summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2026-08-08selftests/bpf: Add struct_ops __arena and __arena__nullable argument testsTejun Heo
Add test_arena and test_arena_nullable members to bpf_testmod_ops3 with arena-tagged stub arguments and kfuncs that forward a caller-provided pointer to them. The kfuncs take arena-tagged arguments, so each round trip exercises both conversion directions end to end: the kfunc receives a kernel arena address and the trampoline converts it back to an arena pointer for the callback. The non-nullable callback dereferences its argument with no NULL branch and captures the raw ctx value, which the trigger program compares against the arena offset of the passed object, pinning the exact (u32)(kaddr - kern_vm_start) conversion. The nullable callback verifies that only a true kernel NULL arrives as NULL. Failure coverage: a program with no arena is rejected when it loads. The tests run on x86-64 and skip elsewhere, as the programs fail verification where the JIT lacks arena argument support. Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260808003938.3486067-11-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-08selftests/bpf: Add JIT-sequence tests for __arena kfunc argumentsTejun Heo
Pin the exact rebase sequences the JITs emit for __arena and __arena__nullable kfunc arguments with __jited assertions on x86-64: the unconditional truncate-and-add, the nullable test-and-skip variant, and all five argument registers in one call, which also covers the REX-prefixed encoding of r8 on x86. The capture kfuncs take the argument without dereferencing, so only the emitted code is under test. The tests skip without LLVM disassembler support. Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260808003938.3486067-10-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-08selftests/bpf: Add kfunc __arena and __arena__nullable argument testsTejun Heo
Add arena-argument kfuncs to bpf_testmod, which also exercises the argument rebasing on module kfuncs, and tests covering the accepted argument forms (arena pointer, low 32 bits as a scalar, full user address as a scalar), the exact rebase semantics via capture kfuncs returning the raw argument (zero low 32 bits arrive as the arena kernel base under __arena and as NULL under __arena__nullable), five arena arguments in one call, a mixed __arena plus __arena__nullable call exercising both bitmasks on one call site, a kernel-side dereference of an unpopulated page recovering through the scratch page, and the rejections (no arena in the program, incompatible register type). The tests run on x86-64 and skip elsewhere, as programs with arena-tagged kfunc args fail verification where the JIT lacks support. Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260808003938.3486067-9-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-08selftests/bpf: Verify zext_dst annotations for various instructionsEduard Zingerman
Includes the following test cases: - a test showing that zero extension flags do not propagate through state pruning in the unpatched kernel. - a 32-bit subregister consumed by MOV32 and ALU32 operations (never zext'ed); - a 64-bit MOV (never zext'ed); - a narrow (32-bit) BPF_LDX load whose result is read as 64-bit; - 32-bit atomic fetch_add and cmpxchg whose result is read as 64-bit; - a CFG case where a 32-bit definition's upper half is used only on one of two branches; - no zext for dead registers; - LD_ABS defines only lower 32 bits, hence needs zext when the result is used as 64-bits; - helper, kfunc and subprogram parameters are considered to use full 64 bits; - a 32-bit subregister consumed by JMP32 (X/K) operations; - a 32-bit subregister consumed by JMP (X/K) operations; - a 64-bit register consumed by both JMP and JMP32 operations (never zext'ed); - ALU64 and address space cast operations on arena pointers; - memory loads using BPF_PROBE_MEM instructions. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260807-static-zext-v4-7-b6c270013c77@gmail.com
2026-08-08bpf: Do not print a newline after disassembly in bpf_verbose_insn()Eduard Zingerman
At the moment there are more callsites that want bpf_verbose_insn() to not print a newline after the instruction, than callsites that want a newline. Drop '\n' from disasm.c. Non-functional change. The changes in bpftool are verified by writing a bpf program using a variety of instructions and comparing `prog dump xlated` output in the following modes: plain, opcodes, visual, visual opcodes. The output before and after the changes is identical. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Quentin Monnet <qmo@kernel.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260807-static-zext-v4-1-b6c270013c77@gmail.com
2026-08-07selftests/net: devmem.py: add check_rx_large_niovBobby Eshleman
Add a new devmem test case for binding the dmabuf with rx-page-size=16K. The test sweeps RX payload sizes straddling the niov boundary to cover the sub-niov, exact-niov, and multi-niov RX paths. Silence pylint invalid-name (`with open() as f`) and too-many-arguments (ncdevmem_rx grew to 6 args) at file scope. Acked-by: Stanislav Fomichev <sdf@fomichev.me> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260805-tcpdm-large-niovs-v8-3-3e0225e2808c@meta.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests/net: ncdevmem: add -b option to set rx-page-size on bindBobby Eshleman
