summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-09-08drm/i915/buf_trans: add vfunc for VS/PE-OMichał Grzelak
Choosing correct table for Vswing / Pre-emphasis Override is platform specific. It also requires different checks that are already used for choosing predefined tables. Add new get_buf_trans_override() vfunc into intel_encoder returning deparsed table from VBT#57. In next patches, set it inside already present if-ladder from intel_ddi_buf_trans_init() instead of duplicating it. Note that get_buf_trans() cannot be overwritten since there are cases when we need to rollback although VS/PE-O was requested, eg. DP is not connected or feature is not yet implemented for the platform. Assume that vfunc returns NULL on rollback and return predefined tables. Suggested-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260904123148.2165596-6-michal.grzelak@intel.com
2026-09-08drm/i915/bios: de/allocate VS/PE-O buffers for each portMichał Grzelak
Every devdata needs VS/PE-O dedicated buffers since each port can request an override. Add intel_ddi_buf_trans{,_entry} pointers into intel_bios_encoder_data. Allocate struct intel_ddi_buf_trans{,_entry} for the port if VS/PE-O was requested and is supported. Keep NULL in vspeo if any allocation failed or VS/PE-O was not requested. It will be used later for checking if override should actually take place. Note that we theoretically could store intel_ddi_buf_trans_entry inside `entries` field of newly allocated intel_ddi_buf_trans. However it will be impossible to overwrite the buffer during intel_ddi_get_buf_trans() without discarding const qualifier of `entries` field. This would involve either void casting or deconstifying entries field and in turn all predefined tables as well. Thus add a separate non-const qualified field into intel_bios_encoder_data for the buffer, which after overwriting will be promoted to be const qualified. Deallocate the buffer as well as entries if requested. v11->v12 - set vspeo->num_entries once (Sashiko) - free allocated vspeo->entries (Sashiko) v9->v10 - add separate non-const field for `entries` caching - cache `entries` into const field after data is overwritten (Jani) v4->v5 - set devdata->vspeo->num_entries in intel_bios.c Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260904123148.2165596-5-michal.grzelak@intel.com
2026-09-08drm/i915/bios: print VS/PE-O port infoMichał Grzelak
Issue a debug message when port asks to override default Vswing / Preemphasis tables. Add helper intel_bios_encoder_requests_vspeo() to check if port requests for overriding default VS/PE tables. v6->v7 - expand VS/PE-O acronym in debug logging (Jani) v3->v4 - change debug message when requesting VS/PE-O (Suraj) Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260904123148.2165596-4-michal.grzelak@intel.com
2026-09-08drm/i915/bios: store VBT #57's metadata in intel_vbt_dataMichał Grzelak
Store tables, number of tables, number of rows and number of columns in intel_vbt_data when search for the VBT #57 has succeeded. Structurize all VS/PE-O relevant metadata inside anonymous struct named as vspeo. Presence of C20 or newer PHY causes each table to contain 16 rows. Each table contains 10 rows in case C20 PHY is absent. Use display version to determine number of rows since there is no helper in intel_bios.c to check presence of any C20+ PHY. pre-MTL platforms should have 10 rows while MTL+ should have 16 rows. v5->v6 - add Bspec (Suraj) v3->v4 - remove unnecessary init of VS/PE-O metadata (Suraj) - add helper for computing number of rows (Suraj) - fix num_rows's type (Jani, Suraj) - declare num_rows (Suraj) Bspec: 68963 Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260904123148.2165596-3-michal.grzelak@intel.com
2026-09-08drm/i915/bios: search for VBT #57 by defaultMichał Grzelak
Start searching for Vswing / Preemphasis Override Block during VBT parsing at init_bdb_blocks(). Check for failure since pre-ICL GOPs do not contain the block. Check also if VBT version is appropriately up-to-date. v6->v7 - parse VBT#57 before blocks dependent on child device list (Jani) - remove debug message (Suraj) v3->v4 - add Bspec (Suraj) Bspec: 32063 Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260904123148.2165596-2-michal.grzelak@intel.com
