summaryrefslogtreecommitdiff
path: root/drivers/infiniband/core
AgeCommit message (Collapse)Author
5 daysRDMA/core: Clear driver_udata before destroying objects in rdma_coreJacob Moroni
When uobject creation fails while copying user output data (i.e., after the HW object has been created), it calls rdma_alloc_abort_uobject() with hw_obj_valid=true which then invokes the object's destroy callback, but passes the uverbs_attr_bundle from the original creation command. The issue is that drivers are expected to validate the udata and return an error if there's unexpected content, and data from the wrong command counts as "unexpected content", so this ends up causing the driver's destroy call to fail. A similar issue exists in the rereg_mr path when a new MR is created and the old one is destroyed. Fix this by clearing driver_udata before invoking the driver's destroy method. Fixes: 6e0954b11c05 ("RDMA/uverbs: Allow drivers to create a new HW object during rereg_mr") Fixes: 0ac8903cbbe6 ("RDMA/core: Allow the ioctl layer to abort a fully created uobject") Signed-off-by: Jacob Moroni <jmoroni@google.com> Link: https://patch.msgid.link/20261006152908.888059-1-jmoroni@google.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-30Merge remote-tracking branch 'ionic/ionic-shared' into wip/leon-for-nextLeon Romanovsky
Preparatory patch to support SRQ in RDMA ionic driver. Signed-off-by: Leon Romanovsky <leon@kernel.org> * ionic/ionic-shared: (1790 commits) net: ionic: Fetch qid allocation and SRQ capability from firmware Linux 7.3-rc4 ...
2026-09-29RDMA/mad: Reject receive completions shorter than GRHJiale Yao
ib_mad_recv_done() derives the OPA MAD length by subtracting the GRH size from wc->byte_len without ensuring the receive completion covers the GRH. If it is shorter, the subtraction wraps before the result is stored in mad_len and an invalid length can be passed downstream. Reject receive completions shorter than the GRH before inspecting the MAD header or deriving the MAD length. Fixes: 8e4349d13f33 ("IB/mad: Add final OPA MAD processing") Signed-off-by: Jiale Yao <yaojiale02@163.com> Link: https://patch.msgid.link/20260926105927.3183294-1-yaojiale02@163.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-29RDMA/nldev: Fix NULL deref in dumps of objects abandoned by DRIVER_FAILUREYili Zhang
fill_res_cq_entry() dereferences cq->uobject->uevent.uobject.context->res.id unconditionally for user resources. This is normally safe by ordering: destroy_hw() removes the resource from the restrack before uverbs_destroy_uobject() clears ->context, and the XA_ZERO_ENTRY marker set by rdma_restrack_begin_del() hides the entry from concurrent netlink dumps. The ordering breaks when a driver keeps failing to destroy an object during ucontext teardown. uverbs_destroy_ufile_hw() then falls back to __uverbs_cleanup_ufile(RDMA_REMOVE_DRIVER_FAILURE), which abandons the object in place: the HW object and its restrack entry are intentionally leaked, while the uobject bookkeeping is torn down and ->context is explicitly set to NULL by uverbs_destroy_uobject(). rdma_restrack_del() is never reached, so the orphaned entry stays in the device restrack with a valid kref, reachable by any subsequent netlink dump. Observed on 6.1.52 with MLNX_OFED 24.10, after an mlx5 FW failure left a process unable to tear down its CQ (destroy_cq FW command failing during FD close): WARNING: ... uverbs_destroy_ufile_hw+0xe3/0x100 BUG: kernel NULL pointer dereference, address: 0000000000000058 RIP: 0010:fill_res_cq_entry+0x15e/0x180 [ib_core] res_get_common_dumpit+0x304/0x530 [ib_core] nldev_res_get_cq_dumpit+0x1a/0x20 [ib_core] The faulting chain maps to the source (CR2 = 0x58): cq->uobject (struct ib_cq +0x08, res at +0x98) uobject->context (struct ib_uobject +0x10, NULL after abandon) context->res.id (struct ib_ucontext +0x58) The recent restrack rework (8d186210677c and its series) moved the restrack deletion to the start of the destroy flow and thus fences concurrent dumps from an object being destroyed, but it does not cover this case: when destroy fails, rdma_restrack_abort_del() restores the entry, and the RDMA_REMOVE_DRIVER_FAILURE sweep still never removes it from the restrack. From the fallback until the device is unregistered, any "rdma res show cq" deterministically takes the NULL pointer dereference; this is a long-lived state, NOT A RACE. The dump path holds neither the restrack lock (dropped before the fill callback runs) nor ufile->hw_destroy_rwsem, and rdma_restrack_get() only guarantees that the res memory stays alive, not that ->context is still valid. Fix the dump side: check the uobject context directly instead of the rdma_is_kernel_res() marker. A non-NULL uobject already implies a user resource, so kernel resources keep being skipped, and the additional ->context check skips the RES_CTXN attribute for orphaned entries instead of crashing the dump. The orphaned resource itself remains visible in "rdma res show" (cqn/cqe/usecnt/pid), which is what an operator needs after the accompanying uverbs WARN to diagnose the driver destroy failure. fill_res_pd_entry() has the same pattern (pd->uobject->context->res.id) and is fixed the same way; a PD can even reach the fallback without its own driver callback failing, e.g. uverbs_free_pd() returns -EBUSY while another object that failed to destroy still holds the PD usecnt. Fixes: c3d02788b45a ("RDMA/nldev: Provide parent IDs for PD, MR and QP objects") Signed-off-by: Yili Zhang <zhangyili01@baidu.com> Link: https://patch.msgid.link/20260923131239.6521-1-zhangyili01@baidu.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-29IB/mad: fix UAF and double-free in RMPP receive reassemblyDairui Zhang
mad_rmpp_recv.state is protected by two locks that do not exclude each other: recv_timeout_handler() (port workqueue) uses agent->lock, continue_rmpp() (CQ softirq) uses rmpp_recv->lock. Nothing serializes the check-then-set sequence on the state word: T1 (CQ softirq) T2 (port workqueue) continue_rmpp() lock(rmpp_recv->lock) state == ACTIVE [passes] recv_timeout_handler() lock(agent->lock) state = TIMEOUT list_del(&rmpp_recv->list) unlock(agent->lock) destroy_rmpp_recv() wait_for_completion() [blocks on T1's ref] state = COMPLETE unlock(rmpp_recv->lock) complete_rmpp() queue cleanup_work (+10s) deref() [unblocks] kfree(rmpp_recv) ib_free_recv_mad(done_wc) +10s: recv_cleanup_handler() runs lock/list_del/destroy on the freed rmpp_recv -> UAF write and double free; nothing can cancel that cleanup_work anymore, the entry is already off agent->rmpp_list. done_wc is also returned to ib_mad_complete_recv() and freed again -> UAF read and double free. Reaching this requires sending MADs to a kernel RMPP agent from the InfiniBand/RoCE fabric: the per-port sa_query agent accepts subnet manager responses whose SLID/GID/TID are not authenticated on the fabric, and legacy user_mad agents registered without IB_USER_MAD_USER_RMPP start reassembly on any incoming RMPP DATA MAD with an attacker-chosen TID, no in-flight send required. The attacker controls segment timing and can run many transactions in parallel (agent->rmpp_list has no cap), so landing the microseconds-wide receive critical section on the 40-second timeout boundary is a matter of patience, not luck. Unify state transitions under rmpp_recv->lock in recv_timeout_handler(), keeping list manipulation under agent->lock (which preserves the agent->lock -> rmpp_recv->lock ordering used by continue_rmpp()). State check/set in both paths is then serialized, so the loser of the race always observes the final state and bails out. recv_cleanup_handler() needs no change: with transitions serialized, a cleanup_work can only be pending after COMPLETE, in which case the timeout handler exits early. The race is as old as the RMPP implementation itself. Fixes: fa619a77046b ("[PATCH] IB: Add RMPP implementation") Assisted-by: LLM Signed-off-by: Dairui Zhang <zhangdairui@gmail.com> Link: https://patch.msgid.link/20260922152342.1474845-1-zhangdairui@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-28RDMA/umem: Derive DMA direction from IB access flagsYishai Hadas
Map non-writable user memory DMA_TO_DEVICE: when no write access is granted, the NIC only reads the pages and DMA_BIDIRECTIONAL is unnecessarily broad. Where the IOMMU enforces direction this prevents the device writing to read-only buffers; where it does not the mapping is still semantically correct. Signed-off-by: Yishai Hadas <yishaih@nvidia.com> Link: https://patch.msgid.link/20260915140933.40580-8-yishaih@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-28RDMA/umem: Map CQ buffers DMA_FROM_DEVICEYishai Hadas
For a CQ ring the device writes CQEs and the CPU only reads. DMA_FROM_DEVICE is the correct direction. Use it explicitly in ib_umem_get_cq_buf() and ib_umem_get_cq_buf_or_va() rather than deriving it from the access flags: CQ callers pass IB_ACCESS_LOCAL_WRITE so that get_user_pages() pins a writable private page (FOLL_WRITE), which the device needs to DMA-write CQEs into. That flag would yield DMA_BIDIRECTIONAL from the access-flag derivation, which is wrong for the bus direction. Signed-off-by: Yishai Hadas <yishaih@nvidia.com> Link: https://patch.msgid.link/20260915140933.40580-7-yishaih@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-28RDMA/umem: Support an explicit DMA direction other than DMA_BIDIRECTIONALYishai Hadas
Add a dma_dir field to struct ib_umem to record the direction chosen at map time and reuse it at unmap. Thread an explicit dma_data_direction parameter through the internal pinning helpers so each caller can supply the direction that matches the device's actual access pattern. All existing callers still pass DMA_BIDIRECTIONAL, so this is a pure mechanism addition with no behavioural change. Signed-off-by: Yishai Hadas <yishaih@nvidia.com> Link: https://patch.msgid.link/20260915140933.40580-6-yishaih@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-23RDMA/multicast: Fix rb-tree corruption on MGID reassignment in join_handlerLi RongQing
When the SA assigns a wildcard (mgid0) join a concrete MGID that already has a group in the port table, join_handler() erases the group from the tree and calls mcast_insert() with allow_duplicates=false. mcast_insert() then finds the existing group and returns it without re-inserting, but join_handler() discards the return value, leaving the group erased yet still alive. When the orphaned group's refcount later drops to zero, release_group() calls rb_erase() on the node that is no longer in the tree, corrupting the rb-tree (a stale parent pointer causes a valid subtree link to be overwritten with NULL). Clear the node with RB_CLEAR_NODE() after the erase in join_handler() so release_group() can detect via RB_EMPTY_NODE() that it is already out of the tree and skip the second erase. A successful re-insert by mcast_insert() restores the in-tree state via rb_link_node(). Signed-off-by: Li RongQing <lirongqing@baidu.com> Link: https://patch.msgid.link/20260917052012.2181-1-lirongqing@baidu.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-22RDMA/core: Force disconnect if DREP and DREQ failAmmar Ratnani
When we call `rdma_disconnect`, it's possible that we fail to send both a DREQ and a DREP. In that case, we currently either do nothing or move into the `IB_CM_TIMEWAIT` state. Either way, we remain in the `RDMA_CM_CONNECT` state. Anyone waiting for us to disconnect hangs. Instead, while we're connected, when we call `rdma_disconnect`, and fail to send both a DREQ and a DREP, mark the connection as disconnected. Call the upper layer's handler for the disconnect, and destroy the connection if instructed. Cc: Leon Romanovsky <leon@kernel.org> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Namjae Jeon <linkinjeon@kernel.org> Cc: Paulo Alcantara <pc@manguebit.org> Cc: Stefan Metzmacher <metze@samba.org> Cc: Tom Talpey <tom@talpey.com> Cc: linux-rdma@vger.kernel.org Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Ammar Ratnani <ammrat13@gmail.com> Link: https://patch.msgid.link/20260908154454.10966-2-ammrat13@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-22RDMA/core: Fix partial copy of IPv6 flow_lbl in LAG hash skbLi RongQing
rdma_build_skb() constructs a synthetic IPv6 header for LAG slave selection and copies the flow label from the AH attribute: memcpy(&ip6h->flow_lbl, &ah_attr->grh.flow_label, sizeof(*ip6h->flow_lbl)); ipv6hdr.flow_lbl is __u8[3], so sizeof(*ip6h->flow_lbl) dereferences the array to a single __u8 and yields 1. The memcpy therefore copies only the first byte of the flow label, leaving flow_lbl[1] and flow_lbl[2] uninitialised in the skb buffer (alloc_skb() does not zero the data). The resulting LAG hash is computed over one byte of real flow-label data and two bytes of kmalloc residue, so IPv6 RoCEv2 traffic on a bonded interface can be steered to the wrong slave. Use sizeof(ip6h->flow_lbl) (the array, 3 bytes) so the whole flow label is copied. Fixes: bd3920eac1331 ("RDMA/core: Add LAG functionality") Signed-off-by: Li RongQing <lirongqing@baidu.com> Link: https://patch.msgid.link/20260916120926.1761-1-lirongqing@baidu.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-18RDMA/uverbs: Drop restrack ref on ib_init_ucontext() failure in GET_CONTEXTLi RongQing
The UVERBS_METHOD_GET_CONTEXT handler allocates the ucontext via ib_alloc_ucontext(), which calls rdma_restrack_new() (initialising the kref to 1) and rdma_restrack_set_name(NULL), the latter attaching the current task and taking a task_struct reference. When ib_init_ucontext() subsequently fails, the error path only does: kfree(attrs->context); attrs->context = NULL; without first calling rdma_restrack_put() on &attrs->context->res. The kref therefore never reaches zero, restrack_release() is never invoked, and put_task_struct() is never called, so the task_struct reference taken during set_name is leaked permanently. A local user with access to an RDMA device can repeat this path (e.g. by hitting an RDMA cgroup limit or supplying invalid ucaps) and leak one task_struct reference per attempt, eventually preventing those processes from being reaped or exhausting memory. The legacy ib_uverbs_get_context() path already handles this correctly at its err_ucontext label, where rdma_restrack_put() precedes kfree(). Mirror that ordering here. Fixes: a1123418ba10 ("RDMA/uverbs: Add ioctl command to get a device context") Signed-off-by: Li RongQing <lirongqing@baidu.com> Link: https://patch.msgid.link/20260916085529.1838-1-lirongqing@baidu.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-18RDMA/restrack: Don't set RESTRACK_DD mark after a failed xa_insert()Li RongQing
When adding a QP to the restrack xarray, rdma_restrack_add() does: ret = xa_insert(&rt->xa, res->id, res, GFP_KERNEL); if (ret) res->id = 0; if (qp->qp_type >= IB_QPT_DRIVER) xa_set_mark(&rt->xa, res->id, RESTRACK_DD); The xa_set_mark() call is not guarded by "!ret". When xa_insert() fails (possible on a qp_num collision or memory pressure), res->id is reset to 0, yet the mark is still applied to index 0. If a legitimate QP whose qp_num is 0 already occupies that slot - e.g. a normal QP or the SMI QP - it is spuriously tagged as driver-private (RESTRACK_DD), and the netlink dump path res_get_common_dumpit() then hides it from "rdma res" output whenever the caller does not request driver details. Only set the mark when the insertion actually succeeded by folding the mark into the non-failure branch. Fixes: e18fa0bbcedf8 ("RDMA/core: Add an option to display driver-specific QPs in the rdmatool") Signed-off-by: Li RongQing <lirongqing@baidu.com> Link: https://patch.msgid.link/20260916073042.1746-1-lirongqing@baidu.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-18RDMA/core: Fix swapped list_add_tail() arguments in ib_add_sub_device()Li RongQing
ib_add_sub_device() links a new sub-device into its parent's sub-device list with: list_add_tail(&parent->subdev_list_head, &sub->subdev_list); list_add_tail(new, head) expects the node to insert as the first argument and the list head as the second, so the call above does the opposite of what was intended: it treats the parent's list head as the new node and the sub-device's node as the list head. Because _ib_alloc_device() initialises subdev_list to a self-referencing empty head, the misplaced insertion does not crash, but it corrupts the parent->subdev_list_head list. After adding two or more sub-devices, only the last one is reachable through the parent's head, and ib_del_sub_device_and_put()'s list_del() on &sub->subdev_list rewrites the head pointers, potentially severing earlier sub-devices from the chain. During parent teardown, the reverse iteration over subdev_list_head then skips the orphaned sub-devices, so their del_sub_dev() callbacks are never invoked and ib_device_put() on the parent is never paired, leaking both the HW sub-devices and a refcount. Swap the arguments to match the documented intent: insert the sub-device node into the parent's list head. Fixes: bca51197620a ("RDMA/core: Support IB sub device with type "SMI"") Signed-off-by: Li RongQing <lirongqing@baidu.com> Link: https://patch.msgid.link/20260916064435.2180-1-lirongqing@baidu.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-15RDMA/uverbs: Make CQ handle mandatory for WQ creationLi RongQing
UVERBS_ATTR_CREATE_WQ_CQ_HANDLE is declared UA_OPTIONAL in the ioctl method definition, so the mandatory attribute bitmap does not enforce its presence. When userspace omits it, uverbs_attr_get_obj() returns ERR_PTR(-ENOENT) and the handler stores that error pointer into wq_init_attr.cq without validation. The bogus cq pointer is then passed to the driver's create_wq callback. In the mlx5 case, create_rq() calls to_mcq(init_attr->cq) which applies container_of to the ERR_PTR value, producing a near-NULL pointer. The subsequent access in get_rq_ts_format() triggers a kernel NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000296 RIP: 0010:create_rq+0x32/0x550 [mlx5_ib] Call Trace: mlx5_ib_create_wq+0x14a/0x210 [mlx5_ib] ib_uverbs_handler_UVERBS_METHOD_WQ_CREATE+0x1f0/0x320 [ib_uverbs] ib_uverbs_run_method+0x296/0x320 [ib_uverbs] ib_uverbs_cmd_verbs+0x1a0/0x260 [ib_uverbs] ib_uverbs_ioctl+0xa8/0x120 [ib_uverbs] A WQ without a CQ was never valid; the legacy write path always required one via uobj_get_obj_read() in ib_uverbs_ex_create_wq(). Declare the attribute UA_MANDATORY so the uverbs framework rejects the ioctl early when the CQ handle is missing, before the handler ever runs. Fixes: ef3bc084a8ed ("IB/uverbs: Introduce create/destroy WQ commands over ioctl") Signed-off-by: Li RongQing <lirongqing@baidu.com> Link: https://patch.msgid.link/20260911021557.2113-1-lirongqing@baidu.com Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-14Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma fixes from Jason Gunthorpe: "Lots of bug fixes from the last weeks: - Various error unwind bugs - Several more races and bugs in siw and rxe, including remote triggerable - HFI1 corruption with its credit scheme - Remove a bogus user triggerable dev_warn - Lock __ethtool_get_link_ksettings() properly - Fix a lockdep loop with diassociation - Several storage related bugs, some triggerable remotely - Do no leak physical addresses to userspace in bnxt_re - Fix wrong irq context for the xarrays in erdma - User triggerable race in ucma with multicast - Race in ipoib with multicast flushing and destruction" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (28 commits) RDMA/siw: Bound fragmented header copies by the remaining length RDMA/efa: Keep EQ resources alive while IRQ is registered RDMA/efa: Keep admin queues alive while IRQ is registered RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() IB/IPoIB: Avoid restoring OPER_UP after multicast flush RDMA/ucma: Serialize join and leave on copy_to_user failure RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted RDMA/irdma: Enforce local fence for IB_WR_REG_MR RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables RDMA/mad: Fix receive buffer leak when PKey enforcement fails RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc() RDMA/bnxt_re: Avoid exposing umdbr to userspace RDMA/rtrs: guard against null kobj name RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup IB/isert: wait for deferred control PDU completions before releasing the connection IB/iser: reject a remote invalidation of an unregistered direction RDMA/srp: Fix srp_remove_target() IB/mlx4: Fix use-after-free on pkey sysfs registration failure RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency RDMA/core: Reject unregistering netdevs in ib_get_eth_speed ...
2026-09-10RDMA: fix repeated words in commentsHemanth Selam
Drop words accidentally written twice, reported by checkpatch.pl as a possible repeated word. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260907065047.26773-3-hemanth.selam@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-10RDMA: fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260907065047.26773-2-hemanth.selam@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-06RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()Jeffin Philip
iwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail() making it accessible to global list where another CPU can kref_get() on nlmsg_request causing a refcount "addition on 0" bug. Fix this by initializing kref _before_ list_add_tail() so refcount for nlmsg_request can be incremented/decremented normally. In addition, also initialize every field before list_add_tail(). Reported-by: syzbot+bd317784d628820741b5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bd317784d628820741b5 Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service") Cc: stable@vger.kernel.org Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com> Link: https://patch.msgid.link/20260904131437.12917-1-jeffinphilip14@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-06RDMA/nldev: Put the device when dellink failsLi RongQing
nldev_dellink() takes a device reference through ib_device_get_by_index() and normally hands it over to ib_unregister_device_and_put(). The error path of the ->dellink callback returns without releasing it, so the reference is leaked. Once that happens, any later unregistration of the device blocks forever, because disable_device() drops its own reference and then waits for the refcount to drain. No in-tree driver returns an error from ->dellink today, so the leak is currently latent. Put the device before returning the error. Fixes: a60e3f3d6fba ("RDMA/nldev: Add dellink function pointer") Signed-off-by: Li RongQing <lirongqing@baidu.com> Link: https://patch.msgid.link/20260903082550.2257-1-lirongqing@baidu.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-06RDMA/ucma: Serialize join and leave on copy_to_user failureQuanye Yang
rdma_join_multicast() queues RoCE work that later reads the ucma_multicast through event->param.ud.private_data, then list_add()s the CMA multicast at the head of id_priv->mc_list. rdma_leave_multicast() matches only by sockaddr and destroys the first hit. ucma_process_join() used to drop ctx->mutex after a successful join and retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls with the same address can therefore insert a second CMA entry before the first thread's leave. leave then cancels the newer work and the older worker still dereferences the ucma_multicast that the first thread frees. Keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and, on -EFAULT, through rdma_leave_multicast() so leave cannot miss this join. Do not leave if join itself failed: that path never published this address on mc_list, and a leave-by-addr would destroy an earlier successful join. Reported-by: syzbot+a6ffe86390c8a6afc818@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a6ffe86390c8a6afc818 Fixes: fe454dc31e84 ("RDMA/ucma: Fix use-after-free bug in ucma_create_uevent") Cc: stable@vger.kernel.org Signed-off-by: Quanye Yang <quanyeyang@proton.me> Link: https://patch.msgid.link/20260831-rdma-ucma-mc-uaf-v1-1-b8eeb7046aff@proton.me Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-04treewide: refresh kmalloc_obj() conversionsKees Cook
This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook <kees+treewide@kernel.org>
2026-09-02RDMA/mad: Fix receive buffer leak when PKey enforcement failsLi RongQing
ib_mad_complete_recv() initializes mad_recv_wc->rmpp_list and then runs ib_mad_enforce_security() before linking recv_buf onto that list. On failure it calls ib_free_recv_mad(), which only walks rmpp_list and frees the ib_mad_private of every buffer found there. As the list is still empty at that point, nothing is freed at all. The caller cannot clean up either: ib_mad_recv_done() sets recv to NULL right after ib_mad_complete_recv() returns, assuming the MAD layer took ownership of the buffer. Every MAD that fails the PKey check therefore leaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA), and a remote node can trigger this repeatedly by sending MADs with a wrong PKey. Link recv_buf onto rmpp_list right after the list is initialized, so the error path has something to free. Fixes: 47a2b338fe63 ("IB/core: Enforce security on management datagrams") Signed-off-by: Li RongQing <lirongqing@baidu.com> Link: https://patch.msgid.link/20260826073216.2367-1-lirongqing@baidu.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-02RDMA/uverbs: Fix potential leak of resources->collection in ↵Li RongQing
flow_resources_alloc() The two array allocations are done unconditionally and only checked afterwards, so if the counters allocation fails while the collection allocation succeeds, the error path frees counters and the containing struct but never frees resources->collection, losing the only pointer to it. Fixes: de7498147d00 ("RDMA/uverbs: Refactor flow_resources_alloc() function") Signed-off-by: Li RongQing <lirongqing@baidu.com> Link: https://patch.msgid.link/20260826073146.2203-1-lirongqing@baidu.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-01RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependencyOr Har-Toov
Commit 51976c6cd786 ("RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages") introduced disassociation_lock to protect new mmap registrations against uverbs_user_mmap_disassociate(), but created an ABBA deadlock: Thread A (mmap / fork): mmap_lock -> disassociation_lock Thread B (disassociate): disassociation_lock -> mmap_lock Fix by removing disassociation_lock entirely and using the pre-existing hw_destroy_rwsem instead. hw_destroy_rwsem already provides the same protection: rdma_umap_open() and ib_uverbs_mmap() both use down_read_trylock() before registering a new VMA, so holding hw_destroy_rwsem in uverbs_user_mmap_disassociate() is sufficient to block new registrations. trylock is used in both mmap paths (not blocking down_read) because mmap_lock is already held on entry, and uverbs_user_mmap_disassociate() acquires mmap_lock internally — a blocking read would recreate the same deadlock. The only caller that was not taking hw_destroy_rwsem for write was rdma_user_mmap_disassociate(). Fix it to take the rwsem per-ufile while iterating under lists_mutex. This is safe because ib_uverbs_close() releases hw_destroy_rwsem entirely before acquiring lists_mutex, so the two locks are never held simultaneously. lockdep warning: [ 776.654252] ====================================================== [ 776.655214] WARNING: possible circular locking dependency detected [ 776.656167] 6.18.0for-upstream_debug_94e244d9ccab #1 Not tainted [ 776.657114] ------------------------------------------------------ [ 776.658087] devlink/14824 is trying to acquire lock: [ 776.658879] ffff88811170c800 (&mm->mmap_lock){++++}-{4:4}, at: uverbs_user_mmap_disassociate+0x168/0x780 [ib_uverbs] [ 776.660479] [ 776.660479] but task is already holding lock: [ 776.661460] ffff888142d92b08 (&file->disassociation_lock){+.+.}-{4:4}, at: uverbs_user_mmap_disassociate+0x39/0x780 [ib_uverbs] [ 776.663177] [ 776.663177] which lock already depends on the new lock. [ 776.663177] [ 776.664525] [ 776.664525] the existing dependency chain (in reverse order) is: [ 776.665724] [ 776.665724] -> #2 (&file->disassociation_lock){+.+.}-{4:4}: [ 776.666887] __mutex_lock+0x16d/0x2330 [ 776.667633] rdma_umap_open+0x129/0x280 [ib_uverbs] [ 776.668489] dup_mmap+0xa40/0x1790 [ 776.669170] copy_process+0x5dd2/0x6170 [ 776.669933] kernel_clone+0xb6/0x610 [ 776.670636] __do_sys_clone+0xb5/0xf0 [ 776.671354] do_syscall_64+0x70/0x12e0 [ 776.672083] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 776.672940] [ 776.672940] -> #1 (&mm->mmap_lock/1){+.+.}-{4:4}: [ 776.673985] down_write_nested+0x90/0x1e0 [ 776.674751] dup_mmap+0x201/0x1790 [ 776.675448] copy_process+0x5dd2/0x6170 [ 776.676180] kernel_clone+0xb6/0x610 [ 776.676904] __do_sys_clone+0xb5/0xf0 [ 776.677615] do_syscall_64+0x70/0x12e0 [ 776.678351] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 776.679239] [ 776.679239] -> #0 (&mm->mmap_lock){++++}-{4:4}: [ 776.680253] __lock_acquire+0x18c6/0x2ec0 [ 776.681018] lock_acquire+0x10e/0x2e0 [ 776.681742] down_read+0x95/0x430 [ 776.682395] uverbs_user_mmap_disassociate+0x168/0x780 [ib_uverbs] [ 776.683436] uverbs_destroy_ufile_hw+0x1ae/0x270 [ib_uverbs] [ 776.684416] ib_uverbs_remove_one+0x22b/0x420 [ib_uverbs] [ 776.685371] remove_client_context+0xa6/0xf0 [ib_core] [ 776.686342] disable_device+0x12b/0x240 [ib_core] [ 776.687249] __ib_unregister_device+0x269/0x460 [ib_core] [ 776.688233] ib_unregister_device+0x21/0x30 [ib_core] [ 776.689140] mlx5r_remove+0xd0/0x170 [mlx5_ib] [ 776.689999] device_release_driver_internal+0x3b2/0x560 [ 776.694876] bus_remove_device+0x1f5/0x3e0 [ 776.695638] device_del+0x3b9/0x990 [ 776.696329] mlx5_detach_device+0x17e/0x350 [mlx5_core] [ 776.697429] mlx5_unload_one_devl_locked+0x3f/0xb0 [mlx5_core] [ 776.698578] mlx5_devlink_reload_down+0x1f9/0x550 [mlx5_core] [ 776.699712] devlink_reload+0x13e/0x680 [ 776.700456] devlink_nl_reload_doit+0xc29/0x1160 [ 776.701293] genl_family_rcv_msg_doit+0x1c9/0x2a0 [ 776.702135] genl_rcv_msg+0x3f0/0x6b0 [ 776.702854] netlink_rcv_skb+0x11d/0x370 [ 776.703605] genl_rcv+0x24/0x40 [ 776.704236] netlink_unicast+0x5b4/0x970 [ 776.704984] netlink_sendmsg+0x730/0xbf0 [ 776.705748] __sock_sendmsg+0xc5/0x190 [ 776.706461] __sys_sendto+0x201/0x2f0 [ 776.707188] __x64_sys_sendto+0xdc/0x1b0 [ 776.707931] do_syscall_64+0x70/0x12e0 [ 776.708643] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 776.709546] [ 776.709546] other info that might help us debug this: [ 776.709546] [ 776.710910] Chain exists of: [ 776.710910] &mm->mmap_lock --> &mm->mmap_lock/1 --> &file->disassociation_lock [ 776.710910] [ 776.712805] Possible unsafe locking scenario: [ 776.712805] [ 776.713828] CPU0 CPU1 [ 776.714589] ---- ---- [ 776.715347] lock(&file->disassociation_lock); [ 776.716097] lock(&mm->mmap_lock/1); [ 776.717067] lock(&file->disassociation_lock); [ 776.718199] rlock(&mm->mmap_lock); [ 776.718857] [ 776.718857] *** DEADLOCK *** Fixes: 51976c6cd786 ("RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages") Signed-off-by: Or Har-Toov <ohartoov@nvidia.com> Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Edward Srouji <edwards@nvidia.com> Link: https://patch.msgid.link/20260811-fix-mmap-lockdep-v1-1-1151b41063b4@nvidia.com Acked-by: Junxian Huang <huangjunxian6@hisilicon.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-01RDMA/core: Reject unregistering netdevs in ib_get_eth_speedKrystian Kaniewski
ib_device_get_netdev() intentionally returns a referenced net_device even when it is unregistering, so matching and cleanup callers can still find the association. The reference keeps struct net_device allocated, but does not guarantee that the device remains operational. ib_get_eth_speed() uses the returned device operationally by invoking its ethtool callback. Although that call is made under RTNL, the function does not verify the registration state first. An asynchronous RDMA port query can therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit have completed. Check for NETREG_REGISTERED while holding RTNL and return -ENODEV for a device which is being unregistered. Keeping RTNL across the check and the ethtool operation prevents unregister from starting between them. Keep the speed fallback and warning under RTNL as well, so the warning can safely read netdev->name. Drop the netdev reference before releasing RTNL once all accesses to the device are complete. Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev") Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5fe14f2ff4ccbace9a26 Signed-off-by: Krystian Kaniewski <krystianmkaniewski@gmail.com> Link: https://patch.msgid.link/20260812081708.32468-1-krystianmkaniewski@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-08-21Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull RDMA updates from Jason Gunthorpe: "About the normal size, still a lot of AI bug fixes and so on, but some interesting new functionality too: - Assorted locking, bounds-checking, cleanup, and error-path fixes across UCMA/CMA, bng_re, bnxt_re, cxgb4, EFA, ERDMA, HFI1, HNS, ionic, iRDMA, mlx4/mlx5, RXE, SIW, SRP/SRPT, and iSER target. - netlink report for max # of supported resources - get_zeroed_page()/etc removal - Robust udata for ionic - Allow unique RDMA device names per network namespace - Completion counters and v2 admit queue support for EFA - UC QP support for MANA - Completion timestamps for ionic - Harden uverbs data validation and resource lifetime handling, fixing several core use-after-free conditions. - bnxt_re toggle-page ownership and lifetime bug fixes - dmabuf SRQ support for mlx5" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (160 commits) RDMA/ucma: Allow path records to exactly fit the output buffer RDMA/uverbs: Guard legacy bundles without method_elm RDMA/efa: Add support for 128B admin v2 SQ entry RDMA/efa: Generalize the admin SQ RDMA/efa: Decouple admin command payload from admin header RDMA/rxe: Fix OOB in free_rd_atomic_resources() RDMA/cma: Fix WARNING in res_to_rt RDMA/cxgb4: Free debugfs on registration failure RDMA/cxgb4: Cancel reg_work before freeing device on remove RDMA/ucma: Lock the handler in ucma_set_ib_path() RDMA/ucma: Lock the handler in ucma_write_cm_event() RDMA/erdma: restrict the driver to little-endian systems RDMA/ionic: Embed counter driver data in rdma_counter allocation RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget RDMA/siw: Fix use-after-free in siw_accept() IB/isert: post the full-feature receive buffers after session registration IB/isert: delay the final Login Response until the session is registered RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ RDMA/erdma: Hold QP references for AE and CM processing RDMA/erdma: Hold CQ references when processing EQ events ...
2026-08-20Merge tag 'mm-stable-2026-08-18-18-39' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - "mm: drop "sub" prefix from various places" (Dev Jain) page->folio conversion and a naming cleanup - "mm/kasan: remove redundant initialization for kasan_flag_write_only" (Igor Putko) KASAN cleanup work - "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling) Small speedup in the pagecaache read code - "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng) Improve the vmalloc code - mainly the avoidance of GFP_KERNEL allocations when the caller asked for GFP_NOFS or GFP_NOIO - "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno Leitao) Avoid a soft lockup watchdog trigger from the kmemleak scanning code in extreme situations - "mm/page_owner: misc cleanups" (Ye Liu) Cleanups to the page_owner code. For some reason lots of people have been working on the page_owner code this cycle. - "mm: convert to walk_page_range_vma() to eliminate find_vma()" (Kefeng Wang) Simplify and accelerate the page walking library function - "mm/migrate: preparatory cleanups for batch copy and offload" (Shivank Garg) Cleanups in the migration code - "mm/page_owner: add per-fd filter infrastructure for print_mode and NUMA filtering" (Zhen Ni) Per-fd filtering to page_owner in order to reduce the sometimes vast amount of output it can produce - "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song) Fixes and preparatory cleanups around bootmem HugeTLB handling, sparse initialization ordering, and related vmemmap setup - "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao) Reduce lock contention in zs_free(), which dominates the unmap path under memory pressure on Android (LMK kills) and on x86 servers running zswap-heavy workloads. Up to 1.83x improvement in microbenchmarking. - "move alloc_tag.c file under mm/" (Suren Baghdasaryan) - "samples/damon: handle damon_{start,stop}() failures" (SJ Park) Fix improper handling of damon_start(), damon_stop(), and damon_call() failures across DAMON sample modules to prevent potential memory leaks, operation disruptions and use-after-free bugs - "mm/damon/sysfs: kobject_del() directories that users can create/remove" (SJ Park) Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE causeing creation failures due to duplicate directory names by adding missing kobject_del() calls before creating new directories - "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand) Clean up the core pte handling code - "selftests/damon: misc fixes for test bugs" (Kunwu Chan) Fix several bugs in the DAMON selftests - "selftests/damon: fix memcg_path staging handling" (Cheng Nie) Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and add a test case for it in sysfs.py. - "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev) Selftest coverage for DAMON's refresh_ms sysfs feature by updating the test control module and verifying that scheme stats update automatically without manual intervention - "mm/damon: five misc fixups" (Akinobu Mita) Miscellaneous DAMON fixups. - "mm/damon/core: detect internal variation above max_nr_regions/2" (Jiayuan Chen) Fix DAMON's region splitting behavior when region counts exceed half the maximum budget by dynamically scaling down the split fraction as the limit approaches, preventing large regions from staying un-split, and add corresponding KUnit test coverage - "mm: preparatory patches for PMD level swap entries" (Usama Arif) Refactor and clean up PMD softleaf helpers, call sites, and architecture flags to lay the groundwork for a follow-up series that introduces PMD page table swap entries - "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ Park) Update DAMON design and ABI documentation, expands unit and selftest coverage, optimize damon_commit_target_regions(), and clean up recently added sysfs interface code for better readability - "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2" (Usama Arif) Optimize vmpressure() by skipping unnecessary work on cgroup v2 for userspace event notifications and refactor v1-only eventfd handling into mm/memcontrol-v1.c to reduce memory overhead and code complexity - "selftests/mm: refactor pkey helpers and fix mmap error handling" (Hongfu Li) Refactor pkeys shared tracing and assertion helpers into a common file, unify protection key selftests to use consistent diagnostic logging and assertions, and enforce standardized MAP_FAILED return checks for mmap() calls across the tests - "mm/damon: optimize out nr_accesses_bp" (SJ Park) Replace the error-prone, continuously updated nr_accesses_bp field in damon_region with an on-demand moving sum function, reducing structure memory overhead and avoiding state corruption bugs - "Open HugeTLB allocation routine for more generic use" (Ackerley Tng) Decouple HugeTLB folio allocation from VMA dependencies by introducing hugetlb_alloc_folio(), enabling subsystems like guest_memfd to allocate HugeTLB folios without standard VMA reservations or pseudo-VMAs - "mm/damon: provide pseudo moving sum probe_hits" (SJ Park) Integrate DAMON's probe_hits attribute counter into the pseudo moving sum infrastructure, enabling real-time, online monitoring without waiting for full aggregation intervals - "mm: Some cleanups for page allocator APIs" (Brendan Jackman) Simplify and refactor the page allocator entry points and flags by unifying allocation paths, adding internal alloc_flags arguments, and eliminating redundant __ prefixed alloc_pages variants. - "Fix incorrect access of hugetlb pte entries" (Dev Jain) Enforce the consistent use of huge_ptep_get() instead of ptep_get() for HugeTLB entries and fixes an unaligned address issue in arm64's huge_ptep_get() implementation - "mm/damon: validate all parameters in the core" (SJ Park) Consolidate parameter validation into the DAMON core specifically within damon_start() and damon_commit_ctx() to centralize error checking, eliminate caller-side redundant checks and to improve maintenance efficiency - "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong Chen) Rename is_need() to filter_record() for clearer return semantics, fix per-record allocation memory leaks and bound output copies in search_pattern() to address an existing buffer issue - "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen) Mitigate a system-wide stall which occurs when a cgroup is removed while one of its memory control files is doing synchronous reclaim - "mm/memory-failure: add panic option for unrecoverable pages" (Breno Leitao) Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl that immediately panics the kernel on unrecoverable memory errors in kernel-owned pages to preserve error context and prevent delayed, silent data corruption - "mm/damon: refactor damon_{start,stop,commit}() for simple error handling" (SJ Park) Refactor the DAMON core API functions to guarantee that all contexts are fully stopped when damon_start(), damon_stop(), or damon_commit() fail, eliminating the need for complex and error-prone caller-side cleanup code - "Keep tail page private zero at free and folio split" (Zi Yan) Add checks to ensure tail_page->private is zero when freeing compound or high-order pages and when promoting tail pages during large folio splits. By validating these fields at free and split time, it allows the removal of redundant private field clearing inside prep_compound_tail() - "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry Song) Eliminate redundant lru_add_drain() calls in wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock contention and system overhead By validating folio refcounts against the LRU cache before draining and removing unnecessary drains in the swap path, it achieves up to a 30.5% reduction in drain calls during heavy swap workloads - "mm: clean up folio LRU and swap declarations" (Jianyue Wu) Reorganize folio LRU and swap code by relocating page-cluster state to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving MM-internal reclaim declarations into mm/internal.h. - "userfaultfd: working set tracking for VM guest memory" (Kiryl Shutsemau) Add userfaultfd support for tracking the working set of VM guest memory, so a VMM can identify hot pages and reclaim cold ones to tiered or remote storage - "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David Hildenbrand) Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE, performing some smaller cleanups around freeing of reserved vmemmap pages on the way. - "mm/damon: update probe hits for runtime parameter commits" (SJ Park) Ensure that DAMON's probe_hits attribute counter is properly updated when monitoring intervals are changed at runtime, matching the behavior of nr_accesses. To achieve this, it refactors and renames existing helper functions for shared use, applies the updates to probe_hits, and handles edge cases in damon_probe_hits_mvsum() to maintain measurement accuracy. - "KSM: performance optimizations for rmap_walk_ksm" (xu xin) Resolve a severe KSM reverse-mapping performance bottleneck where thousands of split VMAs sharing a single anon_vma cause extended lock contention. By adding an interval-filtering check during the rmap walk, it reduces worst-case anon_vma lock hold times from over 500ms down to under 2ms, preventing application freezes and latency spikes under memory pressure. - "mm: split a couple of headers from internal.h" (Mike Rapoport) Split declarations related to mm_init, memblock, vmalloc and sparse into new headers - "KSM: use linear_page_index in collect_procs_ksm()" (xu xin) Apply the interval tree optimization from rmap_walk_ksm() to collect_procs_ksm() to avoid iterating over non-matching VMAs during KSM memory error handling. It hoists loop-invariant address initialization and restricts the anon_vma_interval_tree_foreach walk to a targeted page offset range, reducing redundant checks and improving lookup efficiency. - "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali Patil) Fix issues in the hugetlb and KSM MM selftest categories that can report failures when the prerequisites for the tests are not satisfied - "mm/damon: introduce data attributes only monitoring" (SJ Park) Introduce attribute-weighted region management in DAMON, allowing users to prioritize specific data attributes (such as page sizes or cgroups) over or instead of access monitoring. By assigning weights to attribute probes, DAMON can completely disable access tracking and adjust monitoring regions based on weighted probe-hit counters to optimize monitoring quality for attribute-focused workloads. - "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings" (Stanislav Kinsburskii) Extend hmm_range_fault() to support userfaultfd-backed regions by allowing the mmap lock to be dropped during fault handling via a new hmm_range_fault_locked() helper. By accepting a locked pointer and signaling retry status when lock release occurs, it enables page fault resolution in userfaultfd regions while preserving backward compatibility for existing callers. - "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes) Clean up and standardize how vma->vm_pgoff is accessed and manipulated across file-backed and anonymous mappings in the kernel It introduces dedicated helper functions such as vma_start_pgoff(), vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while renaming rmap interval tree helpers to better reflect their functionality. These changes establish a cleaner foundation for future work that will unify virtual page offset indexing for all anonymous and CoW'd folios. - "mm: handle device-private PMDs in walk callbacks" (Usama Arif) Address kernel panics and state corruption caused by MM walk callbacks reaching non-present device-private PMD swap entries created during HMM migrations It ensures that functions which acquire pmd_trans_huge_lock() properly recognize device-private PMDs instead of assuming a present THP or a standard migration entry. - "mm/rmap: Refactor try_to_unmap_one" (Dev Jain) Refactor try_to_unmap_one by modularizing Hugetlb, anonymous-lazyfree, and anonymous-swapbacked logic into dedicated functions, laying the structural groundwork for batched anonymous large folio unmapping. - "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu) Fix typos and fills in missing entries in the DAMON sysfs ABI document - "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price) Introduce an atomic sysfs state attribute and supporting DAX/MM infrastructure to prevent userland races when offlining and removing entire memory regions By adding an unplugged state alongside standard online modes, it enables whole-device atomic hotplug control while preserving backward compatibility. - "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes) Continue transitioning the kernel from the deprecated vm_flags_t type to vma_flags_t across core memory management infrastructure. It replaces legacy type usage in core functions such as do_mmap(), unmapped area allocation, mm->def_vma_flags, and VMA operations like mlock, mprotect, and mremap. - "Two small patches to clean up mm/mm_slot.h" (xu xin) Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate slot deletion sequences in khugepaged and KSM. It also adds code documentation explaining why mm_slot_lookup and mm_slot_insert must remain as preprocessor macros rather than static inline functions. - "mm/damon/core: hide core-private struct fields" (SJ Park) Clean up DAMON core structures by consistently marking internal-only fields with private: comment tags to prevent improper direct access from outer layers. It enforces encapsulation across core structures including damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to interact through approved access APIs instead of exposing raw struct members. - "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races" (SJ Park) Address potential infinite loops, NULL dereferences, and race conditions identified in DAMON It fixes an infinite loop triggered by extreme user configurations, a NULL pointer dereference within unit tests and minor monitoring accuracy degradation caused by subtle runtime races. - "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan Jackman) Fix an NMI safety flaw in __free_frozen_pages() where freeing pages on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks via non-PCP or isolated migration paths. It also resolves potential kernel crashes and privilege escalation risks triggered when BPF tracing runs in NMI context alongside memory hotplug or large allocation frees. - "mm/page_alloc: couple of followups for recent cleanups" (Brendan Jackman) Clean up and update page allocator nomenclature, documentation, and debug assertions. It aligns internal FPI_ flags with the public "nolock" naming convention, removes outdated internal implementation details from high-level page allocator comments, and eliminates obsolete VM_BUG_ON() assertions in allocation paths. - "mm/mseal: further cleanups" (Lorenzo Stoakes) Refactor and simplify the mseal implementation by clarifying API boundaries and removing unnecessary code complexity. It replaces generic do_mseal() usage outside the syscall with a dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO, eliminates mm_struct parameters to enforce that sealing applies only to current->mm, and streamlines overall logic and comments with no functional changes intended. - "mm/vmscan: fix swappiness=max and clean up per-node proactive reclaim" (Ridong Chen) Resolve reclaim behavior bugs and clean up function parameters across memory reclaim paths It fixes swappiness=max in both standard reclaim and MGLRU so unswappable anonymous memory no longer falls back to evicting page cache, ensures reclaim_store() returns accurate error codes instead of collapsing all failures into -EAGAIN, and removes the obsolete gfp_mask parameter from __node_reclaim(). - "mm: mincore: misc cleanups" (Kefeng Wang) Clean up and simplifies the mincore code. Most importantly, it removes the historical special behavior that always reports VM_PFNMAP pages as non-resident. - "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau) Two trivial cleanups in the folio split API - "mm/damon: fix uninitialized DAMOS field and kunit exec expectation bugs" (SJ Park) Resolve minor operational and testing bugs in DAMON identified by Sashiko. It initializes the damos->last_applied field to prevent occasional efficiency degradation and fixes invalid memory accesses in DAMON KUnit tests during test failure handling. - "cleanup for stable_page_flags()" (Jinjiang Tu) Clean up and refactor stable_page_flags() used by /proc/kpageflags without altering functionality. It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag bits, converts folio-specific flag checks to standard folio_test_*() helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling. - "Batch unmap of uffd-wp file folios" (Dev Jain) Extend batched folio unmapping support to file folios within userfaultfd write-protect (uffd-wp) VMAs by adding batching capabilities to pte_install_uffd_wp_if_needed(). This removes special-case restrictions on uffd-wp VMAs in try_to_unmap_one(), significantly simplifying the function's control flow and complexity. - "mm/early_ioremap: clarify and clean up early_ioremap_reset()" (Sang-Heon Jeon) Clarify and clean up the architecture-specific usage of __late_set_fixmap() and __late_clear_fixmap() after early_ioremap_reset() It adds explicit documentation regarding when early_ioremap_reset() must be called and removes redundant macro definitions and reset calls in the RISC-V and ARM64 architectures. - "mm: fix reclaim storms in defrag_mode" (Johannes Weiner) Address severe performance regressions, swap storms, and spurious OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta production It updates the page allocator slowpath so non-movable allocation requests actively trigger direct reclaim and direct compaction at pageblock_order scale, allowing them to claim whole pageblocks rather than spinning unproductively. - "zram: lockmap tweaks" (Sebastian Siewior) Optimize and fix lockdep tracking for zram devices by consolidating per-entry lockmaps and isolate lock classes across multiple instances This reduces memory overhead by replacing per-entry lockdep_map instances with a single map per struct zram, and assigns a dynamic lock_class_key to each instance to prevent false deadlock reports when different zram devices are backed by distinct filesystems. * tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits) selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check selftests/mm: unpoison pages in memory-failure teardown mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn() mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro mm/zsmalloc: fix release order of locks in zs_page_migrate() Documentation: zram: remove sections numbering ksm: stop iterating VMAs when ksm_test_exit returns true mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() zram: use a custom key for each zram object zram: move lockmap to be per-zram instead per table selftests/mm: fix gup_longterm EINVAL error message mm: page_alloc: fix non-movable reclaim storm in defrag_mode mm: page_alloc: move capture_control to the page allocator mm: compaction: support non-movable compaction for pageblock requests mm: page_alloc: __GFP_FS lockdep annotation for direct compaction hugetlb: evaluate subpool free state while locked mm/damon: remove trailing semicolons after function definitions mm/damon/ops-common: prevent migration fallback to non-target nodes mm/damon: update outdated comment about DAMOS filter handling ...
2026-08-20RDMA/ucma: Allow path records to exactly fit the output bufferSerhat Kumral
ucma_query_path() emits a path record only when the remaining output buffer is strictly larger than struct ib_path_rec_data. A buffer sized exactly for the response header and N complete records therefore gets only N - 1 records, while resp->num_paths still advertises N. A caller sizing its buffer for a single record gets a header claiming one path and no path data at all. ucma_query_ib_service() in the same file computes the record count with a plain division and so accepts an exact fit; make ucma_query_path() behave the same way. Current librdmacm is unaffected because it always sizes the response for six records while the kernel currently reports at most two paths. Other users of the UAPI that provide an exactly sized buffer can observe the truncated response. Fixes: ac53b264b2f3 ("RDMA/ucma: Support querying when IB paths are not reversible") Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com> Link: https://patch.msgid.link/20260806201358.147478-1-serhatkumral1@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-18RDMA/uverbs: Guard legacy bundles without method_elmYuhang Pan
The legacy write() path dispatches through a uverbs_api_write_method, but the uverbs_attr_bundle passed to provider code does not have an ioctl method element. If malformed provider input causes the common uverbs validation code to emit an error message, uverbs_get_handler_fn() dereferences the uninitialized method_elm pointer. Initialize method_elm explicitly for legacy bundles and make uverbs_get_handler_fn() return NULL when no ioctl method is present. The legacy dispatcher continues to use its local write method, while the ioctl path continues to use the registered ioctl handler. Cc: stable@vger.kernel.org Fixes: 7122ff96068a ("RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn()") Link: https://patch.msgid.link/r/AOYAQgCQK3IXqJLr1TB5Qao9.1.1787036796115.Hmail.242270054@hdu.edu.cn Signed-off-by: Yuhang Pan <242270054@hdu.edu.cn> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-18Merge rdma branch 'for-rc' into 'for-next'Jason Gunthorpe
These did not seem worth sending as a dedicated rc PR during the last week of the cycle. * ko-rdma/for-rc: RDMA/ipoib: Drain RCU callbacks during module teardown RDMA/mlx5: Drain RCU callbacks during module teardown RDMA/core: Wait for RCU callbacks before unloading ib_core RDMA/irdma: Prevent overflows in memory contiguity checks RDMA/siw: publish QP after initialization RDMA/hns: Fix potential integer overflow in mhop hem cleanup RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe RDMA/mana_ib: initialize err for empty send WR lists RDMA/erdma: initialize ret for empty receive WR lists RDMA/irdma: Prevent user-triggered null deref on QP create RDMA/irdma: Prevent rereg_mr for non-mem regions RDMA/cma: Fix hardware address comparison length in netevent callback RDMa/mlx5: Avoid frame overflow warning IB/mad: Drop unmatched RMPP responses before reassembly Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-11RDMA/cma: Fix WARNING in res_to_rtZhu Yanjun
syzbot reported a WARN_ON(!res->dev) in res_to_rt() triggered via addr_handler() during asynchronous address resolution: " WARNING: drivers/infiniband/core/restrack.c:138 at res_to_rt+0x1c4/0x230 CPU#1: kworker/u8:4/59 Modules linked in: CPU: 1 UID: 0 PID: 59 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine, BIOS Google 07/24/2026 Workqueue: ib_addr process_one_req RIP: 0010:res_to_rt+0x1c4/0x230 drivers/infiniband/core/restrack.c:138 RSP: 0018:ffffc9000201f850 EFLAGS: 00010293 RAX: ffffffff88d00ce5 RBX: ffff88807f0fd4f8 RCX: ffff88801e6e0000 RDX: 0000000000000000 RSI: ffffffff8fd996f0 RDI: 0000000000000003 RBP: 0000000000000000 R08: ffff88801e6e0000 R09: 000000000000000a R10: 0000000000000009 R11: 0000000000000000 R12: dffffc0000000000 R13: 1ffff1100fe1fa9f R14: 0000000000000000 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff888125012000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00001d559c3d2000 CR3: 0000000077c4c000 CR4: 00000000003526f0 Call Trace: <TASK> rdma_restrack_add+0x5a/0x8a0 drivers/infiniband/core/restrack.c:236 addr_handler+0x41a/0x5a0 drivers/infiniband/core/cma.c:3534 process_one_req+0x2eb/0x540 drivers/infiniband/core/addr.c:624 process_one_work kernel/workqueue.c:3375 [inline] process_scheduled_works+0xc4e/0x1630 kernel/workqueue.c:3458 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3539 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> " In addr_handler(), cma_acquire_dev_by_src_ip() is called to populate id_priv->cma_dev and bind the associated ib_device to id_priv->id.device. If cma_acquire_dev_by_src_ip() returns an error (non-zero status), the ID remains unassociated with any RDMA device. Previously, rdma_restrack_add(&id_priv->res) was invoked unconditionally even when cma_acquire_dev_by_src_ip() failed, passing a resource with a NULL dev pointer and triggering the WARN_ON assertion in res_to_rt(). Fix this by only adding the resource to restrack when acquiring the device succeeds. Reported-by: syzbot+72eddfbadda3e3928e72@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=72eddfbadda3e3928e72 Tested-by: syzbot+72eddfbadda3e3928e72@syzkaller.appspotmail.com Fixes: cb5cd0ea4eb3 ("RDMA/core: Add CM to restrack after successful attachment to a device") Link: https://patch.msgid.link/r/20260810220123.191696-1-yanjun.zhu@linux.dev Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-11RDMA/ucma: Lock the handler in ucma_set_ib_path()Norbert Szetei
ucma_set_ib_path() calls ucma_event_handler() straight from the write() path, without the handler lock that keeps ctx->file stable while a uevent is queued. The handler re-reads ctx->file for every dereference: mutex_lock(&ctx->file->mut); /* file A */ list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */ mutex_unlock(&ctx->file->mut); /* file B */ wake_up_interruptible(&ctx->file->poll_wait); /* file B */ A concurrent ucma_migrate_id() reassigns ctx->file while the SET_OPTION caller sleeps in mutex_lock(), so the list_add_tail() lands on file B's event_list while only file A's mutex is held, racing every other user of that list: BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x1aa/0x1c0 Read of size 8 at addr ffff888153c6a418 by task poc_corr/486 Call Trace: __list_add_valid_or_report+0x1aa/0x1c0 ucma_event_handler+0x1be/0xc00 ucma_set_ib_path+0x45e/0x710 ucma_set_option+0x32e/0x590 ucma_write+0x1f9/0x330 Allocated by task 505: ucma_write_cm_event+0x1a1/0x660 Freed by task 505: kfree+0x1da/0x4c0 ucma_get_event+0x5d5/0x7e0 The freed object is a ucma_event that another thread dequeued from file B's list under file B's mutex. File A's mut is left held on top of that, wedging its next writer in uninterruptible sleep. This path needs a bound and address-resolved cm_id, so it requires an RDMA device to be present. Take the handler lock around the call. Fixes: 09e328e47a69 ("RDMA/ucma: Fix the locking of ctx->file") Link: https://patch.msgid.link/r/2823D190-92D5-4714-8769-4FB643C64FF3@doyensec.com Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: Norbert Szetei <norbert@doyensec.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-11RDMA/ucma: Lock the handler in ucma_write_cm_event()Norbert Szetei
ctx->file may only be changed under the handler lock and the xa_lock, which is what stops uevents being queued for a ctx while ucma_migrate_id() moves it to another file. The CM core takes that lock before invoking ucma_event_handler(), but the write() paths that queue uevents themselves do not. ucma_write_cm_event() re-reads ctx->file for each of its four dereferences, so ucma_migrate_id() can swap it mid-sequence: mutex_lock(&ctx->file->mut); /* file A */ list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */ mutex_unlock(&ctx->file->mut); /* file B */ wake_up_interruptible(&ctx->file->poll_wait); /* file B */ The window is the mutex_lock() itself: the writer sleeps in it while the migration reassigns ctx->file. The list_add_tail() then runs on file B's event_list holding only file A's mutex: list_add corruption. prev->next should be next (ffff888101320f30), but was ffff88814a08c418. (prev=ffff88814a075c18). kernel BUG at lib/list_debug.c:32! Call Trace: ucma_write_cm_event+0x36e/0x5e0 and file A's mut is left held forever, wedging its next writer in D state. The uevent is also stranded on a list ucma_cleanup_ctx_events() will not walk, so it outlives its context. /dev/infiniband/rdma_cm is 0666 and no RDMA device is involved, so an unprivileged user reaches all of this. Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is pinned by the ucma_get_ctx() reference. Fixes: a3c9d0fcd371 ("RDMA/ucma: Support write an event into a CM") Link: https://patch.msgid.link/r/60544A67-EFD6-4D5D-974C-D983445F1070@doyensec.com Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: Norbert Szetei <norbert@doyensec.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-05RDMA/core: Prevent rereg_mr for dmabuf umemsJacob Moroni
The rereg_mr method has always been explicitly blocked in rdma-core for dmabuf MRs anyway, so add a check to the ib_umem_check_rereg helper so that each driver doesn't need to handle it. Depending on how the driver handled rereg_mr, this also has the benefit of preventing rereg_mr from being used to add the IB_ACCESS_MW_BIND flag to a dmabuf MR. This flag is not allowed during registration, so it seems sensible to prevent it from being added back with rereg_mr. Preventing IB_ACCESS_MW_BIND is important for drivers that support revocable dmabufs and implement "revoke" by issuing a dereg_mr command to the HW because most(?) HW will reject this command if the MR has windows bound to it, and a failure to revoke is supposed to trigger a function reset. Signed-off-by: Jacob Moroni <jmoroni@google.com> Link: https://patch.msgid.link/20260728141501.1425737-1-jmoroni@google.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-08-04RDMA/umem: use hmm_range_fault_unlocked_timeout() for ODP faultsStanislav Kinsburskii
ib_umem_odp_map_dma_and_lock() takes mmap_read_lock() only around hmm_range_fault(), then retries -EBUSY until HMM_RANGE_DEFAULT_TIMEOUT expires. Use hmm_range_fault_unlocked_timeout() instead. The HMM helper now owns the mmap lock and refreshes range->notifier_seq for its internal retries. ODP keeps using HMM_RANGE_DEFAULT_TIMEOUT for each HMM fault attempt, while interval invalidation retries continue to be handled by the existing outer loop. ODP still validates the interval notifier sequence while holding umem_mutex before DMA mapping pages. Link: https://lore.kernel.org/20260723-hmm-v10-v11-6-c55b003a4b61@gmail.com Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dexuan Cui <decui@microsoft.com> Cc: Haiyang Zhang <haiyangz@microsoft.com> Cc: Jonathan Corbet <corbet@lwn.net> Cc: K. Y. Srinivasan <kys@microsoft.com> Cc: Leon Romanovsky <leon@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lizhi Hou <lizhi.hou@amd.com> Cc: Long Li <longli@microsoft.com> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Lyude <lyude@redhat.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Oded Gabbay <ogabbay@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Thomas Zimemrmann <tzimmermann@suse.de> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Wei Liu <wei.liu@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-26RDMA/core: Make device names unique per net namespaceJiri Pirko
Use rdma_dev_access_netns() to scope RDMA device name lookup and "%d" name allocation to the relevant net namespace. Keep shared mode and CONFIG_NET_NS=n behaviour system-wide. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-12-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Document the SELinux ibendport net namespace limitationJiri Pirko
Document that SELinux ibendport labels use a global (device name, port) key, so same-named RDMA devices in different net namespaces share a label. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-11-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/cma: Document that CM configfs cannot be net namespace scopedJiri Pirko
Document the rdma_cm configfs limitation: configfs is global, so same-named RDMA devices in different net namespaces cannot both be represented there. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-10-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/cgroup: Disambiguate devices across net namespacesJiri Pirko
RDMA device names are unique only within a network namespace, but an RDMA cgroup can account resources for devices from multiple namespaces. Duplicate names therefore make cgroup output ambiguous and can cause limit writes to select the wrong device. Use the system-wide RDMA device index to distinguish duplicate names while preserving the existing UAPI for unique names. Reject ambiguous name-only writes with -ENOTUNIQ and expose a complete device view to administrators. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-9-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/nldev: Allow setting the device name while changing net namespaceJiri Pirko
Accept RDMA_NLDEV_ATTR_DEV_NAME together with RDMA_NLDEV_NET_NS_FD so a netlink move can rename the device in the destination namespace. Keep the name semantics aligned with the existing RDMA rename path. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-6-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/nldev: Report net namespace move errors through extackJiri Pirko
Thread extack through the existing net namespace move helper and report the main failure reasons from the core path. Keep the existing move UAPI shape unchanged. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-5-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Support renaming a device when changing its net namespaceJiri Pirko
Allow namespace moves to request a destination device name. Keep requested names on the same literal-name path as the existing RDMA rename operation, and keep teardown fallback naming on the trusted kernel-controlled path. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-4-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Handle device name conflicts when changing net namespaceJiri Pirko
Prepare namespace moves for per-netns names. Check user-initiated moves for destination-name conflicts before disabling the device, keep same-netns moves as no-ops, and make teardown moves detach from the exiting namespace even if fallback naming fails. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-3-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Pass the net namespace to the device name lookupsJiri Pirko
Prepare for per-netns RDMA device names by passing the target net namespace through the name lookup and allocation helpers. Keep current global uniqueness behaviour. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-2-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-23RDMA/uverbs: Add SRQ buffer UMEM attributeJiri Pirko
Apply the per-attribute UMEM model to the SRQ create method. Add an optional UMEM attribute that backs the SRQ WQE buffer, so userspace can supply it as either a VA or a dma-buf through a single descriptor, consistent with the CQ and QP create methods. mlx5 is the only driver that pins an SRQ WQE buffer via umem; it maps a single ucmd->buf_addr region through this attribute. No other driver implements a user SRQ buffer, so none of them use the attribute. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260701124015.64350-2-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-22Merge branch 'big-tcp-for-udp-tunnels'Paolo Abeni
Alice Mikityanska says: ==================== BIG TCP for UDP tunnels This series is a follow-up to "BIG TCP without HBH in IPv6", and it adds support for BIG TCP IPv4/IPv6 workloads in vxlan and geneve. Now that IPv6 BIG TCP doesn't require stripping the HBH in all various combinations in tunneled traffic, adding BIG TCP becomes feasible. Patch 01 adds accessors for the length field in the UDP header, as suggested by Paolo in review. The usage of udp_set_len is then added in the following patches that start using length=0 in BIG TCP UDP packets. Patches 02-04 close the gaps that prevent BIG TCP packets from going through UDP tunnel code. Patch 05 validates packets in udp_gro_receive to exclude packets with length=0 from GRO aggregation. Patch 06 is for proper formatting in tcpdump (set UDP len to 0 rather than a trimmed value on overflow). Patches 07-08 bump up tso_max_size for VXLAN and GENEVE. Patch 09 adds selftests. ====================$ Link: https://patch.msgid.link/20260710134242.216538-1-alice.kernel@fastmail.im Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-22net: Use helpers to get/set UDP len tree-wideAlice Mikityanska
Since BIG TCP for UDP tunnels will start using len=0 in the UDP header as an indicator of a GSO packet bigger than 65535 bytes, this commit introduces the following getter and setters to use tree-wide, in order to explicitly mark places where len=0 may be expected, and handle them properly: 1. udp_set_len() sets uh->len to its real value if it's not bigger than 65535, and to 0 otherwise: to be used in GSO context with aggregated packets. 2. udp_set_len_short() is to be used when the length is known to fit 16 bits. It WARNs when the caller tries to assign a bigger value if CONFIG_DEBUG_NET=y. 3. udp_get_len_short() returns len in host byte order: to be used on the RX side to deal with non-aggregated packets, or to access the raw value of the len field. 4. udp_get_len() decodes uh->len set by udp_set_len(). It checks whether the packet is GSO to guard from malformed packets. At the moment udp_set_len() is not used, a following commit will start using it after enabling len>65535 for GSO. Raw uh->len (in network byte order) is still accessed in a few places for checksum calculation purposes, and to decode len=0 in udpv6_rcv for jumbograms. udp_rcv and udpv6_rcv will be addressed by the commit that starts using udp_set_len() to set UDP len=0 for BIG TCP packets in UDP tunnels. Signed-off-by: Alice Mikityanska <alice@isovalent.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Acked-by: Jason A. Donenfeld <Jason@zx2c4.com> Link: https://patch.msgid.link/20260710134242.216538-2-alice.kernel@fastmail.im Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-22RDMA/core: Add Completion Counters to resource trackingMichael Margolin
Track completion counter objects in the resource tracking database so they are visible through the rdma netlink interface. The rdma tool displays the comp_cntr count in the resource summary. Add RDMA_RESTRACK_COMP_CNTR type, embed rdma_restrack_entry in ib_comp_cntr, and add the res_to_dev mapping. Register the resource on create and remove it on destroy. Reviewed-by: Yonatan Nachum <ynachum@amazon.com> Signed-off-by: Michael Margolin <mrgolin@amazon.com> Link: https://patch.msgid.link/20260722083603.30334-5-mrgolin@amazon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-22RDMA/core: Expose Completion Counter capabilities to userspaceMichael Margolin
Add a dedicated query interface for completion counter capabilities via UVERBS_METHOD_QUERY_COMP_CNTR_CAPS on the device object. The query returns the maximum number of counters, maximum counter value, and a bitmask of supported QP attach operations. Each field is an optional ioctl attribute, allowing userspace to request only the capabilities it needs. Drivers implement the query_comp_cntr_caps operation to report device-specific capabilities. Reviewed-by: Yonatan Nachum <ynachum@amazon.com> Signed-off-by: Michael Margolin <mrgolin@amazon.com> Link: https://patch.msgid.link/20260722083603.30334-4-mrgolin@amazon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>