Add -b <bytes> to request a non-default niov size via NETDEV_A_DMABUF_RX_PAGE_SIZE. When the value exceeds PAGE_SIZE, udmabuf_alloc() switches to an MFD_HUGETLB-backed memfd so each 2 MB hugepage produces one naturally-aligned sg entry. Acked-by: Stanislav Fomichev <sdf@fomichev.me> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260805-tcpdm-large-niovs-v8-2-3e0225e2808c@meta.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Cover recursive node cleanupMohsin Bashir
Exercise cleanup of nested nodes after deleting their last queue leaf. The test builds a two-level node hierarchy and checks that removing the queue also removes both now-empty node shapers. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-15-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Cover mixed-parent groupingMohsin Bashir
Add coverage for grouping leaves that currently belong to different parent nodes. The test verifies that an implicit parent is rejected, an explicit parent succeeds, and the old empty parent nodes are cleaned up. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-14-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Reject invalid set requestsMohsin Bashir
Verify that invalid set requests fail without corrupting existing queue shaper state. The test covers invalid node creation through set and invalid queue identifiers, then confirms the original queue configuration remains unchanged. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-13-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Cover scalar attributesMohsin Bashir
Exercise queue-scope scalar shaper attributes reported by the device, including rate limits, burst, priority and weight. Build the set request from advertised capabilities so devices are tested for the attributes they claim rather than skipped for missing unrelated fields. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-12-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Add reparenting rejection testMohsin Bashir
Add reject_reparenting to verify that the group operation rejects attempts to change an existing node's parent. The test creates two node shapers under netdev and verifies that re-grouping the first node under the second fails with EOPNOTSUPP. It also verifies that updating the node with the same parent succeeds, and that updating the node without specifying a parent keeps the queue leaves under the original node while updating their weights. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-11-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Add queue migration between nodes testMohsin Bashir
Add move_queue_between_nodes to verify that a queue can be moved from one node to another via re-grouping. Creates N1 with Q1,Q2 and N2 with Q3, then re-groups N2 with Q1,Q3 to steal Q1 from N1. Verifies Q1 moved to N2 and Q2 remains under N1. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-10-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Add child node deletion reparent testMohsin Bashir
Add delete_child_reparent to verify that deleting a child node reparents its queue leaves to the parent node. Creates a two-level hierarchy (N1 with Q1,Q2 and child N2 with Q3), deletes N2, and verifies Q3's parent becomes N1. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-9-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Add nested depth limit discovery testMohsin Bashir
Add nested_depth_limit to incrementally create deeper nesting levels until the driver rejects. Reports the maximum supported nesting depth on both pass and fail. A device advertising nesting support must support at least depth 2, otherwise nesting is meaningless. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-8-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Add .group rate update testMohsin Bashir
Add group_update_rate to test updating an existing node's rate via the .group callback. Creates a node with bw_max=10000, re-groups with bw_max=50000, and verifies the rate changed while leaves remain under the same node. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-7-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Add node scope .set rate update testMohsin Bashir
Add set_node_shaper to test updating a NODE scope shaper's rate via the .set callback. Creates a node group with bw_max=10000, updates to 20000 via .set, and verifies the change. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-6-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Add basic_groups_with_rate testMohsin Bashir
Add a test that groups queues under the netdev parent with rate limiting enabled. Extract the common group-under-netdev flow into _group_under_netdev helper to share with basic_groups. The test independently checks for netdev scope bw_max and metric capabilities before proceeding, and verifies that the netdev shaper persists after leaf deletion. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-5-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Decouple basic_groups from netdev rate limitingMohsin Bashir
Decouple basic_groups from the set_nshapers test dependency. The test was gated on cfg.netdev which is set by set_nshapers. Replace with direct capability checks: netdev scope support (required for grouping under netdev handle) and queue scope nesting + weight. Remove bw-max and metric from the .group call so the test validates pure queue grouping without rate limiting. The rate-limited variant is restored in the following patch, which adds a dedicated basic_groups_with_rate test. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-4-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Prepare helpers for group testsMohsin Bashir
dup_leaves expects the kernel to reject a group request that lists the same queue twice. When that rejection does not happen, ksft_raises only records a failed check and leaves cm.exception as None, so the following errno check raises AttributeError. Worse, the accepted group request leaves a node shaper and queue 0 behind, which makes later tests fail for an unrelated reason. Handle the negative test explicitly instead. If group fails, verify that the errno is EINVAL and return. If group succeeds, delete the node returned by the operation and queue 0 before reporting the failure. Give the duplicate leaves different weights so the request still contains two distinct leaf entries while exercising duplicate handle validation. This also introduces _delete_shaper(), cached _cap_get(), and _require_caps() helpers as preparation for the following shaper group tests. The follow-on tests need the same capability checks for node and queue scope support. Keeping that logic in one place avoids repeating raw EOPNOTSUPP handling in each test. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-3-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07selftests: net: shaper: Drop redundant command timeoutsMohsin Bashir
Commit 57bb59ab6fa3 ("selftests: net: bump default cmd() timeout to 20 seconds") raised the default cmd() timeout to 20 seconds, so the explicit timeout=10 passed to the ethtool channel commands in queue_update() is now redundant and, in fact, shorter than the default. Drop it and rely on the default timeout. Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260805030936.1092907-2-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc7Daniel Borkmann
Cross-merge BPF and other fixes after downstream PR. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2026-08-07Merge branch 'pm-cpufreq'Rafael J. Wysocki
Merge cpufreq updates for 7.3-rc1: - Minor fixes and cleanups in assorted cpufreq drivers (Dan Carpenter, Guru Das Srinagesh, Haoxiang Li, Karl Mehltretter, Sasha Finkelstein, and Pan Chuang) - Fix cpufreq table creation and bios_limits() callback in the Rust bindings (Priya Bala Govindasamy) - Add IPQ5210 support to qcom-nvmem driver (Varadarajan Narayanan) - Adjust the .adjust_perf() cpufreq driver callback to allow the maximum performance value to be passed to drivers and update the intel_pstate driver to use it (Rafael Wysocki) - Set policy->cur to the actual requested frequency in the intel_pstate driver when the performance policy is used (Rafael Wysocki) - Simplify HWP handling on Broadwell processors in intel_pstate (Rafael Wysocki) - Fix setting minimum P-state at init time in intel_pstate (Rafael Wysocki) - Consolidate frequency values computation in intel_pstate and clean up code in that driver (Rafael Wysocki) - Add missing kernel-doc desciptions for structure and union members in the amd-pstate driver (David Vernet) - Handle missing policy in dynamic EPP callbacks in the amd-pstate driver (EDAMAMEX) - Introduce EXPORT_SYMBOL_FOR_PSTATE_UT() to export amd-pstate driver symbols to the amd-pstate-ut subdriver (K Prateek Nayak) - Add dynamic EPP as an "energy_performance_preference" mode in amd-pstate, remove the "amd_dynamic_epp" kernel command line option and the "dynamic_epp" sysfs attribute, and update the dynamic_epp documentation accordingly (K Prateek Nayak) - Add unit tests for CPPC Performance Priority and the "dynamic" EPP mode in the amd-pstate driver (K Prateek Nayak) - Set min_limit_freq based on bios_min_perf in amd-pstate and remove the defensive check for bios_min_perf from it (K Prateek Nayak) - Fix EPP return type and handle errors in amd-pstate during initialization, toggle auto_sel in active mode on shared memory systems, and cache the firmware programmed EPP value (Marco Scardovi) - Skip tests in amd-pstate-ut if the amd-pstate driver is not in active use (Qianheng Peng) - Replace sprintf() with sysfs_emit() in sysfs show in the cpufreq schedutil governor and fix a self-contradictory comment in sugov_iowait_apply() (Zhongqiu Han) - Fix the usage example for the sampling_rate tunable of the ondemand cpufreq governor in admin-guide (wangxiaodong) * pm-cpufreq: (40 commits) cpufreq: imx6q: fix out-of-bounds write when probed more than once cpufreq: imx6q: fix devres accumulation across driver rebind rust: cpufreq: Fix temporary write in Registration::bios_limit_callback rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table cpufreq: intel_pstate: Adjust policy->cur in active mode to policy cpufreq/amd-pstate: Document missing kernel-doc members cpufreq/amd-pstate-ut: Add unit test for CPPC Performance Priority cpufreq/amd-pstate-ut: Add unit test for "dynamic" EPP mode cpufreq/amd-pstate: Reduce the scope of exported symbols Documentation/amd-pstate: Update dynamic_epp documentation with new behavior cpufreq/amd-pstate: Remove "amd_dynamic_epp" cmdline and "dynamic_epp" sysfs cpufreq/amd-pstate: Add dynamic EPP as an "energy_performance_preference" mode cpufreq/amd-pstate: Extract platform profile to EPP conversion into a helper cpufreq/amd-pstate: Remove the defensive check for bios_min_perf cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf cpufreq: apple-soc: Calculate frequency as a 64-bit value kselftest: cpufreq: Backup and restore governor for sptests selftests/cpufreq: Remove unnecessary sudo from quick_shuffle() selftests/cpufreq: Remove unused local variables from switch_show_governor() cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks ...