2026-09-08Merge tag 'drm-xe-next-2026-08-31-1' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Cross-subsystem Changes: - MAINTAINERS: Add entries for drm_ras (Rodrigo) - alerts and controller enabling modifications (Heikki) Core Changes: - Introduce cold reset recovery method (Mallesh) - Add drm_ras netlink error event support (Riana) - Introduce error threshold to drm_ras (Raag) Driver Changes: - Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl (Lu) - match argument naming with PCODE_DATAx (Grzelak) - fix stale GGTT mappings on unmap (Tangudu) - Introduce error threshold to drm_ras (Raag) - Add debugfs knob to control GPGPU preemption granularity (Varun) - fix vecs config for powergating info (Ashutosh) - Read mailbox phase bit from hardware (Anoop) - alerts and controller enabling modifications (Heikki) - Use int instead of u32 for mailbox status (Umesh) - Reject page faults from non-fault-mode scratch VMs (Arvind) - Add CCS to the powergating info print (Balasubramani) - Do not apply WA 14025883347 to media 3503 (Daniele) - don't WARN on kernel job timeout when device already wedged (Nitin) - handle exec queue teardown after hot-unplug (Nitin) - Allow debugging PCI errors (Raag) - Add structured SIGID error logging infrastructure (Wajdeczko, Rodrigo) - Enable package and vram temperatures for CRI (Karthik) - Introduce cold reset recovery method (Mallesh) - fix error message in xe_migrate_sanity_test (Dan Carpenter) - Add drm_ras netlink error event support (Riana) - Fix a bug in pc_adjust_freq_bounds() (Vinay) - Fix xe_device_probe() failure (Raag) - Page fault cleanups (Wajdeczko) - OA memory fixes (Linmao) - document sentinel and make CTX_TIMESTAMP read TOCTOU-safe (Gajendra) - Move has_drm_ras check to drm_ras layer (Raag) - add termination on resume (Daniele) - Add _locked variants of some config functions (Wajdeczko) - Order ring writes before ring tail updates (Brost) - Parallel page fault handling (Brost) - handle CRI+ power interval encoding (Karthik) - allocate UM queues in a separate UC BO (Jia) - Fix boot-time ras error processing (Raag) - VF migration for multi-queue (Niranjana) - Apply RCS/CCS yield policy to SR-IOV VFs (Marcin) - Fix memory leak in exec_queue_set_hang_replay_state (Winiarski) - Use IBC v3 on PTL (Vinay) - Reduce MERT debug log spam (Lukasz, Piotr) - Validate sysctrl response (Raag) - Changes for Xe3p_HPM media (Ashutosh) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/apYbnrklyk6nNO7Q@gsse-cloud1.jf.intel.com
2026-09-08firmware: coreboot: Use named initializers for acpi_device_idPawel Zalewski
Use a named initializer for the acpi_device_id fields which makes the code more readable and consistent with how lists are initialized in the rest of the kernel code base. Also drop explicitly setting fields to 0 where it is redundant. Signed-off-by: Pawel Zalewski <pzalewski@thegoodpenguin.co.uk> Link: https://lore.kernel.org/r/20260907-acpi-firmware-v2-1-e0b6d40823d1@thegoodpenguin.co.uk Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2026-09-07drm/msm/adreno: Only check for PAS when a zap shader is presentPaul Hollinsky
Commit 0be72be03ca7 ("drm/msm: Switch to generic PAS TZ APIs") replaced the qcom_scm_is_available() check in adreno_zap_shader_load() with qcom_pas_is_available(). These are not equivalent: the former reports whether the SCM transport is up, the latter whether the TrustZone firmware implements the peripheral authentication service. On SC7180 Chromebooks (trogdor) TZ does not implement PAS at all. SCM call-availability queries return 0 for every PAS command while other services answer normally: svc 0x06 cmd 0x01 IS_CALL_AVAIL -> 1 svc 0x02 cmd 0x01 PAS_INIT_IMAGE -> 0 svc 0x02 cmd 0x05 PAS_AUTH_RESET -> 0 svc 0x02 cmd 0x07 PAS_IS_SUPPORTED -> 0 svc 0x0c cmd 0x16 MP_ASSIGN -> 1 svc 0x05 cmd 0x01 IO_READ -> 1 so qcom_scm_probe() never registers a PAS backend and qcom_pas_is_available() is false for the lifetime of the boot. That on its own need not matter, because sc7180-trogdor.dtsi does /delete-node/ &gpu_zap_shader;, and the intended path for such a board is for zap_shader_load_mdt() to find no zap-shader child, clear zap_available, return -ENODEV, and let the