kernel/git/stable/linux.git/net/rds, branch master

Merge tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-08-27T20:53:43+00:00

Pull networking fixes from Jakub Kicinski: "Including fixes from Bluetooth, IPSec and Netfilter. Current release - fix to a fix: - netfilter: ipset: remove need to allocate memory on delete operations Current release - regressions: - macb: drop CONFIG_OF #if block, fix build Previous releases - always broken: - stream of fixes for SCTP continues - inet: frags: strip GSO state from fragments before reassembly - virtio-net: ensure that TCP packets don't overflow gso_segs - tcp-ao: fix use-after-free of current_key on reconnect to another peer - page_pool: remove zone/policy GFP flags when allocating XArray entries - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN - tls: device: fix out-of-bounds write in tls_append_frag() - eth: bnxt: - ring the doorbell when SW USO exits early, avoid packets stuck in Tx - gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid users of older NICs seeing non-actionable warning messages - eth: qede: fix NULL pointer dereference in TPA fragment processing" * tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits) inet: frags: strip GSO state from fragments before reassembly net/sched: sch_htb: limit htb_classify inner-class filter hops selftests/net: packetdrill: add tcp_urg_ptr_retransmit tcp: fix corruption of urgent data on multi-segment retransmit usb: atm: usbatm: fix invalid ci_range initialization net: fec: only stop PTP if it was initialized slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() net: bridge: mcast: fix use-after-free of a master VLAN's multicast context net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup net: dsa: mxl862xx: enable assisted learning on CPU port net: stmmac: restore NET_IP_ALIGN in the RX DMA offset net: stmmac: drop gso_enabled_types and rely on netdev features net: stmmac: selftests: Don't test flow control for small rx fifos net: stmmac: selftests: Account for the UC filter list for filtering tests net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering net: stmmac: dwmac4: Account for the primary MAC address for UC filtering net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering net: stmmac: selftests: Check multiple MMC counters selftests: net: Fix slow configurations in big_tcp_tunnels.sh selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh ...

net/rds: use wq_has_sleeper() in rds_cong_map_updated()

2026-08-24T19:03:25+00:00

rds_cong_map_updated() runs after a peer's congestion map has been rewritten (by rds_tcp_cong_recv() and rds_ib_cong_recv(), or the clear-all in the loopback and IB send-completion paths). It bumps rds_cong_generation and then checks waitqueue_active() on map->m_waitq and on rds_poll_waitq to decide whether anyone needs waking. atomic_inc() carries no ordering and waitqueue_active() is a plain load, so nothing orders the map and generation stores before the wait queue reads. The waiters do the mirror image: rds_cong_wait() adds itself to m_waitq and then tests the port bit, and rds_poll() registers on rds_poll_waitq and then reads the generation. That is the store-buffering pattern described above waitqueue_active() in include/linux/wait.h - the updater can observe an empty wait queue while the waiter still observes the port as congested, and no wake-up is issued. rds_cong_wait() is an interruptible sleep with no timeout, so a sender blocked on a congested port stays blocked until the next congestion update from that peer arrives or a signal is delivered. A poll() waiter misses the map-updated notification the same way. Use wq_has_sleeper(), which is waitqueue_active() preceded by the required full barrier, as rds_tcp_state_change() already does for the same pattern. Fixes: 922cb17a5c81 ("RDS: Congestion-handling code") Signed-off-by: Allison Henderson Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260822052647.88318-1-achender@kernel.org Signed-off-by: Jakub Kicinski

