* [PATCH] fix: net: cadence: macb_mii_init: fix double of_node_put on mdio_np after macb_mdiobus_register
From: WenTao Liang @ 2026-06-26 15:14 UTC (permalink / raw)
To: Nicolas Ferre, netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
stable, linux-kernel, WenTao Liang
After macb_mdiobus_register succeeds, the mdio_np reference ownership is
transferred to the mii_bus device (stored in mii_bus->dev.of_node). When
the subsequent macb_mii_probe fails, the error path jumps to
err_out_unregister_bus which calls mdiobus_free (releasing the node via
fwnode_handle_put) and then falls through to err_out which calls
of_node_put(mdio_np) again, causing a double put.
Move the of_node_put to only execute on paths where the reference was not
transferred (i.e., before successful macb_mdiobus_register).
Cc: stable@vger.kernel.org
Fixes: ef8a2e27289e ("net: macb: fix probing of PHY not described in the dt")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/net/ethernet/cadence/macb_main.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index a12aa21244e8..c58e089e5888 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -1170,6 +1170,9 @@ static int macb_mii_init(struct macb *bp)
mdiobus_unregister(bp->mii_bus);
err_out_free_mdiobus:
mdiobus_free(bp->mii_bus);
+ of_node_put(mdio_np);
+ return err;
+
err_out:
of_node_put(mdio_np);
--
2.39.5 (Apple Git-154)
^ permalink raw reply related
* Re: [PATCH v4] virtio_net: disable cb when NAPI is busy-polled
From: Simon Horman @ 2026-06-26 15:15 UTC (permalink / raw)
To: lange_tang
Cc: Simon Horman, mst, xuanzhuo, jasowang, edumazet, virtualization,
netdev, tanglongjun
In-Reply-To: <20260625013733.29300-1-lange_tang@163.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
Full review at: https://sashiko.dev
---
virtio_net: disable cb when NAPI is busy-polled
This commit disables the virtqueue callback at the entry of virtnet_poll().
It aims to prevent a large number of spurious interrupts when busy-poll is
active by keeping the callback off while polling.
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 26afa6341d161..c1e252400c0fc 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -3011,6 +3011,8 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
> unsigned int xdp_xmit = 0;
> bool napi_complete;
>
> + virtqueue_disable_cb(rq->vq);
> +
[Severity: High]
Can this unconditionally disable the RX callback and cause a permanent network
stall when polled by netpoll?
If the netpoll subsystem (e.g., used by netconsole) calls the NAPI poll
function directly with a budget of 0, virtqueue_disable_cb() is called
immediately. virtnet_receive() will then process 0 packets and return 0.
Later in virtnet_poll(), the completion condition is checked:
if (received < budget) {
napi_complete = virtqueue_napi_complete(napi, rq->vq, received);
...
}
When both received and budget are 0, this condition evaluates to false. This
skips virtqueue_napi_complete(), leaving the RX callback permanently disabled
and preventing the device from raising further RX interrupts.
> virtnet_poll_cleantx(rq, budget);
>
> received = virtnet_receive(rq, budget, &xdp_xmit);
^ permalink raw reply
* Re: iproute2: trailing whitespace in man pages
From: Stephen Hemminger @ 2026-06-26 15:15 UTC (permalink / raw)
To: Bjarni Ingi Gislason; +Cc: netdev, Debian Bug Tracking System
In-Reply-To: <178243847243.6540.10252433987238870483.reportbug@kassi.invalid.is>
On Fri, 26 Jun 2026 01:54:52 +0000
Bjarni Ingi Gislason <bjarniig@simnet.is> wrote:
> Package: iproute2 (in Debian)
> Version: 7.1.0-1
> Severity: minor
>
> Additional remarks.
>
> Mails from me to "submit@bugs.debian.org" are no longer acknowledged. A
> Debian maintainer told me, that he would contact the mail administrator
> about me not wanting to send bugs upstream.
>
> -.-
>
> Dear Maintainer,
>
> * What led up to the situation?
>
> Checking for defects with a new version
>
> test-[g|n]roff -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=0 -ww -z < "man page"
>
> [Use
>
> grep -n -e ' $' -e '\\~$' -e ' \\f.$' -e ' \\"' <file>
>
> to find (most) trailing spaces.]
>
> ["test-groff" is a script in the repository for "groff"; is not shipped]
> (local copy and "troff" slightly changed by me).
>
> [The fate of "test-nroff" was decided in groff bug #55941.]
>
> * What was the outcome of this action?
>
> troff:/tmp/gz.roff.tw9zTq:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:15: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:20: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:34: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:36: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:38: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:40: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:41: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:42: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:43: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:44: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:45: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:46: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:47: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:48: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:49: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:50: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:55: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:56: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tw9zTq:57: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/bridge.8.gz
>
> troff:/tmp/gz.roff.m7ah0F:12: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/dcb-app.8.gz
>
> troff:/tmp/gz.roff.lEZOzh:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.lEZOzh:32: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/dcb-apptrust.8.gz
>
> troff:/tmp/gz.roff.WIScEl:12: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/dcb-buffer.8.gz
>
> troff:/tmp/gz.roff.lQyzHW:11: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/dcb-dcbx.8.gz
>
> troff:/tmp/gz.roff.i604Vp:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.i604Vp:43: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/dcb-ets.8.gz
>
> troff:/tmp/gz.roff.21mI9Z:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.21mI9Z:37: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/dcb-maxrate.8.gz
>
> troff:/tmp/gz.roff.tNIhrB:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.tNIhrB:38: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/dcb-pfc.8.gz
>
> troff:/tmp/gz.roff.rSgJgv:12: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/dcb-rewr.8.gz
>
> troff:/tmp/gz.roff.Q8vb3N:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Q8vb3N:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Q8vb3N:24: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/dcb.8.gz
>
> troff:/tmp/gz.roff.IodjFN:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.IodjFN:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.IodjFN:32: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.IodjFN:34: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.IodjFN:36: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.IodjFN:54: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.IodjFN:123: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.IodjFN:133: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.IodjFN:149: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.IodjFN:175: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/devlink-dev.8.gz
>
> troff:/tmp/gz.roff.Nx3P7S:13: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Nx3P7S:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Nx3P7S:28: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Nx3P7S:32: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/devlink-dpipe.8.gz
>
> troff:/tmp/gz.roff.f7fvNK:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.f7fvNK:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.f7fvNK:24: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.f7fvNK:66: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.f7fvNK:68: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.f7fvNK:184: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.f7fvNK:188: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.f7fvNK:193: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.f7fvNK:197: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/devlink-health.8.gz
>
> troff:/tmp/gz.roff.hTtjSy:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hTtjSy:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hTtjSy:24: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hTtjSy:25: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hTtjSy:29: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hTtjSy:50: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hTtjSy:54: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hTtjSy:55: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hTtjSy:56: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hTtjSy:68: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/devlink-lc.8.gz
>
> troff:/tmp/gz.roff.soeA6o:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:22: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:24: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:29: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:35: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:50: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:66: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:68: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:69: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:71: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:74: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:77: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:80: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:83: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:86: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:91: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:101: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:127: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.soeA6o:167: warning: treating total indentation -72u as zero [-w range]
> /usr/share/man/man8/devlink-port.8.gz
>
> troff:/tmp/gz.roff.kYqBeN:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.kYqBeN:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.kYqBeN:26: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/devlink-rate.8.gz
>
> troff:/tmp/gz.roff.9tHyhr:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.9tHyhr:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.9tHyhr:28: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.9tHyhr:48: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/devlink-region.8.gz
>
> troff:/tmp/gz.roff.9MYeZd:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.9MYeZd:17: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/devlink-resource.8.gz
>
> troff:/tmp/gz.roff.ZhPBEk:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:22: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:23: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:28: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:29: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:31: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:39: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:41: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:43: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:48: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:49: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:51: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:59: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:61: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:63: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:66: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:67: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:69: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZhPBEk:71: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/devlink-sb.8.gz
>
> troff:/tmp/gz.roff.cbJFkk:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.cbJFkk:79: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.cbJFkk:114: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.cbJFkk:139: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.cbJFkk:143: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/devlink-trap.8.gz
>
> troff:/tmp/gz.roff.QOaboD:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.QOaboD:16: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/devlink.8.gz
>
> troff:/tmp/gz.roff.m0E9ov:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.m0E9ov:19: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.m0E9ov:29: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/dpll.8.gz
>
> troff:/tmp/gz.roff.hhba1k:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hhba1k:19: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hhba1k:24: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hhba1k:29: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.hhba1k:31: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/genl.8.gz
>
> troff:/tmp/gz.roff.UspeXf:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:27: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:29: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:31: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:33: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:39: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:41: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:43: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:45: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:47: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:49: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:51: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:63: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:65: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:67: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:69: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:71: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:76: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.UspeXf:77: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-address.8.gz
>
> troff:/tmp/gz.roff.ACnG5f:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ACnG5f:15: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ACnG5f:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ACnG5f:56: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-addrlabel.8.gz
>
> troff:/tmp/gz.roff.5eqgIA:14: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.5eqgIA:21: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.5eqgIA:27: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.5eqgIA:31: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.5eqgIA:35: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.5eqgIA:39: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.5eqgIA:48: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.5eqgIA:52: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.5eqgIA:56: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.5eqgIA:60: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-fou.8.gz
>
> troff:/tmp/gz.roff.muormS:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.muormS:21: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.muormS:25: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.muormS:49: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-ioam.8.gz
>
> troff:/tmp/gz.roff.YZqY4h:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.YZqY4h:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.YZqY4h:85: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.YZqY4h:232: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-l2tp.8.gz
>
> troff:/tmp/gz.roff.x9nPAk:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:59: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:67: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:159: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:164: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:186: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:195: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:197: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:223: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:224: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:226: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:227: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:228: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:229: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:230: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:236: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:237: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:248: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:249: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.x9nPAk:256: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-link.8.gz
>
> troff:/tmp/gz.roff.r9LukD:5: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.r9LukD:64: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.r9LukD:65: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.r9LukD:67: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.r9LukD:75: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.r9LukD:77: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.r9LukD:80: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.r9LukD:83: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.r9LukD:85: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-macsec.8.gz
>
> troff:/tmp/gz.roff.fk7Uej:12: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-maddress.8.gz
>
> troff:/tmp/gz.roff.OtuwHM:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.OtuwHM:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.OtuwHM:45: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.OtuwHM:51: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.OtuwHM:57: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.OtuwHM:58: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-monitor.8.gz
>
> troff:/tmp/gz.roff.DLgQwy:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:14: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:16: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:22: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:30: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:32: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:35: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:37: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:39: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:42: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:45: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:52: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:88: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:89: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DLgQwy:92: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-mptcp.8.gz
>
> troff:/tmp/gz.roff.Bf2muc:9: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Bf2muc:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Bf2muc:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Bf2muc:13: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Bf2muc:15: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Bf2muc:17: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-mroute.8.gz
>
> troff:/tmp/gz.roff.aIjjMP:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:20: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:24: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:26: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:27: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:28: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:29: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:30: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:35: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:37: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.aIjjMP:39: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-neighbour.8.gz
>
> troff:/tmp/gz.roff.sjvvc4:9: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-netconf.8.gz
>
> troff:/tmp/gz.roff.bAu8qy:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.bAu8qy:46: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-netns.8.gz
>
> troff:/tmp/gz.roff.nM3cIw:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:19: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:23: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:28: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:40: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:42: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:44: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:46: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:48: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:49: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:53: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:59: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:60: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:62: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:64: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:65: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:67: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:68: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.nM3cIw:70: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-nexthop.8.gz
>
> troff:/tmp/gz.roff.Kn3w81:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Kn3w81:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Kn3w81:57: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Kn3w81:59: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-ntable.8.gz
>