caller fall back to SECVID_TRUST_CNTL. The problem is the ordering. zap_available is a static initialised to true and is only ever cleared inside zap_shader_load_mdt(), but adreno_zap_shader_load() consults PAS before calling it. The discovery that decides whether a zap shader is needed at all can therefore never run, the flag is never cleared, and every call returns -EPROBE_DEFER: adreno 5000000.gpu: [drm:adreno_zap_shader_load] *ERROR* PAS is not available msm_dpu ae01000.display-controller: [drm:adreno_load_gpu] *ERROR* gpu hw init failed: -517 Nothing retries that deferral, either. adreno_zap_shader_load() is called from a6xx_hw_init() rather than from probe, so the -EPROBE_DEFER is not a probe return value: it propagates up until adreno_load_gpu() returns NULL. load_gpu() re-attempts on every DRM open while priv->gpu is NULL, each open fails identically, and PAS cannot become available in between - which is why the error repeats and userspace stays on llvmpipe. Move the availability check into zap_shader_load_mdt(), behind the zap-shader node lookup, so the driver only consults PAS once it knows it needs PAS. Boards with no zap-shader node take the intended -ENODEV fallback without ever asking, and boards that do have one keep the qcom_pas_is_available() gate. Fixes: 0be72be03ca7 ("drm/msm: Switch to generic PAS TZ APIs") Link: https://lore.kernel.org/r/20260808034716.58888-1-phollinsky@holtechnik.com Signed-off-by: Paul Hollinsky <phollinsky@holtechnik.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/747583/ Message-ID: <20260821081325.89088-1-phollinsky@holtechnik.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-09-07selftests/bpf: Add test for bpf_skb_change_tail on csum partial skbsDaniel Borkmann
Add a test which builds an ICMP error out of a TCP segment. A tcx prog on the client's egress side trims the first data segment down to the target size and pushes the ICMP error headers in front of it to then reflect the packet back to the sender. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t tc_change_tail [...] #509 tc_change_tail:OK #510 tc_change_tail_pmtu:OK Summary: 2/0 PASSED, 0 SKIPPED, 0/0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260907121025.1923656-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-07bpf: Fix bpf_skb_change_tail wrt csum partial skbsDaniel Borkmann
Cilium generates ICMP "frag needed" replies from BPF when a LB DSR packet exceeds the egress MTU. The reply is built by first trimming the packet down to target size via bpf_skb_change_tail(), and then pushing the ICMP error headers in front of it. The trim is rejected for skbs which carry a checksum offload, e.g. TCP packets aggregated by GRO on ingress where tcp_gro_complete() leaves the skb as CHECKSUM_PARTIAL. __bpf_skb_min_len() raises the minimum length to the end of the L4 checksum field, so a trim to 42 bytes bails out with -EINVAL given a min_len of 52 in this case, and due to that the ICMP generator fails. This is not the case if GRO is turned off. Fix this bpf_skb_change_tail() restriction and drop the checksum offload when the new length no longer covers the checksum field. The BPF program rewrites the skb into an ICMP error and computes the checksum itself anyway. Fixes: 5293efe62df8 ("bpf: add bpf_skb_change_tail helper") Reported-by: Tom Hadlaw <tom.hadlaw@isovalent.com> Reported-by: Yusuke Suzuki <yusuke.suzuki@isovalent.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260907121025.1923656-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-07atm: fix typo "protcol" in commentHemanth Selam
Correct "protcol" to "protocol", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260904123638.39273-1-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: ipv6: fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260904122157.29281-1-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: cortina: fix typo "trigged" in commentHemanth Selam
Correct "trigged" to "triggered", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260904115917.13695-1-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07mii: fix typo "asymetric" in commentHemanth Selam