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

2026-08-21T18:48:54+00:00

Pull RDMA updates from Jason Gunthorpe: "About the normal size, still a lot of AI bug fixes and so on, but some interesting new functionality too: - Assorted locking, bounds-checking, cleanup, and error-path fixes across UCMA/CMA, bng_re, bnxt_re, cxgb4, EFA, ERDMA, HFI1, HNS, ionic, iRDMA, mlx4/mlx5, RXE, SIW, SRP/SRPT, and iSER target. - netlink report for max # of supported resources - get_zeroed_page()/etc removal - Robust udata for ionic - Allow unique RDMA device names per network namespace - Completion counters and v2 admit queue support for EFA - UC QP support for MANA - Completion timestamps for ionic - Harden uverbs data validation and resource lifetime handling, fixing several core use-after-free conditions. - bnxt_re toggle-page ownership and lifetime bug fixes - dmabuf SRQ support for mlx5" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (160 commits) RDMA/ucma: Allow path records to exactly fit the output buffer RDMA/uverbs: Guard legacy bundles without method_elm RDMA/efa: Add support for 128B admin v2 SQ entry RDMA/efa: Generalize the admin SQ RDMA/efa: Decouple admin command payload from admin header RDMA/rxe: Fix OOB in free_rd_atomic_resources() RDMA/cma: Fix WARNING in res_to_rt RDMA/cxgb4: Free debugfs on registration failure RDMA/cxgb4: Cancel reg_work before freeing device on remove RDMA/ucma: Lock the handler in ucma_set_ib_path() RDMA/ucma: Lock the handler in ucma_write_cm_event() RDMA/erdma: restrict the driver to little-endian systems RDMA/ionic: Embed counter driver data in rdma_counter allocation RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget RDMA/siw: Fix use-after-free in siw_accept() IB/isert: post the full-feature receive buffers after session registration IB/isert: delay the final Login Response until the session is registered RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ RDMA/erdma: Hold QP references for AE and CM processing RDMA/erdma: Hold CQ references when processing EQ events ...

net/rds: clear i_rx_lat_trace in rds_inc_path_init()

2026-08-13T10:53:14+00:00

The commit that introduced the receive-path latency trace added the clearing of inc->i_rx_lat_trace[] to rds_inc_init() only; rds_inc_path_init() never got it. That asymmetry matters for the one caller that reuses memory: rds_tcp_data_recv() carves its rds_tcp_incoming out of a kmem_cache with no zeroing and no constructor, so after rds_inc_path_init() the array still holds the timestamps of whatever message previously occupied that slab object. No stale value is user-visible today - every message that reaches the socket happens to overwrite all four slots (RX_HDR at allocation, RX_START when the header completes, RX_END at delivery, RX_CMSG at recvmsg time) before RDS_CMSG_RXPATH_LATENCY reads them back as deltas - but that is a property of the current writers, not of the init contract, and a future trace point or an early-exit path would expose another message's timestamps to userspace. Clear the array in rds_inc_path_init() too, so both init helpers leave the inc fully initialized. memset is the form the clearing already takes on the rds_inc_init() side since commit 1635bb548f84 ("net: rds: use memset to optimize the recv"). Hardening only; no user-visible bug in the current code. Assisted-by: Claude-Code:claude-fable-5 Signed-off-by: Allison Henderson Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260810055631.299558-1-achender@kernel.org Signed-off-by: Paolo Abeni

net/rds: initialize i_conn_path in rds_inc_init()

2026-08-13T10:52:29+00:00

rds_inc_init() initializes every field of the embedded rds_incoming except i_conn_path, and incomings are not zero-allocated (IB carves them out of a slab cache). The field therefore holds stale garbage for incs created by rds_ib. The loopback transport is different: rds_loop_xmit() re-runs rds_inc_init() on the message's embedded inc after rds_send_queue_rm() has already stored the connection path in it, so there the field holds a live value rather than garbage, and a NULL store would discard it. Switch rds_loop_xmit() to rds_inc_path_init() with the connection's single path, which is exactly the value readers of the field reconstruct for a non-multipath transport. With loopback preserving the field, initialize it to NULL in rds_inc_init() so that any future reader trips over a clean NULL pointer instead of a stale one, and so the two init helpers (rds_inc_init/rds_inc_path_init) leave the structure in an equivalent, fully-initialized state. Hardening only; no reader dereferences i_conn_path for a non-multipath transport today. This mirrors Oracle UEK commit "rds: rds_inc_init() should initialize the inc->i_conn_path field". Signed-off-by: William Kucharski [achender: port to net-next; keep loopback's i_conn_path valid by switching rds_loop_xmit() to rds_inc_path_init(); update commit message] Assisted-by: Claude-Code:claude-fable-5 Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260809005103.82371-3-achender@kernel.org Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni

net/rds: reinitialize to_be_dropped on rds_send_xmit() restart

2026-08-13T10:52:29+00:00

The to_be_dropped list is declared once at the top of rds_send_xmit() but the function can loop via "goto restart" after each batch. The code currently relies on rds_send_remove_from_sock() having emptied the list entry by entry (via list_del_init()) at the end of the previous batch; nothing in rds_send_xmit() itself guarantees the list head is empty when a new batch starts. Re-initialize the list on every restart, and warn once if it is ever found non-empty there: entries left on the list at that point would keep their message reference, their RDS_MSG_ON_SOCK accounting and their pending RDS_RDMA_DROPPED notification, so a silent re-init would orphan them. This is hardening: no user-visible bug is known in the current code. This mirrors Oracle UEK commit "net/rds: rds_send_xmit should INIT_LIST_HEAD(&to_be_dropped) on restart". Signed-off-by: Gerd Rausch Signed-off-by: Sharath Srinivasan [achender: port to net-next (keep the existing LIST_HEAD declaration and add only the restart re-init); warn if the restart invariant is violated; update commit message] Assisted-by: Claude-Code:claude-fable-5 Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260809005103.82371-2-achender@kernel.org Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni

rds: synchronize info callbacks with module unload

2026-08-06T00:51:48+00:00

rds_info_getsockopt() reads a callback from rds_info_funcs and invokes it without protecting the callback's lifetime. Transport modules register functions stored in this array. For example, rds_tcp.ko registers rds_tcp_tc_info() for RDS_INFO_TCP_SOCKETS. This permits the following interleaving: CPU0 CPU1 rds_info_getsockopt() func = rds_tcp_tc_info rmmod rds_tcp rds_tcp_exit() rds_info_deregister_func() rds_info_funcs[offset] = NULL free rds_tcp module text func() The reader can therefore branch to an address in unloaded module text. Protect callback invocation with SRCU. Enter the SRCU read-side critical section before loading the callback and leave it only after the callback returns. Clear the callback with WRITE_ONCE() and call synchronize_srcu() before deregistration returns, preventing module unload from freeing its text while an old reader is still executing it. SRCU is required because callbacks such as RDS_INFO_COUNTERS can sleep. Keep the callback array unannotated and use READ_ONCE() and WRITE_ONCE() for concurrent slot access so sparse does not have to apply __rcu through the function-pointer typedef. Replace the two callback-slot BUG_ON() checks with WARN_ON_ONCE() and return without changing the slot on mismatch. Link: https://lore.kernel.org/netdev/20260720184955.3008978-1-nicoyip.dev@gmail.com/ Suggested-by: Allison Henderson Suggested-by: Kuniyuki Iwashima Reviewed-by: Allison Henderson Signed-off-by: Chengfeng Ye Link: https://patch.msgid.link/20260801054234.3535077-1-nicoyip.dev@gmail.com Signed-off-by: Jakub Kicinski

net/rds: unpin MR pages with unpin_user_pages_dirty_lock()

2026-08-05T01:01:02+00:00

The pages backing an RDS memory region are pinned in __rds_rdma_map() with rds_pin_pages(), which uses pin_user_pages_fast(): each page's refcount is biased by GUP_PIN_COUNTING_BIAS to account the pin. The scatterlist is then handed to the IB transport, and the transport releases the pages in __rds_ib_teardown_mr() with set_page_dirty(page); put_page(page); put_page() drops a single reference instead of removing the pin bias, so every MR teardown permanently strands the remaining references and the pages are never freed - a userspace-triggerable memory leak of up to RDS_MAX_MSG_SIZE per RDS_GET_MR/RDS_GET_MR_FOR_DEST call. The conversion to the pin API updated the unpin sites in rdma.c but missed this one on the transport side. Release the pages with unpin_user_pages_dirty_lock(), which removes the pin bias and also dirties the page under the folio lock, closing the truncation race that a bare set_page_dirty() leaves open. Dirtying under the folio lock can sleep, which is safe in every path that reaches __rds_ib_teardown_mr(): the registration-reuse path (rds_ib_map_frmr()) runs in syscall context, and the pool flush (rds_ib_unreg_frmr()) runs under pool->flush_lock, a mutex, and already sleeps in rds_ib_post_inv(). The WARN_ON that guarded the old irq-context set_page_dirty() case is dropped along with it. Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260730041629.3512480-5-achender@kernel.org Signed-off-by: Jakub Kicinski

