* RE: [PATCH net v2] tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
From: Tung Quang Nguyen @ 2026-07-14 9:36 UTC (permalink / raw)
To: Daehyeon Ko
Cc: Jon Maloy, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org, stable@vger.kernel.org,
netdev@vger.kernel.org
In-Reply-To: <20260713082342.3803379-1-4ncienth@gmail.com>
>Subject: [PATCH net v2] tipc: clear sock->sk on the failed-insert path in
>tipc_sk_create()
>
>When tipc_sk_create() fails to insert the new socket (tipc_sk_insert() returns
>non-zero), its error path frees the sk with sk_free() but leaves
>sock->sk pointing at the freed object:
>
> if (tipc_sk_insert(tsk)) {
> sk_free(sk);
> pr_warn("Socket create failed; port number exhausted\n");
> return -EINVAL;
> }
>
>This is harmless for plain socket(): the syscall layer clears sock->ops before
>releasing, so tipc_release() is never called. It is not harmless on the accept()
>path. tipc_accept() creates the pre-allocated child socket with
>tipc_sk_create(net, new_sock, 0, kern); on failure it leaves new_sock->sk
>dangling and new_sock->ops non-NULL, and do_accept() then fput()s the new
>file, so __sock_release() -> tipc_release() runs
>lock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the sk_lock
>spinlock.
>
>tipc_release() already guards this exact "failed accept() releases a pre-allocated
>child" case with "if (sk == NULL) return 0;", but the guard is bypassed because
>tipc_sk_create() left sock->sk non-NULL
>(dangling) rather than NULL.
>
>Clear sock->sk on the failed-insert path so the existing tipc_release() NULL
>check fires and the use-after-free is avoided.
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
^ permalink raw reply
* Re: [net-next v5 3/4] net: af_unix: useful handling of LSM denials on SCM_RIGHTS
From: Kuniyuki Iwashima @ 2026-07-14 9:22 UTC (permalink / raw)
To: Jori Koolstra
Cc: Christian Brauner, Aleksa Sarai, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, netdev, linux-fsdevel,
linux-kernel
In-Reply-To: <20260712192958.1631672-4-jkoolstra@xs4all.nl>
On Sun, Jul 12, 2026 at 9:29 PM Jori Koolstra <jkoolstra@xs4all.nl> wrote:
>
> Right now if some LSM such as Smack denies an AF_UNIX socket peer to
> receive an SCM_RIGHTS fd, the SCM_RIGHTS fd array will be cut short at
> that point, and MSG_CTRUNC is set on return of recvmsg(). This is
> highly problematic behaviour, because it leaves the receiver
> wondering what happened. As per man page MSG_CTRUNC is supposed to
> indicate that the control buffer was sized too short, but suddenly
> a permission error might result in the exact same flag being set.
> Moreover, the receiver has no chance to determine how many fds got
> originally sent and how many were suppressed.[1]
>
> Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful
> handling of LSM denials when receiving SCM_RIGHTS messages: instead of
> truncating the message at the first blocked fd, keep every fd slot
> and store the LSM errno in the blocked slot.
>
> [1]: https://github.com/uapi-group/kernel-features#useful-handling-of-lsm-denials-on-scm_rights
>
> Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org>
> Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
> ---
> arch/alpha/include/uapi/asm/socket.h | 2 ++
> arch/mips/include/uapi/asm/socket.h | 2 ++
> arch/parisc/include/uapi/asm/socket.h | 2 ++
> arch/sparc/include/uapi/asm/socket.h | 2 ++
> include/net/af_unix.h | 1 +
> include/net/scm.h | 13 +++------
> include/uapi/asm-generic/socket.h | 2 ++
> net/compat.c | 4 +--
> net/core/scm.c | 38 +++++++++++++++++++++++----
> net/unix/af_unix.c | 9 +++++++
> 10 files changed, 59 insertions(+), 16 deletions(-)
>
> diff --git a/arch/alpha/include/uapi/asm/socket.h b/arch/alpha/include/uapi/asm/socket.h
> index 5ef57f88df6b..946a5fad2691 100644
> --- a/arch/alpha/include/uapi/asm/socket.h
> +++ b/arch/alpha/include/uapi/asm/socket.h
> @@ -155,6 +155,8 @@
> #define SO_INQ 84
> #define SCM_INQ SO_INQ
>
> +#define SO_RIGHTS_NOTRUNC 85
> +
> #if !defined(__KERNEL__)
>
> #if __BITS_PER_LONG == 64
> diff --git a/arch/mips/include/uapi/asm/socket.h b/arch/mips/include/uapi/asm/socket.h
> index 72fb1b006da9..f1641dde135f 100644
> --- a/arch/mips/include/uapi/asm/socket.h
> +++ b/arch/mips/include/uapi/asm/socket.h
> @@ -166,6 +166,8 @@
> #define SO_INQ 84
> #define SCM_INQ SO_INQ
>
> +#define SO_RIGHTS_NOTRUNC 85
> +
> #if !defined(__KERNEL__)
>
> #if __BITS_PER_LONG == 64
> diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
> index c16ec36dfee6..f3a3815c7dc2 100644
> --- a/arch/parisc/include/uapi/asm/socket.h
> +++ b/arch/parisc/include/uapi/asm/socket.h
> @@ -147,6 +147,8 @@
> #define SO_INQ 0x4052
> #define SCM_INQ SO_INQ
>
> +#define SO_RIGHTS_NOTRUNC 0x4053
> +
> #if !defined(__KERNEL__)
>
> #if __BITS_PER_LONG == 64
> diff --git a/arch/sparc/include/uapi/asm/socket.h b/arch/sparc/include/uapi/asm/socket.h
> index 71befa109e1c..7907f3b1f0ee 100644
> --- a/arch/sparc/include/uapi/asm/socket.h
> +++ b/arch/sparc/include/uapi/asm/socket.h
> @@ -148,6 +148,8 @@
> #define SO_INQ 0x005d
> #define SCM_INQ SO_INQ
>
> +#define SO_RIGHTS_NOTRUNC 0x005e
> +
> #if !defined(__KERNEL__)
>
>
> diff --git a/include/net/af_unix.h b/include/net/af_unix.h
> index 34f53dde65ce..bb1b3dee02e8 100644
> --- a/include/net/af_unix.h
> +++ b/include/net/af_unix.h
> @@ -49,6 +49,7 @@ struct unix_sock {
> struct scm_stat scm_stat;
> int inq_len;
> bool recvmsg_inq;
> + bool scm_rights_notrunc;
> #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
> struct sk_buff *oob_skb;
> #endif
> diff --git a/include/net/scm.h b/include/net/scm.h
> index c52519669349..86ae6bc109ec 100644
> --- a/include/net/scm.h
> +++ b/include/net/scm.h
> @@ -50,8 +50,8 @@ struct scm_cookie {
> #endif
> };
>
> -void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm);
> -void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm);
> +void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm, bool notrunc);
> +void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm, bool notrunc);
> int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm);
> void __scm_destroy(struct scm_cookie *scm);
> struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl);
> @@ -107,13 +107,8 @@ void scm_recv(struct socket *sock, struct msghdr *msg,
> void scm_recv_unix(struct socket *sock, struct msghdr *msg,
> struct scm_cookie *scm, int flags);
>
> -static inline int scm_recv_one_fd(struct file *f, int __user *ufd,
> - unsigned int flags)
> -{
> - if (!ufd)
> - return -EFAULT;
> - return receive_fd(f, ufd, flags);
> -}
> +int scm_recv_one_fd(struct file *f, int __user *ufd, unsigned int flags,
> + bool notrunc);
>
> #endif /* __LINUX_NET_SCM_H */
>
> diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
> index 53b5a8c002b1..84ea7b92936e 100644
> --- a/include/uapi/asm-generic/socket.h
> +++ b/include/uapi/asm-generic/socket.h
> @@ -150,6 +150,8 @@
> #define SO_INQ 84
> #define SCM_INQ SO_INQ
>
> +#define SO_RIGHTS_NOTRUNC 85
> +
> #if !defined(__KERNEL__)
>
> #if __BITS_PER_LONG == 64 || (defined(__x86_64__) && defined(__ILP32__))
> diff --git a/net/compat.c b/net/compat.c
> index d68cf9c3aad5..6bdf4a2c9077 100644
> --- a/net/compat.c
> +++ b/net/compat.c
> @@ -286,7 +286,7 @@ static int scm_max_fds_compat(struct msghdr *msg)
> return (msg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
> }
>
> -void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm)
> +void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm, bool notrunc)
> {
> struct compat_cmsghdr __user *cm =
> (struct compat_cmsghdr __user *)msg->msg_control_user;
> @@ -296,7 +296,7 @@ void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm)