Correct "asymetric" to "asymmetric", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260904104107.12832-3-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07mdio-mux: fix typo "framwork" in commentHemanth Selam
Correct "framwork" to "framework", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260904104107.12832-2-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07Merge branch 'net-disallow-buggy-tcp-transitions-and-ipv6_addrform'Jakub Kicinski
Kuniyuki Iwashima says: ==================== net: Disallow buggy TCP transitions and IPV6_ADDRFORM. The following operations have recently received a lot of AI-driven bug reports: * listen() + shutdown() + connect() * connect() + connect(AF_UNSPEC) + listen() * setsockopt(IPV6_ADDRFORM) They are not worth fixing by churning the fast path, so this series disallows the transitions and removes IPV6_ADDRFORM. https://lore.kernel.org/CANn89i+px52TtJy3S9=uHxGj3s-WueguRo1Z_4FxO=02KLmwmQ@mail.gmail.com https://lore.kernel.org/5832ba17-c096-4f07-aa73-2e2bb6f79856@redhat.com I did not add Fixes tags, but if we want to backport, the tag would be: Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") ==================== Link: https://patch.msgid.link/20260904033543.2635540-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07ipv6: Remove IPV6_ADDRFORM.Kuniyuki Iwashima
Recently, IPV6_ADDRFORM has received many AI-driven bug reports. Fixing them properly would needlessly churn the fast paths in TCP and UDP. IPV6_ADDRFORM was initially introduced in RFC 2133 in 1997, but only two years later, it was removed from RFC 2553 in 1999. In 2026, modern applications natively support dual-stack sockets; notably, systemd's socket activation does not use IPV6_ADDRFORM. Also, getsockopt(IPV6_ADDRFORM) can be replaced with SO_DOMAIN. Let's remove IPV6_ADDRFORM. Later, we can remove sk->sk_prot_creator and revert commit c26c192c3d48 ("udp: properly deal with xfrm encap and ADDRFORM"). Reported-by: Daehyeon Ko <4ncienth@gmail.com> Closes: https://lore.kernel.org/netdev/20260902010408.1057857-1-4ncienth@gmail.com/ Reported-by: Hyunwoo Kim <imv4bel@gmail.com> Closes: https://lore.kernel.org/netdev/20260824033331.1084971-1-imv4bel@gmail.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260904033543.2635540-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07tcp: Do not allow buggy transitions between ehash and lhash2.Kuniyuki Iwashima
The following state transitions have long been a playground for syzbot, and recently AI joined in, reporting a lot more bugs. * listen() + shutdown() + connect() * connect() + connect(AF_UNSPEC) + listen() All the fix attempts would add more code to the fast path, which is not worth it. Instead of playing whack-a-mole with these edge-case bugs, let's disallow these transitions. Note that unhashed_state is placed in the 4-byte hole after icsk_pmtu_cookie. $ pahole -C inet_connection_sock vmlinux struct inet_connection_sock { ... __u32 icsk_pmtu_cookie; /* 1208 4 */ unsigned char unhashed_state; /* 1212 1 */ /* XXX 3 bytes hole, try to pack */ Reported-by: Kyle Zeng <kylebot@openai.com> Closes: https://lore.kernel.org/netdev/20260731140512.566464-1-david.lee@trailofbits.com/ Reported-by: Michal Luczaj <mhal@rbox.co> Closes: https://lore.kernel.org/netdev/20260803-sockmap-lookup-tcp-leak-v2-0-306e025bfe66@rbox.co/ Reported-by: Hyunwoo Kim <imv4bel@gmail.com> Closes: https://lore.kernel.org/netdev/20260824033331.1084971-1-imv4bel@gmail.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260904033543.2635540-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: usb: qmi_wwan: add Quectel RG660QBSebastian Sjoholm
Add support for the Quectel RG660QB 5G module (USB ID 2c7c:013d). Its QMI interface (interface 4) uses class/subclass/protocol ff/ff/ff like the other recent Quectel modules, so match it the same way. The remaining interfaces are handled by the option driver. Tested with an early sample of the module on a Quectel 5G EVB connected over USB 3 to a Raspberry Pi 5: qmicli talks to the module via /dev/cdc-wdm0. Signed-off-by: Sebastian Sjoholm <sebastian.sjoholm@gmail.com> Link: https://patch.msgid.link/20260903180044.6179-1-sebastian.sjoholm@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07Merge branch 'net-bridge-vlan-minor-cleanups-and-annotations'Jakub Kicinski
