* Re: [PATCH v1 net-next] selftest: net: Use port outside of the default ip_local_ports in csum.c.
From: Jakub Kicinski @ 2026-04-12 16:47 UTC (permalink / raw)
To: Willem de Bruijn
Cc: Kuniyuki Iwashima, David S. Miller, Eric Dumazet, Paolo Abeni,
Simon Horman, Willem de Bruijn, Mahesh Bandewar,
Kuniyuki Iwashima, netdev
In-Reply-To: <willemdebruijn.kernel.15ccd7e646278@gmail.com>
On Sat, 11 Apr 2026 15:18:56 -0400 Willem de Bruijn wrote:
> > diff --git a/tools/testing/selftests/net/lib/csum.c b/tools/testing/selftests/net/lib/csum.c
> > index e28884ce3ab3..4e044689bc37 100644
> > --- a/tools/testing/selftests/net/lib/csum.c
> > +++ b/tools/testing/selftests/net/lib/csum.c
> > @@ -105,9 +105,9 @@ static char *cfg_mac_src;
> > static int cfg_proto = IPPROTO_UDP;
> > static int cfg_payload_char = 'a';
> > static int cfg_payload_len = 100;
> > -static uint16_t cfg_port_dst = 34000;
>
> This is paired with wait_port_listen(3400, .. in
> tools/testing/selftests/drivers/net/hw/csum.py
FWIW I can confirm that this caused the HW testing in NIPA to fail
the csum test since Friday.
^ permalink raw reply
* Re: [PATCH net-next 00/11] netfilter: updates for net-next
From: Jakub Kicinski @ 2026-04-12 16:40 UTC (permalink / raw)
To: Florian Westphal
Cc: netdev, Paolo Abeni, David S. Miller, Eric Dumazet,
netfilter-devel, pablo
In-Reply-To: <20260410112352.23599-1-fw@strlen.de>
On Fri, 10 Apr 2026 13:23:41 +0200 Florian Westphal wrote:
> 1-3) IPVS updates from Julian Anastasov to enhance visibility into
> IPVS internal state by exposing hash size, load factor etc and
> allows userspace to tune the load factor used for resizing hash
> tables.
Someone should take a look at the Sashiko reports for those, please?
^ permalink raw reply
* Re: [PATCH net 1/1] net/sched: act_ct: Only release RCU read lock after ct_ft
From: patchwork-bot+netdevbpf @ 2026-04-12 16:40 UTC (permalink / raw)
To: Jamal Hadi Salim
Cc: netdev, davem, edumazet, kuba, pabeni, horms, jiri,
zdi-disclosures, security, victor
In-Reply-To: <20260410111627.46611-1-jhs@mojatatu.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 10 Apr 2026 07:16:27 -0400 you wrote:
> When looking up a flow table in act_ct in tcf_ct_flow_table_get(),
> rhashtable_lookup_fast() internally opens and closes an RCU read critical
> section before returning ct_ft.
> The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()
> is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft
> object. This vulnerability can lead to privilege escalation.
>
> [...]
Here is the summary with links:
- [net,1/1] net/sched: act_ct: Only release RCU read lock after ct_ft
https://git.kernel.org/netdev/net/c/f462dca0c841
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net 1/2] can: ucan: fix devres lifetime
From: patchwork-bot+netdevbpf @ 2026-04-12 16:40 UTC (permalink / raw)
To: Marc Kleine-Budde
Cc: netdev, davem, kuba, linux-can, kernel, johan, stable,
jakob.unterwurzacher
In-Reply-To: <20260409165942.588421-2-mkl@pengutronix.de>
Hello:
This series was applied to netdev/net.git (main)
by Marc Kleine-Budde <mkl@pengutronix.de>:
On Thu, 9 Apr 2026 18:57:07 +0200 you wrote:
> From: Johan Hovold <johan@kernel.org>
>
> USB drivers bind to USB interfaces and any device managed resources
> should have their lifetime tied to the interface rather than parent USB
> device. This avoids issues like memory leaks when drivers are unbound
> without their devices being physically disconnected (e.g. on probe
> deferral or configuration changes).
>
> [...]