> int err = 0, i;
>
> for (i = 0; i < fdmax; i++) {
> - err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags);
> + err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags, notrunc);
> if (err < 0)
> break;
> }
> diff --git a/net/core/scm.c b/net/core/scm.c
> index a73b1eb30fd2..f0d44ecdb11f 100644
> --- a/net/core/scm.c
> +++ b/net/core/scm.c
> @@ -351,7 +351,31 @@ static int scm_max_fds(struct msghdr *msg)
> return (msg->msg_controllen - sizeof(struct cmsghdr)) / sizeof(int);
> }
>
> -void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
> +int scm_recv_one_fd(struct file *f, int __user *ufd, unsigned int flags,
> + bool notrunc)
> +{
> + int error;
> +
> + if (!ufd)
> + return -EFAULT;
> +
> + error = security_file_receive(f);
> + if (error)
> + return notrunc ? put_user(error, ufd) : error;
> +
> + FD_PREPARE(fdf, flags, get_file(f));
> + if (fdf.err)
> + return fdf.err;
> +
> + error = put_user(fd_prepare_fd(fdf), ufd);
> + if (error)
> + return error;
> +
> + __receive_sock(fd_prepare_file(fdf));
> + return fd_publish(fdf);
> +}
> +
> +void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm, bool notrunc)
> {
> struct cmsghdr __user *cm =
> (__force struct cmsghdr __user *)msg->msg_control_user;
> @@ -365,12 +389,12 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
> return;
>
> if (msg->msg_flags & MSG_CMSG_COMPAT) {
> - scm_detach_fds_compat(msg, scm);
> + scm_detach_fds_compat(msg, scm, notrunc);
> return;
> }
>
> for (i = 0; i < fdmax; i++) {
> - err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags);
> + err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags, notrunc);
> if (err < 0)
> break;
> }
> @@ -542,8 +566,12 @@ void scm_recv_unix(struct socket *sock, struct msghdr *msg,
> if (!__scm_recv_common(sock->sk, msg, scm, flags))
> return;
>
> - if (scm->fp)
> - scm_detach_fds(msg, scm);
> + if (scm->fp) {
> + struct unix_sock *u;
> +
> + u = unix_sk(sock->sk);
> + scm_detach_fds(msg, scm, READ_ONCE(u->scm_rights_notrunc));
> + }
>
> if (sock->sk->sk_scm_pidfd)
> scm_pidfd_recv(msg, scm);
> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> index 3d256255085b..e7b3aab2f176 100644
> --- a/net/unix/af_unix.c
> +++ b/net/unix/af_unix.c
> @@ -921,6 +921,7 @@ static bool unix_custom_sockopt(int optname)
> {
> switch (optname) {
> case SO_INQ:
> + case SO_RIGHTS_NOTRUNC:
> return true;
> default:
> return false;
> @@ -956,6 +957,14 @@ static int unix_setsockopt(struct socket *sock, int level, int optname,
>
> WRITE_ONCE(u->recvmsg_inq, val);
> break;
> +
> + case SO_RIGHTS_NOTRUNC:
> + if (val > 1 || val < 0)
> + return -EINVAL;
> +
> + WRITE_ONCE(u->scm_rights_notrunc, val);
This should be inherited to the child sock, after setting newu->listener
in unix_stream_connect().
> + break;
> +
> default:
> return -ENOPROTOOPT;
> }
> --
> 2.55.0
>
^ permalink raw reply
* [PATCH net-next] ppp: reuse ppp_get_stats64() for ioctl stats
From: Zhixing Chen @ 2026-07-14 9:19 UTC (permalink / raw)
To: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Qingfang Deng, linux-ppp, netdev, Zhixing Chen
ppp_get_stats() open-codes the per-cpu tstats aggregation even though
ppp_get_stats64() already collects the packet, byte and error counters
needed by the legacy SIOCGPPPSTATS ioctl path.
Reuse ppp_get_stats64() when filling struct ppp_stats. This keeps the
ioctl stats path consistent with the netdev stats64 path and removes the
open-coded per-cpu stats aggregation from the ioctl path.
Signed-off-by: Zhixing Chen <running910@gmail.com>
---
This is meant as a small cleanup. The ioctl path and the netdev stats64
path already use the same underlying counters, so this just makes the
ioctl path reuse ppp_get_stats64() instead of open-coding the per-cpu
aggregation locally.
---
drivers/net/ppp/ppp_generic.c | 25 ++++++++-----------------
1 file changed, 8 insertions(+), 17 deletions(-)
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 57c68efa5ff8..53e6d40193fd 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -3303,26 +3303,17 @@ find_compressor(int type)
static void
ppp_get_stats(struct ppp *ppp, struct ppp_stats *st)
{
+ struct rtnl_link_stats64 stats64 = {};
struct slcompress *vj = ppp->vj;
- int cpu;
memset(st, 0, sizeof(*st));
- for_each_possible_cpu(cpu) {
- struct pcpu_sw_netstats *p = per_cpu_ptr(ppp->dev->tstats, cpu);
- u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
-
- rx_packets = u64_stats_read(&p->rx_packets);
- rx_bytes = u64_stats_read(&p->rx_bytes);
- tx_packets = u64_stats_read(&p->tx_packets);
- tx_bytes = u64_stats_read(&p->tx_bytes);
-
- st->p.ppp_ipackets += rx_packets;
- st->p.ppp_ibytes += rx_bytes;
- st->p.ppp_opackets += tx_packets;
- st->p.ppp_obytes += tx_bytes;
- }
- st->p.ppp_ierrors = ppp->dev->stats.rx_errors;
- st->p.ppp_oerrors = ppp->dev->stats.tx_errors;
+ ppp_get_stats64(ppp->dev, &stats64);
+ st->p.ppp_ipackets = stats64.rx_packets;
+ st->p.ppp_ibytes = stats64.rx_bytes;
+ st->p.ppp_opackets = stats64.tx_packets;
+ st->p.ppp_obytes = stats64.tx_bytes;
+ st->p.ppp_ierrors = stats64.rx_errors;
+ st->p.ppp_oerrors = stats64.tx_errors;
if (!vj)
return;
st->vj.vjs_packets = vj->sls_o_compressed + vj->sls_o_uncompressed;
--
2.34.1
^ permalink raw reply related
* Re: [net-next v5 1/4] net: af_unix: enable custom setsockopt for all socket types
From: Kuniyuki Iwashima @ 2026-07-14 9:19 UTC (permalink / raw)
To: Jori Koolstra
Cc: Christian Brauner, Aleksa Sarai, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, netdev, linux-fsdevel,
linux-kernel
In-Reply-To: <20260712192958.1631672-2-jkoolstra@xs4all.nl>
On Sun, Jul 12, 2026 at 9:29 PM Jori Koolstra <jkoolstra@xs4all.nl> wrote:
>
> unix_setsockopt() and the SOCK_CUSTOM_SOCKOPT flag were only wired up
> for SOCK_STREAM (introduced along with the stream-only SO_INQ).
> Consequently custom AF_UNIX options are unreachable on SOCK_DGRAM and
> SOCK_SEQPACKET: those setsockopt() calls bypass unix_setsockopt() and
> fall through to the generic sock_setsockopt(), failing with
> -ENOPROTOOPT.
>
> Set SOCK_CUSTOM_SOCKOPT for every AF_UNIX socket type in unix_create(), and
> also for accepted sockets in unix_accept() (reachable for stream and
> seqpacket).
>
> This is a prerequisite for making SO_RIGHTS_NOTRUNC settable on all AF_UNIX
> socket types.
>
> Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
> ---
> net/unix/af_unix.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> index f7a9d55eee8a..3d256255085b 100644
> --- a/net/unix/af_unix.c
> +++ b/net/unix/af_unix.c
> @@ -949,7 +949,7 @@ static int unix_setsockopt(struct socket *sock, int level, int optname,
> switch (optname) {
> case SO_INQ:
> if (sk->sk_type != SOCK_STREAM)
> - return -EINVAL;
> + return -ENOPROTOOPT;
>
> if (val > 1 || val < 0)
> return -EINVAL;
> @@ -1005,6 +1005,7 @@ static const struct proto_ops unix_dgram_ops = {
> #endif
> .listen = sock_no_listen,
> .shutdown = unix_shutdown,
> + .setsockopt = unix_setsockopt,
> .sendmsg = unix_dgram_sendmsg,
> .read_skb = unix_read_skb,
> .recvmsg = unix_dgram_recvmsg,
> @@ -1029,6 +1030,7 @@ static const struct proto_ops unix_seqpacket_ops = {
> #endif
> .listen = unix_listen,
> .shutdown = unix_shutdown,
> + .setsockopt = unix_setsockopt,
> .sendmsg = unix_seqpacket_sendmsg,
> .recvmsg = unix_seqpacket_recvmsg,
> .mmap = sock_no_mmap,
> @@ -1142,9 +1144,10 @@ static int unix_create(struct net *net, struct socket *sock, int protocol,
> if (protocol && protocol != PF_UNIX)
> return -EPROTONOSUPPORT;
>
> + set_bit(SOCK_CUSTOM_SOCKOPT, &sock->flags);
Please move this to unix_create1(), then we don't need the chunk below.
> +
> switch (sock->type) {
> case SOCK_STREAM:
> - set_bit(SOCK_CUSTOM_SOCKOPT, &sock->flags);
> sock->ops = &unix_stream_ops;
> break;
> /*
> @@ -1864,8 +1867,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock,
> skb_free_datagram(sk, skb);
> wake_up_interruptible(&unix_sk(sk)->peer_wait);
>
> - if (tsk->sk_type == SOCK_STREAM)
> - set_bit(SOCK_CUSTOM_SOCKOPT, &newsock->flags);
> + set_bit(SOCK_CUSTOM_SOCKOPT, &newsock->flags);
>
> /* attach accepted sock to socket */
> unix_state_lock(tsk);
> --
> 2.55.0
>
^ permalink raw reply
* [PATCH wireless] wifi: wilc1000: validate assoc response length before subtracting header
From: Huihui Huang @ 2026-07-14 9:17 UTC (permalink / raw)
To: linux-wireless; +Cc: Huihui Huang, Ajay Singh, Claudiu Beznea, netdev, stable
wilc_parse_assoc_resp_info() computes the trailing IE length as
ies_len = buffer_len - sizeof(*res);
without first checking that buffer_len is at least sizeof(struct
wilc_assoc_resp) (6 bytes). buffer_len is the length reported for a
received association response (host_int_parse_assoc_resp_info() passes
hif_drv->assoc_resp / assoc_resp_info_len straight in) and must be
validated before the driver accesses the fixed header.
For a frame shorter than the 6-byte fixed header, the subtraction wraps.
For a four-byte response the result is truncated to a u16 ies_len of
65534, so kmemdup() then attempts to copy 65534 bytes starting at
buffer + sizeof(*res), beyond the valid association-response data
(CWE-125). A response shorter than four bytes can also cause an
out-of-bounds read of res->status_code at offsets 2 and 3.
Reject frames too short to hold the fixed header before touching the
header or computing ies_len. Also set the connection status to a failure
on this path: the caller falls through to a
"conn_info->status == WLAN_STATUS_SUCCESS" check after the parser
returns, so leaving the status untouched could let a malformed short
response be treated as a successful association.
Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Huihui Huang <hhhuang@smu.edu.sg>
---
drivers/net/wireless/microchip/wilc1000/hif.c | 5 +++++
1 file changed, 5 insertions(+)
Confirmed on Linux v7.2-rc2 with a temporary KUnit test that calls the
static wilc_parse_assoc_resp_info() on a 4-byte association-response frame
(status_code zeroed, i.e. WLAN_STATUS_SUCCESS). Verbatim KUnit output
(timestamps stripped):
before this change:
# wilc_assoc_resp_short_frame_test: ret=0 resp_ies=ffff888008890000 resp_ies_len=65534 (want -EINVAL / NULL / 0)
after this change:
# wilc_assoc_resp_short_frame_test: ret=-22 resp_ies=0000000000000000 resp_ies_len=0 (want -EINVAL / NULL / 0)
So a 4-byte frame drives a 65534-byte kmemdup() over-read before the fix,
and is rejected with -EINVAL after it. The test also asserts the rejected
frame does not leave conn_info->status at WLAN_STATUS_SUCCESS.
diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c
index 009c477..60fe5f0 100644
--- a/drivers/net/wireless/microchip/wilc1000/hif.c
+++ b/drivers/net/wireless/microchip/wilc1000/hif.c
@@ -600,6 +600,11 @@ static s32 wilc_parse_assoc_resp_info(u8 *buffer, u32 buffer_len,
u16 ies_len;
struct wilc_assoc_resp *res = (struct wilc_assoc_resp *)buffer;
+ if (buffer_len < sizeof(*res)) {
+ ret_conn_info->status = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ return -EINVAL;
+ }
+
ret_conn_info->status = le16_to_cpu(res->status_code);
if (ret_conn_info->status == WLAN_STATUS_SUCCESS) {
ies = &buffer[sizeof(*res)];
base-commit: a0d82fb8505326cbc53dc9a0c08f97d11197bb30
--
2.50.1
^ permalink raw reply related
* Re: [PATCH net-next v6 2/7] net: phy: phylink: add helper to modify pause
From: Maxime Chevallier @ 2026-07-14 9:16 UTC (permalink / raw)
To: Javen, hkallweit1@gmail.com, nic_swsd@realtek.com,
andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, horms@kernel.org
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
daniel@makrotopia.org, linux@armlinux.org.uk,
enelsonmoore@gmail.com, daniel@thingy.jp
In-Reply-To: <aeed474059bc4fd7b9c5e3074ef591a4@realsil.com.cn>
Hi Javen,
On 7/13/26 09:51, Javen wrote:
> Hi,
>
>> There's a change in the MAC's ability to support Pause, so we should :
>>
>> - Recompute the pl->supported field. Update the config.mac_capabilities with
>> the
>> new pause settings, calling phylink_validate() should do the trick I think, this
>> will rebuild the capability list:
>>
>> phylink_validate(pl, pl->supported, &pl->link_config);
>>
>> - Then update the pl->link_config.pause,
>>
>> - Then update the pause advertising, like done in phylink_setpauseparam
>> ( I think, everything that comes after pl->state_mutex gets released in
>> phylink_ethtool_set_pauseparam)
>>
>> Ideally, the logic to update the advertising and re-trigger a negociation should
>> be factored out in a private helper, then reused from both this path (MAC
>> updates pause support) and the phylink_ethtool_set_pauseparam path.
>>
>> Maxime
>
> Thanks for review and helpful suggestions.
>
> I agree with your suggestion to factor out the logic into a private helper and reuse it for both phylink_ethtool_set_pauseparam() and phylink_update_mac_pause_capabilities().
>
> Here is the refactored logic. I want to share this specific part with you for a quick check before I submit v7 patch.
I'm currently attending the netdev conference, It'll take a few days for me to
look at this, sorry about that :/
Maxime
^ permalink raw reply
* Re: [PATCH net] bpf: tcp: fix double sock release on batch realloc
From: Eric Dumazet @ 2026-07-14 9:13 UTC (permalink / raw)
To: Xiang Mei (Microsoft)
Cc: Neal Cardwell, Kuniyuki Iwashima, David S . Miller,
Jakub Kicinski, Paolo Abeni, Simon Horman, netdev, linux-kernel,
bpf, Jordan Rife, Martin KaFai Lau, Stanislav Fomichev,
AutonomousCodeSecurity, tgopinath, kys
In-Reply-To: <20260713233230.3553593-1-xmei5@asu.edu>
On Tue, Jul 14, 2026 at 1:32 AM Xiang Mei (Microsoft) <xmei5@asu.edu> wrote:
>
> bpf_iter_tcp_batch() releases the current batch via
> bpf_iter_tcp_put_batch(), which drops the socket refs and rewrites
> each slot with the socket cookie, then grows the batch. cur_sk/end_sk
> are kept for bpf_iter_tcp_resume(), but on realloc failure the function
> returns ERR_PTR() before resume runs, leaving cur_sk < end_sk over
> slots that now hold cookies rather than sock pointers.
> bpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and
> dereferences a cookie as a struct sock.
>
> Empty the batch on the failure path so stop() does not release it
> again. The sockets were already freed by the first
> bpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans
> the bucket from the start instead of skipping it. The sibling
> GFP_NOWAIT failure path still holds real socket references and is left
> for stop() to release.
Reviewed-by: Eric Dumazet <edumazet@google.com>
^ permalink raw reply
* Re: [PATCH net-next v10 5/5] net: wangxun: add pcie error handler
From: Simon Horman @ 2026-07-14 9:11 UTC (permalink / raw)
To: jiawenwu
Cc: Simon Horman, netdev, mengyuanlou, andrew+netdev, davem, edumazet,
kuba, pabeni, richardcochran, linux, aleksandr.loktionov,
jacob.e.keller, michal.swiatkowski, kees, joe, leitao, shaojijie,
u.kleine-koenig, weirongguang, larysa.zaremba, fabio.baltieri
In-Reply-To: <20260707061455.39564-6-jiawenwu@trustnetic.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
Full review at: https://sashiko.dev
---
--- Patch [5]: [PATCH net-next v10 5/5] net: wangxun: add pcie error handler ---
commit 91baa4e77d07ab6772569a7d37ed86cfda625c00
Author: Jiawen Wu <jiawenwu@trustnetic.com>
Subject: net: wangxun: add pcie error handler
This commit adds PCIe error handling support (AER) to the wangxun drivers
(ngbe and txgbe). It detects hardware errors, attempts to soft quiesce,
and registers standard PCI error handler callbacks.
> diff --git a/drivers/net/ethernet/wangxun/libwx/wx_err.c b/drivers/net/ethernet/wangxun/libwx/wx_err.c
> index ee27f96735dc7..0cb99e456a1c9 100644
> --- a/drivers/net/ethernet/wangxun/libwx/wx_err.c
> +++ b/drivers/net/ethernet/wangxun/libwx/wx_err.c
[ ... ]
> +static void wx_io_resume(struct pci_dev *pdev)
> +{
> + struct wx *wx = pci_get_drvdata(pdev);
> + struct net_device *netdev;
> + int err;
> +
> + netdev = wx->netdev;
> + rtnl_lock();
> + if (netif_running(netdev)) {
> + err = netdev->netdev_ops->ndo_open(netdev);
[Severity: High]
Does this sequence risk corrupting the hw_tc_lock seqlock?
During AER recovery, wx_io_slot_reset() calls down_suspend(), which bypasses
wx_ptp_stop(). This leaves the PTP clock registered and potentially in use by
userspace.
When wx_io_resume() then calls ndo_open(), this triggers txgbe_up() or
ngbe_up(), which in turn calls wx_ptp_init(). Since wx_ptp_init()
unconditionally calls seqlock_init(&wx->hw_tc_lock), won't this corrupt the
lock if userspace is actively issuing PTP ioctls?
> + if (err) {
> + wx_err(wx, "Failed to open netdev after reset\n");
[ ... ]
> diff --git a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
> index 92895f5035118..56d4b63387fd6 100644
> --- a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
> +++ b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
[ ... ]
> @@ -413,6 +428,9 @@ static void ngbe_disable_device(struct wx *wx)
>
> static void ngbe_reset(struct wx *wx)
> {
> + if (test_bit(WX_FLAG_NEED_PCIE_RECOVERY, wx->flags))
> + return;
> +
> wx_flush_sw_mac_table(wx);
[Severity: High]
Is the hardware properly reinitialized here after an AER slot reset?
In wx_io_slot_reset(), the hardware needs to be restarted from scratch.
While txgbe_reset() calls txgbe_reset_hw(), ngbe_reset() only flushes the
software MAC tables and skips calling ngbe_reset_hw().
Because this patch registers wx_err_handler for the ngbe driver, won't this
leave the hardware uninitialized and the interface broken after a PCIe slot
reset?
[ ... ]
> @@ -529,12 +548,16 @@ static int ngbe_close(struct net_device *netdev)
> {
> struct wx *wx = netdev_priv(netdev);
>
> + if (test_bit(WX_STATE_RES_FREED, wx->state))
> + goto out;
> +
> wx_ptp_stop(wx);
[Severity: High]
Does this early return cause a use-after-free for the PTP clock?
If a PCI error occurs, down_suspend() sets WX_STATE_RES_FREED but
intentionally skips wx_ptp_stop(). If the interface is subsequently closed or
unregistered, ngbe_close() will return early here and never call
wx_ptp_stop().
Because the PTP clock device is never unregistered, it remains exposed to
userspace after the driver's memory is freed. Can this lead to a
use-after-free if userspace interacts with the clock later?
[ ... ]
> diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
> index a7bde03a98feb..d85ee83192e4f 100644
> --- a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
> +++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
[ ... ]
> @@ -530,12 +549,16 @@ static int txgbe_close(struct net_device *netdev)
> {
> struct wx *wx = netdev_priv(netdev);
>
> + if (test_bit(WX_STATE_RES_FREED, wx->state))
> + goto out;
> +
> wx_ptp_stop(wx);
[Severity: High]
Similar to ngbe_close() above, does this early return skip wx_ptp_stop() and
lead to a use-after-free if the txgbe device is closed after an AER suspend?
^ permalink raw reply
* Re: [PATCH net-next v10 4/5] net: wangxun: implement soft quiesce for PCIe error recovery
From: Simon Horman @ 2026-07-14 9:11 UTC (permalink / raw)
To: jiawenwu
Cc: Simon Horman, netdev, mengyuanlou, andrew+netdev, davem, edumazet,
kuba, pabeni, richardcochran, linux, aleksandr.loktionov,
jacob.e.keller, michal.swiatkowski, kees, joe, leitao, shaojijie,
u.kleine-koenig, weirongguang, larysa.zaremba, fabio.baltieri
In-Reply-To: <20260707061455.39564-5-jiawenwu@trustnetic.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
Full review at: https://sashiko.dev
---
--- Patch [4]: [PATCH net-next v10 4/5] net: wangxun: implement soft quiesce for PCIe error recovery ---
commit 1b8a0e5e722ffb89c8fe24492e80dca44f3410f2
Author: Jiawen Wu <jiawenwu@trustnetic.com>
net: wangxun: implement soft quiesce for PCIe error recovery
This commit introduces a soft quiesce path for PCIe error recovery. It adds
WX_STATE_DOWN and WX_STATE_RESETTING state checks to subtasks to block
execution, explicitly avoiding a cancellation of the service task to speed
up recovery.
> diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
> index c8a4822d38194..a65312c8078fa 100644
> --- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c
> +++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
[ ... ]
> @@ -3383,5 +3383,23 @@ void wx_service_timer(struct timer_list *t)
> }
> EXPORT_SYMBOL(wx_service_timer);
>
> +void wx_soft_quiesce(struct wx *wx)
> +{
> + if (!netif_running(wx->netdev) ||
> + test_and_set_bit(WX_STATE_DOWN, wx->state))
> + return;
> +
> + pci_clear_master(wx->pdev);
> + netif_tx_stop_all_queues(wx->netdev);
> + netif_carrier_off(wx->netdev);
> + netif_tx_disable(wx->netdev);
> + wx_napi_disable_all(wx);
> + wx_ptp_quiesce(wx);
> +
> + clear_bit(WX_FLAG_NEED_PF_RESET, wx->flags);
> + timer_delete_sync(&wx->service_timer);
[Severity: High]
The commit message notes the service task is deliberately not cancelled here
to avoid delaying PCIe error recovery. However, does omitting
cancel_work_sync(&wx->service_task) open a race window with the subtasks
that rely on the WX_STATE_DOWN flag?
> +}
> +EXPORT_SYMBOL(wx_soft_quiesce);
> diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
> index a8773712cff82..a7bde03a98feb 100644
> --- a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
> +++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
[ ... ]
> @@ -94,6 +94,10 @@ static void txgbe_module_detection_subtask(struct wx *wx)
> {
> int err;
>
> + if (test_bit(WX_STATE_DOWN, wx->state) ||
> + test_bit(WX_STATE_RESETTING, wx->state))
> + return;
> +
[Severity: High]
Does this state check adequately protect against concurrent MMIO access
during a PCIe reset?
If the task passes this check, it subsequently sleeps for 200ms:
txgbe_main.c:txgbe_module_detection_subtask() {
...
if (!test_and_clear_bit(WX_FLAG_NEED_MODULE_RESET, wx->flags))
return;
/* wait for SFF module ready */
msleep(200);
err = txgbe_identify_module(wx);
...
}
If wx_soft_quiesce() runs on another CPU during this msleep(), it will set
WX_STATE_DOWN and begin a hardware reset.
When the task wakes up from the sleep, will it call txgbe_identify_module()
and perform MMIO reads (such as rd32(wx, WX_GPIO_EXT)) while the device is
in reset?
Could this time-of-check to time-of-use race lead to Master Aborts or
fatal PCIe errors during AER recovery?
> if (!test_and_clear_bit(WX_FLAG_NEED_MODULE_RESET, wx->flags))
> return;
^ permalink raw reply
* Re: [PATCH net v3 3/3] net: stmmac: reset residual action in L3L4 filters on delete
From: Maxime Chevallier @ 2026-07-14 9:10 UTC (permalink / raw)
To: muhammad.nazim.amirul.nazle.asmade, netdev
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, rmk+kernel,
Jose.Abreu, linux-kernel
In-Reply-To: <20260714023716.29865-5-muhammad.nazim.amirul.nazle.asmade@altera.com>
Hi,
On 7/14/26 04:37, muhammad.nazim.amirul.nazle.asmade@altera.com wrote:
> From: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
>
> When deleting an L3/L4 flower filter entry, the action field is not
> reset. If a filter was previously configured with a drop action, that
> action may persist and affect subsequent filter configurations
> unintentionally.
>
> Clear the action field when the filter entry is deleted.
>
> Fixes: 425eabddaf0f ("net: stmmac: Implement L3/L4 Filters using TC Flower")
> Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
> Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Maxime
^ permalink raw reply
* Re: [PATCH net v3 2/3] net: stmmac: fix l3l4 filter rejecting unsupported offload requests
From: Maxime Chevallier @ 2026-07-14 9:09 UTC (permalink / raw)
To: muhammad.nazim.amirul.nazle.asmade, netdev
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, rmk+kernel,
Jose.Abreu, linux-kernel
In-Reply-To: <20260714023716.29865-4-muhammad.nazim.amirul.nazle.asmade@altera.com>
Hi,
On 7/14/26 04:37, muhammad.nazim.amirul.nazle.asmade@altera.com wrote:
> From: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
>
> The basic flow parser in tc_add_basic_flow() does not validate match
> keys before proceeding. Unsupported offload configurations such as
> partial protocol masks, non-IPv4 network proto, or non-TCP/UDP transport
> proto are silently accepted instead of returning -EOPNOTSUPP.
>
> Add validation to return -EOPNOTSUPP early for:
> - No network or transport proto present in the key
> - Partial protocol mask (only full mask supported)
> - Network proto is not IPv4
> - Transport proto is not TCP or UDP
>
> Each rejection includes an extack message so the user knows which part
> of the match is unsupported.
>
> Also propagate -EOPNOTSUPP from tc_add_basic_flow() in tc_add_flow()
> by returning it directly rather than using break. The break was silently
> discarding the error for FLOW_CLS_REPLACE operations where entry->in_use
> is already true, causing tc_add_flow() to return 0 (success) for
> unsupported replace requests.
>
> Fixes: 425eabddaf0f ("net: stmmac: Implement L3/L4 Filters using TC Flower")
> Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
> Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Maxime
^ permalink raw reply
* [syzbot] [net?] possible deadlock in rtnl_net_dev_lock
From: syzbot @ 2026-07-14 9:07 UTC (permalink / raw)
To: dario.binacchi, linux-can, linux-kernel, mailhol, mkl, netdev,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: bee763d5f341 Add linux-next specific files for 20260710
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=17d360b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c00ea6b66be5f95
dashboard link: https://syzkaller.appspot.com/bug?extid=de610eeef174bd59a8a3
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/34c8f306351e/disk-bee763d5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d6fb1414f52c/vmlinux-bee763d5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2e7f8585b4c7/bzImage-bee763d5.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+de610eeef174bd59a8a3@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G L
------------------------------------------------------
kworker/u8:47/12528 is trying to acquire lock:
ffff8880517dd070 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2852 [inline]
ffff8880517dd070 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline]
ffff8880517dd070 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: call_netdevice_unregister_notifiers net/core/dev.c:1917 [inline]
ffff8880517dd070 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: call_netdevice_unregister_net_notifiers+0x1e0/0x4c0 net/core/dev.c:1953
but task is already holding lock:
ffffffff8f7c1e78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
ffffffff8f7c1e78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0 net/core/dev.c:2167
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #6 (rtnl_mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/rtmutex_api.c:559 [inline]
_mutex_lock_killable+0x63/0x1d0 kernel/locking/rtmutex_api.c:599
rtnl_net_lock_killable include/linux/rtnetlink.h:145 [inline]
register_netdev+0x18/0x60 net/core/dev.c:11565
slcan_open+0x35f/0x440 drivers/net/can/slcan/slcan-core.c:857
tty_ldisc_open+0xa1/0x100 drivers/tty/tty_ldisc.c:432
tty_set_ldisc+0x365/0x540 drivers/tty/tty_ldisc.c:563
tty_ioctl+0xc36/0xde0 drivers/tty/tty_io.c:2728
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #5 (&tty->ldisc_sem){++++}-{0:0}:
__ldsem_down_read_nested+0xb2/0x790 drivers/tty/tty_ldsem.c:300
tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
tty_poll+0x6b/0x170 drivers/tty/tty_io.c:2195
vfs_poll include/linux/poll.h:82 [inline]
ep_item_poll fs/eventpoll.c:1328 [inline]
ep_insert+0x11ee/0x1830 fs/eventpoll.c:1928
do_epoll_ctl_file+0x8d5/0xf00 fs/eventpoll.c:2677
do_epoll_ctl fs/eventpoll.c:2724 [inline]
__do_sys_epoll_ctl fs/eventpoll.c:2741 [inline]
__se_sys_epoll_ctl+0x162/0x230 fs/eventpoll.c:2732
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #4 (&ep->mtx){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/rtmutex_api.c:559 [inline]
mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:578
get_epoll_tfile_raw_ptr+0x86/0x1a0 fs/eventpoll.c:2909
kcmp_epoll_target+0x14f/0x1f0 kernel/kcmp.c:117
__do_sys_kcmp kernel/kcmp.c:207 [inline]
__se_sys_kcmp+0x668/0x8f0 kernel/kcmp.c:135
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #3 (&sig->exec_update_lock){++++}-{4:4}:
down_read_killable+0xa4/0x220 kernel/locking/rwsem.c:1599
mm_access+0x4d/0x2c0 kernel/fork.c:1409
proc_map_files_lookup+0x3d3/0x6b0 fs/proc/base.c:2340
lookup_open fs/namei.c:4476 [inline]
open_last_lookups fs/namei.c:4602 [inline]
path_openat+0x112d/0x3850 fs/namei.c:4854
do_file_open+0x23e/0x4a0 fs/namei.c:4886
do_sys_openat2+0x115/0x200 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&sb->s_type->i_mutex_key#11){++++}-{4:4}:
down_read+0x97/0x200 kernel/locking/rwsem.c:1574
inode_lock_shared include/linux/fs.h:1039 [inline]
lookup_slow+0x46/0x70 fs/namei.c:1935
walk_component fs/namei.c:2282 [inline]
lookup_last fs/namei.c:2789 [inline]
path_lookupat+0x3f5/0x8c0 fs/namei.c:2813
filename_lookup+0x265/0x5d0 fs/namei.c:2842
kern_path+0x3d/0x150 fs/namei.c:3036
bpf_prog_get_type_path+0xa3/0x270 kernel/bpf/inode.c:642
__bpf_mt_check_path net/netfilter/xt_bpf.c:60 [inline]
bpf_mt_check_v1+0x156/0x360 net/netfilter/xt_bpf.c:84
xt_checkentry_match net/netfilter/x_tables.c:543 [inline]
xt_check_match+0x602/0xce0 net/netfilter/x_tables.c:576
__nft_match_init+0x66b/0x8c0 net/netfilter/nft_compat.c:546
nft_match_large_init+0xc0/0x150 net/netfilter/nft_compat.c:568
nf_tables_newexpr net/netfilter/nf_tables_api.c:3633 [inline]
nf_tables_newrule+0x179e/0x28a0 net/netfilter/nf_tables_api.c:4451
nfnetlink_rcv_batch net/netfilter/nfnetlink.c:524 [inline]
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:647 [inline]
nfnetlink_rcv+0x1291/0x28d0 net/netfilter/nfnetlink.c:665
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
__sock_sendmsg net/socket.c:825 [inline]
____sys_sendmsg+0x565/0x870 net/socket.c:2727
___sys_sendmsg+0x2a5/0x360 net/socket.c:2781
__sys_sendmsg net/socket.c:2813 [inline]
__do_sys_sendmsg net/socket.c:2818 [inline]
__se_sys_sendmsg net/socket.c:2816 [inline]
__x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2816
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&nft_net->commit_mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/rtmutex_api.c:559 [inline]
mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:578
nf_tables_netdev_event+0xad/0x160 net/netfilter/nft_chain_filter.c:416
call_netdevice_notifier net/core/dev.c:1893 [inline]
call_netdevice_register_notifiers net/core/dev.c:1901 [inline]
call_netdevice_register_net_notifiers+0x133/0x750 net/core/dev.c:1934
register_netdevice_notifier+0x96/0x160 net/core/dev.c:1990
nft_chain_filter_netdev_init net/netfilter/nft_chain_filter.c:442 [inline]
nft_chain_filter_init+0x1d/0x80 net/netfilter/nft_chain_filter.c:468
nf_tables_module_init+0x25/0x100 net/netfilter/nf_tables_api.c:12216
do_one_initcall+0x250/0x870 init/main.c:1357
do_initcall_level+0x10a/0x1a0 init/main.c:1419
do_initcalls+0x59/0xa0 init/main.c:1435
kernel_init_freeable+0x29d/0x3e0 init/main.c:1670
kernel_init+0x22/0x1d0 init/main.c:1560
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #0 (&dev_instance_lock_key#3){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3181 [inline]
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x15ff/0x2e40 kernel/locking/lockdep.c:5254
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5906
__mutex_lock_common kernel/locking/rtmutex_api.c:559 [inline]
mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:578
netdev_lock include/linux/netdevice.h:2852 [inline]
netdev_lock_ops include/net/netdev_lock.h:42 [inline]
call_netdevice_unregister_notifiers net/core/dev.c:1917 [inline]
call_netdevice_unregister_net_notifiers+0x1e0/0x4c0 net/core/dev.c:1953
__unregister_netdevice_notifier_net net/core/dev.c:2084 [inline]
unregister_netdevice_notifier_dev_net+0x159/0x1a0 net/core/dev.c:2214
nsim_destroy+0x105/0x800 drivers/net/netdevsim/netdev.c:1185
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:234
cleanup_net+0x575/0x810 net/core/net_namespace.c:702
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
other info that might help us debug this:
Chain exists of:
&dev_instance_lock_key#3 --> &tty->ldisc_sem --> rtnl_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(rtnl_mutex);
lock(&tty->ldisc_sem);
lock(rtnl_mutex);
lock(&dev_instance_lock_key#3);
*** DEADLOCK ***
locks held by kworker/u8:47/12528: 6, last CPU#1:
#0: ffff88801bee0938 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88801bee0938 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88801bee0938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc9000473fc60 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc9000473fc60 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc9000473fc60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#2: ffffffff8f7b2b60 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:673
#3: ffff888037bdd160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#3: ffff888037bdd160 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline]
#3: ffff888037bdd160 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x420 net/devlink/core.c:575
#4: ffff888038d1e310 (&devlink->lock_key#10){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:308 [inline]
#4: ffff888038d1e310 (&devlink->lock_key#10){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline]
#4: ffff888038d1e310 (&devlink->lock_key#10){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x142/0x420 net/devlink/core.c:575
#5: ffffffff8f7c1e78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#5: ffffffff8f7c1e78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0 net/core/dev.c:2167
stack backtrace:
CPU: 1 UID: 0 PID: 12528 Comm: kworker/u8:47 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: netns cleanup_net
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2059
check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2191
check_prev_add kernel/locking/lockdep.c:3181 [inline]
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x15ff/0x2e40 kernel/locking/lockdep.c:5254
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5906
__mutex_lock_common kernel/locking/rtmutex_api.c:559 [inline]
mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:578
netdev_lock include/linux/netdevice.h:2852 [inline]
netdev_lock_ops include/net/netdev_lock.h:42 [inline]
call_netdevice_unregister_notifiers net/core/dev.c:1917 [inline]
call_netdevice_unregister_net_notifiers+0x1e0/0x4c0 net/core/dev.c:1953
__unregister_netdevice_notifier_net net/core/dev.c:2084 [inline]
unregister_netdevice_notifier_dev_net+0x159/0x1a0 net/core/dev.c:2214
nsim_destroy+0x105/0x800 drivers/net/netdevsim/netdev.c:1185
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:234
cleanup_net+0x575/0x810 net/core/net_namespace.c:702
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply
* Re: [PATCH net v3 1/3] net: stmmac: xgmac: fix l4 filter port overwrite on register update
From: Maxime Chevallier @ 2026-07-14 9:04 UTC (permalink / raw)
To: muhammad.nazim.amirul.nazle.asmade, netdev
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, rmk+kernel,
Jose.Abreu, linux-kernel
In-Reply-To: <20260714023716.29865-3-muhammad.nazim.amirul.nazle.asmade@altera.com>
Hello,
On 7/14/26 04:37, muhammad.nazim.amirul.nazle.asmade@altera.com wrote:
> From: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
>
> The XGMAC_L4_ADDR register holds both source and destination port
> match values. The current implementation overwrites the entire register
> when configuring either port, so setting one silently erases the other.
>
> Fix this by reading the register first, then masking and updating only
> the relevant field before writing back.
>
> Fixes: 425eabddaf0f ("net: stmmac: Implement L3/L4 Filters using TC Flower")
> Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
> Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Maxime
^ permalink raw reply
* Re: [PATCH net v2] tcp: initialize standalone TCP-AO response padding
From: Eric Dumazet @ 2026-07-14 9:04 UTC (permalink / raw)
To: Yizhou Zhao
Cc: netdev, Neal Cardwell, Kuniyuki Iwashima, David S. Miller,
Jakub Kicinski, Paolo Abeni, Simon Horman, linux-kernel,
Yuxiang Yang, Ao Wang, Xuewei Feng, Qi Li, Ke Xu, stable
In-Reply-To: <20260713105631.8616-1-zhaoyz24@mails.tsinghua.edu.cn>
On Mon, Jul 13, 2026 at 12:56 PM Yizhou Zhao
<zhaoyz24@mails.tsinghua.edu.cn> wrote:
>
> tcp_v4_send_ack() and tcp_v6_send_response() construct standalone TCP
> responses with TCP-AO options. The option length carries the actual MAC
> length, but the TCP header length includes the option rounded up to a
> four-byte boundary.
>
> tcp_ao_hash_hdr() writes the MAC only. Thus, when the MAC length is not
> four-byte aligned, the one to three bytes after the MAC are left
> uninitialized and may be transmitted. For the normal TCP-AO hashing
> mode, those bytes also have to be initialized before computing the MAC.
>
> Initialize only the alignment padding in the TCP-AO branches, before
> hashing the header. Use TCPOPT_NOP, as in the normal TCP-AO output path.
> This avoids adding work to non-AO TCP responses while preserving a valid
> authenticated header.
>
Reviewed-by: Eric Dumazet <edumazet@google.com>
^ permalink raw reply
* Re: [PATCH net-next v7 4/4] net: pse-pd: realtek-pse-mcu: add UART transport
From: Oleksij Rempel @ 2026-07-14 9:01 UTC (permalink / raw)
To: Jonas Jelonek
Cc: Kory Maincent, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, netdev, devicetree, linux-kernel, Daniel Golle,
Bjørn Mork
In-Reply-To: <20260712192251.1413279-5-jelonek.jonas@gmail.com>
On Sun, Jul 12, 2026 at 07:22:50PM +0000, Jonas Jelonek wrote:
> Add the serdev (UART) transport for the Realtek PSE MCU core. It registers
> the MCU as a serdev device and provides the send/recv callbacks the core
> uses to exchange the 12-byte frames, receiving asynchronously via the
> serdev receive_buf callback.
>
> The baud rate defaults to 19200 and can be overridden per board with the
> "current-speed" property.
>
> Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
...
> +static int rtpse_mcu_uart_probe(struct serdev_device *serdev)
> +{
...
> +
> + fwnode_property_read_u32(dev_fwnode(dev), "current-speed", &speed);
> + serdev_device_set_baudrate(serdev, speed);
> + serdev_device_set_flow_control(serdev, false);
> + serdev_device_set_parity(serdev, SERDEV_PARITY_NONE);
Some of this functions will return errors, it will be good to get at
least warnings, even if we decide to go with best effort initialization.
Otherwise, LGTM, with this addressed you can add my:
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
^ permalink raw reply
* [PATCH 1/2] ptp: ptp_s390: Add missing CC check for ptff()
From: Sven Schnelle @ 2026-07-14 8:49 UTC (permalink / raw)
To: Richard Cochran
Cc: netdev, linux-s390, linux-kernel, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Heiko Carstens, Vasily Gorbik,
Alexander Gordeev
In-Reply-To: <20260714084921.3926697-1-svens@linux.ibm.com>
The code doesn't honor the returned condition code when issuing
the PTFF_QPT call. Fix this by checking the return code and returning
EIO if it is not zero.
Fixes: 2d7de7a3010d ("s390/time: Add PtP driver")
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Cc: stable@kernel.org
---
drivers/ptp/ptp_s390.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/ptp/ptp_s390.c b/drivers/ptp/ptp_s390.c
index 29618eb9bf44..7299c3aae65f 100644
--- a/drivers/ptp/ptp_s390.c
+++ b/drivers/ptp/ptp_s390.c
@@ -48,7 +48,8 @@ static int ptp_s390_qpt_gettime(struct ptp_clock_info *ptp,
{
unsigned long tod;
- ptff(&tod, sizeof(tod), PTFF_QPT);
+ if (ptff(&tod, sizeof(tod), PTFF_QPT) != 0)
+ return -EOPNOTSUPP;
*ts = tod_to_timespec64(tod);
return 0;
}
--
2.53.0
^ permalink raw reply related
* [PATCH 2/2] ptp: ptp_s390: Add missing facility check
From: Sven Schnelle @ 2026-07-14 8:49 UTC (permalink / raw)
To: Richard Cochran
Cc: netdev, linux-s390, linux-kernel, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Heiko Carstens, Vasily Gorbik,
Alexander Gordeev
In-Reply-To: <20260714084921.3926697-1-svens@linux.ibm.com>
Only register the physical clock when facility 28 is installed.
Fixes: 2d7de7a3010d ("s390/time: Add PtP driver")
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Cc: stable@kernel.org
---
drivers/ptp/ptp_s390.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/ptp/ptp_s390.c b/drivers/ptp/ptp_s390.c
index 7299c3aae65f..3ea94648cdde 100644
--- a/drivers/ptp/ptp_s390.c
+++ b/drivers/ptp/ptp_s390.c
@@ -108,6 +108,9 @@ static __init int ptp_s390_init(void)
if (IS_ERR(ptp_stcke_clock))
return PTR_ERR(ptp_stcke_clock);
+ if (!test_facility(28))
+ return 0;
+
ptp_qpt_clock = ptp_clock_register(&ptp_s390_qpt_info, NULL);
if (IS_ERR(ptp_qpt_clock)) {
ptp_clock_unregister(ptp_stcke_clock);
@@ -118,7 +121,8 @@ static __init int ptp_s390_init(void)
static __exit void ptp_s390_exit(void)
{
- ptp_clock_unregister(ptp_qpt_clock);
+ if (ptp_qpt_clock)
+ ptp_clock_unregister(ptp_qpt_clock);
ptp_clock_unregister(ptp_stcke_clock);
}
--
2.53.0
^ permalink raw reply related
* [PATCH 0/2] Fix two issues in ptp_s390 driver
From: Sven Schnelle @ 2026-07-14 8:49 UTC (permalink / raw)
To: Richard Cochran
Cc: netdev, linux-s390, linux-kernel, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Heiko Carstens, Vasily Gorbik,
Alexander Gordeev
This patchset fixes two issues in the ptp_s390 driver:
a) Missing check of condition code in qpt query function. When PTFF QPT is
not supported ptp_s390_qpt_gettime() would just return without storing
the physical time.
b) Missing test for presence of facility 28 during driver registration.
Sven Schnelle (2):
ptp: ptp_s390: Add missing CC check for ptff()
ptp: ptp_s390: Add missing facility check
drivers/ptp/ptp_s390.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--
2.53.0
^ permalink raw reply
* Re: [PATCH v2] RDMA/core: quiesce CQ polling before device shutdown on reboot
From: Leon Romanovsky @ 2026-07-14 8:46 UTC (permalink / raw)
To: Chenguang Zhao
Cc: jgg, saeedm, tariqt, mbloch, davem, edumazet, kuba, pabeni,
linux-rdma, netdev, Chenguang Zhao
In-Reply-To: <20260714075558.1420384-1-chenguang.zhao@linux.dev>
On Tue, Jul 14, 2026 at 03:55:58PM +0800, Chenguang Zhao wrote:
> From: Chenguang Zhao <zhaochenguang@kylinos.cn>
>
> On reboot -f with NFS over RDMA, mlx5 shutdown can tear the device
> down while ib-comp-wq still polls live CQs, leading to UAF in
> wr_cqe->done().
> Mark the device shutting down before teardown, and skip CQ poll/arm
> and SYS_ERROR completion delivery while that flag is set.
>
> Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
> ---
> 1. Set the SHUTTING_DOWN flag at the mlx5 PCI/SF shutdown entry.
>
> 2. Skip SYS_ERROR notifications during shutdown to avoid the
> internal error path re-arming CQs.
>
> 3. Make mlx5_ib_poll_cq / mlx5_ib_arm_cq return immediately while
> that flag is set, so completions are no longer delivered.
>
> drivers/infiniband/hw/mlx5/cq.c | 6 ++++++
> drivers/infiniband/hw/mlx5/main.c | 11 +++++++++++
> drivers/net/ethernet/mellanox/mlx5/core/health.c | 3 +++
> drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 +
> .../net/ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 +
> include/linux/mlx5/driver.h | 6 ++++++
> 6 files changed, 28 insertions(+)
>
> diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
> index 49b4bf148a4a..584445e6d2fc 100644
> --- a/drivers/infiniband/hw/mlx5/cq.c
> +++ b/drivers/infiniband/hw/mlx5/cq.c
> @@ -618,6 +618,9 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
> int soft_polled = 0;
> int npolled;
>
> + if (mlx5_core_is_shutting_down(mdev))
> + return 0;
> +
1. Send patches as standalone messages, not as replies.
2. Add the target tree to the patch subject, for example:
[PATCH rdma-next v2]
3. This is racy; nothing prevents MLX5_INTERFACE_STATE_SHUTTING_DOWN from being set
immediately after this check.
Thanks
> spin_lock_irqsave(&cq->lock, flags);
> if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
> /* make sure no soft wqe's are waiting */
> @@ -653,6 +656,9 @@ int mlx5_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
> unsigned long irq_flags;
> int ret = 0;
>
> + if (mlx5_core_is_shutting_down(mdev))
> + return 0;
> +
> spin_lock_irqsave(&cq->lock, irq_flags);
> if (cq->notify_flags != IB_CQ_NEXT_COMP)
> cq->notify_flags = flags & IB_CQ_SOLICITED_MASK;
> diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
> index 02809114fc79..265c95129fad 100644
> --- a/drivers/infiniband/hw/mlx5/main.c
> +++ b/drivers/infiniband/hw/mlx5/main.c
> @@ -2976,6 +2976,9 @@ static void mlx5_ib_handle_internal_error(struct mlx5_ib_dev *ibdev)
> unsigned long flags_cq;
> unsigned long flags;
>
> + if (mlx5_core_is_shutting_down(ibdev->mdev))
> + return;
> +
> INIT_LIST_HEAD(&cq_armed_list);
>
> /* Go over qp list reside on that ibdev, sync with create/destroy qp.*/
> @@ -3200,6 +3203,9 @@ static void mlx5_ib_handle_sys_error_event(struct work_struct *_work)
> struct mlx5_ib_dev *ibdev = work->dev;
> struct ib_event ibev;
>
> + if (mlx5_core_is_shutting_down(ibdev->mdev))
> + goto out;
> +
> ibev.event = IB_EVENT_DEVICE_FATAL;
> mlx5_ib_handle_internal_error(ibdev);
> ibev.element.port_num = (u8)(unsigned long)work->param;
> @@ -3222,10 +3228,15 @@ static int mlx5_ib_sys_error_event(struct notifier_block *nb,
> unsigned long event, void *param)
> {
> struct mlx5_ib_event_work *work;
> + struct mlx5_ib_dev *ibdev;
>
> if (event != MLX5_DEV_EVENT_SYS_ERROR)
> return NOTIFY_DONE;
>
> + ibdev = container_of(nb, struct mlx5_ib_dev, sys_error_events);
> + if (mlx5_core_is_shutting_down(ibdev->mdev))
> + return NOTIFY_OK;
> +
> work = kmalloc_obj(*work, GFP_ATOMIC);
> if (!work)
> return NOTIFY_DONE;
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
> index aeeb136f5ebc..d9cc42c4c310 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
> @@ -202,6 +202,9 @@ static void enter_error_state(struct mlx5_core_dev *dev, bool force)
> mlx5_cmd_flush(dev);
> }
>
> + if (mlx5_core_is_shutting_down(dev))
> + return;
> +
> mlx5_notifier_call_chain(dev->priv.events, MLX5_DEV_EVENT_SYS_ERROR, (void *)1);
> }
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
> index 643b4aac2033..078114bfb357 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
> @@ -2192,6 +2192,7 @@ static void shutdown(struct pci_dev *pdev)
> int err;
>
> mlx5_core_info(dev, "Shutdown was called\n");
> + set_bit(MLX5_INTERFACE_STATE_SHUTTING_DOWN, &dev->intf_state);
> set_bit(MLX5_BREAK_FW_WAIT, &dev->intf_state);
> mlx5_drain_fw_reset(dev);
> mlx5_drain_health_wq(dev);
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
> index 4391ef0bab5d..6f8242bfb455 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
> @@ -111,6 +111,7 @@ static void mlx5_sf_dev_shutdown(struct auxiliary_device *adev)
> struct mlx5_sf_dev *sf_dev = container_of(adev, struct mlx5_sf_dev, adev);
> struct mlx5_core_dev *mdev = sf_dev->mdev;
>
> + set_bit(MLX5_INTERFACE_STATE_SHUTTING_DOWN, &mdev->intf_state);
> set_bit(MLX5_BREAK_FW_WAIT, &mdev->intf_state);
> mlx5_drain_health_wq(mdev);
> mlx5_unload_one(mdev, false);
> diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
> index b1871c0821d0..a9efc37cd254 100644
> --- a/include/linux/mlx5/driver.h
> +++ b/include/linux/mlx5/driver.h
> @@ -653,8 +653,14 @@ enum mlx5_device_state {
> enum mlx5_interface_state {
> MLX5_INTERFACE_STATE_UP = BIT(0),
> MLX5_BREAK_FW_WAIT = BIT(1),
> + MLX5_INTERFACE_STATE_SHUTTING_DOWN = BIT(2),
> };
>
> +static inline bool mlx5_core_is_shutting_down(struct mlx5_core_dev *dev)
> +{
> + return test_bit(MLX5_INTERFACE_STATE_SHUTTING_DOWN, &dev->intf_state);
> +}
> +
> enum mlx5_pci_status {
> MLX5_PCI_STATUS_DISABLED,
> MLX5_PCI_STATUS_ENABLED,
> --
> 2.25.1
>
>
^ permalink raw reply
* Re: [PATCH net-next v7 3/4] net: pse-pd: realtek-pse-mcu: add I2C transport
From: Oleksij Rempel @ 2026-07-14 8:34 UTC (permalink / raw)
To: Jonas Jelonek
Cc: Kory Maincent, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, netdev, devicetree, linux-kernel, Daniel Golle,
Bjørn Mork
In-Reply-To: <20260712192251.1413279-4-jelonek.jonas@gmail.com>
On Sun, Jul 12, 2026 at 07:22:49PM +0000, Jonas Jelonek wrote:
> Add the I2C/SMBus transport for the Realtek PSE MCU core. It registers
> the MCU on an I2C bus and provides the send/recv callbacks the core
> uses to exchange the 12-byte frames.
>
> The MCU firmware expects one of two framings on the I2C bus, and which one
> is part of the compatible: '-smbus' (reads carry a leading command byte
> and a repeated start) or raw '-i2c' (bare block writes and reads). The
> match data flags the raw-I2C case; SMBus is the default because that's
> what the majority of devices uses.
>
> Because i2c_master_send()/i2c_master_recv() may DMA, the raw-I2C path
> bounces each frame through a heap buffer rather than the core's stack
> buffers; the SMBus path is unaffected.
>
> Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Thank you!
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
^ permalink raw reply
* [PATCH] net: core: use WARN_ON_ONCE in datagram iterators
From: Igor Putko @ 2026-07-14 8:25 UTC (permalink / raw)
To: netdev; +Cc: davem, edumazet, kuba, pabeni, horms, linux-kernel, Igor Putko
Datagram fragment iteration helpers check for invalid buffer offsets
using WARN_ON(). In fast-path packet processing routines, a malformed
skb or lower-level driver bug triggering this check can result in
unbounded dmesg logging.
Excessive console logging in data-path contexts introduces severe I/O
latency overhead and risks triggering a DoS or system instability
via log flooding.
Replace WARN_ON() with WARN_ON_ONCE() in __skb_datagram_iter() and
skb_copy_datagram_from_iter(). This ensures anomalous conditions remain
reportable for debugging without spamming the kernel log on repeated
occurrences.
Signed-off-by: Igor Putko <igorpetindev@gmail.com>
---
net/core/datagram.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/core/datagram.c b/net/core/datagram.c
index c285c6465..125b52870 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -416,7 +416,7 @@ static int __skb_datagram_iter(const struct sk_buff *skb, int offset,
int end;
const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
- WARN_ON(start > offset + len);
+ WARN_ON_ONCE(start > offset + len);
end = start + skb_frag_size(frag);
if ((copy = end - offset) > 0) {
@@ -449,7 +449,7 @@ static int __skb_datagram_iter(const struct sk_buff *skb, int offset,
skb_walk_frags(skb, frag_iter) {
int end;
- WARN_ON(start > offset + len);
+ WARN_ON_ONCE(start > offset + len);
end = start + frag_iter->len;
if ((copy = end - offset) > 0) {
@@ -570,7 +570,7 @@ int skb_copy_datagram_from_iter(struct sk_buff *skb, int offset,
int end;
const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
- WARN_ON(start > offset + len);
+ WARN_ON_ONCE(start > offset + len);
end = start + skb_frag_size(frag);
if ((copy = end - offset) > 0) {
@@ -594,7 +594,7 @@ int skb_copy_datagram_from_iter(struct sk_buff *skb, int offset,
skb_walk_frags(skb, frag_iter) {
int end;
- WARN_ON(start > offset + len);
+ WARN_ON_ONCE(start > offset + len);
end = start + frag_iter->len;
if ((copy = end - offset) > 0) {
--
2.47.3
^ permalink raw reply related
* Re: [PATCH net-next v7 2/4] net: pse-pd: add Realtek PSE MCU core
From: Oleksij Rempel @ 2026-07-14 8:19 UTC (permalink / raw)
To: Jonas Jelonek
Cc: Kory Maincent, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, netdev, devicetree, linux-kernel, Daniel Golle,
Bjørn Mork
In-Reply-To: <20260712192251.1413279-3-jelonek.jonas@gmail.com>
On Sun, Jul 12, 2026 at 07:22:48PM +0000, Jonas Jelonek wrote:
> A range of managed Realtek-based PoE switches use a small microcontroller
> on the PCB to front the actual PSE silicon. The host CPU talks to that
> MCU over I2C/SMBus or UART using a fixed 12-byte request/response
> protocol with a trailing checksum; the PSE chips are managed by the MCU
> and are not accessed directly. Two generations of the protocol exist -
> both Realtek's - diverging in opcode numbering and a few response
> layouts; the driver handles this with a per-dialect opcode table and
> parser hooks for the responses that differ, selected by the compatible.
> The specific PSE chip behind the MCU is detected at runtime and only
> influences per-chip constants (power scaling and the per-port cap).
>
> This core module implements the protocol, message framing, the dialect
> machinery and the pse_controller_ops glue, and exports a registration
> helper for transport modules. The I2C and UART transports that drive it
> follow in the next patches; the core (PSE_REALTEK_MCU) is selected
> automatically by those transports and is not user-selectable on its own.
>
> The realtek-pse-mcu-* files and PSE_REALTEK_MCU* symbols match the
> realtek,pse-mcu-* compatibles (see the binding for the naming rationale).
> The two protocol generations - gen1 on older Broadcom-PSE boards, gen2 on
> Realtek's own PSE silicon - are both Realtek's, handled by the same shared
> core, each selecting its dialect via the compatible.
>
> Power budgeting is left to the MCU firmware; the driver advertises
> PSE_BUDGET_EVAL_STRAT_DYNAMIC (controller-managed budget) accordingly.
>
> Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Thank you!
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
^ permalink raw reply
* Re: [PATCH net-next v7 1/4] dt-bindings: net: pse-pd: add bindings for Realtek PSE MCU
From: Oleksij Rempel @ 2026-07-14 8:15 UTC (permalink / raw)
To: Jonas Jelonek
Cc: Kory Maincent, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, netdev, devicetree, linux-kernel, Daniel Golle,
Bjørn Mork, Conor Dooley
In-Reply-To: <20260712192251.1413279-2-jelonek.jonas@gmail.com>
On Sun, Jul 12, 2026 at 07:22:47PM +0000, Jonas Jelonek wrote:
> Add a binding for the microcontroller (MCU) that fronts the PSE silicon
> on a range of managed Realtek-based switches. The host talks only to the
> MCU, over I2C/SMBus or UART, using a fixed message-based protocol; the
> PSE chips behind it never appear on the bus.
>
> The device is the MCU together with its Realtek firmware: the firmware
> and its host protocol are what the binding describes, not the
> general-purpose microcontroller they run on. The PSE silicon behind the
> MCU (Realtek or Broadcom) is reported by the MCU and detected at runtime,
> so it is not described here - hence the 'realtek' vendor prefix.
>
> Two protocol generations exist, both Realtek's, selected by the
> compatible: gen1 on older boards (fronting Broadcom PSE silicon) and gen2,
> the altered protocol used with Realtek's own PSE silicon. On an I2C
> attachment the framing the MCU firmware expects is part of the compatible
> as well - '-smbus' or raw '-i2c'; a UART attachment carries no framing
> suffix, as the transport is given by the parent serial node.
>
> Each board additionally carries a device-specific compatible that falls
> back to one of the protocol compatibles above. Drivers bind on the
> protocol compatible; the device-specific string identifies the board and
> reserves a place for a future per-board quirk without having to retrofit
> device trees already in the field.
>
> Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
> Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Thank you!
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
^ permalink raw reply
* [PATCH] idpf: disable PCIe PTM on device removal
From: Myeonghun Pak @ 2026-07-14 8:11 UTC (permalink / raw)
To: Tony Nguyen, Przemek Kitszel, intel-wired-lan
Cc: Milena Olech, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, netdev, linux-kernel, Myeonghun Pak,
Ijae Kim
idpf_probe() enables PCIe Precision Time Measurement with
pci_enable_ptm(pdev, NULL), which programs the PTM control bits and sets
pdev->ptm_enabled when the bus/controller supports it. The teardown path
in idpf_remove() releases the workqueues, vports, mutexes and the adapter
memory but never calls pci_disable_ptm(), so PTM is left enabled on the
device after the driver detaches.
This leaves the PCI core's software PTM state and the device's PTM control
bits set with no bound driver. pcim_enable_device() only arranges for
pci_disable_device() on teardown and does not undo the PTM enable, so it
is not a substitute here.
Pair the enable with pci_disable_ptm(pdev) in idpf_remove(), matching the
igc and mlx5 drivers which already disable PTM on their remove paths.
Fixes: 8d5e12c5921c ("idpf: add initial PTP support")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
drivers/net/ethernet/intel/idpf/idpf_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/intel/idpf/idpf_main.c b/drivers/net/ethernet/intel/idpf/idpf_main.c
index 0dd741dcfc..3d3471d3f7 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_main.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_main.c
@@ -159,6 +159,7 @@ static void idpf_remove(struct pci_dev *pdev)
mutex_destroy(&adapter->queue_lock);
mutex_destroy(&adapter->vc_buf_lock);
+ pci_disable_ptm(pdev);
pci_set_drvdata(pdev, NULL);
kfree(adapter);
}
--
2.47.1
^ permalink raw reply related
* [PATCH net] net: mctp i3c: clean up notifier and buses if driver register fails
From: Myeonghun Pak @ 2026-07-14 8:10 UTC (permalink / raw)
To: Jeremy Kerr, Matt Johnston
Cc: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev, linux-kernel, Myeonghun Pak, Ijae Kim
mctp_i3c_mod_init() registers the I3C bus notifier and then walks the
existing buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL)
before registering the I3C device driver. If i3c_driver_register()
fails, the function returns the error directly, leaving the notifier
registered and every mctp_i3c_bus object created for the existing buses
allocated. The notifier is left pointing into the module that failed to
load and the bus list is leaked.
Mirror the module exit path on this failure: unregister the notifier and
tear down the buses that were added before returning the error.
Fixes: c8755b29b58e ("mctp i3c: MCTP I3C driver")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
drivers/net/mctp/mctp-i3c.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/mctp/mctp-i3c.c b/drivers/net/mctp/mctp-i3c.c
index 6d2bbae747..677e77e917 100644
--- a/drivers/net/mctp/mctp-i3c.c
+++ b/drivers/net/mctp/mctp-i3c.c
@@ -740,9 +740,14 @@ static __init int mctp_i3c_mod_init(void)
rc = i3c_driver_register(&mctp_i3c_driver);
if (rc < 0)
- return rc;
+ goto err_unregister_notifier;
return 0;
+
+err_unregister_notifier:
+ i3c_unregister_notifier(&mctp_i3c_notifier);
+ mctp_i3c_bus_remove_all();
+ return rc;
}
static __exit void mctp_i3c_mod_exit(void)
--
2.53.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox