kernel/git/next/linux-next.git/drivers/infiniband, branch master

Merge branch 'main' of https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git

2026-09-16T12:07:39+00:00

# Conflicts: # net/core/neighbour.c

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git

2026-09-16T12:07:36+00:00

Merge branch 'mm-nonmm-unstable' of https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-09-16T11:51:57+00:00

fault-inject: fix dentry leak

2026-09-16T04:48:34+00:00

fault_create_debugfs_attr() has always taken an extra dentry reference on the created directory (attr->dname = dget(dir)) so that fail_dump() could print the name via %pd from any context. Nothing anywhere in the tree ever calls dput() on attr->dname. For callers with a matching teardown, that unmatched reference causes one dentry plus its attached inode to leak per fault_create_debugfs_attr / debugfs_remove_recursive cycle. simple_recursive_removal() drops debugfs's own +1 ref on the child dentry, but the dget()'d ref keeps its refcount at 1: the dentry ends up unhashed but pinned, and its inode is never freed. Boot-once callers (mm/failslab, block/blk-core, etc.) leak exactly once at init and never destroy the tree, so the impact there is bounded. But per-lifecycle callers (drivers/nvme, drivers/infiniband/hw/hfi1, drivers/mmc, drivers/iommu/iommufd, drivers/media, drivers/misc, drivers/gpu/drm/msm, drivers/crypto, net/sunrpc) leak on every create/destroy cycle. We observed this in production: an NVMe/RDMA host repeatedly reconnecting to a target that rejected the CRTO Property Get went through ~50 nvme controller create/destroy cycles per second, and dentry and inode_cache grew by ~13k pinned objects per 240 s -- unrecoverable through drop_caches. Byte math matched a per-cycle 1-dentry / 1-inode leak from the "fault_inject" directory dentry. Fix this by not holding any external reference in fault_attr. Embed the directory name as a fixed-size char array (FAULT_ATTR_DNAME_LEN, 64 bytes) inside struct fault_attr, copied by strscpy() at fault_create_debugfs_attr() time. fail_dump() prints it via %s. Advantages of an embedded array over kstrdup() + kfree() paired with a new destroy API: - Zero API footprint. No new export and no caller changes required: callers already own their fault_attr's memory and free it when they are done, and now that suffices. - No allocation on the create path. - fault_create_debugfs_attr() cannot fail from the name-copy step. - No lifetime coupling between attr->dname and debugfs; the string is valid for exactly as long as the containing struct. The 64-byte length accommodates every in-tree caller with generous headroom (the longest current name is "fail_dma_array_full", 19 chars). The user-visible fail_dump() format changes from "name %pd" to "name %s", but the printed content is identical -- %pd on the created directory renders the same string that was passed in as @name. drivers/infiniband/hw/hfi1/fault.c drops a now-invalid "attr.dname = NULL" statement; the surrounding kzalloc() already zero-initialises the array. Link: https://lore.kernel.org/20260821181527.3271414-1-mliang@purestorage.com Fixes: 6adc4a22f20b ("fault-inject: add ratelimit option") Signed-off-by: Michael Liang Signed-off-by: Andrew Morton Reviewed-by: Andrew Morton Cc: Akinbou Mita Cc: Dennis Dalessandro Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Vlastimil Babka Cc:

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

2026-09-14T16:58:12+00:00

Pull rdma fixes from Jason Gunthorpe: "Lots of bug fixes from the last weeks: - Various error unwind bugs - Several more races and bugs in siw and rxe, including remote triggerable - HFI1 corruption with its credit scheme - Remove a bogus user triggerable dev_warn - Lock __ethtool_get_link_ksettings() properly - Fix a lockdep loop with diassociation - Several storage related bugs, some triggerable remotely - Do no leak physical addresses to userspace in bnxt_re - Fix wrong irq context for the xarrays in erdma - User triggerable race in ucma with multicast - Race in ipoib with multicast flushing and destruction" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (28 commits) RDMA/siw: Bound fragmented header copies by the remaining length RDMA/efa: Keep EQ resources alive while IRQ is registered RDMA/efa: Keep admin queues alive while IRQ is registered RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() IB/IPoIB: Avoid restoring OPER_UP after multicast flush RDMA/ucma: Serialize join and leave on copy_to_user failure RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted RDMA/irdma: Enforce local fence for IB_WR_REG_MR RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables RDMA/mad: Fix receive buffer leak when PKey enforcement fails RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc() RDMA/bnxt_re: Avoid exposing umdbr to userspace RDMA/rtrs: guard against null kobj name RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup IB/isert: wait for deferred control PDU completions before releasing the connection IB/iser: reject a remote invalidation of an unregistered direction RDMA/srp: Fix srp_remove_target() IB/mlx4: Fix use-after-free on pkey sysfs registration failure RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency RDMA/core: Reject unregistering netdevs in ib_get_eth_speed ...

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-09-10T22:14:05+00:00

Cross-merge networking fixes after downstream PR (net-7.3-rc3). Conflicts: drivers/net/dsa/mt7530.c 3c18e3c9a54e ("net: dsa: mt7530: populate lpi_interfaces to fix EEE support") 10d9d8328e8a ("net: dsa: mt7530: replace mt7530_read with regmap_read") Adjacent changes: drivers/net/bonding/bond_alb.c 1746ef2e2df2 ("bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()") 4cef95f72bbd ("bonding: fix u32 overflow in compute_gap()") Signed-off-by: Jakub Kicinski

RDMA/siw: Bound fragmented header copies by the remaining length

2026-09-10T15:15:46+00:00

siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length. Fixes: 754209850df8 ("RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.") Signed-off-by: Jérémy Jean Link: https://patch.msgid.link/20260908085520.1746329-1-Jeremy.Jean@oss.cyber.gouv.fr Assisted-by: Codex:gpt-6 Acked-by: Bernard Metzler Signed-off-by: Leon Romanovsky

RDMA/efa: Keep EQ resources alive while IRQ is registered

2026-09-10T13:35:13+00:00

The completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was registered before that state was initialized, while teardown released the buffer before free_irq() synchronized the handler. Initialize the EQ without arming it, register the IRQ, and then arm it. Reverse the resource order during teardown by freeing the IRQ before destroying the EQ. Fixes: 2a152512a155 ("RDMA/efa: CQ notifications") Link: https://patch.msgid.link/20260907-use-after-free-of-admin-queue-struct-v1-2-dd9d9267fbf4@nvidia.com Reviewed-by: Michael Margolin Signed-off-by: Leon Romanovsky

RDMA/efa: Keep admin queues alive while IRQ is registered

2026-09-10T13:35:13+00:00

The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed them before freeing the IRQ, so the handler's lifetime was not contained by the resources it accesses. Initialize the queues with interrupts masked, request the IRQ, and then switch to interrupt mode. On removal, reset the device and free the IRQ before destroying the queues. Also reset the device before destroying the queues if IRQ registration fails, because the device already has their DMA addresses. Fixes: b7f5e880f377 ("RDMA/efa: Add the efa module") Link: https://patch.msgid.link/20260907-use-after-free-of-admin-queue-struct-v1-1-dd9d9267fbf4@nvidia.com Reviewed-by: Michael Margolin Signed-off-by: Leon Romanovsky

RDMA: fix repeated words in comments

2026-09-10T11:58:12+00:00

Drop words accidentally written twice, reported by checkpatch.pl as a possible repeated word. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Link: https://patch.msgid.link/20260907065047.26773-3-hemanth.selam@gmail.com Signed-off-by: Leon Romanovsky