Nikolay Aleksandrov says: ==================== net: bridge: vlan: minor cleanups and annotations In preparation for a complete vlan fast-path re-work, this set cleans up a few minor things - removing legacy code barriers that don't help, annotating lockless accesses and using proper helpers. No functional changes are intended. Sashiko will find many pre-existing problems, none of them are related to this set. I will try to fix everything pre-existing separately in -net, there will probably be a few critical items. So if there are missed places to annotate, or if there're actual functional changes, these obviously should be addressed in this set. ==================== Link: https://patch.msgid.link/20260903143138.1574598-1-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: bridge: use br_vlan_get_state to get vlan stateNikolay Aleksandrov
The vlan state can change under RTNL or RCU (mst), so use the helper to get the state properly throughout the bridge driver. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260903143138.1574598-10-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: bridge: vlan: add missing tinfo.tunnel_id annotationsNikolay Aleksandrov
When I annotated data races around tinfo.tunnel_id before, I missed a few places (e.g. bridge notifications, rhashtable compare), so add them now. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260903143138.1574598-9-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: bridge: vlan: annotate lockless use of mstiNikolay Aleksandrov
Annotate data races around vlan msti field, it can be read lockless. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260903143138.1574598-8-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: bridge: vlan: annotate lockless use of num_vlansNikolay Aleksandrov
Annotate data races around vlan group's num_vlans, it can be read lockless. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260903143138.1574598-7-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: bridge: vlan: annotate lockless use of private flagsNikolay Aleksandrov
Annotate vlan private flags data races, they can be read lockless. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260903143138.1574598-6-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: bridge: vlan: annotate lockless vlan flags useNikolay Aleksandrov
Annotate vlan flags data races, they can be read lockless. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260903143138.1574598-5-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: bridge: mst: use br_get_pvid helperNikolay Aleksandrov
The only place that accessed pvid directly outside of the bridge vlan code was mst, change it to use the br_get_pvid helper. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260903143138.1574598-4-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: bridge: vlan: annotate lockless pvid useNikolay Aleksandrov
Use READ/WRITE_ONCE to annotate lockless pvid use, br_get_pvid() is the helper that should be used outside of the bridge vlan code. The rest of the vlan places that access pvid directly all have rtnl. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260903143138.1574598-3-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: bridge: vlan: drop legacy memory barriersNikolay Aleksandrov
These memory barriers are legacy code from the old vlan implementation that is not needed anymore. They're also affecting the fast-path. The pvid is changed under lock and is read with rcu only in the fast-path there is no need for a barrier, nothing to commit prior to changing it nor invalidate prior to reading. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260903143138.1574598-2-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: ethernet: ti: davinci_mdio: Drop commas after match table sentinelsGeert Uytterhoeven
It does not make sense to have a comma after a sentinel, as any new elements must be added before the sentinel. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/e481b6de46cecc6ea604ae165272c667274cc621.1788437140.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()Henry Hu