> troff:/tmp/gz.roff.gv3LBB:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:19: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:33: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:36: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:38: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:40: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:42: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:44: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:46: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:56: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:60: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:62: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:64: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:66: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:68: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:70: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:72: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:74: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gv3LBB:84: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-route.8.gz
>
> troff:/tmp/gz.roff.6owsuu:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:31: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:34: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:36: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:38: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:40: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:42: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:44: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:46: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:48: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:49: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:51: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:53: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:54: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:55: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:56: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:57: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:58: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:59: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.6owsuu:61: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-rule.8.gz
>
> troff:/tmp/gz.roff.6yXkbF:10: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-sr.8.gz
>
> troff:/tmp/gz.roff.glO7gb:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.glO7gb:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.glO7gb:20: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.glO7gb:28: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-stats.8.gz
>
> troff:/tmp/gz.roff.XiAasB:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.XiAasB:25: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.XiAasB:26: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-tcp_metrics.8.gz
>
> troff:/tmp/gz.roff.XtavYp:10: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-token.8.gz
>
> troff:/tmp/gz.roff.TS3gWw:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.TS3gWw:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.TS3gWw:20: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.TS3gWw:25: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.TS3gWw:34: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.TS3gWw:39: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.TS3gWw:41: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.TS3gWw:59: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.TS3gWw:76: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.TS3gWw:81: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-tunnel.8.gz
>
> troff:/tmp/gz.roff.5llFkR:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.5llFkR:28: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-vrf.8.gz
>
> troff:/tmp/gz.roff.91zMPC:13: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:19: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:29: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:103: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:158: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:171: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:175: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:183: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:198: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:240: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:274: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:325: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:327: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:345: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:363: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:367: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:371: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:427: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:448: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.91zMPC:564: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip-xfrm.8.gz
>
> troff:/tmp/gz.roff.gY3yJ3:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gY3yJ3:16: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gY3yJ3:21: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gY3yJ3:31: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gY3yJ3:39: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gY3yJ3:169: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gY3yJ3:175: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ip.8.gz
>
> troff:/tmp/gz.roff.j0dcO5:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.j0dcO5:15: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.j0dcO5:111: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.j0dcO5:112: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.j0dcO5:203: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.j0dcO5:204: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/netshaper.8.gz
>
> troff:/tmp/gz.roff.EOKA9l:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.EOKA9l:17: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/rdma-dev.8.gz
>
> troff:/tmp/gz.roff.j9CeKZ:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.j9CeKZ:17: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/rdma-link.8.gz
>
> troff:/tmp/gz.roff.NBliDx:16: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/rdma-monitor.8.gz
>
> troff:/tmp/gz.roff.n7n6Ij:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.n7n6Ij:15: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.n7n6Ij:16: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.n7n6Ij:21: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/rdma-resource.8.gz
>
> troff:/tmp/gz.roff.zNQGc9:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.zNQGc9:40: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.zNQGc9:85: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.zNQGc9:89: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.zNQGc9:93: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.zNQGc9:97: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/rdma-statistic.8.gz
>
> troff:/tmp/gz.roff.w2n0Tg:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.w2n0Tg:17: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/rdma-system.8.gz
>
> troff:/tmp/gz.roff.G452XU:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.G452XU:16: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.G452XU:21: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.G452XU:26: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/rdma.8.gz
>
> troff:/tmp/gz.roff.8E9eVD:10: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/rtmon.8.gz
>
> troff:/tmp/gz.roff.cESP7P:447: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.cESP7P:607: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/ss.8.gz
>
> troff:/tmp/gz.roff.ux4fN1:9: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ux4fN1:11: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-basic.8.gz
>
> troff:/tmp/gz.roff.E5yQLK:9: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-cgroup.8.gz
>
> troff:/tmp/gz.roff.xDoFMo:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.xDoFMo:49: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-connmark.8.gz
>
> troff:/tmp/gz.roff.EPr6TY:15: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.EPr6TY:26: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-csum.8.gz
>
> troff:/tmp/gz.roff.ozliFK:7: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ozliFK:9: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ozliFK:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ozliFK:13: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ozliFK:18: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-ct.8.gz
>
> troff:/tmp/gz.roff.NlhG4f:34: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.NlhG4f:39: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.NlhG4f:51: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-dualpi2.8.gz
>
> troff:/tmp/gz.roff.AXC30K:14: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.AXC30K:20: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.AXC30K:22: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.AXC30K:33: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.AXC30K:73: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-ematch.8.gz
>
> troff:/tmp/gz.roff.Xqn4yW:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:13: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:21: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:22: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:24: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:32: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:34: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:36: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:38: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:46: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:47: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:54: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:55: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:56: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.Xqn4yW:57: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-flow.8.gz
>
> troff:/tmp/gz.roff.SN8HX6:8: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:9: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:13: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:22: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:24: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:26: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:28: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:29: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:30: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:32: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:34: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:35: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:36: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:38: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:40: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:41: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:42: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:44: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.SN8HX6:45: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-flower.8.gz
>
> troff:/tmp/gz.roff.75BF9d:69: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-fq_codel.8.gz
>
> troff:/tmp/gz.roff.ATqeiC:9: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-fw.8.gz
>
> troff:/tmp/gz.roff.0gJmYD:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0gJmYD:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0gJmYD:21: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0gJmYD:24: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-gact.8.gz
>
> troff:/tmp/gz.roff.1ht4Bu:9: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:13: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:15: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:16: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:19: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:22: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:26: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:32: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:36: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:59: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.1ht4Bu:67: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-ife.8.gz
>
> troff:/tmp/gz.roff.eEZB5X:8: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.eEZB5X:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.eEZB5X:12: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-matchall.8.gz
>
> troff:/tmp/gz.roff.BCTuKt:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.BCTuKt:15: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.BCTuKt:22: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.BCTuKt:26: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.BCTuKt:30: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-mirred.8.gz
>
> troff:/tmp/gz.roff.KuFNwq:8: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:9: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:10: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:14: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:19: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:23: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:25: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:27: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:31: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:35: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:37: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:40: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:57: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:80: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.KuFNwq:81: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-mpls.8.gz
>
> troff:/tmp/gz.roff.9RiFlD:235: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.9RiFlD:237: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.9RiFlD:254: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.9RiFlD:274: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.9RiFlD:282: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.9RiFlD:284: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-mqprio.8.gz
>
> troff:/tmp/gz.roff.t0JWAM:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.t0JWAM:22: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.t0JWAM:23: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-nat.8.gz
>
> troff:/tmp/gz.roff.ZHcyYL:6: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:14: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:25: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:26: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:34: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:35: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:37: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:41: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:45: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:47: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:51: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:55: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:56: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:59: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:60: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:63: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:67: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:383: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZHcyYL:387: warning [page 1, line 269]: cannot adjust line in b adjust mode; overset by 4n [-w break]
> /usr/share/man/man8/tc-netem.8.gz
>
> troff:/tmp/gz.roff.DJ46bB:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:22: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:29: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:44: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:48: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:53: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:57: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:62: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:63: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:67: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:71: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:77: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:79: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.DJ46bB:80: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-pedit.8.gz
>
> troff:/tmp/gz.roff.HpJEdr:34: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-police.8.gz
>
> troff:/tmp/gz.roff.JYFwIE:9: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.JYFwIE:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.JYFwIE:13: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.JYFwIE:15: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-route.8.gz
>
> troff:/tmp/gz.roff.TQDw2w:14: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.TQDw2w:16: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.TQDw2w:19: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-sample.8.gz
>
> troff:/tmp/gz.roff.LzdwcT:69: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-skbedit.8.gz
>
> troff:/tmp/gz.roff.EeoYee:8: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.EeoYee:9: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.EeoYee:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.EeoYee:13: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.EeoYee:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.EeoYee:19: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.EeoYee:21: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.EeoYee:23: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.EeoYee:26: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-skbmod.8.gz
>
> troff:/tmp/gz.roff.LaXqMO:8: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.LaXqMO:12: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-tunnel_key.8.gz
>
> troff:/tmp/gz.roff.0SnZpw:9: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:13: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:15: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:17: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:19: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:21: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:23: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:25: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:27: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:29: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:31: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:32: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:33: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:37: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:44: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:46: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:51: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:52: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.0SnZpw:53: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-u32.8.gz
>
> troff:/tmp/gz.roff.ZLTTLY:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZLTTLY:16: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZLTTLY:20: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZLTTLY:24: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZLTTLY:28: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZLTTLY:30: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.ZLTTLY:33: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc-vlan.8.gz
>
> troff:/tmp/gz.roff.bkv7BO:128: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.bkv7BO:129: warning: ignoring escape character before ']' [-w escape]
> troff:/tmp/gz.roff.bkv7BO:717: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.bkv7BO:723: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tc.8.gz
>
> troff:/tmp/gz.roff.My0dwn:57: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tipc-bearer.8.gz
>
> troff:/tmp/gz.roff.bYd25b:18: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.bYd25b:27: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.bYd25b:28: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.bYd25b:30: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.bYd25b:32: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.bYd25b:42: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.bYd25b:53: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.bYd25b:62: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.bYd25b:66: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tipc-link.8.gz
>
> troff:/tmp/gz.roff.rs4kL6:17: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tipc-media.8.gz
>
> troff:/tmp/gz.roff.z8m3fR:15: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.z8m3fR:19: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.z8m3fR:23: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tipc-node.8.gz
>
> an.tmac:/tmp/gz.roff.9VgwLV:30: warning: cannot call .SS while an input trap is pending
> an.tmac:/tmp/gz.roff.9VgwLV:34: warning: cannot call .SS while an input trap is pending
> /usr/share/man/man8/tipc-socket.8.gz
>
> troff:/tmp/gz.roff.rBSHKg:14: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.rBSHKg:19: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/tipc.8.gz
>
> troff:/tmp/gz.roff.gPfIxK:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gPfIxK:12: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.gPfIxK:17: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/vdpa-dev.8.gz
>
> troff:/tmp/gz.roff.wHzGiy:11: warning: trailing whitespace [-w trail]
> troff:/tmp/gz.roff.wHzGiy:16: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/vdpa-mgmtdev.8.gz
>
> troff:/tmp/gz.roff.qSwXBM:10: warning: trailing whitespace [-w trail]
> /usr/share/man/man8/vdpa.8.gz
>
> * What outcome did you expect instead?
>
> No output (no warnings).
>
> -.-
>
> General remarks and further material, if a diff-file exist, are in the
> attachments.
>
>
> -- System Information:
> Debian Release: forky/sid
> APT prefers testing
> APT policy: (500, 'testing')
> Architecture: amd64 (x86_64)
>
> Kernel: Linux 7.0.12+deb14.1-amd64 (SMP w/2 CPU threads; PREEMPT)
> Locale: LANG=is_IS.iso88591, LC_CTYPE=is_IS.iso88591 (charmap=ISO-8859-1), LANGUAGE not set
> Shell: /bin/sh linked to /usr/bin/dash
> Init: sysvinit (via /sbin/init)
>
> Versions of packages iproute2 depends on:
> ii debconf [debconf-2.0] 1.5.92
> ii libbpf1 1:1.7.0-1
> ii libc6 2.42-17
> ii libcap2 1:2.78-1
> ii libcap2-bin 1:2.78-1
> ii libdb5.3t64 5.3.28+dfsg2-11+b1
> ii libelf1t64 0.195-1
> ii libmnl0 1.0.5-3+b2
> ii libselinux1 3.10-1
> ii libtirpc3t64 1.3.7+ds-1
> ii libxtables12 1.8.13-1
>
> iproute2 recommends no packages.
>
> Versions of packages iproute2 suggests:
> ii python3 3.13.9-3+b1
>
> -- debconf information excluded
Please send a patch as described in iproute2
The only place I found trailing whitespace on a man page source was
diff --git a/man/man8/tc-fq_codel.8 b/man/man8/tc-fq_codel.8
index 78590636..6ed523c7 100644
--- a/man/man8/tc-fq_codel.8
+++ b/man/man8/tc-fq_codel.8
@@ -66,7 +66,7 @@ the local minimum queue delay that packets experience. Default value is 5ms.
has the same semantics as
.B codel
and is used to ensure that the measured minimum delay does not become too stale.
-The minimum delay must be experienced in the last epoch of length
+The minimum delay must be experienced in the last epoch of length
.BR interval .
It should be set on the order of the worst-case RTT through the bottleneck to
give endpoints sufficient time to react. Default value is 100ms.
^ permalink raw reply related
* Re: [patch 09/24] timekeeping: Add CLOCK_AUX support for ktime_get_snapshot_id()
From: Thomas Gleixner @ 2026-06-26 15:17 UTC (permalink / raw)
To: Thomas Weißschuh
Cc: LKML, David Woodhouse, Miroslav Lichvar, John Stultz,
Stephen Boyd, Anna-Maria Behnsen, Frederic Weisbecker,
Arthur Kiyanovski, Rodolfo Giometti, Vincent Donnefort,
Marc Zyngier, Oliver Upton, kvmarm, Oliver Upton, Richard Cochran,
netdev, Takashi Iwai, Miri Korenblit, Johannes Berg, Jacob Keller,
Tony Nguyen, Saeed Mahameed, Peter Hilber, Michael S. Tsirkin,
virtualization, linux-wireless, linux-sound
In-Reply-To: <20260626125819-d8b197fc-7671-4d12-a578-9025affc52d9@linutronix.de>
On Fri, Jun 26 2026 at 13:03, Thomas Weißschuh wrote:
> On Fri, Jun 26, 2026 at 12:49:41PM +0200, Thomas Gleixner wrote:
>> On Fri, Jun 26 2026 at 10:48, Thomas Weißschuh wrote:
>> > On Tue, May 26, 2026 at 07:14:13PM +0200, Thomas Gleixner wrote:
>> > (...)
>> >
>> >> static inline void tk_update_aux_offs(struct timekeeper *tk, ktime_t offs)
>> >> @@ -1218,6 +1223,12 @@ bool ktime_get_snapshot_id(struct system
>> >> tkd = &tk_core;
>> >> offs = &tk_core.timekeeper.offs_boot;
>> >> break;
>> >> + case CLOCK_AUX ... CLOCK_AUX_LAST:
>> >> + tkd = aux_get_tk_data(clock_id);
>> >> + if (!tkd)
>> >> + return false;
>> >> + offs = &tkd->timekeeper.offs_aux;
>> >> + break;
>> >
>> > 'tkd' is also used to compute 'monoraw'. However 'tkr_raw' and 'tkr_mono'
>> > are the same for auxilary clocks, so this will compute a wrong 'monoraw'.
>>
>> AUX clocks are independent in the first place and the MONORAW part is
>> the "MONORAW" related to the AUX clock itself.
>>
>> > Instead 'monoraw' should be computed based on 'tk_core'.
>> > Which then also requires the sequence locking of 'tk_core'.
>>
>> No. From a PTP and steering point of view you want the "raw" value which
>> is related to the AUX clock itself and not the global one.
>
> Ack.
>
> However the kdocs call it 'CLOCK_MONOTONIC_RAW'. Can we clean this up?
Yes. Something like the below?
Thanks,
tglx
---
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1202,10 +1202,21 @@ static inline u64 tk_clock_read_snapshot
/**
* ktime_get_snapshot_id - Simultaneously snapshot a given clock ID with
- * CLOCK_MONOTONIC_RAW and the underlying
+ * the corresponding monotonic raw the underlying
* clocksource counter value.
* @clock_id: The clock ID to snapshot
* @systime_snapshot: Pointer to struct receiving the system time snapshot
+ *
+ * For the system time keeping clocks (REALTIME, MONOTONIC and BOOTTIME) the
+ * monotonic raw clock is CLOCK_MONOTONIC_RAW. For AUX clocks this is the
+ * monotonic raw clock related to the AUX clock. These AUX clock related
+ * monotonic raw clocks have a strict linear offset to the system time
+ * CLOCK_MONOTONIC_RAW:
+ *
+ * MONOTONIC_RAW(AUX$N) = CLOCK_MONOTONIC_RAW(system) + offset(AUX$N)
+ *
+ * The offset is established when a AUX clock is initialized, but it is
+ * currently not accessible.
*/
void ktime_get_snapshot_id(clockid_t clock_id, struct system_time_snapshot *systime_snapshot)
{
@@ -1512,6 +1523,9 @@ EXPORT_SYMBOL_GPL(ktime_real_to_base_clo
* @xtstamp: Receives simultaneously captured system and device time
*
* Reads a timestamp from a device and correlates it to system time
+ *
+ * See documentation for ktime_get_snapshot_id() for information about the raw
+ * monotonic time stamp which is used here.
*/
int get_device_system_crosststamp(int (*get_time_fn)
(ktime_t *device_time,
^ permalink raw reply
* [PATCH] fix: net: marvell: orion_mdio_probe: fix clock reference leak on extra clock detection
From: WenTao Liang @ 2026-06-26 15:19 UTC (permalink / raw)
To: Andrew Lunn, netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
stable, linux-kernel, WenTao Liang
The code calls of_clk_get(pdev->dev.of_node, ARRAY_SIZE(dev->clk)) to
detect unsupported extra clocks. If an extra clock exists, the function
prints a warning but discards the returned clk pointer without calling
clk_put, leaking a clock reference on every probe.
Store the returned clock and call clk_put after the warning to properly
release the acquired reference.
