tg3: Fix race for querying speed/duplexThomas Bogendoerfer
When driver signals carrier up via netif_carrier_on() its internal link_up state isn't updated immediately. This leads to inconsistent speed/duplex in /proc/net/bonding/bondX where the speed and duplex is shown as unknown while ethtool shows correct values. Fix this by using netif_carrier_ok() for link checking in get_ksettings function. Fixes: 84421b99cedc ("tg3: Update link_up flag for phylib devices") Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de> Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2026-03-26net: stmmac: remove axi_kbbe, axi_mb and axi_rb membersRussell King (Oracle)
axi_kbbe, axi_mb and axi_rb are all written, but nothing ever reads their values. Remove the code that sets these and the struct members. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w4ydo-0000000Dlpb-34jd@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26virtio-net: enable NETIF_F_GRO_HW only if GRO-related offloads are supportedDi Zhu
Negotiating VIRTIO_NET_F_CTRL_GUEST_OFFLOADS indicates the device allows control over offload support, but the offloads that can be controlled may have nothing to do with GRO (e.g., if neither GUEST_TSO4 nor GUEST_TSO6 is supported). In such a setup, reporting NETIF_F_GRO_HW as available for the device is too optimistic and misleading to the user. Improve the situation by masking off NETIF_F_GRO_HW unless the device possesses actual GRO-related offload capabilities. Out of an abundance of caution, this does not change the current behaviour for hardware with just v6 or just v4 GRO: current interfaces do not allow distinguishing between v6/v4 GRO, so we can't expose them to userspace precisely. Signed-off-by: Di Zhu <zhud@hygon.cn> Acked-by: Jason Wang <jasowang@redhat.com> Link: https://patch.msgid.link/20260323041730.986351-1-zhud@hygon.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: enetc: do not access non-existent registers on pseudo MACWei Fang
The ENETC4_PM_IEVENT and ENETC4_PM_CMD_CFG registers do not exist on the ENETC pseudo MAC, so the driver should prevent from accessing them. Fixes: 5175c1e4adca ("net: enetc: add basic support for the ENETC with pseudo MAC for i.MX94") Signed-off-by: Wei Fang <wei.fang@nxp.com> Tested-by: Claudiu Manoil <claudiu.manoil@nxp.com> Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260324062121.2745033-4-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: enetc: add graceful stop to safely reinitialize the TX RingWei Fang
For ENETC v4, the PIR and CIR will be reset if they are not equal when reinitializing the TX BD ring. However, resetting the PIR and CIR alone is insufficient. When a link-down event occurs while the TX BD ring is transmitting frames, subsequent reinitialization of the TX BD ring may cause it to malfunction. For example, the below steps can reproduce the problem. 1. Unplug the cable when the TX BD ring is busy transmitting frames. 2. Disable the network interface (ifconfig eth0 down). 3. Re-enable the network interface (ifconfig eth0 up). 4. Plug in the cable, the TX BD ring may fail to transmit packets. When the link-down event occurs, enetc4_pl_mac_link_down() only clears PMa_COMMAND_CONFIG[TX_EN] to disable MAC transmit data path. It doesn't set PORT[TXDIS] to 1 to flush the TX BD ring. Therefore, reinitializing the TX BD ring at this point is unsafe. To safely reinitialize the TX BD ring after a link-down event, we checked with the NETC IP team, a proper Ethernet MAC graceful stop is necessary. Therefore, add the Ethernet MAC graceful stop to the link-down event handler enetc4_pl_mac_link_down(). Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260324062121.2745033-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: enetc: reset PIR and CIR if they are not equal when initializing TX ringWei Fang
Currently the driver does not reset the producer index register (PIR) and consumer index register (CIR) when initializing a TX BD ring. The driver only reads the PIR and CIR and initializes the software indexes. If the TX BD ring is reinitialized when it still contains unsent frames, its PIR and CIR will not be equal after the reinitialization. However, the BDs between CIR and PIR have been freed and become invalid and this can lead to a hardware malfunction, causing the TX BD ring will not work properly. For ENETC v4, it supports software to set the PIR and CIR, so the driver can reset these two registers if they are not equal when reinitializing the TX BD ring. Therefore, add this solution for ENETC v4. Note that this patch does not work for ENETC v1 because it does not support software to set the PIR and CIR. Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260324062121.2745033-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: fec: fix the PTP periodic output sysfs interfaceBuday Csaba
When the PPS channel configuration was implemented, the channel index for the periodic outputs was configured as the hardware channel number. The sysfs interface uses a logical channel index, and rejects numbers greater than `n_per_out` (see period_store() in ptp_sysfs.c). That property was left at 1, since the driver implements channel selection, not simultaneous operation of multiple PTP hardware timer channels. A second check in fec_ptp_enable() returns -EOPNOTSUPP when the two channel numbers disagree, making channels 1..3 unusable from sysfs. Fix by removing this redundant check in the FEC PTP driver. Fixes: 566c2d83887f ("net: fec: make PPS channel configurable") Signed-off-by: Buday Csaba <buday.csaba@prolan.hu> Link: https://patch.msgid.link/8ec2afe88423c2231f9cf8044d212ce57846670e.1774359059.git.buday.csaba@prolan.hu Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26virtio_net: sync RX buffer before reading the headerMichael S. Tsirkin
receive_buf() reads the virtio header through buf before page_pool_dma_sync_for_cpu() runs in receive_small() or receive_mergeable(). The header buffer is thus unsynchronized at the point where flags and, for mergeable buffers, num_buffers are consumed. Omar Elghoul reported that on s390x Secure Execution this showed up as greatly reduced virtio-net performance together with "bad gso" and "bad csum" messages in dmesg. This is because with SE sync actually copies data, so the header is uninitialized. Move the sync into receive_buf() so the header is synchronized before any access through buf. Tool use: Cursor with GPT-5.4 drafted the initial code move from prompt: "in drivers/net/virtio_net.c, move page_pool_dma_sync_for_cpu on receive path to before memory is accessed through buf". The result and the commit log were reviewed and edited manually. Fixes: 24fbd3967f3f ("virtio_net: add page_pool support for buffer allocation") Reported-by: Omar Elghoul <oelghoul@linux.ibm.com> Tested-by: Srikanth Aithal <sraithal@amd.com> Tested-by: Omar Elghoul <oelghoul@linux.ibm.com> Link: https://lore.kernel.org/r/20260323150136.14452-1-oelghoul@linux.ibm.com Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Vishwanath Seshagiri <vishs@meta.com> Acked-by: Jason Wang <jasowang@redhat.com> Link: https://patch.msgid.link/f4caa9be9e5addae7851c012cab0a733be7f0974.1774365273.git.mst@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabledSven Eckelmann (Plasma Cloud)
If the gmac0 is disabled, the precheck for a valid ingress device will cause a NULL pointer deref and crash the system. This happens because eth->netdev[0] will be NULL but the code will directly try to access netdev_ops. Instead of just checking for the first net_device, it must be checked if any of the mtk_eth net_devices is matching the netdev_ops of the ingress device. Cc: stable@vger.kernel.org Fixes: 73cfd947dbdb ("net: ethernet: mtk_eth_soc: ppe: prevent ppe update for non-mtk devices") Signed-off-by: Sven Eckelmann (Plasma Cloud) <se@simonwunderlich.de> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260324-wed-crash-gmac0-disabled-v1-1-3bc388aee565@simonwunderlich.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: mana: Fix RX skb truesize accountingDipayaan Roy
MANA passes rxq->alloc_size to napi_build_skb() for all RX buffers. It is correct for fragment-backed RX buffers, where alloc_size matches the actual backing allocation used for each packet buffer. However, in the non-fragment RX path mana allocates a full page, or a higher-order page, per RX buffer. In that case alloc_size only reflects the usable packet area and not the actual backing memory. This causes napi_build_skb() to underestimate the skb backing allocation in the single-buffer RX path, so skb->truesize is derived from a value smaller than the real RX buffer allocation. Fix this by updating alloc_size in the non-fragment RX path to the actual backing allocation size before it is passed to napi_build_skb(). Fixes: 730ff06d3f5c ("net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.") Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Link: https://patch.msgid.link/acLUhLpLum6qrD/N@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: dsa: microchip: drop an outdated comment about SGMII supportMaxime Chevallier
SGMII support has been added to ksz9477, we can drop the comment saying that it'll be added later. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Vladimir Oltean <olteanv@gmail.com> Link: https://patch.msgid.link/20260324180826.524327-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: dsa: microchip: Drop unnecessary check in ksz9477 PCS setupMaxime Chevallier
The ksz_dev_ops .pcs_create() is called under the assumption that the switch has a PCS port : if (ksz_has_sgmii_port(dev) && dev->dev_ops->pcs_create) { ret = dev->dev_ops->pcs_create(dev); [...] } The KSZ9477 implementation of .pcs_create() does the same check on ksz_has_sgmii_port(), and protects the entire function with it. Drop it, saving a level of indentation and increasing readability. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Vladimir Oltean <olteanv@gmail.com> Link: https://patch.msgid.link/20260324180826.524327-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: phylink: use phylink_expects_phy() in phylink_fwnode_phy_connect()Russell King (Oracle)
The tests in phylink_expects_phy() and phylink_fwnode_phy_connect() are identical (by intention). Use phylink_expects_phy() to decide whether to ignore a call to phylink_fwnode_phy_connect(). Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/E1w4zHg-0000000DmC4-2oyb@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: stmmac: dwmac-sofcpga: Drop the struct device referenceMaxime Chevallier
We keep a reference to our the struct device in the socfpga_dwmac priv structure, but now it's only ever used to produce logs in the .set_phy_mode() ops, that are specific to this driver. When we call that ops, we always have a ref to the struct device around, so let's pass it to .set_phy_mode(). We can now discard that reference from struct socfpga_dwmac. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260324092102.687082-6-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: stmmac: dwmac-socfpga: get the phy_mode with the dedicated helperMaxime Chevallier
We enable/disable the sgmii_adapter in the .fix_mac_speed() ops based on the phy_mode used in the plat_data. We currently get it with : socfpga_dwmac ->dev ->drv_data ->netdev ->priv ->stmmac_priv ->plat ->phy_interface where we can get it with : socfpga_dwmac ->plat_data ->phy_interface (done by socfpga_get_plat_phymode) Use that helper here. Note that we are also being passed a phy_interface_t from the .fix_mac_speed() callback, provided by phylink. We can handle that in the future when dynamic interface selection is supported. We'd need to guarantee that we have a Lynx PCS to handle it. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260324092102.687082-5-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: stmmac: dwmac-socfpga: Use the correct type for interface modesMaxime Chevallier
The internal helper socfpga_get_plat_phymode() returns an int where we actually return a PHY_INTERFACE_MODE_xxx, use the correct type for this. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260324092102.687082-4-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: stmmac: dwmac-socfpga: Use the socfpga_sgmii_config() helperMaxime Chevallier
Use the existing socfpga_sgmii_config() helper in socfpga_dwmac_fix_mac_speed(), instead of re-coding the register access. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260324092102.687082-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: stmmac: dwmac-socfpga: Move internal helpersMaxime Chevallier