The issue was discovered via smatch static analyzer: make CHECK="smatch -p=kernel" C=2 drivers/net/phy/microchip_t1.o CHECK scripts/mod/empty.c DESCEND objtool CHECK drivers/net/phy/microchip_t1.c drivers/net/phy/microchip_t1.c:1295 lan887x_phy_init() warn: 'priv->clock' can also be NULL mchp_rds_ptp_probe() returns NULL when CONFIG_MICROCHIP_PHY_RDS_PTP or CONFIG_PTP_1588_CLOCK is disabled. However, lan887x_phy_init() only checks for an error pointer before using the returned clock to configure the periodic output pin, which can result in a NULL pointer dereference. Handle the NULL return as PTP being unavailable and skip the event pin configuration in that case. Smatch no longer reports the NULL dereference warning after the change. Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path Reviewed-by: Divya Koppera <Divya.Koppera@microchip.com> Signed-off-by: Henry Hu <huhai@kylinos.cn> Link: https://patch.msgid.link/20260903113046.163630-1-15815827059@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07Merge branch 'fix-udp-length-overflow-in-edge-cases'Jakub Kicinski
Alice Mikityanska says: ==================== Fix UDP length overflow in edge cases These are fixes for rare edge cases of 16-bit UDP length field overflow that might happen on netdevs with MTU >= 64k. Exposed by the new WARN added to udp_set_len_short, reported by syzbot. ==================== Link: https://patch.msgid.link/20260901195714.673548-1-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forwardAlice Mikityanska
Commit 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward") dropped the IP6_MAX_MTU clamp that used to be present in ip6_mtu(). A similar IPv4 commit ac6627a28dbf ("net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward") preserves the IP_MAX_MTU clamp. Restore the upper bound in the IPv6 flow to avoid potential 16-bit overflows in forwarding paths. Fixes: 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward") Signed-off-by: Alice Mikityanska <alice@isovalent.com> Suggested-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260901195714.673548-5-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07selftests: net: Test UDP length overflow with PMTU discover and big MTUAlice Mikityanska
Two previous commits fixed overflow of UDP length when setsockopt IP(V6)_MTU_DISCOVER is set to IPV6_PMTUDISC_DO or IP(V6)_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU. This commit adds the selftests that replicate the described steps to reproduce for IPv6 and IPv4, and also one more test that ensures that sending UDP jumbograms over a raw socket is still possible after the fix. Signed-off-by: Alice Mikityanska <alice@isovalent.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260901195714.673548-4-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: ipv6: Fix UDP length overflow with PMTU discover and big MTUAlice Mikityanska
This commit bounds cork->base.fragsize to IP6_MAX_MTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udp_set_len_short when setsockopt IPV6_MTU_DISCOVER is set to IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU. Steps to reproduce (included in the new selftest): 1. Set device MTU bigger than IP6_MAX_MTU. cork->base.fragsize will be set to that MTU in ip6_setup_cork. 2. Set IPV6_MTU_DISCOVER to IPV6_PMTUDISC_PROBE or IPV6_PMTUDISC_DO. It lets maxnonfragsize be set to device MTU (cork->fragsize) in __ip6_append_data, rather than to IP6_MAX_MTU. 3. Send 65528 bytes of payload (+8 bytes of UDP header, +40 bytes of IPv6 header). Device MTU allows it (it's only one byte bigger than IP6_MAX_MTU, and the device MTU is bigger than that). 4. The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udp_set_len_short. To avoid breaking sending UDP jumbograms over raw IPv6 sockets, limit the change to UDP sockets only. The original overflow bug with IPv6 and IPV6_PMTUDISC_DO seems to predate git history (verified reproduction on 2.6.21), was fixed later, and then reappeared in commit 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward"), which is chosen as the Fixes tag here. The overflow with IPV6_PMTUDISC_PROBE reproduces since its introduction in commit 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE"). Fixes: 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward") Reported-by: syzbot+ce13c07d96d04716eaa2@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/ Signed-off-by: Alice Mikityanska <alice@isovalent.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260901195714.673548-3-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: ipv4: Fix UDP length overflow with PMTU discover and big MTUAlice Mikityanska
This commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a possible overflow of UDP length that triggers a WARN in udp_set_len_short when setsockopt IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU. Steps to reproduce: 1. Set device MTU bigger than IP_MAX_MTU + 20. cork->base.fragsize will be set to that MTU in ip_setup_cork. 2. Set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE. It lets maxnonfragsize be set to device MTU (cork->fragsize) in __ip_append_data, rather than to IP_MAX_MTU. 3. Send 65528 bytes of payload (+8 bytes of UDP header, +20 bytes of IPv4 header). Device MTU allows it (it's only one byte bigger than IP_MAX_MTU + IPv4 header, and the device MTU is bigger than that). 4. The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udp_set_len_short. Note: IP_PMTUDISC_DO with IPv4 is safe, because ip_dst_mtu_maybe_forward always clamps at IP_MAX_MTU, unlike ip6_dst_mtu_maybe_forward. The Fixes tag points at the first commit where I could reproduce the overflow with IPv4 and IP_PMTUDISC_PROBE. Fixes: daba287b299e ("ipv4: fix DO and PROBE pmtu mode regarding local fragmentation with UFO/CORK") Reported-by: syzbot+ce13c07d96d04716eaa2@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/ Signed-off-by: Alice Mikityanska <alice@isovalent.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260901195714.673548-2-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07Merge branch 'af_unix-minor-fixes-for-msg_oob-and-msg_peek'Jakub Kicinski
Kuniyuki Iwashima says: ==================== af_unix: Minor fixes for MSG_OOB and MSG_PEEK. Fahad Alharbi reported blocking recv(MSG_PEEK) could hog CPU due to OOB skb. Patch 1 and 2 fixes the issues and Patch 3 adds tests. ==================== Link: https://patch.msgid.link/20260902202202.892676-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07selftest: af_unix: Add zero-buffer test for msg_oob.cKuniyuki Iwashima
The previous patches fixed two issues related to zero-length buffer with MSG_PEEK for MSG_OOB skb. Let's add corresponding tests in msg_oob.c. Without this series: # FAILED: 50 / 60 tests passed. # Totals: pass:50 fail:10 xfail:0 xpass:0 skip:0 error:0 With this series: # PASSED: 60 / 60 tests passed. # Totals: pass:60 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260902202202.892676-4-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.Kuniyuki Iwashima
Fahad Alharbi reported that recv(0, MSG_PEEK) triggers busy-wait in unix_stream_read_generic() if recv() is blocking and the last skb in the queue is MSG_OOB skb. In such a situation, TCP returns 0 immediately regardless of blocking or non-blocking. Let's follow the behaviour. Fixes: 314001f0bf92 ("af_unix: Add OOB support") Reported-by: Fahad Alharbi <fahad@codepure.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260902202202.892676-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07af_unix: Update last skb marker in manage_oob().Kuniyuki Iwashima
Fahad Alharbi reported that blocking recv(MSG_PEEK) could hog CPU due to OOB skb. In the following cases, manage_oob() skips OOB skb(s) and returns NULL for the last recv(MSG_PEEK): socketpair(AF_UNIX, SOCK_STREAM, 0, sk); 1) skb -> OOB skb -> NULL send(sk[0], "ab", 2, MSG_OOB); recv(sk[1], buf, 0, MSG_PEEK); 2) skb -> consumed OOB skb -> NULL send(sk[0], "ab", 2, MSG_OOB); recv(sk[1], buf, 1, MSG_OOB); recv(sk[1], buf, 0, MSG_PEEK); 3) consumed OOB skb -> OOB skb -> NULL send(sk[0], "a", 1, MSG_OOB); recv(sk[1], buf, 0, MSG_OOB); send(sk[0], "b", 1, MSG_OOB); recv(sk[1], buf, 1, MSG_PEEK); Then, @copied is 0 in unix_stream_read_generic() (zero-length buffer, or non-OOB skb is not yet consumed), and unix_stream_data_wait() is called. However, it returns immediately because @last is not updated in unix_stream_read_generic(), and the thread busy-waits for a new skb. Let's update @last in manage_oob(). For MSG_PEEK, @last is updated with the skipped OOB, and for the non-peek case, @last matches the returned value (when !copied) because OOB is unlinked. Note that manage_oob() is inlined and no stack canary is added. Fixes: 22dd70eb2c3d ("af_unix: Don't peek OOB data without MSG_OOB.") Reported-by: Fahad Alharbi <fahad@codepure.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260902202202.892676-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07Merge branch 'remove-comma-after-sentinel-entries-in-match-table'Jakub Kicinski
Siddharth Vadapalli says: ==================== Remove comma after sentinel entries in match table This series removes the comma present after sentinel entries in the match tables across all networking subsystem drivers, with the exception of the davinci_mdio.c driver, for which, the patch posted by Geert at: https://lore.kernel.org/r/e481b6de46cecc6ea604ae165272c667274cc621.1788437140.git.geert+renesas@glider.be/ does the same. Since I inquired about a cleanup across the entire networking subsystem but didn't get a response: https://lore.kernel.org/r/b3d19098-eccd-4619-b667-ad3b7e0a4422@ti.com/ I decided to post this series. Given that Andrew Lunn acknowledged the cleanup of the davinci_mdio driver: https://lore.kernel.org/r/abec6831-d344-489d-b70c-1e5dd4d43c2d@lunn.ch/ and I don't see why the cleanup is specific to davinci_mdio driver alone, I am hoping that this series is treated identically to the patch that Geert had posted for the davinci_mdio driver. ==================== Link: https://patch.msgid.link/20260904043724.2955444-1-s-vadapalli@ti.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: wan: slic_ds26522: Remove comma after sentinel-entry in match-tableSiddharth Vadapalli
Since sentinel is the last entry and we do not expect further entries following it, remove the comma. Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: phy: nxp-c45-tja11xx: Remove comma after sentinel-entry in match-tableSiddharth Vadapalli
Since sentinel is the last entry and we do not expect further entries following it, remove the comma. Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: pcs: xpcs-plat: Remove comma after sentinel-entry in match-tableSiddharth Vadapalli
Since sentinel is the last entry and we do not expect further entries following it, remove the comma. Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: mdio: bcm-unimac: Remove comma after sentinel-entry in match-tableSiddharth Vadapalli
Since sentinel is the last entry and we do not expect further entries following it, remove the comma. Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: mdio: bcm-iproc: Remove comma after sentinel-entry in match-tableSiddharth Vadapalli
Since sentinel is the last entry and we do not expect further entries following it, remove the comma. Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: ethernet: ti: cpsw_new: Remove comma after sentinel-entry in match-tableSiddharth Vadapalli
Since sentinel is the last entry and we do not expect further entries following it, remove the comma. Reviewed-by: Alexander Sverdlin <alex@sverdlin.org> Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: ethernet: ti: cpsw: Remove comma after sentinel-entry in match-tableSiddharth Vadapalli
Since sentinel is the last entry and we do not expect further entries following it, remove the comma. Reviewed-by: Alexander Sverdlin <alex@sverdlin.org> Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: ti: am65-cpsw-nuss: Remove comma after sentinel-entry in match-tableSiddharth Vadapalli
Since sentinel is the last entry and we do not expect further entries following it, remove the comma. Reviewed-by: Alexander Sverdlin <alex@sverdlin.org> Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Link: https://patch.msgid.link/20260904043724.2955444-27-s-vadapalli@ti.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07net: spacemit: k1_emac: Remove comma after sentinel-entry in match-tableSiddharth Vadapalli
Since sentinel is the last entry and we do not expect further entries following it, remove the comma. Acked-by: Vivian Wang <wangruikang@iscas.ac.cn> Reviewed-by: Troy Mitchell <troy.mitchell@linux.spacemit.com> Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Link: https://patch.msgid.link/20260904043724.2955444-26-s-vadapalli@ti.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-23 20:52:50 +0000