2026-08-08selftests/ftrace: Force C locale in ftracetestRui Qi
Some ftracetest test cases parse command output by matching English field names. Tools such as readelf may localize their output via gettext, while ftracetest currently inherits the user locale from the environment. If a translated field name is printed, parsing can fail even though the tested kernel behavior is unchanged. For example, add_remove_uprobe can fail to find the ELF entry point and then write a uprobe event with a missing offset. Export LC_ALL=C in the top-level ftracetest runner so every test case gets stable command output by default. Link: https://lore.kernel.org/all/20260807081512.2974757-2-qirui.001@bytedance.com/ Signed-off-by: Rui Qi <qirui.001@bytedance.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-08-08selftests/ftrace: Convert ELF entry point to file offset in uprobe testRui Qi
The add_remove_uprobe test uses readelf -h to obtain the ELF entry point (e_entry) and passes it directly as the offset to uprobe_events. However, uprobe_events expects a file offset, not a virtual address. For PIE binaries, the virtual address happens to equal the file offset because the first LOAD segment has p_vaddr == p_offset, so the test works by coincidence. But for non-PIE executables, e_entry is an absolute virtual address that can far exceed the file size. When the probe is enabled, uprobe_register() checks offset > i_size_read(inode) and rejects it with -EINVAL. Fix this by converting the virtual address to a file offset using the ELF program headers: scan readelf -lW output for the LOAD segment containing the entry point, then compute file_offset = e_entry - p_vaddr + p_offset. For PIE binaries the result is unchanged; for non-PIE binaries the offset is correctly translated. The conversion uses only POSIX shell primitives, with no dependency on gawk or perl. Link: https://lore.kernel.org/all/20260807081512.2974757-3-qirui.001@bytedance.com/ Fixes: dc4b165855f2 ("selftests/ftrace: Use readelf to find entry point in uprobe test") Cc: stable@vger.kernel.org Signed-off-by: Rui Qi <qirui.001@bytedance.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-08-07Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull BPF fixes from Daniel Borkmann: - Fix BPF verifier to preserve full pointer state for commuted scalar += pointer arithmetic (Yiyang Chen, Eduard Zingerman) - Fix a use-after-free of request sockets in the BPF TCP iterator batching (Jose Fernandez) - Fix a use-after-free of sk_redir in the BPF sockmap send verdict path (Chengfeng Ye) - Fix a netns reference imbalance in the BPF conntrack kfuncs (Chengfeng Ye) - Fix bpf_get_fsverity_digest() dynptr assumptions and silent digest truncation (Eric Biggers) - Fix bpf_tcp_{gen,check}_syncookie to check sk_state before sk_protocol to make sure it is a full socket (Luxiao Xu) - Fix rqspinlock to reset the tail when preserving the queue on deadlock (Kumar Kartikeya Dwivedi) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: rqspinlock: Reset tail when preserving queue on deadlock bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie fsverity: Fix silent truncation in bpf_get_fsverity_digest() fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() bpf: Fix netns reference imbalance in conntrack kfuncs bpf, sockmap: Fix sk_redir use-after-free in send verdict selftests/bpf: Cover commuted pointer state propagation bpf: Propagate untrusted pointer state in commuted arithmetic bpf: Preserve pointer state for commuted arithmetic bpf: Simplify sanitize_err() signature
2026-08-07selftests/bpf: Add load-acquire test for probe-memory pointer typesDaniel Borkmann
Add a verifier test that a BPF_LOAD_ACQ from a rdonly_untrusted_mem pointer (PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED, obtained via bpf_rdonly_cast()) is rejected. Such a source requires BPF_PROBE_MEM fault protection which is not applied to atomic loads; without the verifier fix the load is accepted and would crash the kernel on a fault. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_load_acquire [...] #621/1 verifier_load_acquire/load-acquire, 8-bit:OK #621/2 verifier_load_acquire/load-acquire, 8-bit @unpriv:OK #621/3 verifier_load_acquire/load-acquire, 16-bit:OK #621/4 verifier_load_acquire/load-acquire, 16-bit @unpriv:OK #621/5 verifier_load_acquire/load-acquire, 32-bit:OK #621/6 verifier_load_acquire/load-acquire, 32-bit @unpriv:OK #621/7 verifier_load_acquire/load-acquire, 64-bit:OK #621/8 verifier_load_acquire/load-acquire, 64-bit @unpriv:OK [...] #621/19 verifier_load_acquire/load-acquire from rdonly_untrusted_mem pointer:OK #621/20 verifier_load_acquire/load-acquire with invalid register R15:OK #621/21 verifier_load_acquire/load-acquire with invalid register R15 @unpriv:OK #621/22 verifier_load_acquire/load-acquire from pkt pointer:OK #621/23 verifier_load_acquire/load-acquire from flow_keys pointer:OK #621/24 verifier_load_acquire/load-acquire from sock pointer:OK #621 verifier_load_acquire:OK Summary: 1/24 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260806201047.333389-6-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-07selftests/bpf: Add arena fault test for load-acquireDaniel Borkmann
Add stream_arena_load_acquire_fault, which performs a load-acquire from an unmapped arena address, next to the existing read and write fault tests. The test covers both halves of the JIT bug that treated a load-acquire as a store when populating its exception table entry: - the fault has to be reported as a READ, and at the address held by the source register, which __stderr() and test_address() check, and - the destination register has to be cleared by the fault handler, which the program checks by poisoning it before the load-acquire and returning it, so __retval(0) fails if it is left untouched Note, load-acquire is open coded since linux/filter.h cannot be included alongside vmlinux.h. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t stream_arena_fault_address [...] #462/1 stream_arena_fault_address/read_fault:OK #462/2 stream_arena_fault_address/write_fault:OK #462/3 stream_arena_fault_address/load_acquire_fault:OK #462 stream_arena_fault_address:OK Summary: 1/3 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260806201047.333389-5-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-06selftests/bpf: Verify decl tags emission in resolve_btfids testIhor Solodrai
Extend test_resolve_btfids() to assert that resolve_btfids emits a BTF_KIND_DECL_TAG named "bpf_kfunc" for every kfunc, and "bpf_fastcall" for kfuncs marked KF_FASTCALL. Add a btf_has_decl_tag() helper that scans the output BTF for a decl tag matching name and target. Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260807032029.78092-6-ihor.solodrai@linux.dev Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-06selftests/bpf: Verify arena type tags in resolve_btfids testIhor Solodrai
Extend test_resolve_btfids() to assert that resolve_btfids emits the address_space(1) type attribute (a BTF_KIND_TYPE_TAG with kflag=1) on the return type and/or arguments of kfuncs marked KF_ARENA_RET, KF_ARENA_ARG1 or KF_ARENA_ARG2. Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260807032029.78092-4-ihor.solodrai@linux.dev Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-06selftests/mm: unpoison pages in memory-failure teardownMuhammad Usama Anjum
The memory-failure tests call cleanup() only after all result checks. A failed ASSERT_* invokes fixture teardown and aborts the test, so it skips cleanup() and leaves the injected page hardware-poisoned. Invoke cleanup() from FIXTURE_TEARDOWN() instead. Guard it with self->injection_attempted so tests that exit before injection do not try to unpoison a page when no injection was attempted. Injection can poison a page before returning an error or delivering SIGBUS, so teardown must clean up after every injection attempt. This runs the existing HWPoison and HardwareCorrupted checks on both normal and assertion-failure paths. Link: https://lore.kernel.org/20260729091127.1001179-1-usama.anjum@arm.com Fixes: ff4ef2fbd101 ("selftests/mm: add memory failure anonymous page test") Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Miaohe Lin <linmiaohe@huawei.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Naoya Horiguchi <nao.horiguchi@gmail.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: fix gup_longterm EINVAL error messagezhaozhengzhuo
The gup_longterm test prints a literal "n" when PIN_LONGTERM_TEST_START fails with EINVAL because the string is missing the newline escape sequence. Print a newline instead. Link: https://lore.kernel.org/23557F4CB8CF36FF+20260724074603.1479243-1-zhaozhengzhuo@uniontech.com Signed-off-by: zhaozhengzhuo <zhaozhengzhuo@uniontech.com> Reviewed-by: Sarthak Sharma <sarthak.sharma@arm.com> Reviewed-by: Dev Jain <dev.jain@arm.com> Acked-by: David Hildenbrand (arm) <david@kernel.org> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: John Hubbard <jhubbard@nvidia.com> Cc: Peter Xu <peterx@redhat.com> Cc: Shuah Khan <shuah@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm/pagemap_ioctl: fix missing NULL checks after calloc()longlong yan
The pagemap_ioctl selftest allocates memory via calloc() in several places but does not check the return values. If calloc() fails, the subsequent code will dereference a NULL pointer and crash. Additionally, in sanity_tests(), the calloc() failure check incorrectly uses MAP_FAILED (the mmap() error constant) instead of NULL. Since calloc() returns NULL on failure, the check never triggers and a failed allocation goes undetected. Add NULL checks after each calloc() call, and fix the wrong error constant in sanity_tests(). Use ksft_exit_fail_msg() consistent with the existing error handling pattern in the file. Link: https://lore.kernel.org/20260721063611.342-1-yanlonglong@kylinos.cn Signed-off-by: longlong yan <yanlonglong@kylinos.cn> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: SJ Park <sj@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: use MAP_FAILED for mmap error checklonglong yan
Replace the direct comparison with (void *)-1 with the standard MAP_FAILED macro when checking mmap() Link: https://lore.kernel.org/20260720063439.522-1-yanlonglong@kylinos.cn Signed-off-by: longlong yan <yanlonglong@kylinos.cn> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: fix BUG_ON checking wrong variable in mremap_dontunmapHongfu Li
In mremap_dontunmap_partial_mapping_overwrite(), mremap() stores its returned remapped address into remapped_mapping, while the BUG_ON incorrectly checks dest_mapping instead. If mremap() fails, dest_mapping still holds a valid pointer obtained from the prior mmap() call, making this BUG_ON never trigger at all. Correct the check to validate the actual mremap() return value stored in remapped_mapping. Link: https://lore.kernel.org/20260717070251.73212-1-hongfu.li@linux.dev Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Reviewed-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: add PAGEMAP_SCAN test for THP PMD holesKiryl Shutsemau (Meta)
Add coverage for the PMD-hole case fixed by "fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes": a MAP_PRIVATE|MAP_ANON THP that is uffd-wp'd and then dropped with MADV_DONTNEED leaves a pmd_none hole with no page table, which PAGEMAP_SCAN must still report as written. Factor the populate/drop/scan-both-paths sequence out of unpopulated_scan_test() into a helper, and add unpopulated_thp_scan_test() that reuses it with a THP. Include <linux/mman.h> for MADV_COLLAPSE; <sys/mman.h> lacks it on older glibc (e.g. 2.34). Same approach as commit fd5295afae91 ("selftests/mm: hmm-tests: include linux/mman.h to access MADV_COLLAPSE"). Link: https://lore.kernel.org/aljWYfPRCVc6IB2b@thinkstation Link: https://lore.kernel.org/20260715144234.442721-3-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau <kas@kernel.org> Cc: Muhammad Usama Anjum <usama.anjum@arm.com> Cc: Peter Xu <peterx@redhat.com> Cc: Zenghui Yu <zenghui.yu@linux.dev> Cc: David Hildenbrand <david@kernel.org> Cc: Jann Horn <jannh@google.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Assisted-by: Claude:claude-fable-5 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/vma: update create_init_stack_vma() to use vma_flags_tLorenzo Stoakes
Replace use of the legacy vm_flags_t flags with vma_flags_t values in create_init_stack_vma(). As part of this change we add VMA_STACK_EARLY and VMA_STACK_INCOMPLETE vma_flags_t defines, and slightly rework create_init_stack_vma() for clarity. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-9-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm: introduce vma_get_page_prot() and use itLorenzo Stoakes
There's a large number of vm_get_page_prot(vma->vm_flags) invocations. Make life easier by introducing vma_get_page_prot() parameterised by the VMA. This also makes converting vm_get_page_prot() to vma_flags_t easier. Also update the userland VMA tests to reflect the change. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-8-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Acked-by: Zi Yan <ziy@nvidia.com> Acked-by: Jani Nikula <jani.nikula@intel.com> # for i915 Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> [DRM] Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/vma: rename vma_get_page_prot to vma_flags_to_page_protLorenzo Stoakes
Having vma_get_page_prot() refer to VMA flags and vma_set_page_prot() refer to a VMA is confusing. Rename vma_get_page_prot() to vma_flags_to_page_prot() to resolve this confusion. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-7-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/dax: add dax/kmem hotplug sysfs regression testGregory Price
Add a kselftest for the dax/kmem whole-device "state" sysfs attribute (/sys/bus/dax/devices/daxX.Y/state), which transitions a kmem-backed dax device between "unplugged", "online" and "online_movable". The kselftest also includes a test to demonstrate the force-unbind does not deadlock - but this is destructive (the dax device can never be rebound), so it only runs when DAX_KMEM_TEST_UNBIND=1 is set. Provisioning a devdax device and binding it to kmem needs daxctl/ndctl out of scope for an in-tree selftest. As the test mutates a device's memory, the operator opts in by naming it in DAX_KMEM_TEST_DEV (or "auto" to pick the first kmem-bound device); it SKIPs when unset, when no device is present, or when the memory cannot be freed to a baseline. When a device is available it validates the interface contract: - online / online_movable actually add memory (MemTotal grows), - online is idempotent, - switching between online types without unplug is rejected, - unplug removes memory and the reported state is "unplugged" - invalid input is rejected, - unplug and unbind tolerate blocks toggled out-of-band through the per-block memoryX/state interface. One specific regression test: online -> unplug -> online_movable -> unplug Re-online must re-reserve per-range resources so subsequent unplug actually offlines and removes instead of silently reporting success while the memory stays online. Link: https://lore.kernel.org/20260712154505.3564379-11-gourry@gourry.net Signed-off-by: Gregory Price <gourry@gourry.net> Cc: Alison Schofield <alison.schofield@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Dave Jiang <dave.jiang@intel.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Hannes Reinecke <hare@suse.de> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pankaj Gupta <pankaj.gupta@amd.com> Cc: "Rafael J. Wysocki" <rafael@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vishal Verma <vishal.l.verma@intel.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: factor out hmm_buffer_alloc() to consolidate buffer setupHongfu Li
Each HMM test open-codes the same buffer initialization sequence: allocate main buffer, assign file descriptor and size, allocate mirror buffer, then perform mmap mapping. Factor out this repeated logic into a standalone hmm_buffer_alloc() helper to eliminate ~35 open-coded copies. The new helper supports distinct mmap_size and mirror_size parameters to fit scenarios with THP alignment padding or per-page snapshot flags. It also exposes prot, flags and fd arguments, enabling support for MAP_SHARED, MAP_HUGETLB and file-backed mappings. Eliminates ~360 lines of redundant boilerplate code. Fixes a missing NULL pointer check bug in the hmm_buffer_alloc() previously used only by the migration benchmark, now subsumed by this new unified helper. Link: https://lore.kernel.org/20260713033209.280435-1-lihongfu@kylinos.cn Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Cc: David Hildenbrand <david@kernel.org> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Leon Romanovsky <leon@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: fix on-fault-limit false failure under sudo-rsInjae Ryou
run_vmtests.sh runs on-fault-limit as the nobody user via "sudo -u nobody ./on-fault-limit", guarded by a check that nobody can access the binary ("sudo -u nobody ls ./on-fault-limit"). The guard resolves the relative path from the inherited working directory, which only requires search permission on the test directory itself. Classic sudo passes the relative path through to execve() the same way, so the two agree. However, sudo-rs (the default sudo implementation since Ubuntu 25.10) canonicalizes the command to an absolute path before executing it, which requires search permission on every ancestor directory. When the kernel tree lives under a private home directory (mode 0750, the Ubuntu default for new users since 21.04), the guard passes but the execution fails with "command not found", and the test is reported as a false FAIL: # running sudo -u nobody ./on-fault-limit sudo: './on-fault-limit': command not found # [FAIL] Wrap the command in "sh -c" so that sudo only resolves the shell binary, and the relative path is resolved by nobody's shell from the inherited working directory, matching what the guard checks. This is the only "sudo -u nobody" invocation in the script; uid, cwd, rlimits (including RLIMIT_MEMLOCK, which this test exercises) and the exit status are unchanged through sh. Verified on Ubuntu 26.04 (sudo-rs 0.2.13): the test now runs and passes instead of failing. Verified on Ubuntu 24.04 (sudo 1.9.15p5): behavior is unchanged. Link: https://lore.kernel.org/20260713092700.464376-1-injaeryou@gmail.com Fixes: 5d2146a3354f ("selftests/mm: skip mlock tests if nobody user can't read it") Signed-off-by: Injae Ryou <injaeryou@gmail.com> Cc: Brendan Jackman <jackmanb@google.com> Cc: Brendan Jackman <brendan.jackman@linux.dev> Cc: David Hildenbrand <david@kernel.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests: mincore: count file-mmap readahead on both sidesYijia Wang
check_file_mmap() faults a page in the middle of a file mapping and expects the mmap read-around path to make neighbouring pages resident. The test currently counts only pages after the faulted page. That misses valid read-around on systems with large base page sizes. On arm64 with 64K pages and the default 128K readahead setting, the read-around window is two pages wide and centred on the faulting page. Faulting page 32 makes pages 31 and 32 resident, so the forward-only scan from page 33 reports ra_pages == 0 even though a neighbouring page was brought in. Keep the existing readahead assertion, but count resident neighbouring pages on both sides of the faulted page. This fixes the 64K-page false failure without teaching the selftest to compute the expected readahead window from sysfs or other implementation details. Link: https://lore.kernel.org/20260713094319.771550-1-wangyijia.yeah@bytedance.com Signed-off-by: Yijia Wang <wangyijia.yeah@bytedance.com> Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org> Cc: Jan Kara <jack@suse.cz> Cc: Muchun Song <muchun.song@linux.dev> Cc: Shuah Khan <shuah@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc7). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06Merge tag 'net-7.2-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter. Looks like our attempt to keep the PRs smaller have only prevented this one from getting even bigger. In the last 9 days there were 405 postings explicitly tagged with [PATCH net], vs 687 with [PATCH net-next]. 37% of posted patches being fixes is pretty crazy, and that's likely undercounting because LLM "researchers" more often post fixes without knowing to tag the patches for specific trees. I don't have historic data. In any case, we keep adjusting the criteria. The next PR will be smaller. Current release - regressions: - net: defer netdev KOBJ_ADD uevent until the device is published, previously rtnl_lock would serialize the accesses vs publishing - net: explicitly cancel work to avoid races with ref tracker exit - qrtr: ns: raise lookup limit to 128 - eth: hns3: fix speed configuration residue after driver reload Previous releases - regressions: - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss(), regressed flows with MSS and scaling_ratio variability - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit", broke some platforms (no packets coming thru) - eth: stmmac: resume PHY before hardware setup when opening the interface Previous releases - always broken: - another pile of fixes for less common protocols (SCTP, TLS, SMC etc.) - close a couple of AF_PACKET bugs and ways it can build skbs problematic for the rest of the stack - bridge: mrp: fix uninitialised bytes on the wire - net: devmem: prevent net-iov / page mixing, avoid crashes - eth: atlantic: free RX pages of consumed but not refilled buffers" * tag 'net-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (116 commits) igc: fix netdev not re-attached after resume if interface is down tls: don't abort the connection on signal-interrupted sends net: avoid theoretical races with ref drain net: Defer netdev KOBJ_ADD uevent until the device is published MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li sctp: clear control chunk transport if it is being removed net/atm: fix slab-out-of-bounds read in vcc_setsockopt() s390/ism: Fix UAF of sba and ieq during ism_dev_exit() packet: use consistent hard_header_len in TX_RING send path packet: use consistent hard_header_len in non-ring send paths net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header bnge: Fix resource leak in bnge_init_nic() error path ptp: ocp: Fix board ID over-read tls: rx: restore msg_iter before TLS 1.3 optimistic retry selftests: tls: add a test for splicing onto a full plaintext record tls: don't leave a full plaintext sk_msg ring unpushed xdp: reject clones that overrun skb_shared_info tailroom mptcp: reclaim forward-allocated memory on RX path errors mptcp: fastopen: only mark MPTFO subflows with SYN data mptcp: pm: fix memory leak from alloc-during-teardown race ...
2026-08-06tls: rx: restore msg_iter before TLS 1.3 optimistic retryJérémy Jean
tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD. Revert the iterator by the number of bytes consumed by the optimistic mapping before retrying without zero-copy. Add a selftest which sends a TLS 1.3 control record with TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not overwrite later iovecs beyond the returned length. Fixes: ce61327ce989 ("tls: rx: support optimistic decrypt to user buffer with TLS 1.3") Cc: stable@vger.kernel.org Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> Link: https://patch.msgid.link/20260804125528.2139928-1-Jeremy.Jean@oss.cyber.gouv.fr Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06selftests: tls: add a test for splicing onto a full plaintext recordchanyoung
Splicing onto a plaintext sk_msg ring that is already full used to wrap the ring and make the kernel oops in the scatterwalk once the record was pushed. Only the copy path leaves the ring full without pushing it, so splice until the ring is one fragment short, add the last fragment with a one-byte MSG_MORE send, and splice once more before pushing the record. CONFIG_MAX_SKB_FRAGS is 17..45, so that last fragment follows between 16 and 44 splices; sweep that range to trigger the bug on any build. Signed-off-by: chanyoung <ppoo1220@gmail.com> Link: https://patch.msgid.link/20260804052837.49015-3-ppoo1220@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06selftests: mptcp: join: mark tests with data corruption as failedGang Yan
check_transfer() compares the input and output files byte-by-byte using `cmp -l "$in" "$out" | while read ...`. Because the while-loop body runs in a subshell (the script sets neither lastpipe nor pipefail), the fail_test call inside it -- which sets the global ret/last_test_failed -- and the `return 1` both act on the subshell, not on check_transfer(). check_transfer() thus always falls through to `return 0`, and any data corruption affecting only the payload (leaving the subflow/PM counters untouched) is silently reported as PASS. Fixes: 8117dac3e7c3 ("selftests: mptcp: add invert check in check_transfer") Cc: stable@vger.kernel.org Signed-off-by: Gang Yan <yangang@kylinos.cn> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260803-net-mptcp-misc-fixes-7-2-rc6-v2-5-b8f496d71664@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06selftests/bpf: Test overlapping RCU protectionNing Ding
Add task kptr tests that keep RCU protection active after a spin or RCU unlock when preemption or IRQs remain disabled. Also test the reverse order with explicit RCU. Verify that task kptrs are rejected after leaving the final preemption-disabled or IRQ-disabled region. Signed-off-by: Ning Ding <dingning04@gmail.com> Link: https://lore.kernel.org/bpf/20260805233940.3966981-3-dingning04@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-06bpf: Account for preempt and IRQ state in RCU protectionNing Ding
Disabling preemption or local IRQs keeps the current CPU in an RCU read-side critical section, but in_rcu_cs() does not account for either state. The verifier therefore rejects safe kptr accesses and invalidates pointers when another RCU source ends. Include preemption-disabled and IRQ-disabled state in in_rcu_cs(). Invalidate RCU-protected pointers on RCU unlock, preempt enable, or IRQ restore only after the final protection ends. Signed-off-by: Ning Ding <dingning04@gmail.com> Link: https://lore.kernel.org/bpf/20260805233940.3966981-2-dingning04@gmail.com [ kkd: Simplify was_in_rcu_cs on spin unlock and adjust the selftest. ] Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-10 00:41:18 +0000