This is preparatory work to allow reusing the SGMII configuration helper and the wrapper to get the interface in the fix_mac_speed() callback. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260324092102.687082-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26Merge tag 'wireless-next-2026-03-26' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== A fairly big set of changes all over, notably with: - cfg80211: new APIs for NAN (Neighbor Aware Networking, aka Wi-Fi Aware) so less work must be in firmware - mt76: - mt7996/mt7925 MLO fixes/improvements - mt7996 NPU support (HW eth/wifi traffic offload) - iwlwifi: UNII-9 and continuing UHR work * tag 'wireless-next-2026-03-26' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (230 commits) wifi: mac80211: ignore reserved bits in reconfiguration status wifi: cfg80211: allow protected action frame TX for NAN wifi: ieee80211: Add some missing NAN definitions wifi: nl80211: Add a notification to notify NAN channel evacuation wifi: nl80211: add NL80211_CMD_NAN_ULW_UPDATE notification wifi: nl80211: allow reporting spurious NAN Data frames wifi: cfg80211: allow ToDS=0/FromDS=0 data frames on NAN data interfaces wifi: nl80211: define an API for configuring the NAN peer's schedule wifi: nl80211: add support for NAN stations wifi: cfg80211: separately store HT, VHT and HE capabilities for NAN wifi: cfg80211: add support for NAN data interface wifi: cfg80211: make sure NAN chandefs are valid wifi: cfg80211: Add an API to configure local NAN schedule wifi: mac80211: cleanup error path of ieee80211_do_open wifi: mac80211: extract channel logic from link logic wifi: iwlwifi: mld: set RX_FLAG_RADIOTAP_TLV_AT_END generically wifi: iwlwifi: reduce the number of prints upon firmware crash wifi: iwlwifi: fix the description of SESSION_PROTECTION_CMD wifi: iwlwifi: mld: introduce iwl_mld_vif_fw_id_valid wifi: iwlwifi: mld: block EMLSR during TDLS connections ... ==================== Link: https://patch.msgid.link/20260326152021.305959-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26net: stmmac: dwmac-nuvoton: Add dwmac glue for Nuvoton MA35 familyJoey Lu
Add support for Gigabit Ethernet on Nuvoton MA35 series using dwmac driver. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Joey Lu <a0987203069@gmail.com> Link: https://patch.msgid.link/20260323101756.81849-4-a0987203069@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26Merge tag 'wireless-2026-03-26' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple more fixes: - virt_wifi: remove SET_NETDEV_DEV to avoid UAF on teardown - iwlwifi: - fix (some) devices that don't have 6 GHz (WiFi6E) - fix potential OOB read of firmware notification - set WiFi generation for firmware to avoid packet drops - fix multi-link scan timing - wilc1000: fix integer overflow - ath11k/ath12k: fix TID during A-MPDU session teardown - wl1251: don't trust firmware TX status response index * tag 'wireless-2026-03-26' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() wifi: wl1251: validate packet IDs before indexing tx_frames wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation wifi: ath12k: Pass the correct value of each TID during a stop AMPDU session wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session wifi: iwlwifi: mld: correctly set wifi generation data wifi: iwlwifi: mvm: don't send a 6E related command when not supported wifi: iwlwifi: mld: Fix MLO scan timing ==================== Link: https://patch.msgid.link/20260326093329.77815-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26device property: Make modifications of fwnode "flags" thread safeDouglas Anderson
In various places in the kernel, we modify the fwnode "flags" member by doing either: fwnode->flags |= SOME_FLAG; fwnode->flags &= ~SOME_FLAG; This type of modification is not thread-safe. If two threads are both mucking with the flags at the same time then one can clobber the other. While flags are often modified while under the "fwnode_link_lock", this is not universally true. Create some accessor functions for setting, clearing, and testing the FWNODE flags and move all users to these accessor functions. New accessor functions use set_bit() and clear_bit(), which are thread-safe. Cc: stable@vger.kernel.org Fixes: c2c724c868c4 ("driver core: Add fw_devlink_parse_fwtree()") Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Mark Brown <broonie@kernel.org> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Saravana Kannan <saravanak@kernel.org> Link: https://patch.msgid.link/20260317090112.v2.1.I0a4d03104ecd5103df3d76f66c8d21b1d15a2e38@changeid [ Fix fwnode_clear_flag() argument alignment, restore dropped blank line in fwnode_dev_initialized(), and remove unnecessary parentheses around fwnode_test_flag() calls. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-26Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.0-rc6). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-26Merge branch '100GbE' of ↵Paolo Abeni
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== For ice: Michal corrects call to alloc_etherdev_mqs() to provide maximum number of queues supported rather than currently allocated number of queues. Petr Oros fixes issues related to some ethtool operations in switchdev mode. For iavf: Kohei Enju corrects number of reported queues for ethtool statistics to absolute max as using current number could race and cause out-of-bounds issues. For idpf: Josh NULLs cdev_info pointer after freeing to prevent possible subsequent improper access. He also defers setting of refillqs value until after allocation to prevent possible NULL pointer dereference. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: idpf: only assign num refillqs if allocation was successful idpf: clear stale cdev_info ptr iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() ice: use ice_update_eth_stats() for representor stats ice: fix inverted ready check for VF representors ice: set max queues in alloc_etherdev_mqs() ==================== Link: https://patch.msgid.link/20260323205843.624704-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-26net: mana: Set default number of queues to 16Long Li
Set the default number of queues per vPort to MANA_DEF_NUM_QUEUES (16), as 16 queues can achieve optimal throughput for typical workloads. The actual number of queues may be lower if it exceeds the hardware reported limit. Users can increase the number of queues up to max_queues via ethtool if needed. Signed-off-by: Long Li <longli@microsoft.com> Link: https://patch.msgid.link/20260323194925.1766385-1-longli@microsoft.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-26net: macb: use the current queue number for statsPaolo Valerio
There's a potential mismatch between the memory reserved for statistics and the amount of memory written. gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat. ================================================================== BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78 [macb] Write of size 760 at addr ffff80008080b000 by task ethtool/1027 CPU: [...] Tainted: [E]=UNSIGNED_MODULE Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 print_report+0x384/0x5e0 kasan_report+0xa0/0xf0 kasan_check_range+0xe8/0x190 __asan_memcpy+0x54/0x98 gem_get_ethtool_stats+0x54/0x78 [macb 926c13f3af83b0c6fe64badb21ec87d5e93fcf65] dev_ethtool+0x1220/0x38c0 dev_ioctl+0x4ac/0xca8 sock_do_ioctl+0x170/0x1d8 sock_ioctl+0x484/0x5d8 __arm64_sys_ioctl+0x12c/0x1b8 invoke_syscall+0xd4/0x258 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xf8 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 The buggy address belongs to a 1-page vmalloc region starting at 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff00000a333000 pfn:0xa333 flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff) raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ================================================================== Fix it by making sure the copied size only considers the active number of queues. Fixes: 512286bbd4b7 ("net: macb: Added some queue statistics") Signed-off-by: Paolo Valerio <pvalerio@redhat.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Link: https://patch.msgid.link/20260323191634.2185840-1-pvalerio@redhat.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-26net: dpaa2-mac: export standard statisticsIoana Ciornei
Take advantage of all the newly added MAC counters available through the MC API and export them through the standard statistics structures - rmon, eth-ctrl, eth-mac and pause. A new version based feature is added into dpaa2-mac - DPAA2_MAC_FEATURE_STANDARD_STATS - and based on the two memory zones needed for gathering the MAC counters are setup for each statistics group. The dpmac_counter structure is extended with a new field - size_t offset - which is being used to instruct the dpaa2_mac_transfer_stats() function where exactly to store a counter value inside the standard statistics structure. The newly added support is used both in the dpaa2-eth driver as well as the dpaa2-switch one. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260323115039.3932600-4-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-26net: dpaa2-mac: retrieve MAC statistics in one firmware commandIoana Ciornei
The latest MC firmware version added a new command to retrieve all DPMAC counters in a single firmware call. Use this new command, when possible, in dpaa2-mac as well. In order to use the dpmac_get_statistics() API, two DMA memory areas are used: one to transmit what counters the driver is requesting and one to receive the values of those counters. These memory areas are allocated and DMA mapped at probe time so that we don't waste time at runtime. And since we are planning to add rmon, eth-ctrl and other standard statistics using the same infrastructure, make the setup and cleanup processes as generic as possibile through the dpaa2_mac_setup_stats() and dpaa2_mac_clear_stats() functions. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260323115039.3932600-3-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-26net: dpaa2-mac: extend APIs related to statisticsIoana Ciornei
Extend the dpmac_counter_id enum with the newly added counters which can be interrogated through the MC firmware. Also add the dpmac_get_statistics() API which can be used to retrieve multiple MAC counters through a single firmware command. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260323115039.3932600-2-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-26octeontx2-pf: macsec: Use AES library instead of ecb(aes) skcipherEric Biggers
cn10k_ecb_aes_encrypt() just encrypts a single block with AES. That is much more easily and efficiently done with the AES library than crypto_skcipher. Use the AES library instead. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Reviewed-by: Subbaraya Sundeep <sbhatta@marvell.com> Link: https://patch.msgid.link/20260321225208.64508-1-ebiggers@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-25wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-freeAlexander Popov
Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for the virt_wifi net devices. However, unregistering a virt_wifi device in netdev_run_todo() can happen together with the device referenced by SET_NETDEV_DEV(). It can result in use-after-free during the ethtool operations performed on a virt_wifi device that is currently being unregistered. Such a net device can have the `dev.parent` field pointing to the freed memory, but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`. Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this: ================================================================== BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0 Read of size 2 at addr ffff88810cfc46f8 by task pm/606 Call Trace: <TASK> dump_stack_lvl+0x4d/0x70 print_report+0x170/0x4f3 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kasan_report+0xda/0x110 ? __pm_runtime_resume+0xe2/0xf0 ? __pm_runtime_resume+0xe2/0xf0 __pm_runtime_resume+0xe2/0xf0 ethnl_ops_begin+0x49/0x270 ethnl_set_features+0x23c/0xab0 ? __pfx_ethnl_set_features+0x10/0x10 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xf/0xf0 ? local_clock+0x10/0x30 ? kasan_save_track+0x25/0x60 ? __kasan_kmalloc+0x7f/0x90 ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0 genl_family_rcv_msg_doit+0x1e7/0x2c0 ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 ? __pfx_cred_has_capability.isra.0+0x10/0x10 ? stack_trace_save+0x8e/0xc0 genl_rcv_msg+0x411/0x660 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_ethnl_set_features+0x10/0x10 netlink_rcv_skb+0x121/0x380 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_down_read+0x10/0x10 genl_rcv+0x23/0x30 netlink_unicast+0x60f/0x830 ? __pfx_netlink_unicast+0x10/0x10 ? __pfx___alloc_skb+0x10/0x10 netlink_sendmsg+0x6ea/0xbc0 ? __pfx_netlink_sendmsg+0x10/0x10 ? __futex_queue+0x10b/0x1f0 ____sys_sendmsg+0x7a2/0x950 ? copy_msghdr_from_user+0x26b/0x430 ? __pfx_____sys_sendmsg+0x10/0x10 ? __pfx_copy_msghdr_from_user+0x10/0x10 ___sys_sendmsg+0xf8/0x180 ? __pfx____sys_sendmsg+0x10/0x10 ? __pfx_futex_wait+0x10/0x10 ? fdget+0x2e4/0x4a0 __sys_sendmsg+0x11f/0x1c0 ? __pfx___sys_sendmsg+0x10/0x10 do_syscall_64+0xe2/0x570 ? exc_page_fault+0x66/0xb0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> This fix may be combined with another one in the ethtool subsystem: https://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u Fixes: d43c65b05b848e0b ("ethtool: runtime-resume netdev parent in ethnl_ops_begin") Cc: stable@vger.kernel.org Signed-off-by: Alexander Popov <alex.popov@linux.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260324224607.374327-1-alex.popov@linux.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-25wifi: iwlwifi: mld: set RX_FLAG_RADIOTAP_TLV_AT_END genericallyJohannes Berg
Instead of setting this flag in the iwl_mld_radiotap_put_tlv() users, and not even all of them, set it inside the function. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.31eff369ccf2.If5cee8f7c767b937891abb6cccf2692068ba7758@changeid
2026-03-25wifi: iwlwifi: reduce the number of prints upon firmware crashEmmanuel Grumbach
When the firmware crashes, we print data to be able to know what happened. The problem is that those prints became excessive as during the course of the years, we added more data without ever removing the prints that were no longer useful. Instead of spamming the log with data that will not help anyone, limit the prints to what is really needed. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Eilon Rinat <eilon.rinat@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.3bb8b142ff48.Ieacb12bf3bc930a4c28824e31d8e06eda177ba78@changeid
2026-03-25wifi: iwlwifi: fix the description of SESSION_PROTECTION_CMDEmmanuel Grumbach
The struct has been renamed to iwl_session_prot_cmd. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.56545b097d13.If468c6a666dcf3a52601604bfc8a1c4faa9d320c@changeid
2026-03-25wifi: iwlwifi: mld: introduce iwl_mld_vif_fw_id_validMiri Korenblit
Introduce a helper function that checks if a vif fw id is valid, and warns if it isn't. Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.b68d43db2ddc.I11b2b98e115da9eec8f603c5a01a0a9bcd040884@changeid
2026-03-25wifi: iwlwifi: mld: block EMLSR during TDLS connectionsAvinash Bhatt
TDLS (Tunneled Direct Link Setup) requires single-link operation for direct peer-to-peer communication, which is incompatible with EMLSR (Enhanced Multi-Link Single Radio) mode where the radio switches between multiple links. Block EMLSR when the first TDLS peer is added and unblock when the last TDLS peer is removed. The block/unblock APIs handle exiting EMLSR and triggering link selection automatically. Signed-off-by: Avinash Bhatt <avinash.bhatt@intel.com> Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.c1376b0259dd.I016587eb1570f7a7a64c0c95e0636e955a640350@changeid
2026-03-25wifi: iwlwifi: TLC_MNG_CONFIG_CMD can use several structuresEmmanuel Grumbach
Depending on the firmware API version, we can use different version of the command. Mention them all in the description. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.2c0b1adb8655.Id0cc6cb6996df53a224d29fa541d19b9ee2aa479@changeid
2026-03-25wifi: iwlwifi: mld: update the TLC when we deactivate a linkEmmanuel Grumbach
We hit a problem in the channel switch flow. We had link 0 using PHY 0, so the TLC object in the firmware is using PHY 0. Then we switched channel, so mac80211 / iwlmld: * deactivated link 0 * removed PHY 0 * added PHY 1 * modified link 0 to use PHY 1 * activated link 0. The TLC object was not updated and the firmware was unhappy that the TLC was still trying to use PHY 0. Fix that by letting the TLC know about the PHY context before the link activation. When we are de-activating a link, let the TLC know so that it'll send a TLC configuration command with an invalid PHY context to remove the relationship between the TLC object and the PHY that is going to be removed. That last part is not implemented yet in the firmware, so leave this as a TODO for now. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.317c66b11a31.I591118fa376ed967c0d1a47058c13834bc94605e@changeid
2026-03-25wifi: iwlwifi: add a macro for max FW linksMiri Korenblit
Currently we use IWL_FW_MAX_LINK_ID + 1 to indicate the maximum number of link that the fw supports. This is a bit confusing. Add a macro that indicates the number if maximum links that the FW supports and use it instead. Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.8da9f991526f.I72709f1db90036265c98c5d45682bcf5f36be7ba@changeid
2026-03-25wifi: iwlwifi: mld: always assign a fw id to a vifMiri Korenblit
We used to have a fw id assignment in iwl_mld_init_vif since all interface types that were added to the driver was immediately added to the FW as well. Since NAN was introduced, this is no longer the case - the NAN interface is not added to the fw until a local schedule is configured. For this vif we don't assign a fw id so it is 0 by default. But later, when the vif is removed from the driver, we think that it has a valid fw id (0) and we point fw_id_to_vif[0] to NULL. fw_id_to_vif[0] might actually point to another vif with a valid fw id 0. In this case, we end up messing fw_id_to_vif. Fix this by initializing a vif with a special invalid fw id, and by exiting iwl_mld_rm_vif early for NAN interfaces. Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.f3b5cc59098f.I3d1dbe66bd224cbb786c2b0ab3d1c9f7ec9003e4@changeid
2026-03-25wifi: iwlwifi: mld: use the dedicated helper to extract a linkMiri Korenblit
There is a helper, iwl_mld_fw_id_to_link_conf, that converts a fw link id into the bss_conf structure. Use it in two more places instead of retrieving the bss_conf directly from the fw-id-to-bss_conf mapping array. This required changing the loop bound in iwl_mld_process_per_link_stats() to ucode_capa.num_links, to avoid hitting a IWL_FW_CHECK for link ids > ucode_capa.num_links and < ARRAY_SIZE(fw_id_to_bss_conf), but this change makes sense anyway (there is no reason to iterate links that cannot be valid). Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.f8da2cd2a873.I7fbd3b4a86a5695206bb5083fdac49de9acc9dca@changeid
2026-03-25wifi: iwlwifi: add MAC context command version 4Johannes Berg
Due to NAN additions, this command needs to grow. In iwlmvm we just need to use the old _v3 (or v2) version, but iwlmld needs to handle the difference and send both. Do that as a first step towards adding NAN support. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.5ab609ca1966.I860737f952865bd0b997f1c190c3891864c7c6ba@changeid
2026-03-25wifi: iwlwifi: handle NULL/ERR returns from ptp_clock_register()Avinash Bhatt
ptp_clock_register() returns NULL when PTP support is disabled and may return an ERR_PTR() on other failures. Reduce Log severity for NULL return cases to avoid misleading errors when PTP is unavailable. Signed-off-by: Avinash Bhatt <avinash.bhatt@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.adea594600e8.I0e3d3f7ce897c54fff8ace6dd0faf55b4f39832b@changeid
2026-03-25wifi: iwlwifi: mld: add double-include guards to nan.hJohannes Berg
This is missing, but needed when we want to add data structures to this file. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.4e09d461db6a.If5c14c495b14a20ce7abadc72be57a40d3462bfb@changeid
2026-03-25wifi: iwlwifi: mld: make alloc functions not forced staticJohannes Berg
In preparation for NAN needing the link ID allocation, have the macro not automatically make the ID allocation functions static so we can remove that later from the link allocation function. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.cbfd202c255f.I4dd4d4416d30bed35bc7b7caa3de50071906830a@changeid
2026-03-25wifi: iwlwifi: mld: rename iwl_mld_phy_from_mac80211() argumentJohannes Berg
Calling the channel context just "channel" is confusing since it's a different struct, rename it to the more appropriate "chanctx". Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260321192637.b2cf8cfd5902.I9e0006481454445058b96ec3e7ae338e917e2c50@changeid
2026-03-25wifi: iwlwifi: mld: remove type argument from iwl_mld_add_sta()Johannes Berg
This is used only in a single place, and the caller always sets the type to STATION_TYPE_PEER right now. We need to change some of this for NAN in the future, removing the type argument will simplify that. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260320100746.71841a054f16.I1851148e582eb710261740459a46d22720788926@changeid
2026-03-25wifi: iwlwifi: mld: make iwl_mld_mac80211_iftype_to_fw() staticJohannes Berg
This function is only used within the file, so make it static. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260320100746.45867b060b3d.Iee64056fab7881ea5146433bacef8c2e936c45b1@changeid
2026-03-25wifi: iwlwifi: pcie: don't dump on reset handshake in dumpJohannes Berg
When a FW dump happens, possibly even because of a reset handshake timeout, there's no point in attempting to dump again. Since all the callers of the function outside the transport itself are from the FW dump infrastructure, just split the internal function and make the external one not dump on timeout. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260320100746.f36ba3893899.I063ccc3a037ae6dabcde61941acb162c4b33f127@changeid
generated by cgit v1.2.3 (git 2.25.1) at 2026-07-10 17:14:08 +0000