summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-05Merge branch ↵Jakub Kicinski
'net-airoha-support-multiple-net_devices-connected-to-the-same-gdm-port' Lorenzo Bianconi says: ==================== net: airoha: Support multiple net_devices connected to the same GDM port EN7581 or AN7583 SoCs support connecting multiple external SerDes (e.g. Ethernet or USB SerDes) to GDM3 or GDM4 ports via a hw arbiter that manages the traffic in a TDM manner. As a result multiple net_devices can connect to the same GDM{3,4} port and there is a theoretical "1:n" relation between GDM ports and net_devices. ┌─────────────────────────────────┐ │ │ ┌──────┐ │ P1 GDM1 ├────►MT7530│ │ │ └──────┘ │ │ ETH0 (DSA conduit) │ │ │ PSE/FE │ │ │ │ │ │ │ ┌─────┐ │ P0 CDM1 ├────►QDMA0│ │ P4 P9 GDM4 │ └─────┘ └──┬─────────────────────────┬────┘ │ │ ┌──▼──┐ ┌────▼────┐ │ PPE │ │ ARB │ └─────┘ └─┬─────┬─┘ │ │ ┌──▼──┐┌─▼───┐ │ ETH ││ USB │ └─────┘└─────┘ ETH1 ETH2 This series introduces support for multiple net_devices connected to the same Frame Engine (FE) GDM port (GDM3 or GDM4) via an external hw arbiter. Please note GDM1 or GDM2 does not support the connection with the external arbiter. ==================== Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-0-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: airoha: Support multiple LAN/WAN interfaces for hw MAC address ↵Lorenzo Bianconi
configuration The EN7581 and AN7583 SoCs provide registers to configure hardware LAN/WAN MAC addresses. These registers are used during FE hw acceleration to determine whether received traffic is destined to this host (L3 traffic) or should be switched to another device (L2 traffic). The SoC hardware design assumes all interfaces configured as LAN (or WAN) share the MAC address MSBs, which are programmed into the REG_FE_{LAN,WAN}_MAC_H register. The LSBs of 'local' mac addresses can be expressed as a range via the REG_FE_MAC_LMIN and REG_FE_MAC_LMAX registers. In order to properly accelerate the traffic, FE module requires the user to configure the REG_FE_{LAN,WAN}_MAC_H register respecting this limitation. Please note a misconfiguration in REG_FE_{LAN,WAN}_MAC_H will still allow the user to log into the device for debugging. Previously, only a single interface was considered when programming these registers. Extend the logic to derive the correct minimum and maximum values for REG_FE_MAC_LMIN/REG_FE_MAC_LMAX when two or more interfaces are configured as LAN or WAN. Since this functionality was not available before this series, no regression is introduced. Tested-by: Madhur Agrawal <madhur.agrawal@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-6-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: airoha: Introduce WAN device flagLorenzo Bianconi
Introduce WAN flag to specify if a given device is used to transmit/receive WAN or LAN traffic. Current codebase supports specifying LAN/WAN device configuration in ndo_init() callback during device bootstrap. In order to consider setups where LAN configuration is used even for GDM3/GDM4 devices, check airoha_is_lan_gdm_dev() to select pse_port in airoha_ppe_foe_entry_prepare(). Please note after this patch, it will be possible to specify multiple LAN devices but just a single WAN one. Please note this change is not visible to the user since airoha_eth driver currently supports just the internal phy available via the MT7530 DSA switch and there are no WAN interfaces officially supported since PCS/external phy is not merged mainline yet (it will be posted with following patches). Tested-by: Xuegang Lu <xuegang.lu@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-5-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: airoha: Do not stop GDM port if it is sharedLorenzo Bianconi
Theoretically, in the current codebase, two independent net_devices can be connected to the same GDM port so we need to check the GDM port is not used by any other running net_device before setting the forward configuration to FE_PSE_PORT_DROP. Moreover, always set in GDM_LONG_LEN_MASK field of REG_GDM_LEN_CFG register the maximum MTU of all running net_devices connected to the same GDM port. Tested-by: Xuegang Lu <xuegang.lu@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-4-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: airoha: Support multiple net_devices for a single FE GDM portLorenzo Bianconi
EN7581 or AN7583 SoCs support connecting multiple external SerDes (e.g. Ethernet or USB SerDes) to GDM3 or GDM4 ports via a hw arbiter that manages the traffic in a TDM manner. As a result multiple net_devices can connect to the same GDM{3,4} port and there is a theoretical "1:n" relation between GDM ports and net_devices. ┌─────────────────────────────────┐ │ │ ┌──────┐ │ P1 GDM1 ├────►MT7530│ │ │ └──────┘ │ │ ETH0 (DSA conduit) │ │ │ PSE/FE │ │ │ │ │ │ │ ┌─────┐ │ P0 CDM1 ├────►QDMA0│ │ P4 P9 GDM4 │ └─────┘ └──┬─────────────────────────┬────┘ │ │ ┌──▼──┐ ┌────▼────┐ │ PPE │ │ ARB │ └─────┘ └─┬─────┬─┘ │ │ ┌──▼──┐┌─▼───┐ │ ETH ││ USB │ └─────┘└─────┘ ETH1 ETH2 Introduce support for multiple net_devices connected to the same Frame Engine (FE) GDM port (GDM3 or GDM4) via an external hw arbiter. Please note GDM1 or GDM2 does not support the connection with the external arbiter. Add get_dev_from_sport callback since EN7581 and AN7583 have different logics for the net_device type connected to GDM3 or GDM4. Tested-by: Xuegang Lu <xuegang.lu@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-3-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: airoha: Remove private net_device pointer in airoha_gdm_dev structLorenzo Bianconi
Remove redundant net_device pointer inside airoha_gdm_dev struct and rely on netdev_from_priv routine instead. Please note this patch does not introduce any logical change, just code refactoring. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-2-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05dt-bindings: net: airoha: Add GDM port ethernet child nodeLorenzo Bianconi
EN7581 and AN7583 SoCs support connecting multiple external SerDes to GDM3 or GDM4 ports via a hw arbiter that manages the traffic in a TDM manner. As a result multiple net_devices can connect to the same GDM{3,4} port and there is a theoretical "1:n" relation between GDM ports and net_devices. Introduce the ethernet node child of a specific GDM port in order to model a given net_device that is connected via the external arbiter to the GDM{3,4} port. This new ethernet node is defined by the "airoha,eth-port" compatible string. Please note GDM1 and GDM2 does not support the connection with the external arbiter and they are represented by an ethernet node defined by the "airoha,eth-mac" compatible string. Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-1-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05Merge branch 'net-mdio-realtek-rtl9300-refactor-initialization-and-port-lookup'Jakub Kicinski
Markus Stockhausen says: ==================== net: mdio: realtek-rtl9300: Refactor initialization and port lookup The Realtek Otto switch platform consists of four different series - RTL838x aka maple : 28 port 1G Switches - RTL839x aka cypress : 52 port 1G Switches - RTL930x aka longan : 28 port 1G/2.5G/10G Switches - RTL931x aka mango : 56 port 1G/2.5G/10G Switches A lot has been done to enhance the ethernet MDIO driver for simple integration of more SoCs. Now it is time to solve inconveniences that were discovered during daily operation. That includes - Consistent "of" API usage - Tightening error handling and improving overall robustness. - Adding support for PHY packages. - Fixing setup order issues. These currently hinder the driver from properly enabling the hardware on devices where U-Boot skips the setup and leaves the controller registers untouched. ==================== Link: https://patch.msgid.link/20260603175924.123019-1-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: mdio: realtek-rtl9300: Correctly handle ethernet-phy-packageManuel Stocker
Realtek Otto switches usually make use of multiport PHYs (e.g. 8 port 1G RTL8218D or 4 port 2.5G RTL8224). The device tree can describe this fact via an "ethernet-phy-package" node that resides between the bus and the PHY node. When looking up the device tree bus node via the chain port->phy->parent the driver totally ignores the existence of a PHY package. Enhance the lookup to take care of this feature. Link: https://github.com/openwrt/openwrt/pull/23591 Signed-off-by: Manuel Stocker <mensi@mensi.ch> Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260603175924.123019-8-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: mdio: realtek-rtl9300: reorder controller setupMarkus Stockhausen
After the former refactoring the existing otto_emdio_9300_mdiobus_init() contains only the c22/c45 bus mode setup. Like the topology setup this must run before bus registration. Otherwise the bus does not "speak" the right protocol for PHY setup. This setup is device-specific and other SoCs will need to set up other register bits in the controller in the future. Therefore - Relocate c22/c45 device tree readout to the very beginning of the probing - Add a new device-specific setup_controller() into the info structure. - Relocate otto_emdio_priv to satisfy the new info structure dependency. - Rename otto_emdio_9300_mdiobus_init accordingly and add it to the RTL9300 info structure. At the same time, adapt register naming for the function to make it clear that it only applies to this SoC. - Call setup_controller() prior to bus registration. Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260603175924.123019-7-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: mdio: realtek-rtl9300: relocate c22/c45 device tree readoutMarkus Stockhausen
otto_emdio_map_ports() is the central place to lookup the topology and the properties of the Realtek ethernet MDIO controller from the device tree. Deviating from this the c22/c45 detection via "ethernet-phy-ieee802.3-c45" is running separately in otto_emdio_probe_one(). It loops over the same nodes, just at a later point in time. There is no benefit to divide this setup and to have a time window where the data structure is only filled partially. Additionally it uses the "fwnode" API. Consolidate the setup and convert it to the "of" API. Remark. This is a subtle change for dangling PHY nodes (not referenced by ethernet-ports). Before this commit all PHY nodes were evaluated for c45 setup, now only the referenced ones. Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260603175924.123019-6-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: mdio: realtek-rtl9300: relocate topology setupMarkus Stockhausen
Until now the driver sets up the port to bus/address topology of the controller after all buses are set up via otto_emdio_probe_one(). This does not work for devices where U-Boot skips this setup. It is not only needed for the hardware internal background PHY polling engine but it is essential for access to the PHYs during probing. Depending on the SoC type there exist two different register arrays - Bus mapping registers (RTL930x, RTL931x) define to which bus the port is attached. E.g. [1] - Address mapping registers (RTL838x, RTL930x, RTL931x) define to which address of the bus the port is attached. E.g. [2] Relocate the topology setup and make it generic. For this - Define device-specific bus_base/addr_base attributes that give the register base address where the mapping lives. In case one or both are not given the SoC does not support this specific type of mapping. - Create a helper otto_emdio_setup_topology() that writes the detected topology to the registers. - Call this helper prior to otto_emdio_probe_one(). - Remove unneeded code from otto_emdio_9300_mdiobus_init(). - Due to the added prefixes, increase define indentation Subtle change: The old coding used regmap_bulk_write and silently wrote bus=0/address=0 to mapping registers for ports that are out of scope. The new coding leaves those untouched. [1] https://svanheule.net/realtek/longan/register/smi_port0_15_polling_sel [2] https://svanheule.net/realtek/longan/register/smi_port0_5_addr_ctrl Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260603175924.123019-5-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: mdio: realtek-rtl9300: harden otto_emdio_probe_one()Markus Stockhausen
The bus probing of the MDIO driver uses a two stage approach. 1. The device tree "ethernet-ports" node is scanned to build a mapping between ports and PHYs. 2. The children of the device tree "controller" are scanned to create the individual MDIO buses. The first step already checks the consistency of the PHY and bus nodes that are linked via the ports. But it might miss a dangling bus child node that is not linked. Step two simply iterates over all bus child nodes and might read malformed data from nodes not checked in step one. Harden this and return a meaningful error message. Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260603175924.123019-4-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: mdio: realtek-rtl9300: harden otto_emdio_map_ports()Markus Stockhausen
Due to its design the MDIO driver needs to set up a port to bus/address mapping during probing. The "ethernet-ports" subnodes are scanned and from the "phy-handle" property the MDIO nodes are looked up. In case of a malformed device tree the driver might produce out-of-bounds accesses. The PHY address is not checked against the maximum supported address. Add a sanity check and drop the unneeded MAX_SMI_ADDR define. Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260603175924.123019-3-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: mdio: realtek-rtl9300: Refactor otto_emdio_map_ports()Markus Stockhausen
This function has multiple issues: - It uses __free low level cleanups - It mixes "fwnode" and "of" functions Convert this to a uniform "of" usage and manual reference counting cleanup. With that also fix two subtle lookup bugs in the original code. mdio_dn = phy_dn->parent; if (mdio_dn->parent != dev->of_node) continue; This skips an API access and therefore misses reference counting. Additionally in the case of a very buggy device tree, phy_dn might be a root node. Looking up its grandparent leads to a NULL pointer access. Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260603175924.123019-2-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bnge: fix context mem iterationVikas Gupta
The firmware advertises context memory (backing store) types through a linked list, with BNGE_CTX_INV serving as the end-of-list sentinel. However, the driver incorrectly assumes that the list is strictly ordered and prematurely terminates traversal when it encounters an unrecognized type (>=BNGE_CTX_V2_MAX). As a result, any valid context types that appear later in the chain are silently skipped, leading to incomplete memory configuration and eventual driver load failure. Fix this by traversing the entire list until the BNGE_CTX_INV sentinel is reached, while safely ignoring only those context types that fall outside the supported range. Fixes: 29c5b358f385 ("bng_en: Add backing store support") Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com> Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: stmmac: dwmac4: Report DCB feature capabilityOvidiu Panait
Bit 16 of the MAC HW Feature1 register reports the DCB (Data Centre Bridging) feature. Read it so that dma_cap.dcben and the debugfs report it accurately. Right now it is always reported as being disabled. Signed-off-by: Ovidiu Panait <ovidiu.panait.rb@renesas.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260603173644.24371-1-ovidiu.panait.rb@renesas.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: ena: PHC: Add missing barrierArthur Kiyanovski
Add dma_rmb() barrier after req_id completion check in ena_com_phc_get_timestamp(). On weakly-ordered architectures, payload fields may be read before req_id is observed as updated. Fixes: e0ea34158ee8 ("net: ena: Add PHC support in the ENA driver") Closes: https://sashiko.dev/#/patchset/20260430032507.11586-1-akiyano%40amazon.com Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: airoha: Add NULL check for of_reserved_mem_lookup() in ↵ZhaoJinming
airoha_qdma_init_hfwd_queues() of_reserved_mem_lookup() may return NULL if the reserved memory region referenced by the "memory-region" phandle is not found in the reserved memory table (e.g. due to a misconfigured DTS or a removed memory-region node). The current code dereferences the returned pointer without checking for NULL, leading to a kernel NULL pointer dereference at the following lines: dma_addr = rmem->base; // line 1156 num_desc = div_u64(rmem->size, buf_size); // line 1160 Add a NULL check after of_reserved_mem_lookup() and return -ENODEV if the lookup fails, which is consistent with the existing error handling for of_parse_phandle() failure in the same code block. Fixes: 3a1ce9e3d01b ("net: airoha: Add the capability to allocate hwfd buffers via reserved-memory") Cc: stable@vger.kernel.org Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05hsr: broadcast netlink notifications in the device's net namespaceMaoyi Xie
The HSR generic netlink family sets .netnsok = true. HSR devices can live in network namespaces other than init_net. Two async notifiers broadcast events with genlmsg_multicast(). They are hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers only on the default genl socket in init_net. So the events always land in init_net. The network namespace of the device does not matter. This has two effects. A listener in the device's own namespace never sees its own ring error and node down events. A privileged listener in init_net receives events from HSR devices in other namespaces. The payload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave port ifindex (HSR_A_IFINDEX). Switch both callers to genlmsg_multicast_netns(). Other families with .netnsok = true already do this. Examples are gtp, ovpn, team, batman-adv, netdev-genl, ethtool and handshake. hsr_nl_ringerror() already has the slave port. It uses dev_net(port->dev). hsr_nl_nodedown() takes the namespace from the master port via hsr_port_get_hsr(). Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Link: https://patch.msgid.link/20260604054949.2999304-1-maoyixie.tju@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05Merge branch 'net-devmem-allow-bind-rx-from-non-init-user-namespaces'Jakub Kicinski
Bobby Eshleman says: ==================== net: devmem: allow bind-rx from non-init user namespaces NETDEV_CMD_BIND_RX is GENL_ADMIN_PERM, which checks CAP_NET_ADMIN against init_user_ns. With netkit and netns support for devmem, it is now useful to let workloads holding CAP_NET_ADMIN only in their own user_ns issue bind-rx for a netns owned by that user_ns. The first patch switches the flag to GENL_UNS_ADMIN_PERM so the check uses the target netns's owning user_ns. Init remains permitted. The second patch just adds test cases. They are identical to nk_devmem.py tests, but using a non-init userns. ==================== Link: https://patch.msgid.link/20260602-nl-prov-v2-0-ad721142c641@meta.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05selftests: drv-net: add userns devmem RX testBobby Eshleman
Add userns_devmem.py, which mirrors nk_devmem.py but places the netkit guest in a netns whose owning user_ns is non-init. ncdevmem is ran there via nsenter so the bind-rx call is issued with creds that hold CAP_NET_ADMIN only in the child user_ns. Without the preceding GENL_UNS_ADMIN_PERM patch the test fails at bind-rx with EPERM, but with the patch the transfer completes and tests pass. Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20260602-nl-prov-v2-2-ad721142c641@meta.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: devmem: allow bind-rx from non-init user namespacesBobby Eshleman
NETDEV_CMD_BIND_RX is currently GENL_ADMIN_PERM, which checks CAP_NET_ADMIN against init userns. With recent container/netkit/ns support for devmem, other userns/netns use cases come online and require bind-rx to allow CAP_NET_ADMIN in non-init user ns as well. Switch the flag to GENL_UNS_ADMIN_PERM to allow bind-rx for CAP_NET_ADMIN in the netns's owning userns as well. Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20260602-nl-prov-v2-1-ad721142c641@meta.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05Merge tag 'drm-fixes-2026-06-06' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Dave Airlie: "Weekly drm fixes, not contributing to things settling down unfortunately. Lots of driver fixes for various bounds checks, leaks and UAF type things, i915/xe probably the most sane, amdgpu has a mix of fixes all over, then ethosu has lots of small fixes. The problem of fixing thing in private has really hit us with the change handle ioctl, and "Sima was right" and we should have disabled the ioctl, since it was only introduced a couple of kernels ago and failed to upstream it's tests in time. The patch here fixes the problems Sima identified, but disables the ioctl as well, with a list of known problems in it and a request for proper tests to be written and upstreamed. It's a niche user ioctl designed for CRIU with AMD ROCm, so I think it's fine to just disable it. Maybe this week will settle down. core: - disable the gem change handle ioctl for security reasons (plan to fix it on list later with proper test coverage) dumb-buffer: - remove strict limits on buffer geometry amdgpu: - BT.2020 fix for DCE - DC bounds checking fixes - SDMA 7.1 fix - UserQ fixes - SI fix - SMU 13 fixes - SMU 14 fixes - GC 12.1 fix - Userptr fix - GC 10.1 fix - GART fix for non-4K pages amdkfd: - UAF race fix - Fix a potential NULL pointer dereference - GC 11 buffer overflow fix for SDMA xe: - Revert removing support for unpublished NVL-S GuC - Suspend fixes related to multi-queue i915: - Fix color blob reference handling in intel_plane_state - Revert "drm/i915/backlight: Remove try_vesa_interface" ethosu: - reject unsupported NPU_OP_RESIZE - fix index of IFM region - fix weight index - fix overflows in DMA-size calculations - reject DMA commands with uninitialized length - fix OOB write in ethosu_gem_cmdstream_copy_and_validate imx: - fix kernel-doc warnings ivpu: - add overflow checks in firmware handling and get_info_ioctl v3d: - wait for pending L2T flush before cleaning caches - fix leak of vaddr - skip CSD when it has zeroed workgroups - fix ref counting in performance monitoring" * tag 'drm-fixes-2026-06-06' of https://gitlab.freedesktop.org/drm/kernel: (50 commits) drm/gem: Try to fix change_handle ioctl, attempt 4 Revert "drm/i915/backlight: Remove try_vesa_interface" accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() accel/ethosu: reject DMA commands with uninitialized length accel/ethosu: fix arithmetic issues in dma_length() accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85 accel/ethosu: reject NPU_OP_RESIZE commands from userspace accel/ethosu: fix IFM region index out-of-bounds in command stream parser drm/v3d: Fix global performance monitor reference counting drm/xe/multi_queue: skip submit when primary queue is suspended drm/xe: Clear pending_disable before signaling suspend fence Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems drm/amdgpu/userq: move wptr_obj cleanup in mqd_destroy drm/amdgpu: improve the userq seq BO free bit lookup drm/amdgpu/userq: remove the vital queue unmap logging drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 drm/amdkfd: fix NULL dereference in get_queue_ids() drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14) ...
2026-06-05ipv6: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL()Eric Dumazet
These symbols don't need to be exported, they are only used from vmlinux: - inet6addr_notifier_call_chain - inet6addr_validator_notifier_call_chain - in6addr_linklocal_allnodes - in6addr_linklocal_allrouters - in6addr_interfacelocal_allnodes - in6addr_interfacelocal_allrouters - in6addr_sitelocal_allrouters - inet6_cleanup_sock - ip6_sk_dst_lookup_flow - ipv6_proxy_select_ident - ip6_sk_update_pmtu - ip6_sk_redirect Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260604174555.2801532-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05ipv4: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL()Eric Dumazet
These symbols no longer need to be exported, they are only used from vmlinux: - inet_send_prepare - inet_splice_eof - inet_sk_rebuild_header - inet_current_timestamp - snmp_fold_field - snmp_get_cpu_field64 - snmp_fold_field64 - fib_nh_common_release - fib_nh_common_init - fib_nexthop_info - fib_add_nexthop - ip_build_and_send_pkt - ipv4_sk_update_pmtu - ipv4_sk_redirect - rt_dst_clone Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260604173413.2782008-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05Merge branch 'bridge-prepare-lockless-br_port_fill_attrs-i'Jakub Kicinski
Eric Dumazet says: ==================== bridge: prepare lockless br_port_fill_attrs() (I) medium-term goal is to allow "ip link show" dump commands to run without RTNL. This round of patches adds/fixes some lockess accesses in bridge. This is not complete, more patches will come later. Ultimately all changes to p->flags should use set_bit()/clear_bit(). I repeat (AI agents might read this cover ?): Many p->flags accesses are racy, and will hopefully be fixed in a future series. ==================== Link: https://patch.msgid.link/20260604141343.2124500-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bridge: read p->flags once in br_port_fill_attrs()Eric Dumazet
We might run br_port_fill_attrs() locklessly in the future. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260604141343.2124500-12-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bridge: provide lockless access to p->config_pendingEric Dumazet
Needed for sysfs show_config_pending(), BRCTL_GET_PORT_INFO and upcoming RTNL avoidance in "ip link" dumps (cf br_port_fill_attrs()). Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260604141343.2124500-11-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bridge: provide lockless access to p->port_idEric Dumazet
sysfs show_port_id() and BRCTL_GET_PORT_INFO need this. This will be needed for upcoming RTNL avoidance in "ip link" dumps (cf br_port_fill_attrs()). Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260604141343.2124500-10-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bridge: provide lockless access to p->priorityEric Dumazet
sysfs show_priority() needs this. Also br_port_fill_attrs() might in the future run without RTNL. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260604141343.2124500-9-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bridge: provide lockless access to p->designated_portEric Dumazet
Add READ_ONCE()/WRITE_ONCE() annotations around p->designated_port This is needed at least for sysfs show_designated_port(), BRCTL_GET_PORT_INFO and upcoming RTNL avoidance in "ip link" dumps (cf br_port_fill_attrs()). Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260604141343.2124500-8-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bridge: provide lockless access to p->designated_costEric Dumazet
Add READ_ONCE()/WRITE_ONCE() annotations around p->designated_cost This is needed at least for sysfs show_designated_cost(), BRCTL_GET_PORT_INFO and upcoming RTNL avoidance in "ip link" dumps (cf br_port_fill_attrs()). Signed-off-by: Eric Dumazet <edumazet@google.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260604141343.2124500-7-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bridge: provide lockless access to p->path_costEric Dumazet
Add READ_ONCE()/WRITE_ONCE() annotations around p->path_cost. This is needed at least for sysfs show_path_cost(), BRCTL_GET_PORT_INFO and upcoming RTNL avoidance in "ip link" dumps (cf br_port_fill_attrs()). Signed-off-by: Eric Dumazet <edumazet@google.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260604141343.2124500-6-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bridge: use BR_ADMIN_COST_BITEric Dumazet
Use set_bit() and test_bit() lockless functions. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260604141343.2124500-5-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bridge: use BR_PROMISC_BITEric Dumazet
Use BR_PROMISC_BIT and set_bit(), clear_bit() and test_bit() lockless functions. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260604141343.2124500-4-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bridge: add bridge_flags_bit enumEric Dumazet
We want to use atomic operations for lockless p->flags changes and reads. Add definitions for bits in addition of masks so that we can use test_bit(), clear_bit() and set_bit() in subsequent patches. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260604141343.2124500-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05bridge: add a READ_ONCE() in br_timer_value()Eric Dumazet
br_timer_value() can be called locklessly, the expires field could be changed concurrently. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260604141343.2124500-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05selftests: net: do not detect PPPoX loopbackQingfang Deng
By default, pppd attempts to detect loopbacks on the underlying interface using a pseudo-randomly generated magic number and checks if the same value is received. The seed for the PRNG is a hash of hostname XOR current time XOR pid, which is likely to collide on NIPA, causing false positives. Disable magic number generation. Reported-by: Matthieu Baerts <matttbe@kernel.org> Fixes: 7af2a94f4dcf ("selftests: net: add tests for PPPoL2TP") Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev> Link: https://patch.msgid.link/20260603061746.23452-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: cpsw_new: unregister devlink on port registration failureGuangshuo Li
cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregisters the notifiers and then releases the lower level resources. It does not undo the successful cpsw_register_devlink() call, leaving the devlink instance and its parameters registered after probe has failed. Add a devlink cleanup label for the path where devlink registration has already succeeded, and use it when port registration fails. Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Alexander Sverdlin <alexander.sverdlin@siemens.com> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Link: https://patch.msgid.link/20260604043115.1409134-1-lgs201920130244@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05Merge branch 'intel-wired-lan-driver-updates-2026-06-02-i40e-ice-idpf'Jakub Kicinski
Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-06-02 (ice, idpf) Petr Oros adds missing callbacks for U.FL DPLL pins on ice. Alok Tiwari corrects copy/paste error causing incorrect reporting of PTP mailbox capability for idpf. ==================== Link: https://patch.msgid.link/20260602225513.393338-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05idpf: fix mailbox capability for set device clock timeAlok Tiwari
The current code incorrectly uses VIRTCHNL2_CAP_PTP_SET_DEVICE_CLK_TIME for both direct and mailbox capabilities, causing mailbox-only support to be ignored and potentially reporting IDPF_PTP_NONE. Fixes: d5dba8f7206da ("idpf: add PTP clock configuration") Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260602225513.393338-4-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05ice: fix missing priority callbacks for U.FL DPLL pinsPetr Oros
The U.FL2 input pin advertises DPLL_PIN_CAPABILITIES_PRIORITY_CAN_CHANGE in its capability mask, but ice_dpll_pin_ufl_ops does not provide .prio_get and .prio_set callbacks. As a result the DPLL subsystem cannot report or accept priority for U.FL pins: pin-get omits the prio field on U.FL2 and pin-set with prio is rejected as invalid, even though the capability is present. This prevents user space from using priority to select or disable U.FL2 as a DPLL input source. Reproducer with iproute2 (dpll command): # dpll pin show board-label U.FL2 pin id 16: module-name ice board-label U.FL2 type ext capabilities priority-can-change|state-can-change parent-device: id 0 direction input state selectable phase-offset 0 /* note: no "prio" between "direction" and "state", even though priority-can-change is advertised */ # dpll pin set id 16 parent-device 0 prio 5 RTNETLINK answers: Operation not supported After the fix the prio field is reported by pin show and pin set with prio is accepted on U.FL2. Add the missing .prio_get and .prio_set callbacks to ice_dpll_pin_ufl_ops, reusing ice_dpll_sw_input_prio_{get,set}. The same ops struct is shared by U.FL1 and U.FL2: U.FL2 (input) delegates to the backing hardware input pin, while U.FL1 (output) does not advertise DPLL_PIN_CAPABILITIES_PRIORITY_CAN_CHANGE so the dpll core capability gate never invokes prio_set for it, and prio_get reports the OUTPUT sentinel (ICE_DPLL_PIN_PRIO_OUTPUT) on the output side exactly like the SMA path does today. Fixes: 2dd5d03c77e2 ("ice: redesign dpll sma/u.fl pins control") Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Signed-off-by: Petr Oros <poros@redhat.com> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260602225513.393338-3-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05selftests/bpf: Fix test_lirc testSean Young
Since commit 68a99f6a0ebf ("media: lirc: report ir receiver overflow"), the rc-loopback driver does not accept edges over 50ms, as these are never seen in real life ir protocols. Fix this. Signed-off-by: Sean Young <sean@mess.org> Link: https://lore.kernel.org/r/20260605151417.777614-1-sean@mess.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05Merge branch 'add-validation-for-bpf_set_retval-helper'Alexei Starovoitov
Xu Kuohai says: ==================== Add validation for bpf_set_retval helper From: Xu Kuohai <xukuohai@huawei.com> The bpf_set_retval() helper is used by cgroup BPF programs to set the return value of the kernel hook. The argument type for this helper is ARG_ANYTHING. This allows setting a positive value, which no cgroup hook expects and can cause issues, such as the kernel panic reported in [1]. This series adds validation for the argument of the bpf_set_retval() helper. For BPF_LSM_CGROUP, the same validation as BPF_LSM_MAC is enforced, i.e. validate the argument against the LSM hook specific range, which is returned by bpf_lsm_get_retval_range(). For all other cgroup program types, restrict the argument to [-MAX_ERRNO, 0], which matches the kernel convention of 0 for success and negative errno for error. BPF_CGROUP_GETSOCKOPT is an exception from this restriction, since valid getsockopt implementations may return positive values (e.g. optlen), as allowed by commit c4dcfdd406aa ("bpf: Move getsockopt retval to struct bpf_cg_run_ctx"). [1] https://lore.kernel.org/all/567d3206-74a5-44e5-99c6-779c425f399e@std.uestc.edu.cn v5: - Use resolve_prog_type(env->prog) instead of env->prog->type for prog type checks - Target bpf-next tree v4: https://lore.kernel.org/bpf/20260604130458.617765-1-xukuohai@huaweicloud.com - Remove the return value limit for BPF_CGROUP_GETSOCKOPT type - Refine the range of return value of bpf_get_retval helper v3: https://lore.kernel.org/bpf/20260530101239.590395-1-xukuohai@huaweicloud.com/ - Mark R1 as precise to prevent validation bypass via branch pruning (sashiko) v2: https://lore.kernel.org/bpf/20260530055557.549474-1-xukuohai@huaweicloud.com/ - Extend validation from LSM cgroup BPF type to all cgroup BPF types (sashiko) v1: https://lore.kernel.org/bpf/20260523085806.417723-1-xukuohai@huaweicloud.com/ ==================== Link: https://patch.msgid.link/20260605140243.664590-1-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05selftests/bpf: Add tests for bpf_set_retval validationXu Kuohai
Add verifier tests to validate bpf_set_retval argument for cgroup program types. Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> #v1 Signed-off-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/r/20260605140243.664590-4-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05bpf: Add validation for bpf_set_retval argumentXu Kuohai
The bpf_set_retval() helper is used by cgroup BPF programs to set the return value of the target hook. The argument type for this helper is ARG_ANYTHING. This allows setting a positive value, which no cgroup hook expects and can cause issues, such as: - BPF_LSM_CGROUP: a positive value from bpf_lsm_socket_create bypasses the err < 0 check in __sock_create(), leaving the socket object unallocated. The positive return value is then propagated to the syscall entry __sys_socket(), which also bypasses the IS_ERR() guard and ultimately causes a NULL pointer dereference. - BPF_CGROUP_DEVICE: a positive value can be returned through cgroup device bpf prog -> devcgroup_check_permission() -> bdev_permission() -> bdev_file_open_by_dev(), where ERR_PTR(positive) produces a pointer that IS_ERR() does not catch, leading to a wild pointer dereference. - BPF_CGROUP_SOCK: a positive value can be returned through cgroup sock bpf prog -> __cgroup_bpf_run_filter_sk() -> inet_create() -> __sock_create(), where inet_create() frees the newly allocated sk via sk_common_release() and sets sock->sk = NULL on the non-zero return, but __sock_create() only checks err < 0 for cleanup, so a positive retval bypasses cleanup and returns a socket with NULL sk to userspace, triggering a NULL pointer dereference on subsequent socket operations. - BPF_CGROUP_SYSCTL: a positive value can be returned through the cgroup bpf prog -> __cgroup_bpf_run_filter_sysctl() -> proc_sys_call_handler(), where a non-zero return bypasses the normal sysctl proc_handler and is returned directly to userspace as return value of read() or write() syscall. So add validation for the argument of the bpf_set_retval() helper. For BPF_LSM_CGROUP, enforce the LSM hook specific range returned by bpf_lsm_get_retval_range(). For all other cgroup program types, restrict the argument to [-MAX_ERRNO, 0], which matches the kernel convention of 0 for success and negative errno for error. BPF_CGROUP_GETSOCKOPT is an exception, since valid getsockopt implementations may return positive values, as allowed by commit c4dcfdd406aa ("bpf: Move getsockopt retval to struct bpf_cg_run_ctx"). Also refine the return value range of bpf_get_retval() so that values returned by bpf_get_retval() can be passed directly to bpf_set_retval() without extra manual bounds checking. Fixes: b44123b4a3dc ("bpf: Add cgroup helpers bpf_{get,set}_retval to get/set syscall return value") Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor") Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn> Closes: https://lore.kernel.org/all/567d3206-74a5-44e5-99c6-779c425f399e@std.uestc.edu.cn Signed-off-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/r/20260605140243.664590-3-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05selftests/bpf: Restrict bpf_set_retval argument in sk_bypass_prot_memXu Kuohai
Test sk_bypass_prot_mem passes an unchecked value as argument to helper bpf_set_retval(). The argument can be outside the valid range enforced by the strict retval validation added in the next patch. Restrict the argument to -EFAULT when it is outside the valid range, so the test will not be rejected by the verifier when retval validation is enforced. Signed-off-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/r/20260605140243.664590-2-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-06drm/gem: Try to fix change_handle ioctl, attempt 4Simona Vetter
[airlied: just added some comments on how to reenable] On-list because the cat is out of the bag and we're clearly not good enough to figure this out in private. The story thus far: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") tried to fix a race condition between the gem_close and gem_change_handle ioctls, but got a few things wrong: - There's a confusion with the local variable handle, which is actually the new handle, and so the two-stage trick was actually applied to the wrong idr slot. 7164d78559b0 ("drm/gem: fix race between change_handle and handle_delete") tried to fix that by adding yet another code block, but forgot to add the error handling. Which meant we now have two paths, both kinda wrong. - dc366607c41c ("drm: Replace old pointer to new idr") tried to apply another fix, but inconsistently, again because of the handle confusion - this would be the right fix (kinda, somewhat, it's a mess) if we'd do the two-stage approach for the new handle. Except that wasn't the intent of the original fix. We also didn't have an igt merged for the original ioctl, which is a big no-go. This was attempted to address off-list in the original bugfix, and amd QA people claimed the bug was fixed now. Very clearly that's not the case. Here's my attempt to sort this out: - Rename the local variable to new_handle, the old aliasing with args->handle is just too dangerously confusing. - Merge the gem obj lookup with the two-stage idr_replace so that we avoid getting ourselves confused there. - This means we don't have a surplus temporary reference anymore, only an inherited from the idr. A concurrent gem_close on the new_handle could steal that. Fix that with the same two-stage approach create_tail uses. This is a bit overkill as documented in the comment, but I also don't trust my ability to understand this all correctly, so go with the established pattern we have from other ioctls instead for maximum paranoia. - Adjust error paths. I've tried to make the error and success paths common, because they are identical except for which handle is removed and on which we call idr_replace to (re)install the object again. But that made things messier to read, so I've left it at the more verbose version, which unfortunately hides the symmetry in the entire code flow a bit. - While at it, also replace the 7 space indent with 1 tab. And finally, because I flat out don't trust my abilities here at all anymore: - Disable the ioctl until we have the igt situation and everything else sorted out on-list and with full consensus. v2: Sashiko noticed that I didn't handle the error path for idr_replace correctly, it must be checked with IS_ERR_OR_NULL like in gem_handle_delete. So yeah, definitely should just the existing paths 1:1 because this is endless amounts of tricky. Also add the Fixes: line for the original ioctl, I forgot that too. Reported-by: DARKNAVY (@DarkNavyOrg) <vr@darknavy.com> Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch> Fixes: dc366607c41c ("drm: Replace old pointer to new idr") Cc: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Cc: Edward Adam Davis <eadavis@qq.com> Cc: Dave Airlie <airlied@redhat.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Fixes: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") Cc: David Francis <David.Francis@amd.com> Cc: Puttimet Thammasaeng <pwn8official@gmail.com> Cc: Christian Koenig <Christian.Koenig@amd.com> Fixes: 7164d78559b0 ("drm/gem: fix race between change_handle and handle_delete") Cc: Zhenghang Xiao <kipreyyy@gmail.com> Fixes: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") Reviewed-by: David Francis <David.Francis@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/20260604194437.1725314-1-simona.vetter@ffwll.ch
2026-06-05Merge branch ↵Alexei Starovoitov
'bpf-fix-sysctl-new-value-handling-in-__cgroup_bpf_run_filter_sysctl' Dawei Feng says: ==================== bpf: fix sysctl new-value handling in __cgroup_bpf_run_filter_sysctl This series fixes three bugs in the sysctl write-buffer replacement path of __cgroup_bpf_run_filter_sysctl(). It resolves a kvzalloc()/kfree() mismatch, adds a missing NUL terminator to the replacement string, and updates a stale return value check to safely restore the replacement functionality. Patch Summary: - patch 1 NUL-terminates the replaced sysctl value - patch 2 uses kvfree() for the replaced sysctl write buffer - patch 3 restores sysctl new-value replacement Changelog: v2 -> v3: - reordered patches 1 and 2 - added the missing Reviewed-by/Acked-by tags to patches 2 and 3 - fixed the incorrect Fixes tag in patch 3 - simplified the dynamic test logs in patch 1 and 2, and updated titles ==================== Link: https://patch.msgid.link/20260603105317.944304-1-dawei.feng@seu.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>