net/rds: fix rds_message leak in the rds_send_xmit() drop path

2026-08-05T01:00:58+00:00

When rds_send_xmit() picks the next message off cp_send_queue it takes its own reference with rds_message_addref(). If the message then hits the never-retransmit check (RDS_MSG_FLUSH, or an RDMA op that was already retransmitted), it is moved to the local to_be_dropped list and that reference is dropped after the batch. However, if RDS_MSG_ON_CONN has already been cleared, the message is not added to to_be_dropped and the reference taken above is never dropped: cp_xmit_rm has not been set at this point, so the loop simply abandons rm and the rds_message (and everything it pins: pages, MRs, notifiers) leaks after an RDMA error. The only other places that clear RDS_MSG_ON_CONN are rds_send_path_drop_acked() and rds_send_drop_to(), and both can run while rds_send_xmit() has dropped cp_lock between moving the message to cp_retrans and re-taking the lock in the never-retransmit check: rds_send_path_drop_acked() can ack away a message that already sat on cp_retrans - the RDS_MSG_RETRANSMITTED case above - and rds_send_drop_to() runs on socket close. Both unlink the message under cp_lock and put their own reference, leaving the xmit-path reference stranded. Drop the reference directly in that case. This mirrors Oracle UEK commit "net/rds: fix rds_message memleak in rds_send_xmit". Signed-off-by: Gerd Rausch Signed-off-by: Sharath Srinivasan [achender: port to net-next; update commit message, checkpatch nits] Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260730041629.3512480-4-achender@kernel.org Signed-off-by: Jakub Kicinski

net/rds: hold the socket while an rds_mr references it

2026-08-05T01:00:54+00:00

Each rds_mr stores a bare back pointer to the socket that created it (mr->r_sock) but takes no reference on it. When the mr is destroyed it references the rs. Hence, provisions must be made to avoid the rs being destroyed before all mrs referencing it have been destroyed. The MR itself is refcounted, and in-flight messages legitimately hold MR krefs that can outlive the socket: rds_release() drops the rb-tree references via rds_rdma_drop_keys(), but a send completion arriving afterwards drops the final message reference from the CQ handler and ends up in rds_message_purge() __rds_put_mr_final() rds_destroy_mr() -> takes rs->rs_rdma_lock dereferencing a socket that may already have been freed. Oracle UEK fixed the same use-after-free ("rds: Add proper refcnt when an RDS MR references an RDS Socket") after seeing crashes of the form: PF: supervisor write access in kernel mode _raw_spin_lock_irqsave+0x4a/0x6a __rds_put_mr_final+0x2c/0xe0 [rds] rds_message_purge+0x13c/0x150 [rds] rds_message_put+0x39/0x54 [rds] rds_ib_send_cqe_handler+0x147/0x3dd [rds_rdma] To fix this, take a socket reference when an MR is created and drop it when the final MR kref goes away. The reference cycle is broken by rds_release(), which always runs rds_rdma_drop_keys() on close. So the socket reference held by an MR never prevents release, it only delays sk_free() until the last MR user is done. The hold sits next to kref_init() at both allocation sites - __rds_rdma_map() and the on-demand-paging path in rds_cmsg_rdma_args() - so every MR owns exactly one socket reference from the moment it becomes kref-managed. For that to work on the ODP path, its get_mr() error handling is converted from a bare kfree() to kref_put(..., __rds_put_mr_final), with r_trans_private cleared first since it holds an ERR_PTR there; both sites then tear down through the same path and a future error-path change cannot silently leak or double-drop the reference. Signed-off-by: Håkon Bugge [achender: port to net-next (sock_hold/sock_put in place of the UEK rds_sock_addref/rds_sock_put helpers); also balance the reference on the rds_cmsg_rdma_args() ODP path and unify its error path with __rds_put_mr_final(); update commit message] Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260730041629.3512480-3-achender@kernel.org Signed-off-by: Jakub Kicinski