Here is the summary with links:
- [net,1/2] can: ucan: fix devres lifetime
https://git.kernel.org/netdev/net/c/fed4626501c8
- [net,2/2] can: raw: fix ro->uniq use-after-free in raw_rcv()
https://git.kernel.org/netdev/net/c/a535a9217ca3
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net 1/2] netfilter: skip recording stale or retransmitted INIT
From: Xin Long @ 2026-04-12 16:35 UTC (permalink / raw)
To: Florian Westphal
Cc: network dev, linux-sctp, davem, kuba, Eric Dumazet, Paolo Abeni,
Simon Horman, Marcelo Ricardo Leitner, Yi Chen
In-Reply-To: <adqsEmki7ppz9T1g@strlen.de>
On Sat, Apr 11, 2026 at 4:16 PM Florian Westphal <fw@strlen.de> wrote:
>
> Xin Long <lucien.xin@gmail.com> wrote:
>
> > diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> > index 645d2c43ebf7..7e10fa65cbdd 100644
> > --- a/net/netfilter/nf_conntrack_proto_sctp.c
> > +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> > @@ -466,9 +466,13 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
> > if (!ih)
> > goto out_unlock;
> >
> > - if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir])
> > - ct->proto.sctp.init[!dir] = 0;
> > - ct->proto.sctp.init[dir] = 1;
> > + /* Do not record INIT matching peer vtag (stale or retransmitted INIT). */
> > + if (old_state == SCTP_CONNTRACK_NONE ||
> > + ct->proto.sctp.vtag[!dir] != ih->init_tag) {
>
> Should ct->proto.sctp.vtag[!dir] == ih->init_tag case also
> set ignore = true?
It should for a stale INIT, but not for a retransmitted one. At this point,
though, we don't reliably distinguish between the two.
Also, as this patch only aims to prevent updating ct->proto.sctp.init[]
(introduced in 8e56b063c865) in this scenario, it’s safer to avoid
changing other behavior.
Thanks.
^ permalink raw reply
* Re: [PATCH net v2] net: fix __this_cpu_add() in preemptible code in dev_xmit_recursion_inc/dec
From: Jakub Kicinski @ 2026-04-12 16:33 UTC (permalink / raw)
To: Jiayuan Chen, Eric Dumazet
Cc: netdev, David S. Miller, David Ahern, Paolo Abeni, Simon Horman,
Weiming Shi, linux-kernel
In-Reply-To: <20260410020631.191786-1-jiayuan.chen@linux.dev>
On Fri, 10 Apr 2026 10:06:30 +0800 Jiayuan Chen wrote:
> dev_xmit_recursion_{inc,dec}() use __this_cpu_{inc,dec}() which requires
> the caller to be non-preemptible in order to avoid cpu migration. However,
> some callers like SCTP's UDP encapsulation path invoke iptunnel_xmit()
> from process context without disabling BH or preemption:
>
> sctp_inet_connect -> __sctp_connect -> sctp_do_sm ->
> sctp_outq_flush -> sctp_packet_transmit -> sctp_v4_xmit ->
> udp_tunnel_xmit_skb -> iptunnel_xmit -> dev_xmit_recursion_inc
Eric, weren't there also a bunch of RCU reports because of this path?
Should we perhaps take the RCU read lock here?
> + guard(migrate)();
Sorry but I detest the guard() usage. Please use migrate_disable()
Quoting documentation:
Use of ``guard()`` is discouraged within any function longer than 20
lines, ``scoped_guard()`` is considered more readable. Using normal
lock/unlock is still (weakly) preferred.
See:
https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs
^ permalink raw reply
* Re: [PATCH v2 2/2] MAINTAINERS: update PTP maintainer entries after directory split
From: David Woodhouse @ 2026-04-12 16:32 UTC (permalink / raw)
To: Jakub Kicinski
Cc: Wen Gu, tglx, richardcochran, andrew+netdev, davem, edumazet,
pabeni, linux-kernel, netdev, jstultz, anna-maria, frederic,
daniel.lezcano, sboyd, vladimir.oltean, wei.fang, xiaoning.wang,
jonathan.lemon, vadim.fedorenko, yangbo.lu, svens, nick.shi,
ajay.kaher, alexey.makhalov, bcm-kernel-feedback-list, linux-fpga,
imx, linux-s390, dust.li, xuanzhuo, mani, imran.shaik, taniya.das
In-Reply-To: <20260412084704.743482ad@kernel.org>
On 12 April 2026 16:47:04 BST, Jakub Kicinski <kuba@kernel.org> wrote:
>On Tue, 7 Apr 2026 18:48:02 +0800 Wen Gu wrote:
>> +PTP EMULATED CLOCK SUPPORT
>> +M: David Woodhouse <dwmw2@infradead.org>
>> +M: Wen Gu <guwen@linux.alibaba.com>
>> +M: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
>> +L: linux-kernel@vger.kernel.org
>> +S: Maintained
>> +T: git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git timers/core
>
>Hi David,
>
>Do you have a tree to route the patches thru? Or do you really have
>access to the tip tree?
I do not have access to the tip tree. I can make a shared tree on git.infradead.org if the other two maintainers would like to send me a SSH pubkey and preferred username...
^ permalink raw reply
* Re: [PATCH net-next] tcp: add indirect call wrapper in tcp_conn_request()
From: patchwork-bot+netdevbpf @ 2026-04-12 16:31 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, horms, ncardwell, kuniyu, netdev,
eric.dumazet
In-Reply-To: <20260410174950.745670-1-edumazet@google.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 10 Apr 2026 17:49:50 +0000 you wrote:
> Small improvement in SYN processing, to directly call
> tcp_v6_init_seq_and_ts_off() or tcp_v4_init_seq_and_ts_off().
>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> include/net/tcp.h | 6 ++++++
> net/ipv4/tcp_input.c | 5 ++++-
> net/ipv4/tcp_ipv4.c | 2 +-
> net/ipv6/tcp_ipv6.c | 2 +-
> 4 files changed, 12 insertions(+), 3 deletions(-)
Here is the summary with links:
- [net-next] tcp: add indirect call wrapper in tcp_conn_request()
https://git.kernel.org/netdev/net-next/c/29703d7813f9
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [GIT PULL] wireless-next-2026-04-10
From: patchwork-bot+netdevbpf @ 2026-04-12 16:31 UTC (permalink / raw)
To: Johannes Berg; +Cc: netdev, linux-wireless
In-Reply-To: <20260410064703.735099-3-johannes@sipsolutions.net>
Hello:
This pull request was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 10 Apr 2026 08:44:33 +0200 you wrote:
> Hi,
>
> Final (obviously) pull request for now, the only thing to
> note is the crypto changes, FWIW the change touching crypto
> was acked by Herbert and he asked me to take it:
> https://lore.kernel.org/r/adYNVB3n358xm_s8@gondor.apana.org.au/
>
> [...]
Here is the summary with links:
- [GIT,PULL] wireless-next-2026-04-10
https://git.kernel.org/netdev/net-next/c/118cbd428e43
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [net,PATCH v2] net: ks8851: Reinstate disabling of BHs around IRQ handler
From: Marek Vasut @ 2026-04-12 16:27 UTC (permalink / raw)
To: Jakub Kicinski
Cc: netdev, stable, David S. Miller, Andrew Lunn, Eric Dumazet,
Nicolai Buchwitz, Paolo Abeni, Ronald Wahl, Yicong Hui,
linux-kernel
In-Reply-To: <20260412090141.21bf1534@kernel.org>
On 4/12/26 6:01 PM, Jakub Kicinski wrote:
> On Wed, 8 Apr 2026 18:24:58 +0200 Marek Vasut wrote:
>> If CONFIG_PREEMPT_RT=y is set AND the driver executes ks8851_irq() AND
>> KSZ_ISR register bit IRQ_RXI is set AND ks8851_rx_pkts() detects that
>> there are packets in the RX FIFO, then netdev_alloc_skb_ip_align() is
>> called to allocate SKBs. If netdev_alloc_skb_ip_align() is called with
>> BH enabled, local_bh_enable() at the end of netdev_alloc_skb_ip_align()
>> will call __local_bh_enable_ip(), which will call __do_softirq(), which
>> may trigger net_tx_action() softirq, which may ultimately call the xmit
>> callback ks8851_start_xmit_par(). The ks8851_start_xmit_par() will try
>> to lock struct ks8851_net_par .lock spinlock, which is already locked
>> by ks8851_irq() from which ks8851_start_xmit_par() was called. This
>> leads to a deadlock, which is reported by the kernel, including a trace
>> listed below.
>
> lock_par is a spinlock, and AFAIU softirqs run in their on thread on RT.
> I'm not following.
Please look at the backtrace in the commit message, this part, please
read from bottom to top to observe the failure in chronological order.
It does not seem the handle_softirqs() is running in its own thread,
separate from the IRQ thread ?
rt_spin_lock from ks8851_start_xmit_par+0x68/0x1a0
ks8851_start_xmit_par from netdev_start_xmit+0x1c/0x40 <---- this
tries to grab the same PAR spinlock, and deadlocks
netdev_start_xmit from dev_hard_start_xmit+0xec/0x1b0
dev_hard_start_xmit from sch_direct_xmit+0xb8/0x25c
sch_direct_xmit from __qdisc_run+0x20c/0x4fc
__qdisc_run from qdisc_run+0x1c/0x28
qdisc_run from net_tx_action+0x1f4/0x244
net_tx_action from handle_softirqs+0x1c0/0x29c
handle_softirqs from __local_bh_enable_ip+0xdc/0xf4
__local_bh_enable_ip from __netdev_alloc_skb+0x140/0x194
__netdev_alloc_skb from ks8851_irq+0x348/0x4d8 <---- this is called
from ks8851_rx_pkts() via netdev_alloc_skb_ip_align()
ks8851_irq from irq_thread_fn+0x24/0x64 <-------- this here runs with
the PAR spinlock held
> The patch looks way to "advanced" for a driver. Something is going
> very wrong here. Or the commit message must be updated to explain
> it better to people like me. Or both.
Does the backtrace make the problem clearer, with the annotation above ?
^ permalink raw reply
* Re: [PATCH net-next] net: fix reference tracker mismanagement in netdev_put_lock()
From: patchwork-bot+netdevbpf @ 2026-04-12 16:20 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms, dw,
skhawaja, bestswngs, razor, daniel
In-Reply-To: <20260410153600.1984522-1-kuba@kernel.org>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 10 Apr 2026 08:36:00 -0700 you wrote:
> dev_put() releases a reference which didn't have a tracker.
> References without a tracker are accounted in the tracking
> code as "no_tracker". We can't free the tracker and then
> call dev_put(). The references themselves will be fine
> but the tracking code will think it's a double-release:
>
> refcount_t: decrement hit 0; leaking memory.
>
> [...]
Here is the summary with links:
- [net-next] net: fix reference tracker mismanagement in netdev_put_lock()
https://git.kernel.org/netdev/net-next/c/0aa72fc37e15
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next] tcp: return a drop_reason from tcp_add_backlog()
From: patchwork-bot+netdevbpf @ 2026-04-12 16:20 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, horms, ncardwell, kuniyu, netdev,
eric.dumazet
In-Reply-To: <20260409101147.1642967-1-edumazet@google.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 9 Apr 2026 10:11:47 +0000 you wrote:
> Part of a stack canary removal from tcp_v{4,6}_rcv().
>
> Return a drop_reason instead of a boolean, so that we no longer
> have to pass the address of a local variable.
>
> $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new
> add/remove: 0/0 grow/shrink: 0/3 up/down: 0/-37 (-37)
> Function old new delta
> tcp_v6_rcv 3133 3129 -4
> tcp_v4_rcv 3206 3202 -4
> tcp_add_backlog 1281 1252 -29
> Total: Before=25567186, After=25567149, chg -0.00%
>
> [...]
Here is the summary with links:
- [net-next] tcp: return a drop_reason from tcp_add_backlog()
https://git.kernel.org/netdev/net-next/c/f5148298b0fe
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [net-next PATCH 0/2] net: dsa: tag_rtl8_4: fixes doc and set keep
From: patchwork-bot+netdevbpf @ 2026-04-12 16:20 UTC (permalink / raw)
To: Luiz Angelo Daros de Luca
Cc: andrew, olteanv, davem, edumazet, kuba, pabeni, horms, netdev,
linux-kernel, alsi, linusw
In-Reply-To: <20260408-realtek_fixes-v1-0-915ff1404d56@gmail.com>
Hello:
This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 08 Apr 2026 17:31:00 -0300 you wrote:
> This small series addresses two points in the rtl8_4 tagger used by the
> realtel rtl8365mb driver.
>
> The first patch updates the documentation of the tag format while the
> second patch sets the KEEP flag bit, ensuring that the switch
> respects the frame's VLAN format as provided by the kernel.
>
> [...]
Here is the summary with links:
- [net-next,1/2] net: dsa: tag_rtl8_4: update format description
https://git.kernel.org/netdev/net-next/c/297e1f411ed4
- [net-next,2/2] net: dsa: tag_rtl8_4: set KEEP flag
https://git.kernel.org/netdev/net-next/c/82f37bd9a4d7
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next v2] net: Add net_cookie to Dead loop messages
From: patchwork-bot+netdevbpf @ 2026-04-12 16:20 UTC (permalink / raw)
To: Chris J Arges
Cc: davem, edumazet, kuba, pabeni, horms, dsahern, kernel-team,
netdev, linux-kernel
In-Reply-To: <20260408191056.1036330-1-carges@cloudflare.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 8 Apr 2026 14:10:47 -0500 you wrote:
> Network devices can have the same name within different network namespaces.
> To help distinguish these devices, add the net_cookie value which can be
> used to identify the netns.
>
> Signed-off-by: Chris J Arges <carges@cloudflare.com>
> ---
> v2: rebased on net-next
>
> [...]
Here is the summary with links:
- [net-next,v2] net: Add net_cookie to Dead loop messages
https://git.kernel.org/netdev/net-next/c/b258cba1e05d
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next] net: Rename ifq_idx to rxq_idx in netif_mp_* helpers
From: patchwork-bot+netdevbpf @ 2026-04-12 16:20 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: netdev, kuba, dw, pabeni, razor
In-Reply-To: <20260410130602.552600-1-daniel@iogearbox.net>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 10 Apr 2026 15:06:02 +0200 you wrote:
> Rename the leftover ifq_idx parameter naming to rxq_idx to be
> consistent with the rest of the file and the header declaration.
> Back then this was taken out of the queue leasing series given
> the cleanup is independent. No functional change.
>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> Link: https://lore.kernel.org/netdev/20260131160237.07789674@kernel.org
>
> [...]
Here is the summary with links:
- [net-next] net: Rename ifq_idx to rxq_idx in netif_mp_* helpers
https://git.kernel.org/netdev/net-next/c/59818773bab6
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next 0/2] ipvlan: multicast delivery changes
From: patchwork-bot+netdevbpf @ 2026-04-12 16:20 UTC (permalink / raw)
To: Eric Dumazet; +Cc: davem, kuba, pabeni, horms, netdev, eric.dumazet
In-Reply-To: <20260409085238.1122947-1-edumazet@google.com>
Hello:
This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 9 Apr 2026 08:52:36 +0000 you wrote:
> As we did recently for macvlan, this series adds some relief
> when ipvlan is under multicast storms.
>
> Eric Dumazet (2):
> ipvlan: ipvlan_handle_mode_l2() refactoring
> ipvlan: avoid spinlock contention in ipvlan_multicast_enqueue()
>
> [...]
Here is the summary with links:
- [net-next,1/2] ipvlan: ipvlan_handle_mode_l2() refactoring
https://git.kernel.org/netdev/net-next/c/441ec8b5bdcc
- [net-next,2/2] ipvlan: avoid spinlock contention in ipvlan_multicast_enqueue()
https://git.kernel.org/netdev/net-next/c/6dd82499fa6c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next v2] selftests: net: py: add test case filtering and listing
From: patchwork-bot+netdevbpf @ 2026-04-12 16:20 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms, willemb,
gal, leitao, shuah, petrm, linux-kselftest
In-Reply-To: <20260410013921.1710295-1-kuba@kernel.org>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 9 Apr 2026 18:39:21 -0700 you wrote:
> When developing new test cases and reproducing failures in
> existing ones we currently have to run the entire test which
> can take minutes to finish.
>
> Add command line options for test selection, modeled after
> kselftest_harness.h:
>
> [...]
Here is the summary with links:
- [net-next,v2] selftests: net: py: add test case filtering and listing
https://git.kernel.org/netdev/net-next/c/e46ff213f7a5
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [GIT PULL] bluetooth-next 2026-04-10
From: Jakub Kicinski @ 2026-04-12 16:16 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: davem, linux-bluetooth, netdev
In-Reply-To: <20260410172206.150975-1-luiz.dentz@gmail.com>
On Fri, 10 Apr 2026 13:22:06 -0400 Luiz Augusto von Dentz wrote:
> bluetooth-next pull request for net-next:
>
> core:
> - hci_core: Rate limit the logging of invalid ISO handle
> - hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
> - hci_event: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
> - hci_event: fix potential UAF in SSP passkey handlers
> - HCI: Avoid a couple -Wflex-array-member-not-at-end warnings
> - L2CAP: CoC: Disconnect if received packet size exceeds MPS
> - L2CAP: Add missing chan lock in l2cap_ecred_reconf_rsp
> - L2CAP: Fix printing wrong information if SDU length exceeds MTU
> - SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec
>
> drivers:
> - btusb: MT7922: Add VID/PID 0489/e174
> - btusb: Add Lite-On 04ca:3807 for MediaTek MT7921
> - btusb: Add MT7927 IDs ASUS ROG Crosshair X870E Hero, Lenovo Legion Pro 7
> 16ARX9, Gigabyte Z790 AORUS MASTER X, MSI X870E Ace Max, TP-Link
> Archer TBE550E, ASUS X870E / ProArt X870E-Creator.
> - btusb: Add MT7902 IDs 13d3/3579, 13d3/3580, 13d3/3594, 13d3/3596, 0e8d/1ede
> - btusb: MediaTek MT7922: Add VID 0489 & PID e11d
> - btintel: Add support for Scorpious Peak2 support
> - btintel: Add support for Scorpious Peak2F support
> - btintel_pcie: Add device id of Scorpius Peak2, Nova Lake-PCD-H
> - btintel_pcie: Add device id of Scorpious2, Nova Lake-PCD-S
> - btmtk: Add reset mechanism if downloading firmware failed
> - btmtk: Add MT6639 (MT7927) Bluetooth support
> - btmtk: fix ISO interface setup for single alt setting
> - btmtk: add MT7902 SDIO support
> - Bluetooth: btmtk: add MT7902 MCU support
> - btbcm: Add entry for BCM4343A2 UART Bluetooth
> - qca: enable pwrseq support for wcn39xx devices
> - hci_qca: Fix BT not getting powered-off on rmmod
> - hci_qca: disable power control for WCN7850 when bt_en is not defined
> - hci_qca: Fix missing wakeup during SSR memdump handling
> - hci_ldisc: Clear HCI_UART_PROTO_INIT on error
> - mmc: sdio: add MediaTek MT7902 SDIO device ID
> - hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x
Two fixes tags are messed up here:
Commit: 802446198014 ("Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array")
Fixes tag: Fixes: 4cdd001ff03f ("Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support")
Has these problem(s):
- Target SHA1 does not exist
Commit: 28c9cc700e30 ("Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU")
Fixes tag: Fixes: fa768fce4aae ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")
Has these problem(s):
- Target SHA1 does not exist
^ permalink raw reply
* Re: [net,PATCH v2] net: ks8851: Reinstate disabling of BHs around IRQ handler
From: Jakub Kicinski @ 2026-04-12 16:01 UTC (permalink / raw)
To: Marek Vasut
Cc: netdev, stable, David S. Miller, Andrew Lunn, Eric Dumazet,
Nicolai Buchwitz, Paolo Abeni, Ronald Wahl, Yicong Hui,
linux-kernel
In-Reply-To: <20260408162535.98108-1-marex@nabladev.com>
On Wed, 8 Apr 2026 18:24:58 +0200 Marek Vasut wrote:
> If CONFIG_PREEMPT_RT=y is set AND the driver executes ks8851_irq() AND
> KSZ_ISR register bit IRQ_RXI is set AND ks8851_rx_pkts() detects that
> there are packets in the RX FIFO, then netdev_alloc_skb_ip_align() is
> called to allocate SKBs. If netdev_alloc_skb_ip_align() is called with
> BH enabled, local_bh_enable() at the end of netdev_alloc_skb_ip_align()
> will call __local_bh_enable_ip(), which will call __do_softirq(), which
> may trigger net_tx_action() softirq, which may ultimately call the xmit
> callback ks8851_start_xmit_par(). The ks8851_start_xmit_par() will try
> to lock struct ks8851_net_par .lock spinlock, which is already locked
> by ks8851_irq() from which ks8851_start_xmit_par() was called. This
> leads to a deadlock, which is reported by the kernel, including a trace
> listed below.
lock_par is a spinlock, and AFAIU softirqs run in their on thread on RT.
I'm not following.
The patch looks way to "advanced" for a driver. Something is going
very wrong here. Or the commit message must be updated to explain
it better to people like me. Or both.
--
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net v3] net/sched: cls_fw: fix NULL dereference of "old" filters before change()
From: patchwork-bot+netdevbpf @ 2026-04-12 16:00 UTC (permalink / raw)
To: Davide Caratti
Cc: jhs, jiri, davem, edumazet, kuba, pabeni, horms, xmei5, netdev,
victor
In-Reply-To: <e39cbd3103a337f1e515d186fe697b4459d24757.1775661704.git.dcaratti@redhat.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 8 Apr 2026 17:24:36 +0200 you wrote:
> Like pointed out by Sashiko [1], since commit ed76f5edccc9 ("net: sched:
> protect filter_chain list with filter_chain_lock mutex") TC filters are
> added to a shared block and published to datapath before their ->change()
> function is called. This is a problem for cls_fw: an invalid filter
> created with the "old" method can still classify some packets before it
> is destroyed by the validation logic added by Xiang.
> Therefore, insisting with repeated runs of the following script:
>
> [...]
Here is the summary with links:
- [net,v3] net/sched: cls_fw: fix NULL dereference of "old" filters before change()
https://git.kernel.org/netdev/net/c/65782b2db732
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next v4 1/2] dt-bindings: net: ti: k3-am654-cpsw-nuss: Add ti,j722s-cpsw-nuss compatible
From: patchwork-bot+netdevbpf @ 2026-04-12 15:50 UTC (permalink / raw)
To: Nora Schiffer
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, nm, vigneshr,
kristo, s-vadapalli, rogerq, robh, krzk+dt, conor+dt, netdev,
devicetree, linux-kernel, linux-arm-kernel, linux
In-Reply-To: <191e9f7e3a6c14eabe891a98c5fb646766479c0a.1775558273.git.nora.schiffer@ew.tq-group.com>
Hello:
This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 7 Apr 2026 12:48:01 +0200 you wrote:
> The J722S CPSW3G is mostly identical to the AM64's, but additionally
> supports SGMII. The AM64 compatible ti,am642-cpsw-nuss is used as a
> fallback.
>
> Signed-off-by: Nora Schiffer <nora.schiffer@ew.tq-group.com>
> ---
>
> [...]
Here is the summary with links:
- [net-next,v4,1/2] dt-bindings: net: ti: k3-am654-cpsw-nuss: Add ti,j722s-cpsw-nuss compatible
https://git.kernel.org/netdev/net-next/c/f757a2da6df5
- [net-next,v4,2/2] net: ethernet: ti: am65-cpsw: add support for J722S SoC family
https://git.kernel.org/netdev/net-next/c/436e9e48ca51
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next v3 0/5] dpll: zl3073x: add ref-sync pair support
From: patchwork-bot+netdevbpf @ 2026-04-12 15:50 UTC (permalink / raw)
To: Ivan Vecera
Cc: netdev, arkadiusz.kubalewski, jiri, mschmidt, poros,
Prathosh.Satish, horms, vadim.fedorenko, linux-kernel, conor+dt,
krzk+dt, robh, devicetree, pvaanane
In-Reply-To: <20260408102716.443099-1-ivecera@redhat.com>
Hello:
This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 8 Apr 2026 12:27:11 +0200 you wrote:
> This series adds Reference-Sync pair support to the ZL3073x DPLL driver.
> A Ref-Sync pair consists of a clock reference and a low-frequency sync
> signal (e.g. 1 PPS) where the DPLL locks to the clock reference but
> phase-aligns to the sync reference.
>
> Patches 1-3 are preparatory cleanups and helper additions:
> - Clean up esync get/set callbacks with early returns and use the
> zl3073x_out_is_ndiv() helper
> - Convert open-coded clear-and-set bitfield patterns to FIELD_MODIFY()
> - Add ref sync control and output clock type accessor helpers
>
> [...]
Here is the summary with links:
- [net-next,v3,1/5] dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv()
https://git.kernel.org/netdev/net-next/c/3c8c39768b10
- [net-next,v3,2/5] dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns
https://git.kernel.org/netdev/net-next/c/737cb6195c40
- [net-next,v3,3/5] dpll: zl3073x: add ref sync and output clock type helpers
https://git.kernel.org/netdev/net-next/c/63009eb92b0f
- [net-next,v3,4/5] dt-bindings: dpll: add ref-sync-sources property
https://git.kernel.org/netdev/net-next/c/a1a702090def
- [net-next,v3,5/5] dpll: zl3073x: add ref-sync pair support
https://git.kernel.org/netdev/net-next/c/14f269ae6998
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next v7 0/9] Wangxun improvement
From: patchwork-bot+netdevbpf @ 2026-04-12 15:50 UTC (permalink / raw)
To: Jiawen Wu
Cc: netdev, mengyuanlou, andrew+netdev, davem, edumazet, kuba, pabeni,
linux, horms, michal.swiatkowski, jacob.e.keller, kees, joe,
larysa.zaremba, abdun.nihaal, leitao
In-Reply-To: <20260407025616.33652-1-jiawenwu@trustnetic.com>
Hello:
This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 7 Apr 2026 10:56:07 +0800 you wrote:
> This patch series cleans up the code and enhances the implementation.
>
> v7:
> - Drop the patches about Tx timeout, pci_error_handlers and ngbe reset.
> - Replace busy-wait reset flag with kernel mutex.
> - Reorder timer and work sync cancellations.
> - Add spin lock to protect wx_update_stats().
> - Enhance the reading of the registers which are not clear-on-read.
>
> [...]
Here is the summary with links:
- [net-next,v7,1/9] net: ngbe: remove netdev->ethtool->wol_enabled setting
https://git.kernel.org/netdev/net-next/c/4d19654dacef
- [net-next,v7,2/9] net: ngbe: move the WOL functions to libwx
https://git.kernel.org/netdev/net-next/c/752157d9eded
- [net-next,v7,3/9] net: ngbe: remove redundant macros
https://git.kernel.org/netdev/net-next/c/9bc29a87fbc6
- [net-next,v7,4/9] net: wangxun: replace busy-wait reset flag with kernel mutex
https://git.kernel.org/netdev/net-next/c/d48df7e7c3fb
- [net-next,v7,5/9] net: wangxun: move ethtool_ops.set_channels into libwx
https://git.kernel.org/netdev/net-next/c/b736ebed937e
- [net-next,v7,6/9] net: wangxun: reorder timer and work sync cancellations
https://git.kernel.org/netdev/net-next/c/58f6303572ec
- [net-next,v7,7/9] net: wangxun: schedule hardware stats update in watchdog
https://git.kernel.org/netdev/net-next/c/dc33e52b8ce6
- [net-next,v7,8/9] net: libwx: wrap-around and reset qmprc counter
https://git.kernel.org/netdev/net-next/c/1dd9b0dafd21
- [net-next,v7,9/9] net: libwx: improve flow control setting
https://git.kernel.org/netdev/net-next/c/40637e4a4477
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2 2/2] MAINTAINERS: update PTP maintainer entries after directory split
From: Jakub Kicinski @ 2026-04-12 15:47 UTC (permalink / raw)
To: dwmw2
Cc: Wen Gu, tglx, richardcochran, andrew+netdev, davem, edumazet,
pabeni, linux-kernel, netdev, jstultz, anna-maria, frederic,
daniel.lezcano, sboyd, vladimir.oltean, wei.fang, xiaoning.wang,
jonathan.lemon, vadim.fedorenko, yangbo.lu, svens, nick.shi,
ajay.kaher, alexey.makhalov, bcm-kernel-feedback-list, linux-fpga,
imx, linux-s390, dust.li, xuanzhuo, mani, imran.shaik, taniya.das
In-Reply-To: <20260407104802.34429-3-guwen@linux.alibaba.com>
On Tue, 7 Apr 2026 18:48:02 +0800 Wen Gu wrote:
> +PTP EMULATED CLOCK SUPPORT
> +M: David Woodhouse <dwmw2@infradead.org>
> +M: Wen Gu <guwen@linux.alibaba.com>
> +M: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
> +L: linux-kernel@vger.kernel.org
> +S: Maintained
> +T: git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git timers/core
Hi David,
Do you have a tree to route the patches thru? Or do you really have
access to the tip tree?
^ permalink raw reply
* [PATCH net] slip: reject VJ frames when no receive slots are allocated
From: Weiming Shi @ 2026-04-12 15:42 UTC (permalink / raw)
To: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Kees Cook, netdev, Xiang Mei, Weiming Shi
slhc_init() allows rslots == 0 and in that case skips the allocation
of comp->rstate, leaving it NULL. Because the struct is zero-initialized
by kzalloc, comp->rslot_limit is also 0.
The receive-side entry points slhc_uncompress() and slhc_remember()
only compare a packet's slot index against rslot_limit, so slot 0
passes the bounds check even though no receive state array exists.
Any VJ-compressed or VJ-uncompressed packet that selects slot 0 then
dereferences the NULL rstate pointer.
This can be reached through PPP by issuing PPPIOCSMAXCID with a value
whose upper 16 bits, after arithmetic right shift, yield -1, making
val2 + 1 == 0 and thus rslots == 0.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519)
Call Trace:
<TASK>
ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466)
ppp_input (drivers/net/ppp/ppp_generic.c:2359)
ppp_async_process (drivers/net/ppp/ppp_async.c:492)
tasklet_action_common (kernel/softirq.c:926)
handle_softirqs (kernel/softirq.c:623)
run_ksoftirqd (kernel/softirq.c:1055)
smpboot_thread_fn (kernel/smpboot.c:160)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:164)
</TASK>
Add a NULL check on comp->rstate at the entry of slhc_uncompress() and
slhc_remember() so that frames are rejected when no receive slots exist.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
drivers/net/slip/slhc.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
index e3c785da3eef..e67052bcab57 100644
--- a/drivers/net/slip/slhc.c
+++ b/drivers/net/slip/slhc.c
@@ -502,6 +502,10 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize)
/* We've got a compressed packet; read the change byte */
comp->sls_i_compressed++;
+ if (!comp->rstate) {
+ comp->sls_i_error++;
+ return 0;
+ }
if(isize < 3){
comp->sls_i_error++;
return 0;
@@ -651,8 +655,9 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize)
/* The packet is shorter than a legal IP header.
* Also make sure isize is positive.
+ * Reject if no receive slots are configured (rstate is NULL).
*/
- if (isize < (int)sizeof(struct iphdr)) {
+ if (!comp->rstate || isize < (int)sizeof(struct iphdr)) {
runt:
comp->sls_i_runt++;
return slhc_toss(comp);
--
2.43.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox