summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
13 daysselftests/ftrace: Add persistent ring buffer testcasesMasami Hiramatsu (Google)
Add test cases for persistent ring buffer (reserve_mem= combined with trace_instance=) and backup instance (trace_instance=backup=boot_map). These test cases verify: - persistent-01-reserve-mem: Memory reservation via reserve_mem= and trace_instance=boot_map@trace. Verifies trace data retention in the boot_map instance across guest crash/reboot via sysrq-trigger. - persistent-02-backup-instance: Backup instance creation via trace_instance=backup=boot_map. Verifies that previous boot trace log is preserved in the backup instance on the subsequent boot. These test cases specify '# REBOOT: 1' to enable multi-boot guest crash/reboot testing with doubled QEMU timeout. Link: https://lore.kernel.org/all/178649544683.438282.14573895196260214231.stgit@devnote2/ Assisted-by: LLM Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
13 daysselftests/ftrace: Add kernel cmdline tracing testcasesMasami Hiramatsu (Google)
Add test cases for kernel command-line tracing options. It verifies various parameters like trace_buf_size and trace_options by reading the output of tracing files in sysfs. Link: https://lore.kernel.org/all/178649543741.438282.2638887907664217934.stgit@devnote2/ Assisted-by: LLM Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
13 daysselftests/ftrace: Add boot-time tracing testcasesMasami Hiramatsu (Google)
Add test cases for boot-time tracing configuration via bootconfig (see Documentation/trace/boottime-trace.rst). These test cases verify: - 01-kprobe: Dynamic kprobe events via bootconfig - 02-synth: Synthetic events via bootconfig - 03-eprobe: Event probes (eprobes) via bootconfig - 04-fprobe: Function probes (fprobes) via bootconfig - 05-tprobe: Tracepoint probes via bootconfig - 06-instance: Custom trace instances via bootconfig Link: https://lore.kernel.org/all/178649542809.438282.16167291066989252262.stgit@devnote2/ Assisted-by: LLM Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
13 daysMerge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.3-rc5Alexei Starovoitov
Cross-merge BPF and other fixes after downstream PR. Conflicts: arch/arm64/net/bpf_jit_comp.c arch/x86/net/bpf_jit_comp.c Signed-off-by: Alexei Starovoitov <ast@kernel.org>
13 daysselftests: fib_tests: use per-test return value in subtestsHangbin Liu
fib_tests mixes use of $ret for both per-test return value and global exit code. If an earlier subtest fails and a later function sets ret=0, the script will exit with status 0 even though [FAIL] lines were printed. Use RET as the per-test return value, as already defined in lib.sh. The exit code ret will only be set in log_test(). Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260930-self_fib_tests-v2-1-3053e649d341@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysMerge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull bpf fixes from Alexei Starovoitov: - Fix overflow of backward jump offset in constant blinding (Alexei Starovoitov) - Fix packet range of packet pointers sharing an id when var_off tightens umax of one pointer and not the other (Alexei Starovoitov) - Fix objects stuck in free_by_rcu_ttrace list of bpf memalloc (Alexei Starovoitov) - Fix use-after-free of progs detached from busy trampolines: wait for an RCU tasks grace period before freeing trampoline progs, and patch detached progs out of trampoline images that are still in use (Florent Revest) - Hold map BTF for the memory allocator destructor record to fix UAF in deferred bpf_mem_alloc destruction (Kumar Kartikeya Dwivedi) - Fix missing migration protection in resizable hashtab lookup_and_delete batch operation (Ömer Mete Kaya) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch() selftests/bpf: Add a test for objects stuck in free_by_rcu_ttrace bpf: Fix objects stuck in free_by_rcu_ttrace bpf: Factor out __do_call_rcu_ttrace() selftests/bpf: Test packet range of pointers sharing an id bpf: Fix packet range of pointers sharing an id selftests/bpf: Detach a trampoline prog while a task sleeps before it bpf: Skip detached progs in trampoline images that are still in use bpf: Wait for an RCU tasks grace period before freeing trampoline progs bpf: Hold map BTF for the memory allocator destructor record bpf: Fix overflow of jump offset in constant blinding
13 daysMerge tag 'block-7.3-20261002' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - NVMe fixes via Keith: - Fix an out-of-bounds write in nvmet_auth_challenge(), where sizeof() on a void pointer undercounted the challenge header and let a short AUTH_RECEIVE buffer pass the check - nvme-multipath fixes for an ANA log bounds check underflow, the command effects log lifetime for multipath heads, and only setting BLK_FEAT_ZONED after the zone info is known. - nvmet fixes for ns->enabled teardown ordering, rejecting I/O after the percpu ns reference is killed, device path preservation on allocation failure, and too-short SGL segments in pci-epf - nvme-tcp: revert the per-socket dynamic lockdep keys, and delay the socket reclassification - A DMA pool alignment quirk for the Micron 4100AT - Controller state/reset race fixes, and -Wformat-security workarounds - blk-mq: set RQF_USE_SCHED when the operation is known, and allow cached requests to be used for flush operations - Reject polled dio with user integrity metadata - Save the IRQ state in blkg_tryget_closest() - Set the zone write granularity in virtio_blk - ublk selftest fixes * tag 'block-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (23 commits) virtio_blk: set the zone write granularity nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known nvme: fix command effects log lifetime for multipath heads nvmet: don't allow I/O admission after percpu ns reference is killed nvmet: defer setting ns->enabled to false in nvmet_ns_disable() nvmet: copy the hostid into the ctrl before creating PR pc_refs nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet: pci-epf: reject too-short SGL segments nvme-multipath: fix underflow in ANA log bounds checks nvme: work around all -Wformat-security warnings nvme: work around -Wformat-security warning nvme: do not reset controllers in NVME_CTRL_NEW state nvme-tcp: delay nvme_tcp_reclassify_socket() Revert "nvme-tcp: lockdep: use dynamic lockdep keys per socket instance" drbd: remove unused drbd_nl_mcgrps[] array blk-mq: allow cached requests to be used for flush operations blk-mq: set RQF_USE_SCHED when the operation is known block: reject polled dio with user integrity metadata selftests: ublk: fix unused_result error blk-cgroup: save IRQ state in blkg_tryget_closest() ...
13 daysMerge tag 'hid-for-linus-2026100201' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - Revert of the Bolt integration into hid-logitech-dj (Benjamin Tissoires) - A couple of buffer overflow in Intel-thc-hid (Even Xu) - A couple of Sashiko findings fixes in hid-multitouch and HID-BPF (Aldo Ariel Panzardo and Benjamin Tissoires) * tag 'hid-for-linus-2026100201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: selftest/hid: add test for negative return codes for hid_bpf_hw_request HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request HID: Intel-thc-hid: Intel-quickspi: Fix buffer overflow HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow HID: universal-pidff: Add support for Turtle Beach VelocityOne Race HID: multitouch: stop the release timer from being rearmed on remove Revert "HID: logitech: add Bolt receiver support for Logitech HID++ devices"
13 daysMerge branch 'for-linus' into for-nextTakashi Iwai
Pull again 7.3-devel branch for working on snd_card_free auto-clean changes. Signed-off-by: Takashi Iwai <tiwai@suse.de>
13 daysselftests/bpf: Test per-call site function specializationEmil Tsalapatis
Add a test to ensure function call specialization is done per-call site. Use bpf_dynptr_from_file that has observably different behavior between its sleepable and nonsleepable versions. The sleepable path fails in the sleepable __kernel_read() call with -EIO, while the nonsleepable fails in the page-cache lookup path with -EFAULT. Test that whatever the order the nonsleepable and sleepable calls are made in the program, both call sites use the correct specialized kfunc. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261002105218.6171-8-emil@etsalapatis.com
13 daysselftests/bpf: Test large allocations for both sleepable/nonsleepable arena ↵Emil Tsalapatis
users We have relaxed the limitation of 1024-page batches for both sleepable and nonsleepable arena allocations by removing the intermediate page array. Add a test to confirm that large allocations succeed for both. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261002105218.6171-5-emil@etsalapatis.com
14 daysselftests: net: amt: check that the relay's queries bypass the amt deviceOmar Ramadan
The relay used to hand its General Queries to dev_queue_xmit() on the amt device, where a query could wait in a qdisc and outlive the tunnel it pointed to. The previous patch sends them directly from the receive path instead. Count the IGMP and MLD queries that leave the relay through amtr with tc flower filters on its egress, installed before the gateway comes up, and check that there are none. The forwarding tests before it already show that the gateway received its queries, since it cannot join without one. Without the previous patch the new test fails (one run counted 7 IGMP and 6 MLD queries); with it, all of amt.sh passes. Signed-off-by: Omar Ramadan <omar@blockcast.net> Link: https://patch.msgid.link/20260928202312.74574-3-omar@blockcast.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-01selftests: net: move log_test to lib file and remove duplicate codeHangbin Liu
Many test scripts under tools/testing/selftests/net/ each define their own log_test() function with near-identical logic for comparing a return code against an expected value and printing OK/FAIL. Add a shared log_test_expected() to lib.sh so we can replace each local definitions. The function is named log_test_expected() rather than log_test() because lib.sh already exports log_test() with a different signature used by the forwarding tests. Most of the checks in log_test_expected() are the same as log_test() in other tests. The differences are: - The function always returns 0 to avoid influencing later code. - On failure with VERBOSE=1, the actual and expected return codes are printed (echo " rc=$rc, expected $expected"). - A PAUSE_ON_FAIL check is added via pause_on_fail() for scripts that did not have one. - A PAUSE=yes check is added for scripts that did not have one. - A trailing [ "$VERBOSE" = "1" ] && echo is added for scripts that did not have one. Several tests required special handling: - fcnal-test.sh - Print format: it uses %-70s, while log_test_expected() uses %-60s. - The old code always printed "expected rc $expected; actual rc $rc" on failure. The new code only prints when VERBOSE=1. - The old [ "${VERBOSE}" = "1" ] && echo ran before the comparison; now it runs after the PAUSE check. - fdb_flush.sh - It used local ret, nsuccess, and nfail, which are not used outside the function. The log_test_expected() uses global variables as all other tests do. - fib-onlink-tests.sh - Print format: it uses %-50s, while log_test_expected() uses %-60s. - srv6_end_dx*.sh and srv6_end_flavors_test.sh - These three tests previously defined ksft_skip locally instead of sourcing lib.sh. They now source lib.sh, which provides ksft_skip and other framework constants. Note that srv6_end_flavors_test.sh previously declared ksft_skip as readonly; the lib.sh definition does not use readonly. - test_bridge_neigh_suppress.sh - The test use ksft_exit_status_merge "$ret" "$ksft_fail", which always set ret=1 as ksft_fail has the maximum weight. So in the lib we just discarded ksft_exit_status_merge and set ret to 1 directly. In addition to the above, 12 tests that previously used "TEST:" now use " TEST:" (4-space prefix), and srv6 tests plus vrf_strict_mode_test.sh that previously used "\n TEST:" (newline + 4-space prefix) now with no leading newline. The fib_nexthops.sh test is skipped because it has a ksft_skip check that needs special handling. Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn> Link: https://patch.msgid.link/20260929-self_log_test-v6-1-41199262e50b@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-01selftests/bpf: Add a call_srcu() re-entry reproducerPuranjay Mohan
Re-enter call_srcu() from a BPF program to exercise its any-context safety, via call_rcu_tasks_trace(), which is call_srcu() on rcu_tasks_trace_srcu_struct. An fentry program on rcu_segcblist_enqueue() fires mid-enqueue: that function is reached from srcu_gp_start_if_needed() with the srcu_data ->lock held. The program does a task-storage delete, whose only deferred work is call_rcu_tasks_trace(), re-entering the enqueue on the same CPU. The handler matches on TID and fires once; pinning the thread removes the migration window between picking the srcu_data and taking its lock. Without the fix the nested call re-takes the same sdp lock and self-deadlocks; with it the nested __call_srcu() sees interrupts disabled and defers via irq_work, so the delete returns and the test passes. The test skips where it does not apply: Tiny RCU has no rcu_segcblist_enqueue() to attach to, and a UP+PREEMPT kernel pairs Tree RCU with Tiny SRCU, so the attach succeeds but call_srcu() never reaches the enqueue. Tiny SRCU is told apart by srcu_expedite_current(), which it stubs out, so on Tree SRCU a zero hit count fails rather than skips and the reproducer cannot quietly stop reproducing. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-10-01Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc6). Conflicts: net/mac80211/tx.c net/mac80211/ieee80211_i.h 8effab902fa34 ("wifi: mac80211: prevent AP VLAN tx from other interfaces") 78b843974fb83 ("wifi: mac80211: report multicast transmission from lookup_ra_sta()") https://lore.kernel.org/arJmcuhpJ69wAvYK@sirena.co.uk drivers/net/ethernet/realtek/r8169_main.c 3cdeaef1754ab ("r8169: disable EEE on RTL8168h/8111h") 8a3c76523e449 ("r8169: add support for phylink") https://lore.kernel.org/ar5vAxEqS8tO8aVT@sirena.org.uk Adjacent changes: rust/kernel/net/netlink.rs 5e5916923759 ("rust: net: netlink: Migrate to zerocopy's IntoBytes") 0923198be4ae ("rust: net: netlink: validate attribute length before casting to `c_int`") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-01Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm fixes from Paolo Bonzini: "The most intrusive change is reverting a commit from 7.3-rc1 that made struct kvm a bit too large, and fixing the same issue otherwise. There are again a lot of selftests lines; the sheer number of commits is not small but I don't expect much more for 7.3 due to people travelling to Plumbers next week. ARM: - Take a reference on the last IRQ loaded into an LR to prevent it from being freed while running the guest (Marc Zyngier) - Ensure that the ITS MOVALL command only affects LPIs that were previously affined to the source redistributor (Marc Zyngier) - Fix + test for honoring the host's trap configuration when running non-protected VMs while KVM is in protected mode (Fuad Tabba) - Use the host stage-1 mapping granularity for VM_PFNMAP mappings at stage-2 (Mostafa Saleh) x86: Various bugfixes where the guest could do stupid things on purpose to cause problems in the host: - Failed VMRUNs can cause pending TLB flushes to be dropped, and in general some actions done through VMCB control fields have to be redone if VMRUN fails - Toggling MSR interceptions or eVMCS execution controls can cause the host to use a stale MSR permission bitmap - Bad page tables can cause a WARN. Also fix issues in last week's pull request (my fault, for changing email workflow and thus missing feedback sent to kvm@ but not LKML). Generic: - Take kvm_lock when creating vCPUs. For almost two decades everybody thought it was not done for some unspecified performance reasons, but in reality it was only done because kvm_lock was originally a spinlock. This is a better fix than 97d65b544f48 ("KVM: Check for duplicate vcpu_id as early as possible", from the 7.3 merge window), and does not waste 2K per VM, hence its inclusion here" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (29 commits) KVM: arm64: Use stage-1 leaf size for VM_PFNMAP KVM: arm64: selftests: Check a feature hidden in an ID register is UNDEF KVM: arm64: Use the host's HCR_EL2 for non-protected VMs in pKVM KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq KVM: arm64: vgic: Allow last_lr_irq to be NULL when LRs are not overflowing KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it KVM: selftests: Extend nested x2APIC test to validate using eVMCS for vmcs12 KVM: selftests: Extend nested x2APIC test to validate disabling x2APIC virt KVM: selftests: Verify that L0's TPR doesn't get clobbered KVM: selftests: Run the nested x2APIC with and without APICv being inhibited in L2 KVM: selftests: Add x2APIC MSR test for inhibiting APICv while nested KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted KVM: SVM: Sync guest's PERF_CNTR_GLOBAL_CTL from h/w only on successful VMRUN KVM: SVM: Don't mark ASID fields as dirty when setting control.tlb_ctl KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded ...
2026-10-01Merge tag 'kvmarm-fixes-7.3-2' of ↵Paolo Bonzini
https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.3, round #2 - Take a reference on the last IRQ loaded into an LR to prevent it from being freed while running the guest (Marc Zyngier) - Ensure that the ITS MOVALL command only affects LPIs that were previously affined to the source redistributor (Marc Zyngier) - Fix + test for honoring the host's trap configuration when running non-protected VMs while KVM is in protected mode (Fuad Tabba) - Use the host stage-1 mapping granularity for VM_PFNMAP mappings at stage-2 (Mostafa Saleh)
2026-10-01selftests/bpf: Add a test for objects stuck in free_by_rcu_ttraceAlexei Starovoitov
Delete all elements of BPF_F_NO_PREALLOC hash map in one batch. The first free_bulk() starts RCU tasks trace GP and the rest of the elements are freed while it's in flight. Wait for call_rcu_ttrace_in_progress to clear in bpf_mem_cache of every cpu and check that free_by_rcu_ttrace and waiting_for_gp_ttrace lists are empty. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20260930095920.601738-4-alexei.starovoitov@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-01selftests/bpf: Test packet range of pointers sharing an idAlexei Starovoitov
Add tests where two packet pointers share an id and tightening one pointer's umax from its var_off would put it less than their constant distance from the other's umax: with an index & 0x38 capped at 50, the base pointer keeps umax 50, so the pointer 8 bytes further on must keep umax 58, even though its known bits allow at most 56. These refused a valid program or accepted an out-of-bounds access before the fix: - check the advanced copy, load through the base: valid, was refused; - check the base, load the byte at base + 1 through a copy advanced by 8: was accepted; - check base + 4, load 4 bytes at base + 2 through base + 8: reads two bytes past the checked range, was accepted; - the same as the second with data_meta pointers checked against data: was accepted. These pass with and without the fix and cover nearby paths: - subtract an unknown scalar from a checked pointer and load below it (the range is kept across a new id); - reach a load through two paths whose checks cover 8 and 7 bytes after the loaded pointer; the second path must not be pruned by the first; - spill a copy of a pointer, check the pointer, fill the copy and load one byte past the checked range: the load is refused, and the copy has the range of the check. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20261001145255.855630-2-alexei.starovoitov@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-01bpf: Fix packet range of pointers sharing an idAlexei Starovoitov
Since commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers"), find_good_pkt_pointers() sets the range of all packet pointers sharing an id from the umax of the compared pointer, and check_packet_access() requires umax + off + size <= range. That assumes the umax of two such pointers differ by exactly their constant distance. reg_bounds_sync() breaks it when var_off tightens one umax and not the other: r4 &= 0x38 if r4 > 50 goto exit ; umax 50, var_off (0x0; 0x38) r5 = pkt + r4 ; umax 50 r6 = r5 r6 += 8 ; umax 56, not 58 Comparing r6 with pkt_end sets the range to 56, and the valid 8-byte load at r5 is rejected (50 + 8 > 56). Comparing r5 sets it to 50, and the out-of-bounds 1-byte load at r6 - 7, i.e. r5 + 1, is accepted (56 - 7 + 1 <= 50). Don't call reg_bounds_sync() on a packet pointer that keeps its id (a constant was added or subtracted) or its range (an unknown non-negative value was subtracted), so that var_off cannot tighten its umax. Only update the 32-bit bounds from var_off: reg_bounds_sanity_check() wants them constant when the lower half of var_off is, e.g. for pkt + 8. This relies on nothing else changing the 64-bit bounds of a packet pointer, which holds today. var_off of such a pointer is no longer narrowed by its bounds. Adjust three verifier_align expectations; the low bits, which the alignment checks use, don't change. veristat on the selftests shows no verdict changes and +0.8% insns in test_cls_redirect_subprogs. Fixes: 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers") Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20261001145255.855630-1-alexei.starovoitov@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-01selftests/rdma: Skip rxe_sent_rcvd_bytes when rdma_rxe is missingBjoern Doebel
On a kernel built without CONFIG_RDMA_RXE the test exits 1 instead of skipping: # modprobe: FATAL: Module rdma_rxe not found in directory ... not ok 467 selftests: rdma: rxe_sent_rcvd_bytes.sh # exit=1 Every other test in this directory probes with modinfo and exits $KSFT_SKIP. Apply the same guard, identical to the one in the otherwise near-identical rxe_socket_with_netns.sh. Fixes: c67bd973695c3 ("selftest/rxe: Add selftests for perf") Assisted-by: kiro:claude-opus-5 Signed-off-by: Bjoern Doebel <doebel@amazon.de> Link: https://patch.msgid.link/20260930135530.881281-1-doebel@amazon.de Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-01Merge tag 'net-7.3-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth, WiFi and netfilter. We are actively retargeting several non-urgent fixes towards next, but the traffic on the ML looks ever-increasing, and propagating the push-back towards subsystems is not immediate. No known outstanding regressions. Current release - regressions: - netfilter: nft_set_rbtree: skip transaction elements during GC Previous releases - regressions: - sched: cls_api: reclaim an empty proto on the error path - core: - fix checksum offsets in skb_splice_from_iter() - cap skb->queue_mapping when the tx queue is picked - page_pool: fix use-after-free in page_pool_recycle_ring_bulk() - wifi: - mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() - mac80211: drop oversized fragments to avoid extra_len overflow - netfilter: - flowtable: restore ieee80211 forward path - bluetooth: hci_conn: Lock parent access during enhanced SCO setup - eth: - bcmgenet: allocate RX buffers as page fragments - stmmac: fix rx Scatter-Gather support - octeontx2-pf: fix aura BPID assignment when CONFIG_DCB is enabled - gve: DQO: accept TSO packets with non-protocol gso_type bits - r8169: disable EEE on RTL8168h/8111h Previous releases - always broken: - tcp: refresh TS.Recent for accepted old ACKs - wifi: - ath11k: reset ar->num_stations on hardware start - cfg80211: fix RTS threshold setting for single-radio PHY - bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() - eth: bcmgenet: fix NULL dereference in set_coalesce before first open Misc: - Eric is retiring from google and updating his contact info" * tag 'net-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (96 commits) net: phy: aquantia: fix system interface type not updated in forced mode net: usb: qmi_wwan: add Rolling Wireless RN947R net: mvneta: clear XDP pfmemalloc flag between frames ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference r8169: disable EEE on RTL8168h/8111h octeontx2-pf: Fix RSS indirection table size sctp: check RCV_SHUTDOWN after the sendmsg connect wait net: sparx5: make ports inherit the switch base mac address type net: microchip: vcap: stop scanning after deleting key field netfilter: flowtable: restore ieee80211 forward path netfilter: flowtable: generalize pending status bit netfilter: bpf: reject invalid NAT manipulation types netfilter: nft_set_rbtree: skip transaction elements during GC ipvs: filter some flags received in the backup server ipvs: do not create invisible templates ipvs: bound LBLCR and LBLC cache growth ipvs: fix missing counter decrement in lblc netfilter: nft_flow_offload: drop flowtable reference on init error path selftests: net: check timestamp echo after an old ACK ...
2026-10-01selftests/filesystems: check that the nullfs root can't be reconfiguredChristian Brauner
Add a test for the root of an empty mount namespace: - fspick() of the root fails with EINVAL - mount(MS_REMOUNT) of the root fails with EINVAL - umount() of the root fails and doesn't remount it read-only Link: https://patch.msgid.link/20260930-work-mount-fixes-3-v1-12-be34c83956ae@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-01selftests/filesystems: check that a mount namespace file on top doesn't bury ↵Christian Brauner
a mount Add a test for moving a mount with a mount namespace file on top of it: - S, a bind mount of a file, with a newer mount namespace's file on top - A shared with a slave B that has Q on B/file - S moved onto A/file, its copy lands on B/file below Q B/file keeps reading Q and once Q is unmounted it reads the copy. Link: https://patch.msgid.link/20260930-work-mount-fixes-3-v1-9-be34c83956ae@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-01selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts coveredChristian Brauner
Add a test for open_tree(OPEN_TREE_NAMESPACE) from a user namespace that doesn't own the mount namespace it copies from: - a file covered by a private or an unbindable tmpfs mount - the non-recursive copy of the parent mount fails with EINVAL - the recursive copy keeps the file covered in the new mount namespace - the owner of the mount namespace keeps the bind mount semantics Link: https://patch.msgid.link/20260930-work-mount-fixes-3-v1-7-be34c83956ae@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-01selftests/filesystems: check that a recursive bind mount can't pin the ↵Christian Brauner
caller's mount namespace Add a test for a recursive bind mount of a namespace file in another mount namespace: - a bind mount of the network namespace file, held through a descriptor - the caller's own mount namespace file stacked on top of it there - the recursive bind mount through the descriptor fails with EINVAL - a plain bind mount of the file still works The copy would pin the namespace it is put in otherwise. Link: https://patch.msgid.link/20260930-work-mount-fixes-3-v1-5-be34c83956ae@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-01selftests/filesystems: check that a busy submount survives a synchronous umountChristian Brauner
Add a test for the shrinkable submounts of a synchronous umount: - P shared, P1 a slave that is shared in turn, P2 its peer - B on P/options with copies on P1 and P2, R on top of the copy in P2 - P with B moved below P1, R is the working directory - umount(P1) slides R to where the copy of B is looked up The umount fails with EBUSY and R stays mounted. Needs the tracefs automount below debugfs for the shrinkable mounts. Link: https://patch.msgid.link/20260930-work-mount-fixes-3-v1-3-be34c83956ae@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-01Merge 7.3-rc5 into char-misc-nextGreg Kroah-Hartman
Lots of subtrees are based on newer -rc versions, so sync up further on the development cycle so that they can be cleanly merged into here. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-09-30selftests: drv-net: Request larger zcrx buffersBjörn Töpel
The large-chunk test always requests two base pages. On interfaces with a large MTU, that may not exceed two maximum-sized frames. Request a power-of-two buffer larger than twice the MTU. This makes the existing rx_buf_len check and data-integrity traffic exercise the larger layout. Signed-off-by: Björn Töpel <bjorn@kernel.org> Tested-by: Breno Leitao <leitao@debian.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260925104417.2325213-6-bjorn@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-30selftests/sched_ext: Test scx_bpf_cgroup_nr_cpus()Andrea Righi
Verify that scx_bpf_cgroup_nr_cpus() reports the number of CPUs in a cgroup's effective cpuset. Create a cgroup-v2 subtree where a child owns a cpuset and a leaf inherits it. Sample the kfunc from a BPF_PROG_TYPE_SYSCALL program and compare it with cpuset.cpus.effective for the root, the cpuset owner and the inheriting leaf, without a scheduler attached. Attach a scheduler and verify the value observed from ops.cgroup_init(). Then restrict the child's cpuset to a non-contiguous and a single-CPU set, and finally disable cpuset below the parent so that both cgroups inherit the parent's cpuset. A disabled cpuset css stays attached to its cgroup until it is asynchronously offlined, so poll briefly for the last step. Skip the test when the required controllers or two CPUs are unavailable. Assisted-by: LLM Signed-off-by: Andrea Righi <arighi@nvidia.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-09-30selftests: cgroup: Preserve command arguments in with_stress.shRen Tamura
with_stress.sh invokes the requested command through unquoted $*. This subjects the arguments to word splitting and pathname expansion: arguments containing whitespace are split, empty arguments disappear, and literal wildcard characters can expand to filenames. Invoke the command through "$@" so that the command name and each argument are passed as supplied by the caller. Assisted-by: LLM Signed-off-by: Ren Tamura <ren.tamura.oss@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-09-30selftests: cgroup: Enable the cpu controller in test_cpuRen Tamura
test_cpu uses cg_read_strstr() to check for "cpu" in the root cgroup's cgroup.subtree_control. The substring also matches "cpuset", so a hierarchy with only cpuset enabled skips writing "+cpu" during setup. The tests then run without the required controller enabled and report failures. When cpu is unavailable in that hierarchy, the suite also reports failures instead of skipping. Always write "+cpu" during setup and skip if the write fails. Enabling a controller that is already enabled is a no-op, so a separate presence check is unnecessary. This requires write access to cgroup.subtree_control even when cpu is already enabled. Assisted-by: LLM Signed-off-by: Ren Tamura <ren.tamura.oss@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-09-30KVM: selftests: Spell out UCALL in nested TSC scaling test's enumsSean Christopherson
Explicitly spell out UCALL instead of prefixing only U in the nested TSC scaling test's ucall commands, as it's all too easy to think USLEEP means "do usleep()", when it actually means "do sleep() in userspace". Opportunistically name the enum and take an enum instead of a bare integer for the to-be-checked level, to make it more obvious that the fact that the level values happen to correspond to '1' and '2' for the nesting level is largely coincidental (or perhaps it was intentional, but it's not a hard requirement for the test). Link: https://patch.msgid.link/20260930173635.3362655-22-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Use GUEST_SYNC2() in nested TSC scaling testSean Christopherson
Use GUEST_SYNC2() instead of open coding equivalent functionality using raw ucall() invocations in the nested TSC scaling test. No functional change intended. Link: https://patch.msgid.link/20260930173635.3362655-21-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Randomize L2's TSC offset in the nested TSC scaling testSean Christopherson
Randomize L2's TSC offset in the nested TSC scaling test, not because it's all that interesting, but because hardcoding a copmletely arbitrary value is all kinds of silly. Link: https://patch.msgid.link/20260930173635.3362655-20-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Test non-zero TSC offset on SVM in nested TSC scaling testSean Christopherson
Set L2's TSC offset for SVM as well as VMX in the nested TSC scaling test. Odds are good skipping SVM was pure oversight. Fixes: e6bcdd212238 ("KVM: selftests: Extend vmx_nested_tsc_scaling_test to cover SVM") Link: https://patch.msgid.link/20260930173635.3362655-19-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Verify that KVM saturates L2 TSC freq on {under,over}flowSean Christopherson
Extend the nested TSC scaling test to validate the extreme ends of what hardware supports, i.e. validate that KVM allows L1 to scale L2's virtual TSC frequency up/down to the architectural maximum/minimum, from L1's perspective, and that KVM saturates L2's effective frequency when L2's frequency can't be virtualized by hardware (which is possible when stacking multipliers/ratios across L1 and L2). Link: https://patch.msgid.link/20260930173635.3362655-18-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Test L1 "up" and L2 "down" in nested TSC scaling testSean Christopherson
Now that the guts of the nested TSC scaling test support scaling L2 down, validate all four combinations of scaling up/down L1 and L2. Ideally, the test would also validate integer+fractional scale up scenarios, but prioritize keeping the test and math somewhat understandable. Opportunistically drop the stale file comment about the test's name. Link: https://patch.msgid.link/20260930173635.3362655-17-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Sanity check KVM's default TSC freq in nested TSC scaling testSean Christopherson
Explicitly verify that both L1 and L2 can run at KVM's default TSC frequency reported via KVM_GET_TSC_KHZ, e.g. that KVM_SET_TSC_KHZ can take in what KVM_GET_TSC_KHZ spits out. Link: https://patch.msgid.link/20260930173635.3362655-16-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Explicitly pass TSC frequencies to guts of TSC scaling testSean Christopherson
Explicitly pass the L1 and L2 TSC frequencies, along with the L2 multiplier, to the main test routine in the nested TSC scaling test. This will allow testing both "scale up" and "scale down" scenarios, and that KVM saturates L2's frequency if it's scale up/down beyond what hardware can support, in which case the expected frequency will not exactly match the L2 multiplier. Link: https://patch.msgid.link/20260930173635.3362655-15-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Use KVM's reported TSC KHz as L0's frequency (sanity checked)Sean Christopherson
Use KVM's reported default TSC frequency as L0's frequency instead of calibrating L0's frequency using RDTSC. Trying to calibrate the frequency in userspace is all but guaranteed to be wildly inaccurate, e.g. due to interrupts, preemption, etc, and no known CPU supports TSC scaling without also having a constant TSC. I.e. there's no need to calibrate the current frequency, as it should also be the same as KVM's default frequency. Opportunistically sanity check KVM's reported frequency against what is observed via RDTSC, e.g. so that KVM_GET_TSC_KHZ or platform issues show up much earlier in the test, before VMs get involved. Link: https://patch.msgid.link/20260930173635.3362655-14-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Allow +/- 1 tolerance if expected TSC frequency is <100Sean Christopherson
Massage the nested TSC scaling test's checker to allow for validating an expected TSC frequency of 1Hz, which is achievable for L2 since L1 can use a completely arbitrary fractional ratio. To do so, set the minimum tolerance to 1, and make the thresholds inclusive, i.e. for an expected frequency of 1, allow the actual frequency to be in the range of [0,2]. Because scaling L2's frequency down to a single Hz makes the virtual TSC run soooo comically slow, and because all of the math is done with basic integer arithmetic, it's very easy for the test to observe what appears to be a frequency of 0. Link: https://patch.msgid.link/20260930173635.3362655-13-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Print out the failing L{0,1,2} level in nested TSC scaling testSean Christopherson
Print out which one of L0, L1, or L2 TSC frequency checks failed if the nested TSC scaling test detects an out-of-bounds frequency. Triaging test failures without the level information is unnecessarily painful. Link: https://patch.msgid.link/20260930173635.3362655-12-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Track L2 multiplier, not scale-up factor, in nested TSC testSean Christopherson
Track L2's multiplier, not just the non-fractional scale-up factor, so that the nested TSC scaling test can also validate scaling L2's frequency *down*. No functional change intended. Link: https://patch.msgid.link/20260930173635.3362655-11-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Extract guts of nested TSC scaling test to helper functionSean Christopherson
Extract the guts of the nested TSC scaling test to a separate helper in anticipation of extending the test beyond its single "scale L1 up, L2 down" testcase. No functional change intended. Link: https://patch.msgid.link/20260930173635.3362655-10-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Rename TSC freq checkers in nested TSC scaling testSean Christopherson
Rename the nested TSC scaling test's helpers to clarify which one is used by guest code and which one is used by host code, and to make it more obvious that the host version *checks* the result and asserts on errors. Contrary to what "compare" suggests, the helper doesn't return whether or not the actual vs. expected values match. Link: https://patch.msgid.link/20260930173635.3362655-9-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Randomize L2's scale factor in nested TSC scaling testSean Christopherson
Randomize L2's scale factor in the nested TSC scaling test; the test's comment that "using a global variable does not work" just means the author didn't know how to use sync_global_to_guest(). Link: https://patch.msgid.link/20260930173635.3362655-8-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Drop unnecessary use of PRIu64 in nested TSC scaling testSean Christopherson
Use a plain "lu" instead of "PRIu64" to print u64s in the nested TSC scaling test, as KVM selftests are 64-bit only (and supporting 32-bit x86 selftest would be an absurdly large lift, for something absolutely no one cares about). Link: https://patch.msgid.link/20260930173635.3362655-7-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Drop redundant VMWRITE of TSC_MULTIPLIER_HIGHSean Christopherson
Drop a redundant VMWRITE of TSC_MULTIPLIER_HIGH in the nested TSC scaling test. KVM selftests are 64-bit only, i.e. the full 64-bit multiplier is always written by setting TSC_MULTIPLIER. Link: https://patch.msgid.link/20260930173635.3362655-6-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: selftests: Use KVM's pRNG to randomize L1's TSC ratio in TSC scaling testSean Christopherson
Use KVM's pRNG to randomize L1's TSC ratio in the nested TSC scaling test, so that reproducing a failure with a specific seed is slightly easier. Link: https://patch.msgid.link/20260930173635.3362655-5-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>