Cc: stable@vger.kernel.org
Fixes: ea664b1bdc19 ("net: mvmdio: print warning when orion-mdio has too many clocks")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/net/ethernet/marvell/mvmdio.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
index 3f4447e68888..4e5b5c5f7301 100644
--- a/drivers/net/ethernet/marvell/mvmdio.c
+++ b/drivers/net/ethernet/marvell/mvmdio.c
@@ -339,11 +339,18 @@ static int orion_mdio_probe(struct platform_device *pdev)
clk_prepare_enable(dev->clk[i]);
}
- if (!IS_ERR(of_clk_get(pdev->dev.of_node,
- ARRAY_SIZE(dev->clk))))
- dev_warn(&pdev->dev,
- "unsupported number of clocks, limiting to the first "
- __stringify(ARRAY_SIZE(dev->clk)) "\n");
+ {
+ struct clk *extra_clk;
+
+ extra_clk = of_clk_get(pdev->dev.of_node,
+ ARRAY_SIZE(dev->clk));
+ if (!IS_ERR(extra_clk)) {
+ dev_warn(&pdev->dev,
+ "unsupported number of clocks, limiting to the first "
+ __stringify(ARRAY_SIZE(dev->clk)) "\n");
+ clk_put(extra_clk);
+ }
+ }
if (type == BUS_TYPE_XSMI)
orion_mdio_xsmi_set_mdc_freq(bus);
--
2.39.5 (Apple Git-154)
^ permalink raw reply related
* [PATCH] fix: net: mediatek: mtk_star_mdio_init: fix double of_node_put after devm_of_mdiobus_register
From: WenTao Liang @ 2026-06-26 15:20 UTC (permalink / raw)
To: Daniel Borkmann, netdev
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, stable,
linux-kernel, WenTao Liang
After devm_of_mdiobus_register succeeds, the mdio_node reference
ownership is transferred to the mii_bus device (released via
mdiobus_release on device teardown). However, the function
unconditionally calls of_node_put(mdio_node) after registration, causing
a double put.
Only call of_node_put when devm_of_mdiobus_register fails (i.e., when
ownership was not transferred). On success, the bus driver manages the
reference lifecycle.
Cc: stable@vger.kernel.org
Fixes: 9ed0a3fac08b ("net: ethernet: mtk-star-emac: use devm_of_mdiobus_register()")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/net/ethernet/mediatek/mtk_star_emac.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/mediatek/mtk_star_emac.c b/drivers/net/ethernet/mediatek/mtk_star_emac.c
index b83886a41121..b949dd240e6b 100644
--- a/drivers/net/ethernet/mediatek/mtk_star_emac.c
+++ b/drivers/net/ethernet/mediatek/mtk_star_emac.c
@@ -1446,7 +1446,10 @@ static int mtk_star_mdio_init(struct net_device *ndev)
priv->mii->priv = priv;
ret = devm_of_mdiobus_register(dev, priv->mii, mdio_node);
+ if (ret)
+ of_node_put(mdio_node);
+ return ret;
out_put_node:
of_node_put(mdio_node);
return ret;
--
2.39.5 (Apple Git-154)
^ permalink raw reply related
* Re: [PATCH] octeontx2-af: Free BPID bitmap on setup failure
From: Simon Horman @ 2026-06-26 15:22 UTC (permalink / raw)
To: haoxiang_li2024
Cc: sgoutham, lcherian, gakula, hkelam, sbhatta, andrew+netdev, davem,
edumazet, kuba, pabeni, netdev, linux-kernel, stable
In-Reply-To: <78397a8d.5bc.19efc3325e6.Coremail.haoxiang_li2024@163.com>
On Thu, Jun 25, 2026 at 08:34:31AM +0800, haoxiang_li2024 wrote:
>
>
> At 2026-06-25 01:09:30, "Simon Horman" <horms@kernel.org> wrote:
> >On Tue, Jun 23, 2026 at 07:43:16PM +0800, Haoxiang Li wrote:
> >> nix_setup_bpids() allocates bp->bpids with rvu_alloc_bitmap(), which uses
> >> a plain kcalloc(). If any of the following devm_kcalloc() allocations for
> >> the BPID mapping arrays fails, the function returns without freeing the
> >> bitmap. Free the BPID bitmap before returning from those error paths.
> >>
> >> Fixes: d6212d2e41a0 ("octeontx2-af: Create BPIDs free pool")
> >> Cc: stable@vger.kernel.org
> >> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
> >
> >Reviewed-by: Simon Horman <horms@kernel.org>
> >
> >I am wondering if you did a pass for any other similar problems
> >with users of rvu_alloc_bitmap.
>
> Thanks for your review! Yes, I did. I found similar issues in
> nix_setup_ipolicers() and rvu_setup_msix_resources(), and
> I will address them in follow-up patches.
Likewise, thanks.
^ permalink raw reply
* Re: [PATCH net] net: gianfar: use of_irq_get()
From: Simon Horman @ 2026-06-26 15:23 UTC (permalink / raw)
To: Rosen Penev
Cc: netdev, claudiu.manoil, andrew+netdev, davem, edumazet, kuba,
pabeni, afleming, linux-kernel
In-Reply-To: <CAKxU2N__hbPOrPe3JUeTLF6d6+=uN+p5ez78rVg6cnrekkvQPw@mail.gmail.com>
On Thu, Jun 25, 2026 at 05:42:05PM -0700, Rosen Penev wrote:
> On Thu, Jun 25, 2026 at 2:36 AM Simon Horman <horms@kernel.org> wrote:
...
> Meh I'll submit to net-next. This is way too messy to fix for net.
Thanks. Be aware that net-next is currently closed for the merge window.
I expect it will repoen next week.
^ permalink raw reply
* [PATCH] fix: net: renesas: rswitch_mii_register: fix double of_node_put after of_mdiobus_register
From: WenTao Liang @ 2026-06-26 15:24 UTC (permalink / raw)
To: netdev
Cc: Yoshihiro Shimoda, David S . Miller, Jakub Kicinski, Paolo Abeni,
stable, linux-kernel, WenTao Liang
After of_mdiobus_register succeeds, the mdio_np reference ownership is
transferred to the mii_bus device (released via fwnode_handle_put during
mdiobus_release). The success path calls of_node_put(mdio_np) which,
combined with the automatic release via bus teardown, results in a double
put and refcount underflow.
Move of_node_put so it is only called in the error path where
of_mdiobus_register failed. On success, the bus driver manages the
reference lifecycle.
Cc: stable@vger.kernel.org
Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for Ethernet Switch")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/net/ethernet/renesas/rswitch_main.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/renesas/rswitch_main.c b/drivers/net/ethernet/renesas/rswitch_main.c
index 6fe964816322..c33add28a70c 100644
--- a/drivers/net/ethernet/renesas/rswitch_main.c
+++ b/drivers/net/ethernet/renesas/rswitch_main.c
@@ -1387,13 +1387,13 @@ static int rswitch_mii_register(struct rswitch_device *rdev)
err = of_mdiobus_register(mii_bus, mdio_np);
if (err < 0) {
mdiobus_free(mii_bus);
- goto out;
+ of_node_put(mdio_np);
+ return err;
}
rdev->etha->mii = mii_bus;
-out:
- of_node_put(mdio_np);
+ return 0;
return err;
}
--
2.39.5 (Apple Git-154)
^ permalink raw reply related
* [PATCH v2] fix: net: renesas: rswitch_mii_register: fix double of_node_put after of_mdiobus_register
From: WenTao Liang @ 2026-06-26 15:25 UTC (permalink / raw)
To: netdev
Cc: Yoshihiro Shimoda, David S . Miller, Jakub Kicinski, Paolo Abeni,
stable, linux-kernel, WenTao Liang
In-Reply-To: <20260626152430.51835-1-vulab@iscas.ac.cn>
After of_mdiobus_register succeeds, the mdio_np reference ownership is
transferred to the mii_bus device (released via fwnode_handle_put during
mdiobus_release). The success path calls of_node_put(mdio_np) which,
combined with the automatic release via bus teardown, results in a double
put and refcount underflow.
Move of_node_put so it is only called in the error path where
of_mdiobus_register failed. On success, the bus driver manages the
reference lifecycle.
Cc: stable@vger.kernel.org
Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for Ethernet Switch")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/net/ethernet/renesas/rswitch_main.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/renesas/rswitch_main.c b/drivers/net/ethernet/renesas/rswitch_main.c
index 6fe964816322..d5f1b5fd5817 100644
--- a/drivers/net/ethernet/renesas/rswitch_main.c
+++ b/drivers/net/ethernet/renesas/rswitch_main.c
@@ -1387,15 +1387,13 @@ static int rswitch_mii_register(struct rswitch_device *rdev)
err = of_mdiobus_register(mii_bus, mdio_np);
if (err < 0) {
mdiobus_free(mii_bus);
- goto out;
+ of_node_put(mdio_np);
+ return err;
}
rdev->etha->mii = mii_bus;
-out:
- of_node_put(mdio_np);
-
- return err;
+ return 0;
}
static void rswitch_mii_unregister(struct rswitch_device *rdev)
--
2.39.5 (Apple Git-154)
^ permalink raw reply related
* [PATCH] fix: net: ti: cpsw_probe_dt: fix phy_node reference leak on error paths
From: WenTao Liang @ 2026-06-26 15:29 UTC (permalink / raw)
To: Siddharth Vadapalli, Roger Quadros, netdev
Cc: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, linux-omap, stable, linux-kernel, WenTao Liang
After slave_data->phy_node is assigned (via of_node_get or
of_parse_phandle), if subsequent calls like of_get_phy_mode or
ti_cm_get_macid fail, the error path jumps to err_node_put which only
releases the loop's port_np reference but not the phy_node reference.
This causes a device_node reference leak.
Release slave_data->phy_node via of_node_put before jumping to
err_node_put on error paths after phy_node has been acquired.
Cc: stable@vger.kernel.org
Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/net/ethernet/ti/cpsw_new.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c
index c5be359f3c66..9f90d5a9d39f 100644
--- a/drivers/net/ethernet/ti/cpsw_new.c
+++ b/drivers/net/ethernet/ti/cpsw_new.c
@@ -1337,6 +1337,7 @@ static int cpsw_probe_dt(struct cpsw_common *cpsw)
if (ret) {
dev_err(dev, "%pOF read phy-mode err %d\n",
port_np, ret);
+ of_node_put(slave_data->phy_node);
goto err_node_put;
}
@@ -1344,8 +1345,10 @@ static int cpsw_probe_dt(struct cpsw_common *cpsw)
if (ret) {
ret = ti_cm_get_macid(dev, port_id - 1,
slave_data->mac_addr);
- if (ret)
+ if (ret) {
+ of_node_put(slave_data->phy_node);
goto err_node_put;
+ }
}
if (of_property_read_u32(port_np, "ti,dual-emac-pvid",
--
2.39.5 (Apple Git-154)
^ permalink raw reply related
* [PATCH] fix: net: ti: cpsw_init_common: fix excess of_node_put on parent node when cpts child not found
From: WenTao Liang @ 2026-06-26 15:29 UTC (permalink / raw)
To: Siddharth Vadapalli, Roger Quadros, netdev
Cc: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, linux-omap, stable, linux-kernel, WenTao Liang
When no "cpts" child node exists in the device tree, cpts_node is
assigned cpsw->dev->of_node without taking a reference via of_node_get.
The function then unconditionally calls of_node_put(cpts_node) at the
end, causing an excess put on the parent device node which can lead to a
refcount underflow.
Use of_node_get when falling back to the parent node to ensure the
reference count is properly balanced with the subsequent of_node_put.
Cc: stable@vger.kernel.org
Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/net/ethernet/ti/cpsw_priv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ti/cpsw_priv.c b/drivers/net/ethernet/ti/cpsw_priv.c
index 1f6f374551cb..b20567f96d78 100644
--- a/drivers/net/ethernet/ti/cpsw_priv.c
+++ b/drivers/net/ethernet/ti/cpsw_priv.c
@@ -553,7 +553,7 @@ int cpsw_init_common(struct cpsw_common *cpsw, void __iomem *ss_regs,
cpts_node = of_get_child_by_name(cpsw->dev->of_node, "cpts");
if (!cpts_node)
- cpts_node = cpsw->dev->of_node;
+ cpts_node = of_node_get(cpsw->dev->of_node);
cpsw->cpts = cpts_create(cpsw->dev, cpts_regs, cpts_node,
CPTS_N_ETX_TS);
--
2.39.5 (Apple Git-154)
^ permalink raw reply related
* Re: [PATCH net v2] net: ipa: fix SMEM state handle leaks in SMP2P init
From: Alex Elder @ 2026-06-26 15:31 UTC (permalink / raw)
To: Haoxiang Li, elder, andrew+netdev, davem, edumazet, kuba, pabeni
Cc: netdev, linux-kernel, stable
In-Reply-To: <20260624065955.2822765-1-haoxiang_li2024@163.com>
On 6/24/26 1:59 AM, Haoxiang Li wrote:
> ipa_smp2p_init() acquires two Qualcomm SMEM state handles with
> qcom_smem_state_get(). However, neither the init error paths
> nor ipa_smp2p_exit() release them.
>
> Release both handles with qcom_smem_state_put() in the init
> error paths and in ipa_smp2p_exit().
>
> Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
This looks good. Thank you for the fix.
Reviewed-by: Alex Elder <elder@riscstar.com>
> ---
> Changes in v2:
> - Use explicit qcom_smem_state_put() calls instead of devm helpers.
> Thanks, Alex! Thanks, Jakub!
> ---
> drivers/net/ipa/ipa_smp2p.c | 30 ++++++++++++++++++++++--------
> 1 file changed, 22 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
> index 2f0ccdd937cc..331c00ad02c0 100644
> --- a/drivers/net/ipa/ipa_smp2p.c
> +++ b/drivers/net/ipa/ipa_smp2p.c
> @@ -232,19 +232,27 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
> &valid_bit);
> if (IS_ERR(valid_state))
> return PTR_ERR(valid_state);
> - if (valid_bit >= 32) /* BITS_PER_U32 */
> - return -EINVAL;
> + if (valid_bit >= 32) { /* BITS_PER_U32 */
> + ret = -EINVAL;
> + goto err_valid_state_put;
> + }
>
> enabled_state = qcom_smem_state_get(dev, "ipa-clock-enabled",
> &enabled_bit);
> - if (IS_ERR(enabled_state))
> - return PTR_ERR(enabled_state);
> - if (enabled_bit >= 32) /* BITS_PER_U32 */
> - return -EINVAL;
> + if (IS_ERR(enabled_state)) {
> + ret = PTR_ERR(enabled_state);
> + goto err_valid_state_put;
> + }
> + if (enabled_bit >= 32) { /* BITS_PER_U32 */
> + ret = -EINVAL;
> + goto err_enabled_state_put;
> + }
>
> smp2p = kzalloc_obj(*smp2p);
> - if (!smp2p)
> - return -ENOMEM;
> + if (!smp2p) {
> + ret = -ENOMEM;
> + goto err_enabled_state_put;
> + }
>
> smp2p->ipa = ipa;
>
> @@ -289,6 +297,10 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
> ipa->smp2p = NULL;
> mutex_destroy(&smp2p->mutex);
> kfree(smp2p);
> +err_enabled_state_put:
> + qcom_smem_state_put(enabled_state);
> +err_valid_state_put:
> + qcom_smem_state_put(valid_state);
>
> return ret;
> }
> @@ -305,6 +317,8 @@ void ipa_smp2p_exit(struct ipa *ipa)
> ipa_smp2p_power_release(ipa);
> ipa->smp2p = NULL;
> mutex_destroy(&smp2p->mutex);
> + qcom_smem_state_put(smp2p->enabled_state);
> + qcom_smem_state_put(smp2p->valid_state);
> kfree(smp2p);
> }
>
^ permalink raw reply
* [PATCH] fix: net: ti: cpts_of_mux_clk_setup: fix device_node reference leak on success path
From: WenTao Liang @ 2026-06-26 15:31 UTC (permalink / raw)
To: Andrew Lunn, netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Grygorii Strashko, linux-omap, stable, linux-kernel, WenTao Liang
of_get_child_by_name acquires a device_node reference for refclk_np, and
of_clk_add_hw_provider additionally takes an extra reference internally.
On the success path, the function returns 0 without calling
of_node_put(refclk_np), leaking the initial reference.
Add of_node_put(refclk_np) before returning success to properly release
the acquired reference.
Cc: stable@vger.kernel.org
Fixes: a3047a81ba13 ("net: ethernet: ti: cpts: add support for ext rftclk selection")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/net/ethernet/ti/cpts.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
index 2ba4c8795d60..d6e6d074747e 100644
--- a/drivers/net/ethernet/ti/cpts.c
+++ b/drivers/net/ethernet/ti/cpts.c
@@ -714,7 +714,8 @@ static int cpts_of_mux_clk_setup(struct cpts *cpts, struct device_node *node)
goto mux_fail;
}
- return ret;
+ of_node_put(refclk_np);
+ return 0;
mux_fail:
of_node_put(refclk_np);
--
2.39.5 (Apple Git-154)
^ permalink raw reply related
* [PATCH] fix: net: mdio: of_phy_register_fixed_link: fix phy_device reference leak via discarded pointer
From: WenTao Liang @ 2026-06-26 15:33 UTC (permalink / raw)
To: Andrew Lunn, netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
stable, linux-kernel, WenTao Liang
fixed_phy_register returns a struct phy_device pointer with a held
reference on success. However, the register_phy label discards the
pointer via PTR_ERR_OR_ZERO, and the phy_device's fwnode is not set, so
of_phy_deregister_fixed_link cannot find the device via
bus_find_device_by_fwnode to clean it up. This permanently leaks the
phy_device and its device_node reference.
Store the returned phy_device pointer and set dev->fwnode so the
deregister path can properly locate and clean it up.
Cc: stable@vger.kernel.org
Fixes: 24c30dbbcdda ("of/mdio: Add support function for Ethernet fixed-link property")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/net/mdio/of_mdio.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c
index b8d298c04d3f..0dd25d94fec0 100644
--- a/drivers/net/mdio/of_mdio.c
+++ b/drivers/net/mdio/of_mdio.c
@@ -456,8 +456,16 @@ int of_phy_register_fixed_link(struct device_node *np)
return -ENODEV;
-register_phy:
- return PTR_ERR_OR_ZERO(fixed_phy_register(&status, np));
+register_phy: {
+ struct phy_device *phydev;
+
+ phydev = fixed_phy_register(&status, np);
+ if (IS_ERR(phydev))
+ return PTR_ERR(phydev);
+
+ phydev->mdio.dev.fwnode = of_fwnode_handle(np);
+ return 0;
+}
}
EXPORT_SYMBOL(of_phy_register_fixed_link);
--
2.39.5 (Apple Git-154)
^ permalink raw reply related
* [PATCH] fix: net: phy: phy_sfp_probe: fix kref leak when phy_setup_sfp_port fails after sfp_bus_add_upstream
From: WenTao Liang @ 2026-06-26 15:34 UTC (permalink / raw)
To: Andrew Lunn, netdev
Cc: Heiner Kallweit, Russell King, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, stable, linux-kernel, WenTao Liang
sfp_bus_add_upstream unconditionally acquires a kref on the SFP bus. When
this call succeeds but the subsequent phy_setup_sfp_port fails, the error
path returns without releasing the upstream reference. Since probe fails,
the device's remove function (which would normally clean this up) will
never be called, permanently leaking the kref.
Call sfp_bus_del_upstream on the error path after a successful
sfp_bus_add_upstream to properly release the upstream reference.
Cc: stable@vger.kernel.org
Fixes: 298e54fa810e ("net: phy: add core phylib sfp support")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/net/phy/phy_device.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 3370eb822017..cd62c46de017 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1723,6 +1723,11 @@ static int phy_sfp_probe(struct phy_device *phydev)
if (!ret && phydev->sfp_bus)
ret = phy_setup_sfp_port(phydev);
+ if (ret && phydev->sfp_bus) {
+ sfp_bus_del_upstream(phydev->sfp_bus);
+ phydev->sfp_bus = NULL;
+ }
+
return ret;
}
--
2.39.5 (Apple Git-154)
^ permalink raw reply related
* [PATCH net v2 0/2] Fix to possible skb leak due to race condtion in tx path
From: Selvamani Rajagopal via B4 Relay @ 2026-06-26 15:35 UTC (permalink / raw)
To: Parthiban Veerasooran, Andrew Lunn, Piergiorgio Beruto,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: netdev, linux-kernel, Andrew Lunn, Parthiban Veerasooran,
Selvamani Rajagopal
Now the traffic is handled in threaded IRQ, and the
disable_traffic flag is checked before handling the
data, new race condition is exposed, in which
buffer may leak, if threaded IRQ interrupts the
trasmit path midway.
With this change, disable_traffic and waiting_tx_skb
pointer are protected by spin lock/unlock pair.
This is highlighted in Sashiko review
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260611-level-trigger-v5-0-4533a9e85ce2%40onsemi.com
Also on buffer overrun condition, probably due to loss of
SPI data chunks, receive path doesn't see the expected
data chunk with end_valid bit set. As a result, driver
keeps adding data chunks to the skb before running out
of space and kernel panic is seen.
With this change, before adding data to the skb, if there
is no space, skb is freed and driver starts looking for
new frame by looking for a data chunk with start_valid
bit set.
[ 705.405490] skbuff: skb_over_panic: text:ffffffd2eb72a264 len:1600 put:64 head:ffffff804e5cdc40 data:ffffff804e5cdc80 tail:0x680 end:0x640 dev:eth1
[ 705.405569] ------------[ cut here ]------------
[ 705.405575] kernel BUG at net/core/skbuff.c:214!
[ 705.405589] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
[ 6703.427690] Call trace:
[ 705.925157] skb_panic+0x58/0x68 (P)
[ 705.928726] skb_put+0x74/0x80
[ 705.931772] oa_tc6_update_rx_skb+0x44/0x98 [oa_tc6_mod]
[ 705.937084] oa_tc6_macphy_threaded_irq+0x3f4/0x900 [oa_tc6_mod]
[ 705.943084] irq_thread_fn+0x34/0xb8
[ 705.946654] irq_thread+0x1a0/0x300
[ 705.950134] kthread+0x138/0x150
[ 705.953356] ret_from_fork+0x10/0x20
Signed-off-by: Selvamani Rajagopal <Selvamani.Rajagopal@onsemi.com>
---
Changes in v2:
- Improvment to how error -EAGAIN is handled. Took care of
couple of use cases where start_bit and end_bit may be missing or
repeated due to lost data chunks.
- Protected handling of waiting_tx_skb pointer with spin lock
- Link to v1: https://lore.kernel.org/r/20260621-fix-race-condition-and-crash-v1-0-87e290d9357f@onsemi.com
---
Selvamani Rajagopal (2):
net: ethernet: oa_tc6: Protect skb pointer used by two different kernel instances
net: ethernet: oa_tc6: Improvement in buffer overflow handling
drivers/net/ethernet/oa_tc6.c | 91 ++++++++++++++++++++++++++++++-------------
1 file changed, 64 insertions(+), 27 deletions(-)
---
base-commit: 805185b7c7a1069e407b6f7b3bc98e44d415f484
change-id: 20260621-fix-race-condition-and-crash-94d055a665c4
Best regards,
--
Selvamani Rajagopal <Selvamani.Rajagopal@onsemi.com>
^ permalink raw reply
* [PATCH net v2 1/2] net: ethernet: oa_tc6: Protect skb pointer used by two different kernel instances
From: Selvamani Rajagopal via B4 Relay @ 2026-06-26 15:35 UTC (permalink / raw)
To: Parthiban Veerasooran, Andrew Lunn, Piergiorgio Beruto,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: netdev, linux-kernel, Andrew Lunn, Parthiban Veerasooran,
Selvamani Rajagopal
In-Reply-To: <20260626-fix-race-condition-and-crash-v2-0-b6c5c10e604f@onsemi.com>
From: Selvamani Rajagopal <Selvamani.Rajagopal@onsemi.com>
Threaded IRQ uses waiting_tx_skb. Transmit path also uses
this pointer without any mutual exclusion protection. As a
result, it might leak skb buffer, particularly threaded IRQ
runs in the middle of tranmsmit path, near skb_linearize.
Fixes: b542d13fab0f ("net: ethernet: oa_tc6: Interrupt is active low, level triggered.")
Signed-off-by: Selvamani Rajagopal <Selvamani.Rajagopal@onsemi.com>
---
changes in v2:
added the missing prefix to the title
---
drivers/net/ethernet/oa_tc6.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/drivers/net/ethernet/oa_tc6.c b/drivers/net/ethernet/oa_tc6.c
index 0727d53345a3..3fd4851ee66d 100644
--- a/drivers/net/ethernet/oa_tc6.c
+++ b/drivers/net/ethernet/oa_tc6.c
@@ -672,10 +672,16 @@ static void oa_tc6_cleanup_ongoing_tx_skb(struct oa_tc6 *tc6)
static void oa_tc6_cleanup_waiting_tx_skb(struct oa_tc6 *tc6)
{
- if (tc6->waiting_tx_skb) {
+ struct sk_buff *skb;
+
+ spin_lock_bh(&tc6->tx_skb_lock);
+ skb = tc6->waiting_tx_skb;
+ tc6->waiting_tx_skb = NULL;
+ spin_unlock_bh(&tc6->tx_skb_lock);
+
+ if (skb) {
tc6->netdev->stats.tx_dropped++;
- kfree_skb(tc6->waiting_tx_skb);
- tc6->waiting_tx_skb = NULL;
+ kfree_skb(skb);
}
}
@@ -1250,11 +1256,6 @@ EXPORT_SYMBOL_GPL(oa_tc6_zero_align_receive_frame_enable);
*/
netdev_tx_t oa_tc6_start_xmit(struct oa_tc6 *tc6, struct sk_buff *skb)
{
- if (tc6->disable_traffic || tc6->waiting_tx_skb) {
- netif_stop_queue(tc6->netdev);
- return NETDEV_TX_BUSY;
- }
-
if (skb_linearize(skb)) {
dev_kfree_skb_any(skb);
tc6->netdev->stats.tx_dropped++;
@@ -1262,6 +1263,11 @@ netdev_tx_t oa_tc6_start_xmit(struct oa_tc6 *tc6, struct sk_buff *skb)
}
spin_lock_bh(&tc6->tx_skb_lock);
+ if (tc6->disable_traffic || tc6->waiting_tx_skb) {
+ netif_stop_queue(tc6->netdev);
+ spin_unlock_bh(&tc6->tx_skb_lock);
+ return NETDEV_TX_BUSY;
+ }
tc6->waiting_tx_skb = skb;
spin_unlock_bh(&tc6->tx_skb_lock);
--
2.43.0
^ permalink raw reply related
* [PATCH net v2 2/2] net: ethernet: oa_tc6: Improvement in buffer overflow handling
From: Selvamani Rajagopal via B4 Relay @ 2026-06-26 15:35 UTC (permalink / raw)
To: Parthiban Veerasooran, Andrew Lunn, Piergiorgio Beruto,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: netdev, linux-kernel, Andrew Lunn, Parthiban Veerasooran,
Selvamani Rajagopal
In-Reply-To: <20260626-fix-race-condition-and-crash-v2-0-b6c5c10e604f@onsemi.com>
From: Selvamani Rajagopal <Selvamani.Rajagopal@onsemi.com>
When oversubscribed traffic causes lot of buffer overflow errors,
probably due to loss of data chunks, driver fails to find a
data chunk with end_valid bit set, before it runs out of sk buffer
space. As a result, assert is seen during skb_put.
Now check is made if tail + len > end, driver abandons the current
data and starts look for a data chunk with start_valid bit,
that is a new frame.
Fixes: d70a0d8f2f2d ("net: ethernet: oa_tc6: implement receive path to receive rx ethernet frames")
Signed-off-by: Selvamani Rajagopal <Selvamani.Rajagopal@onsemi.com>
---
changes in v2
- Check rx_skb pointer before new allocation and NULL before use.
---
drivers/net/ethernet/oa_tc6.c | 69 +++++++++++++++++++++++++++++++------------
1 file changed, 50 insertions(+), 19 deletions(-)
diff --git a/drivers/net/ethernet/oa_tc6.c b/drivers/net/ethernet/oa_tc6.c
index 3fd4851ee66d..c59daa032e70 100644
--- a/drivers/net/ethernet/oa_tc6.c
+++ b/drivers/net/ethernet/oa_tc6.c
@@ -692,6 +692,12 @@ static void oa_tc6_free_pending_skbs(struct oa_tc6 *tc6)
oa_tc6_cleanup_waiting_tx_skb(tc6);
}
+static void oa_tc6_look_for_new_frame(struct oa_tc6 *tc6)
+{
+ tc6->rx_buf_overflow = true;
+ oa_tc6_cleanup_ongoing_rx_skb(tc6);
+}
+
/* If the failure is at SPI interface level, masking and clearing
* the interrupt of the device won't work. Since SPI interrupt is
* disabled, it should stop the repeated interrupts.
@@ -729,8 +735,7 @@ static int oa_tc6_process_extended_status(struct oa_tc6 *tc6)
}
if (FIELD_GET(STATUS0_RX_BUFFER_OVERFLOW_ERROR, value)) {
- tc6->rx_buf_overflow = true;
- oa_tc6_cleanup_ongoing_rx_skb(tc6);
+ oa_tc6_look_for_new_frame(tc6);
net_err_ratelimited("%s: Receive buffer overflow error\n",
tc6->netdev->name);
return -EAGAIN;
@@ -811,13 +816,35 @@ static void oa_tc6_submit_rx_skb(struct oa_tc6 *tc6)
tc6->rx_skb = NULL;
}
-static void oa_tc6_update_rx_skb(struct oa_tc6 *tc6, u8 *payload, u8 length)
+/* On oversubscribed traffic condition, particularly with overwhelming rx
+ * buffer overflow errors, there could be data chunk loss. If tail + length
+ * goes beyond end pointer, that is an indication that the data chunk with
+ * end_valid bit is lost. Time to look for a data chunk with start_valid bit.
+ *
+ * If rx_skb is NULL, it is time to start looking for data chunk with
+ * start_bit.
+ */
+static int oa_tc6_update_rx_skb(struct oa_tc6 *tc6, u8 *payload, u8 length)
{
+ if (!tc6->rx_skb ||
+ (tc6->rx_skb->tail + length) > tc6->rx_skb->end) {
+ oa_tc6_look_for_new_frame(tc6);
+ return -EAGAIN;
+ }
+
memcpy(skb_put(tc6->rx_skb, length), payload, length);
+ return 0;
}
+/* On overwhelming rx buffer overflow errors, due to data chunk loss, it is
+ * possible that we get two data chunks with start_valid bit set, without
+ * end_valid bit set in between. In this case, rx_skb would have a valid
+ * buffer pointer. We should release, if a valid pointer is found before
+ * allocating a new one.
+ */
static int oa_tc6_allocate_rx_skb(struct oa_tc6 *tc6)
{
+ oa_tc6_cleanup_ongoing_rx_skb(tc6);
tc6->rx_skb = netdev_alloc_skb_ip_align(tc6->netdev, tc6->netdev->mtu +
ETH_HLEN + ETH_FCS_LEN);
if (!tc6->rx_skb) {
@@ -837,7 +864,9 @@ static int oa_tc6_prcs_complete_rx_frame(struct oa_tc6 *tc6, u8 *payload,
if (ret)
return ret;
- oa_tc6_update_rx_skb(tc6, payload, size);
+ ret = oa_tc6_update_rx_skb(tc6, payload, size);
+ if (ret)
+ return ret;
oa_tc6_submit_rx_skb(tc6);
@@ -852,22 +881,24 @@ static int oa_tc6_prcs_rx_frame_start(struct oa_tc6 *tc6, u8 *payload, u16 size)
if (ret)
return ret;
- oa_tc6_update_rx_skb(tc6, payload, size);
-
- return 0;
+ return oa_tc6_update_rx_skb(tc6, payload, size);
}
-static void oa_tc6_prcs_rx_frame_end(struct oa_tc6 *tc6, u8 *payload, u16 size)
+static int oa_tc6_prcs_rx_frame_end(struct oa_tc6 *tc6, u8 *payload, u16 size)
{
- oa_tc6_update_rx_skb(tc6, payload, size);
+ int ret;
- oa_tc6_submit_rx_skb(tc6);
+ ret = oa_tc6_update_rx_skb(tc6, payload, size);
+ if (!ret)
+ oa_tc6_submit_rx_skb(tc6);
+ return ret;
}
-static void oa_tc6_prcs_ongoing_rx_frame(struct oa_tc6 *tc6, u8 *payload,
- u32 footer)
+static int oa_tc6_prcs_ongoing_rx_frame(struct oa_tc6 *tc6, u8 *payload,
+ u32 footer)
{
- oa_tc6_update_rx_skb(tc6, payload, OA_TC6_CHUNK_PAYLOAD_SIZE);
+ return oa_tc6_update_rx_skb(tc6, payload,
+ OA_TC6_CHUNK_PAYLOAD_SIZE);
}
static int oa_tc6_prcs_rx_chunk_payload(struct oa_tc6 *tc6, u8 *data,
@@ -880,6 +911,7 @@ static int oa_tc6_prcs_rx_chunk_payload(struct oa_tc6 *tc6, u8 *data,
bool start_valid = FIELD_GET(OA_TC6_DATA_FOOTER_START_VALID, footer);
bool end_valid = FIELD_GET(OA_TC6_DATA_FOOTER_END_VALID, footer);
u16 size;
+ int ret;
/* Restart the new rx frame after receiving rx buffer overflow error */
if (start_valid && tc6->rx_buf_overflow)
@@ -907,8 +939,7 @@ static int oa_tc6_prcs_rx_chunk_payload(struct oa_tc6 *tc6, u8 *data,
/* Process the chunk with only rx frame end */
if (end_valid && !start_valid) {
size = end_byte_offset + 1;
- oa_tc6_prcs_rx_frame_end(tc6, data, size);
- return 0;
+ return oa_tc6_prcs_rx_frame_end(tc6, data, size);
}
/* Process the chunk with previous rx frame end and next rx frame
@@ -921,7 +952,9 @@ static int oa_tc6_prcs_rx_chunk_payload(struct oa_tc6 *tc6, u8 *data,
*/
if (tc6->rx_skb) {
size = end_byte_offset + 1;
- oa_tc6_prcs_rx_frame_end(tc6, data, size);
+ ret = oa_tc6_prcs_rx_frame_end(tc6, data, size);
+ if (ret)
+ return ret;
}
size = OA_TC6_CHUNK_PAYLOAD_SIZE - start_byte_offset;
return oa_tc6_prcs_rx_frame_start(tc6,
@@ -930,9 +963,7 @@ static int oa_tc6_prcs_rx_chunk_payload(struct oa_tc6 *tc6, u8 *data,
}
/* Process the chunk with ongoing rx frame data */
- oa_tc6_prcs_ongoing_rx_frame(tc6, data, footer);
-
- return 0;
+ return oa_tc6_prcs_ongoing_rx_frame(tc6, data, footer);
}
static u32 oa_tc6_get_rx_chunk_footer(struct oa_tc6 *tc6, u16 footer_offset)
--
2.43.0
^ permalink raw reply related
* Re: [PATCH] fix: net: cadence: macb_mii_init: fix double of_node_put on mdio_np after macb_mdiobus_register
From: Andrew Lunn @ 2026-06-26 16:02 UTC (permalink / raw)
To: WenTao Liang
Cc: Nicolas Ferre, netdev, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, stable, linux-kernel
In-Reply-To: <20260626151449.50969-1-vulab@iscas.ac.cn>
On Fri, Jun 26, 2026 at 11:14:49PM +0800, WenTao Liang wrote:
> After macb_mdiobus_register succeeds, the mdio_np reference ownership is
> transferred to the mii_bus device (stored in mii_bus->dev.of_node). When
> the subsequent macb_mii_probe fails, the error path jumps to
> err_out_unregister_bus which calls mdiobus_free (releasing the node via
> fwnode_handle_put) and then falls through to err_out which calls
> of_node_put(mdio_np) again, causing a double put.
>
> Move the of_node_put to only execute on paths where the reference was not
> transferred (i.e., before successful macb_mdiobus_register).
>
> Cc: stable@vger.kernel.org
> Fixes: ef8a2e27289e ("net: macb: fix probing of PHY not described in the dt")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
> drivers/net/ethernet/cadence/macb_main.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
> index a12aa21244e8..c58e089e5888 100644
> --- a/drivers/net/ethernet/cadence/macb_main.c
> +++ b/drivers/net/ethernet/cadence/macb_main.c
> @@ -1170,6 +1170,9 @@ static int macb_mii_init(struct macb *bp)
> mdiobus_unregister(bp->mii_bus);
> err_out_free_mdiobus:
> mdiobus_free(bp->mii_bus);
> + of_node_put(mdio_np);
> + return err;
> +
> err_out:
> of_node_put(mdio_np);
This does not look correct.
You say if mdiobus_register() is successful, mdiobus_free() will
release the reference.
If macb_mii_probe() fails, we have successfully done
mdiobus_register(). It does a goto err_out_unregister_bus, which calls
mdiobus_unregister(), mdiobus_free() releasing the reference, and then
with your patch of_node_put(). This looks like a double put to me.
I think i already said this once, consider the risk of your patches,
particularly if you cannot test them.
Andrew
^ permalink raw reply
* Re: [PATCH v2] fix: net: renesas: rswitch_mii_register: fix double of_node_put after of_mdiobus_register
From: Andrew Lunn @ 2026-06-26 16:10 UTC (permalink / raw)
To: WenTao Liang
Cc: netdev, Yoshihiro Shimoda, David S . Miller, Jakub Kicinski,
Paolo Abeni, stable, linux-kernel
In-Reply-To: <20260626152550.51911-1-vulab@iscas.ac.cn>
On Fri, Jun 26, 2026 at 11:25:50PM +0800, WenTao Liang wrote:
> After of_mdiobus_register succeeds, the mdio_np reference ownership is
> transferred to the mii_bus device (released via fwnode_handle_put during
> mdiobus_release). The success path calls of_node_put(mdio_np) which,
> combined with the automatic release via bus teardown, results in a double
> put and refcount underflow.
>
> Move of_node_put so it is only called in the error path where
> of_mdiobus_register failed. On success, the bus driver manages the
> reference lifecycle.
Please stop with these patches.
First please read:
https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html
and
https://docs.kernel.org/process/submitting-patches.html
You are getting a lot of things wrong.
* don’t repost your patches within one 24h period
* Don't thread new versions of a patch to the old one
* Include version history, how is v2 different to v1
* When you see your own patch is broken, reply with NACK, and explain
what is wrong with it.
Until you learn how to correctly submit patches, please only submit
them one at a time, get it accepted, and move onto the next. Otherwise
you are wasting peoples time, and getting yourself a bad reputation.
Andrew
^ permalink raw reply
* Re: [PATCH] fix: net: phy: phy_sfp_probe: fix kref leak when phy_setup_sfp_port fails after sfp_bus_add_upstream
From: Andrew Lunn @ 2026-06-26 16:11 UTC (permalink / raw)
To: WenTao Liang
Cc: Andrew Lunn, netdev, Heiner Kallweit, Russell King,
David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
stable, linux-kernel
In-Reply-To: <20260626153443.52842-1-vulab@iscas.ac.cn>
On Fri, Jun 26, 2026 at 11:34:43PM +0800, WenTao Liang wrote:
> sfp_bus_add_upstream unconditionally acquires a kref on the SFP bus. When
> this call succeeds but the subsequent phy_setup_sfp_port fails, the error
> path returns without releasing the upstream reference. Since probe fails,
> the device's remove function (which would normally clean this up) will
> never be called, permanently leaking the kref.
>
> Call sfp_bus_del_upstream on the error path after a successful
> sfp_bus_add_upstream to properly release the upstream reference.
>
> Cc: stable@vger.kernel.org
> Fixes: 298e54fa810e ("net: phy: add core phylib sfp support")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Andrew
---
pw-bot: cr
^ permalink raw reply
* Re: [PATCH] fix: net: mdio: of_phy_register_fixed_link: fix phy_device reference leak via discarded pointer
From: Andrew Lunn @ 2026-06-26 16:11 UTC (permalink / raw)
To: WenTao Liang
Cc: Andrew Lunn, netdev, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, stable, linux-kernel
In-Reply-To: <20260626153330.52741-1-vulab@iscas.ac.cn>
On Fri, Jun 26, 2026 at 11:33:30PM +0800, WenTao Liang wrote:
> fixed_phy_register returns a struct phy_device pointer with a held
> reference on success. However, the register_phy label discards the
> pointer via PTR_ERR_OR_ZERO, and the phy_device's fwnode is not set, so
> of_phy_deregister_fixed_link cannot find the device via
> bus_find_device_by_fwnode to clean it up. This permanently leaks the
> phy_device and its device_node reference.
>
> Store the returned phy_device pointer and set dev->fwnode so the
> deregister path can properly locate and clean it up.
>
> Cc: stable@vger.kernel.org
> Fixes: 24c30dbbcdda ("of/mdio: Add support function for Ethernet fixed-link property")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Andrew
---
pw-bot: cr
^ permalink raw reply
* Re: [PATCH] fix: net: ti: cpts_of_mux_clk_setup: fix device_node reference leak on success path
From: Andrew Lunn @ 2026-06-26 16:11 UTC (permalink / raw)
To: WenTao Liang
Cc: Andrew Lunn, netdev, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Grygorii Strashko, linux-omap,
stable, linux-kernel
In-Reply-To: <20260626153148.52612-1-vulab@iscas.ac.cn>
On Fri, Jun 26, 2026 at 11:31:48PM +0800, WenTao Liang wrote:
> of_get_child_by_name acquires a device_node reference for refclk_np, and
> of_clk_add_hw_provider additionally takes an extra reference internally.
> On the success path, the function returns 0 without calling
> of_node_put(refclk_np), leaking the initial reference.
>
> Add of_node_put(refclk_np) before returning success to properly release
> the acquired reference.
>
> Cc: stable@vger.kernel.org
> Fixes: a3047a81ba13 ("net: ethernet: ti: cpts: add support for ext rftclk selection")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Andrew
---
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net v2 1/1] net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
From: Jamal Hadi Salim @ 2026-06-26 16:11 UTC (permalink / raw)
To: Simon Horman
Cc: netdev, davem, edumazet, kuba, pabeni, jiri, victor, security,
zdi-disclosures, stable, kernel test robot
In-Reply-To: <20260626141547.GA1310988@horms.kernel.org>
Hi Simon,
On Fri, Jun 26, 2026 at 10:15 AM Simon Horman <horms@kernel.org> wrote:
>
> On Fri, Jun 26, 2026 at 06:16:43AM -0400, Jamal Hadi Salim wrote:
> > "
> >
> > On Wed, Jun 24, 2026 at 6:40 PM Jamal Hadi Salim <jhs@mojatatu.com> wrote:
> > >
> > > The teql master->slaves singly linked list is not protected against
> > > multiple writes. It can be mod'ed concurently from teql_master_xmit(),
> > > teql_dequeue(), teql_init() and teql_destroy() without holding any list
> > > lock or RCU protection.
> > >
> > > zdi-disclosures@trendmicro.com has demonstrated that the qdisc is freed
> > > after an RCU grace period, but teql_master_xmit() running on another
> > > CPU can still hold a stale pointer into the list, resulting in a
> > > slab-use-after-free:
> > >
> > > BUG: KASAN: slab-use-after-free in teql_destroy+0x3ca/0x440 linux/net/sched/sch_teql.c:142
> > > Read of size 8 at addr ffff88802923aa80 by task ip/10024
> > >
> > > The zdi-disclosures@trendmicro.com repro created concurrent AF_PACKET
> > > senders on a teql device against a thread that repeatedly adds/deletes the
> > > slave qdisc, together with a SLUB spray that reclaims the freed slot; the
> > > resulting UAF is controllable enough to be turned into a read/write
> > > primitive against the freed qdisc object.
> > >
> > > The fix?
> > > Add a per-master slaves_lock spinlock that serializes all mutations of
> > > master->slaves and the NEXT_SLAVE() links in teql_destroy() and
> > > teql_qdisc_init(). teql_master_xmit() also takes the same slaves_lock
> > > around those updates.
> > > Annotate master->slaves and the per-slave ->next pointer with __rcu and
> > > use the appropriate RCU accessors everywhere they are touched:
> > > rcu_assign_pointer() on the writer side (under slaves_lock),
> > > rcu_dereference_protected() for the writer-side loads (also under
> > > slaves_lock), rcu_dereference_bh() for the loads in teql_master_xmit() and
> > > rtnl_dereference() for the loads in teql_master_open()/teql_master_mtu(),
> > > which run under RTNL.
> > > Pair this with rcu_read_lock_bh()/rcu_read_unlock_bh() around the list
> > > traversal in teql_master_xmit(), so that readers either observe a fully
> > > linked list or are deferred until the in-flight mutation completes. The two
> > > early-return paths in teql_master_xmit() are updated to release the RCU-bh
> > > read-side critical section before returning, since leaving it held would
> > > disable BH on that CPU for good.
> > >
> >
> > sashiko-gemini's complaints:
> > https://sashiko.dev/#/patchset/20260624224016.24018-1-jhs%40mojatatu.com
> > seem bogus to me (someone correct me if i am wrong). I am only going
> > to address the first claim of "TOCTOU / "resurrection" race in
> > teql_master_xmit()"
> > teql_master_xmit() holds rcu_read_lock_bh() across the entire
> > traversal. teql_destroy() freeing can only proceed once the qdisc's
> > RCU grace period has elapsed - so where is this TOCTOU? Let's say this
> > were true: both calls hold the slaves_lock.
> > The other issues are of similar nature.
>
> Hi Jamal,
>
> I think the central question here is about the protection offered by RCU
> in these code paths. And while I agree it protects the use of elements
> of the list, I think the problem flagged relates to the management of
> the list itself.
>
> The example AI gave me when I asked is like this:
>
> Assume a TEQL master has one slave, `q`.
> The list is circular: `q->next == q`.
>
> 1. CPU A (Transmitting): Enters `teql_master_xmit()`.
> It reads `master->sla ves` and gets a local pointer to `q`.
>
> 2. CPU B (Destroying): Calls `teql_destroy(q)`.
> It takes the lock, unlinks `q`, and sets `master->slaves = NULL`.
> The list is now logically empty.
>
> 3. CPU A: Finishes its work and prepares to rotate the list head
> to the next slave.
> It takes the lock.
>
> 4. CPU A (The "Use" / The Resurrection):
> It executes: `rcu_assign_pointer(master->slaves, NEXT_SLAVE(q));`
> Because `q` was circular, `NEXT_SLAVE(q)` is still `q`.
>
> 5. CPU A: Releases the lock.
> **The global `master->slaves` is now `q` again.**
>
> 6. The System: The RCU grace period expires. CPU B finishes
> `teql_destroy()` and the memory for `q` is freed.
>
> The global `master->slaves` pointer is now a **dangling pointer**
> pointing to freed memory.
>
Yeah, thats the same earlier claim of TOCTOU (what sashiko-gemini
claimed was "resurrecting the freed q")
My view is rcu read lock blocks the subsequent call_rcu free - and
destroy() and xmit() already serialize on slaves_lock.
I could be totaly wrong, but it's almost like sashiko-gemini thinks
that the list-mutation lock _alone_ governs the object lifetime.
The rcu read-side critical section prevents the UAF, not just the
slaves_lock alone
Only reason i added slaves_lock was to prevent corrupting the list
state (whereas the RCU read lock prevents premature free).
In step #4 above this thing somehow leaves out any mention of the rcu
read lock entirely and places the free in step 6 as if it was
independent of CPU A's critical section.
I am not sure how to improve it.
> > OTOH, sashiko-claude
> > (https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260624224016.24018-1-jhs%40mojatatu.com)
> > does make some valid claims which are low value, so not sure a resend
> > is worth it.
> > For example in claim 1 it says "Should the changelog mention this
> > teql_dequeue() site too?" Sure I can - but just because I provided
> > extra information in the commit log, which I could have omitted, now I
> > have to add more info? ;->
>
> FWIIW, I think there is a value in tightening up the commit message.
> E.g. so it's accurate when we look at again in two years time.
> But I also lean towards it not being necessary to post an update
> only to address this.
>
>
> > The second claim is "rcu_dereference_bh()
> > should be rcu_dereference_protected() on writer side". Sparse didnt
> > complain and i dont see this as breakage rather a consistency measure.
>
> I think it would be good to address in the long run. But as per my comment
> immediately above, I also lean towards it not being necessary to post an
> update only to address this.
I can resend with these two taken care of - but i am skeptical of what
sashiko-gemini is claiming (and i admit as a human the AI may see
something i am totally missing).
cheers,
jamal
>
> > Unless I am missing something ..
> >
> > cheers,
> > jamal
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox