| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross:
"A bunch of isolated fixes of Xen related drivers"
* tag 'for-linus-7.4a-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
Xen/gnttab: improve error handling in gnttab_dma_{alloc,free}_pages()
xen: don't allow gnttab_dma_[alloc|free]_pages() in PV guest
xen/pvcalls: destroy the per-socket workqueue on release
xen/pvcalls: unwind pvcalls_new_active_socket() step by step
xen/privcmd: fix double free when an irqfd is shut down twice
xen/gntdev: fix deadlock between map ioctl and mmap
xen/platform-pci: Disable device before releasing PCI regions
xen/grant-table: annotate on-stack work in gnttab_unmap_refs_sync()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:
- Read tracking-mode voltage fault limits dynamically in the mp2975
PMBus driver instead of caching probe-time snapshots, avoiding false
over-voltage alarms when CPU voltage changes at runtime.
- Fix SCMI sensor probe by enabling supported sensors via firmware IDs
before exposing channels and checking channel config allocations.
- Fix runtime PM enable and reference count imbalances during probe and
teardown in the gpio-fan driver.
- Fix max31760 fan controller initialization and reporting, including
leaving standby at probe, initial 0 RPM reporting, and swapped
temperature limit registers.
- Assorted minor sensor reading, interval clamping, and register
handling fixes in other drivers.
* tag 'hwmon-for-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
hwmon: (aht10) Fix update_interval overflow on 64-bit
hwmon: (scmi) Configure sensors before exposing channels
hwmon: (scmi) Check channel config allocation
hwmon: (nct6775) Handle dual use registers
hwmon: (scmi) Enable temperature sensors using their sensor IDs
hwmon: (pmbus/mp2975) Get vout fault limits dynamically
hwmon: (sy7636a) fix negative temperatures
hwmon: (max31760) Report 0 RPM before the first fan speed measurement
hwmon: (max31760) Leave standby mode at probe
hwmon: (max31760) Fix the local temperature limit registers
hwmon: (gpio-fan) Fix runtime PM imbalance in probe and teardown
|
|
Pull drm fixes from Dave Airlie:
"Weekly drm fixes, this is a bit bigger as we missed xe last week due
to a tree screw up, so it's mostly xe and amdgpu, then the usual
scattering of fixes across drivers.
sched:
- Ensure stopped entity cannot be re-added to the run-queue
bridge:
- ssd2825: Fix panel enable sequence
- sii902x: validate I2S data lane values
display:
- hdmi: Fixes to SCDC
i915:
- Fix for PTL GitLab #9196: eDP-2 on DDI B ends up in a state where
any enable fails
- PSR fixes
amdgpu:
- DCN 6 DML2 fix
- VCE fixes
- GC 11.0.2 fix
- SMU 15 fix
- Error handling fixes
- Partition fix
- IMU firmware clean up fix
- TLB fence handling fix
amdkfd:
- SVM fixes
- CRIU fixes
xe:
- select configfs
- Sync Wa_16023105232 in xe_was to match OOB rule
- Program LMTT directory pointer from each GT init path
- Demote uncorrectable local error log on CRI
- Apply tile workarounds after PCODE init
- VRAM offlining fixes
- ras: Fix sysctrl and drm-ras discrepancy
- pat: Return error from xe_pat_init_early() on unknown
- Prevent VF memory IRQ from accessing a torn-down engine
- guc: Protect timeout handling from device unplug
- gt: Disable GT reset worker before engine teardown
- Various hwmon fixes
- tuning: Restrict Anyhit NULL-query tuning to render engines
- gsc: Fix NVL-S GSC compatibility number
- Don't abort the shrinker walk on -EBUSY
- Mark xe_vma_ops_alloc() noinline for error injection
- lrc: Restore CTX_CS_INDIRECT_CTX_OFFSET programming for pre-Xe2
- Fix build with DRM_XE=y and CONFIGFS_FS=m
- madvise: use already clamped pat_index
- Various wedging fixes
- Rebind BOs evicted before the first LR queue
- Toggle the D3Cold enable flag at runtime resume
- Access GT MMIO after pcode init
- xe_late_bind_fw: Fix firmware leak on missing manifest entry
- svm: Preserve default PAT index when resetting VMA attributes
- Unwrap sync fences before adding them as job dependencies
- Schedule disable G2H fixes
gud:
- Avoid divide error in gud_stats_debugfs
meson:
- load ENCL gamma table while ENCL is disabled
nouveau:
- disp: Set atomic functions in struct drm_mode_config_funcs
- gsp: Handle only IRQs routed to host
panfrost:
- Fixes to perfcnt
vc4:
- Fix firmware reference leak
- Hold runtime PM reference while allocating the binner BO
- Rebuild V3D interrupt mask on every power transition
- Re-enable the V3D interrupt after a GPU reset"
* tag 'drm-fixes-2026-11-14' of https://gitlab.freedesktop.org/drm/kernel: (81 commits)
drm/vc4: Re-enable the V3D interrupt after a GPU reset
drm/vc4: Rebuild the V3D interrupt mask on every power transition
drm/vc4: Hold a runtime PM reference while allocating the binner BO
drm: xe: select configfs
drm/xe: Sync Wa_16023105232 in xe_was to match OOB rule
drm/xe/pf: Program LMTT directory pointer from each GT's init path
drm/xe/guc: Demote uncorrectable local error log on CRI
drm/xe/pm: Apply tile workarounds after PCODE initialization
drm/gud: avoid divide error in gud_stats_debugfs
drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (attempt 2)
drm/amdgpu: fix TLB invalidation fence handling v4
drm/amdkfd: check CRIU SVM priv data bounds before allocating
drm/amdgpu: release the IMU firmware with the other GFX microcode
drm/amdgpu: Allow cancelling a requested NPS mode
drm/amdgpu: fix the error handling of amdgpu_vm_init_entities()
drm/amdgpu: use supported SMU clock messages on SMU 15.0.0
drm/amdkfd: skip GPUs without a VM when checkpointing the BO mappings
drm/amdkfd: Acquire cwsr buffer during CRIU resume
drm/amdkfd: Acquire buffers in CRIU queue restore (again)
drm/amdgpu: Fix VCE buffer size check for DPB and input surface
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull watchdog fixes from Guenter Roeck:
- gunyah_wdt: Re-enable the watchdog on resume
- mediatek: Register reset controller before watchdog device
- meson_gxbb_wdt: fix suspend/resume handling of HW_RUNNING watchdog
- mtk_wdt: Stop a running watchdog over system sleep even if not opened
- npcm: fix clock prepare leak when setting timeout on a running
watchdog
- omap: Fix early_enable handling in omap_wdt_probe()
- orion_wdt: load the pretimeout counter on Armada 370/XP start
- rzv2h: Drop runtime PM handling from WDTDCR init, and use
pm_runtime_put_sync()
- sbsa_gwdt: Limit the MediaTek WS0 race workaround to revision 0
- sc1200wdt: add missing MODULE_DEVICE_TABLE()
- sp5100_tco: Use release_mem_region() for EFCH MMIO resource
* tag 'watchdog-fixes-for-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
watchdog: rzv2h: Drop runtime PM handling from WDTDCR init
watchdog: rzv2h: Use pm_runtime_put_sync()
watchdog: omap: Fix early_enable handling in omap_wdt_probe()
watchdog: npcm: fix clock prepare leak when setting timeout on a running watchdog
watchdog: gunyah_wdt: Re-enable the watchdog on resume
watchdog: mediatek: Register reset controller before watchdog device
watchdog: sp5100_tco: Use release_mem_region() for EFCH MMIO resource
watchdog: sbsa_gwdt: Limit the MediaTek WS0 race workaround to revision 0
watchdog: meson_gxbb_wdt: fix suspend/resume handling of HW_RUNNING watchdog
watchdog: mtk_wdt: Stop a running watchdog over system sleep even if not opened
watchdog: orion_wdt: load the pretimeout counter on Armada 370/XP start
watchdog: sc1200wdt: add missing MODULE_DEVICE_TABLE()
|
|
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes
Short summary of fixes pull:
bridge:
- ssd2825: Fix panel enable sequence
- sii902x: validate I2S data lane values
display:
- hdmi: Fixes to SCDC
gud:
- Avoid divide error in gud_stats_debugfs
meson:
- load ENCL gamma table while ENCL is disabled
nouveau:
- disp: Set atomic functions in struct drm_mode_config_funcs
- gsp: Handle only IRQs routed to host
panfrost:
- Fixes to perfcnt
sched:
- Ensure stopped entity cannot be re-added to the run-queue
vc4:
- Fix firmware reference leak
- Hold runtime PM reference while allocating the binner BO
- Rebuild V3D interrupt mask on every power transition
- Re-enable the V3D interrupt after a GPU reset
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20261113074438.GA14592@linux.fritz.box
|
|
On 64-bit, update_interval writes are clamped to LONG_MAX ms, but
ms_to_ktime() overflows above 9223372036854 ms and the interval wraps.
LONG_MAX becomes -1 ms, so every read starts a new measurement and
update_interval reads back -1.
Clamp to INT_MAX like sht4x, so the limit is the same on all platforms.
Fixes: 8c78f0dee437 ("hwmon: Add AHT10 Temperature and Humidity Sensor Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Rupesh Majhi <zoone.rupert@gmail.com>
Link: https://patch.msgid.link/20261108172651.220121-1-zoone.rupert@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
SCMI hwmon enables sensors with SENSOR_CONFIG_SET, but only after
registering the hwmon device and only for temperature sensors. This
leaves other sensor classes disabled on firmware that defaults sensors
to off, and exposes temperature channels before they are ready.
Configure each supported sensor while building the channel list, before
registering the hwmon device. Leave failed sensors out of the list so
their channels remain hidden, while continuing with other sensors.
Cc: Marek Vasut <marek.vasut@mailbox.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-4bdf9a68-22d5-4305-b684-f11fe6d1dbcc
Fixes: 72804d1631b3 ("hwmon: (scmi) Enable sensors to assure they can be read")
Cc: stable@vger.kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Link: https://patch.msgid.link/20261109151927.1672956-2-sudeep.holla@kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
scmi_hwmon_add_chan_info() can fail to allocate a channel's config
array. Ignoring that error leaves a channel with a NULL config pointer
in the hwmon chip info, which hwmon dereferences while registering the
device.
Check the helper's return value and abort probe on failure.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-d10ced6b-a6f0-403b-9619-f5a6573f9e7f
Fixes: b23688aefb8b ("hwmon: add support for sensors exported via ARM SCMI")
Cc: stable@vger.kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Link: https://patch.msgid.link/20261109151927.1672956-1-sudeep.holla@kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
The REG_TARGET register has different meaning, depending on if pwm is in
thermal_cruise or speed_cruise.
This means we can't assume it's always word sized, so we need to handle
it differently depending on which mode we're in.
The code already does this, but the register was configured as word
sized for the speed_cruise mode, which would do the wrong thing in
thermal_cruise mode.
Fixes: 6c009501ff20 ("hwmon: (nct6775) Add support for NCT6102D/6106D")
Fixes: 29c7cb485b32 ("hwmon: (nct6775) Integrate new model nct6116")
Fixes: 437b3c2a4bdc ("hwmon: (nct6775) Add support for NCT6126D")
Cc: stable@vger.kernel.org
Signed-off-by: Anton Lundin <glance@ac2.se>
Link: https://patch.msgid.link/20261109082511.851377-2-glance@ac2.se
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
scmi_hwmon_probe() groups sensors by hwmon type, so the index in
scmi_sensors->info[hwmon_temp] is not necessarily the SCMI sensor ID.
Passing that index to config_set() targets a different sensor if the
platform exposes non-temperature sensors ahead of temperature sensors.
The intended temperature sensor can remain disabled, causing subsequent
readings to fail. If configuring the wrong sensor fails, thermal
registration of the intended sensor is also skipped.
Use the firmware sensor ID, as the read and thermal registration paths
already do, so temperature sensors are enabled correctly.
The patch was reviewed and the commit message expanded with OpenCode
AI assistance.
Fixes: 72804d1631b3 ("hwmon: (scmi) Enable sensors to assure they can be read")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org>
Link: https://patch.msgid.link/AED18609B941BCFD+20261109082854.3739085-1-raoxu@uniontech.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
The over- and under-voltage fault limits of the tracking mode are
relative to the voltage reference, which follows the VID/AVS requests
issued to the device and therefore changes at runtime.
The driver reads the voltage reference once during probe and derives the
limits from that snapshot, which the PMBus core caches in addition. As a
result in2_crit and in2_lcrit reflect the operating point at probe, rather
than the thresholds the device enforces. On systems where the device
supplies the CPU core voltage, in2_crit was reported anywhere between
1.15V and 1.70V across identical systems, causing false over-voltage
reports once the CPU voltage exceeded the value latched at probe.
Read the voltage reference and the over-voltage offset selector whenever
a limit is requested, and mark both limits with pmbus_set_update(), so
that the core does not cache them. The voltage reference is available on
page 3 only. Let the core change the page, so that the page it caches
matches the device, except for a single rail configuration, for which the
core does not issue PAGE commands, and the page is changed directly.
With the selector read at runtime, a device configured with an
unsupported selector no longer fails to probe. The OVP1 threshold, which
does not depend on the selector, is reported for it instead, with a
warning.
Clamp the under-voltage limit to zero, since the offset can exceed a low
voltage reference, while a negative value would be reported as a read
error.
Fixes: 2c6fcbb21149 ("hwmon: (pmbus) Add support for MPS Multi-phase mp2975 controller")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Radensky <fradensky@nvidia.com>
Reviewed-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://patch.msgid.link/20261105193200.1570996-1-fradensky@nvidia.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
The thermistor readout is a signed 8-bit value in degrees Celsius.
Fixes: de34a4053250 ("hwmon: sy7636a: Add temperature driver for sy7636a")
Cc: stable@vger.kernel.org
Signed-off-by: Pablo Mazzini <pmazzini@gmail.com>
Link: https://patch.msgid.link/20261108093602.329554-3-pmazzini@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- ublk fixes: don't publish a new device in the idr until it's fully
set up, and don't hold ublk_ctl_mutex across device removal, as a
stuck filesystem on one device otherwise blocked ADD_DEV and DEL_DEV
for every other ublk device.
- s390/dasd fixes: re-initialize the RCD buffer magic before every
request start, fix a wrong free and refcount leak in the check_tcw
error path, don't trust the userspace-supplied result field in the
format check, and a typo fix.
* tag 'block-7.4-20261112' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
s390/dasd: Don't trust userspace-supplied result field in format check
s390/dasd: Fix wrong free and refcount leak in build_check_tcw error path
s390/dasd: Re-initialize RCD buffer with "V1.0" before every start
s390/dasd: Fix typo 'immediatly' -> 'immediately'
ublk: don't take ublk_ctl_mutex in DEL_DEV
ublk: publish a new device by its id only once it is set up
|
|
Both decrease-reservation and populate-physmap can succeed partially. For
the former this may be pretty unlikely, but clearly the latter can hit
both out-of-memory conditions in the hypervisor or denial because of the
allocation exceeding the domain's allowance (there's no interaction with
the balloon driver here either).
In gnttab_dma_free_pages() we simply can't give back to the system what
hasn't been re-filled with backing memory. For gnttab_dma_alloc_pages()
both parts of the overall region need dealing with differently.
While no present caller of gnttab_dma_free_pages() checks its return
value, also don't use -EFAULT there: It really is an out-of-memory
condition. (In gnttab_dma_alloc_pages() -EFAULT doesn't look quite right
either, but I couldn't think of a clearly better error code there.)
Fixes: 9bdc7304f536 ("xen/grant-table: Allow allocating buffers suitable for DMA")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20261110095605.369848-3-jgross@suse.com>
|
|
Today gnttab_dma_alloc_pages() or gnttab_dma_free_pages are never
called when running as a PV guest, but this holds for in-tree callers
only.
Bail out early when being called in PV mode in order to ensure no out
of tree module or future use cases are violating this assumption.
This enables to safely remove PV-only code from both functions.
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20261110095605.369848-2-jgross@suse.com>
|
|
https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes
Driver Changes:
- select configfs (Arnd)
- Sync Wa_16023105232 in xe_was to match OOB rule (Gustavo)
- Program LMTT directory pointer from each GT init path (Satya)
- Demote uncorrectable local error log on CRI (Varun)
- Apply tile workarounds after PCODE init (Daniel)
- VRAM offlining fixes (Tejas)
- ras: Fix sysctrl and drm-ras discrepancy (Roper)
- pat: Return error from xe_pat_init_early() on unknown (Roper)
- Prevent VF memory IRQ from accessing a torn-down engine (Piotr)
- guc: Protect timeout handling from device unplug (Satya)
- gt: Disable GT reset worker before engine teardown (Satya)
- Various hwmon fixes (Karthik)
- tuning: Restrict Anyhit NULL-query tuning to render engines (Nitin)
- gsc: Fix NVL-S GSC compatibility number (Daniele)
- Don't abort the shrinker walk on -EBUSY (Thomas)
- Mark xe_vma_ops_alloc() noinline for error injection (Shuicheng)
- lrc: Restore CTX_CS_INDIRECT_CTX_OFFSET programming for pre-Xe2 (Helen)
- Fix build with DRM_XE=y and CONFIGFS_FS=m (Rodrigo)
- madvise: use already clamped pat_index (Auld)
- Various wedging fixes (Raag)
- Rebind BOs evicted before the first LR queue (Arvind)
- Toggle the D3Cold enable flag at runtime resume (Vinay)
- Access GT MMIO after pcode init (Vinay)
- xe_late_bind_fw: Fix firmware leak on missing manifest entry (Badal)
- svm: Preserve default PAT index when resetting VMA attributes (Arvind)
- Unwrap sync fences before adding them as job dependencies (Junjia)
- Schedule disable G2H fixes (Jagmeet)
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/avZ4bHmL2NTc4W8a@gsse-cloud1.jf.intel.com
|
|
https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes
amd-drm-fixes-7.4-2026-11-12:
amdgpu:
- DCN 6 DML2 fix
- VCE fixes
- GC 11.0.2 fix
- SMU 15 fix
- Error handling fixes
- Partition fix
- IMU firmware clean up fix
- TLB fence handling fix
amdkfd:
- SVM fixes
- CRIU fixes
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20261112163539.1265175-1-alexander.deucher@amd.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from netfilter, wireless and bluetooth.
Previous releases - regressions:
- tcp: rate limit receive queue collapsing
- raw: fix ICMP unreachable sent when receive queue is full
- eth: bnxt_en: take RTNL before netif_close() when aborting FW reset
Previous releases - always broken:
- tcp:
- bound snd_cwnd_clamp to TCP_MAX_SND_CWND
- number of fixes for TCP Fast Open
- gro:
- invalidate frag0 after a pull
- avoid parsing headers from shared fragments
- cipso: stop modifying live ip_options_rcu
- udp: do not use a cross-family sk_rx_dst in early demux
- fou: gue: check IP version of held packets for direct IP
encapsulation
- skbuff: preserve fclone lifetime when freeing stolen heads
- eth:
- mlx5e:
- fix crashes on queue stats access to queues without stats
- SHAMPO, disable end padding when relaxed ordering is
- ena: keep the RX buffer mapped if skb allocation fails"
* tag 'net-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (227 commits)
selftests: net: add a test for NSH GSO
nsh: limit recursion in nsh_gso_segment()
selftests: tls: Cover the cap on consecutive empty records
selftests: tls: Extend coverage for zero-length records
selftests: tls: Skip the zero_len tests when TLS is unavailable
tls: Consume empty data records in tls_sw_splice_read()
tls: Break the connection after a burst of empty data records
net: phy: c45: select BASE-T1 type for the forced speed
net/mlx5e: Fix false WARN_ON_ONCE in flow steering cleanup on RX init failure
net/mlx5e: IPsec, don't match upper proto selectors in crypto offload TX
tcp: fix request_sock use-after-free during Fast Open accept()
net: usb: cdc_ncm: don't underflow the NDP room check
net: netns: fix INT_MAX nsid cleanup
amt: use ipv6_hdr() in amt_mldv1_leave_handler()
af_unix: Inherit SO_INQ in unix_stream_connect()
tcp: Pass req->rsk_listener to inet_csk_reqsk_queue_drop() in tcp_check_req().
mailmap: add entries for Hangbin Liu
net: virtio: validate outer protocol of UDP tunnel GSO packets
tun: clear stale skb->protocol of NAPI frags skbs
net: virtio: fix UDP tunnel GSO header of VLAN tagged packets
...
|
|
Commit 25108a834e14 ("net: phy: c45: add support for 1000BASE-T1 forced
setup") made genphy_c45_pma_setup_forced() write the type selection
field (bits 3:0) of the BASE-T1 PMA/PMD control register (1.2100) on
every forced setup: 1000BASE-T1 for SPEED_1000, and 0 for everything
else. 0 selects 100BASE-T1, so forcing a 10BASE-T1L PHY to 10 Mbit/s
now also switches its PMA to 100BASE-T1, a mode it does not implement.
Seen on an ADIN1110 (internal ADIN1100 PHY): after
ethtool -s ethX autoneg off speed 10 master-slave forced-master
1.2100 reads 0xc000 instead of the 0xc002. Since the field is not
restored by re-enabling autoneg, the PHY keeps the wrong type until
the next forced setup or reset.
Add a helper that returns the type selection value for the forced speed
and the supported link modes: 100BASE-T1, 1000BASE-T1, and 10BASE-T1L or
10BASE-T1S for SPEED_10 depending on the supported 10 Mbit/s modes. Fail
with -EINVAL when no type matches instead of writing 100BASE-T1. This
also applies to forced 2.5G, 5G and 10G on BASE-T1 capable PHYs, for
which there are no link modes yet.
The field is called "type selection" in IEEE 802.3-2022 (45.2.1.214,
Table 45-178). Keep the old STRAP names as aliases.
Tested on EVAL-ADIN1110EBZ: with this change, forcing 10 Mbit/s writes
1.2100 = 0xc002 (10BASE-T1L) instead of the invalid 0xc000.
Fixes: 25108a834e14 ("net: phy: c45: add support for 1000BASE-T1 forced setup")
Signed-off-by: Iustin Stolniceanu <iustin.stolniceanu@analog.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20261111100053.345196-1-iustin.stolniceanu@analog.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
mlx5e_attach_netdev() sets rx_mode_active before calling init_rx(), so
any init_rx() failure after mlx5e_create_flow_steering() has succeeded
makes mlx5e_destroy_flow_steering() trip
WARN_ON_ONCE(fs->rx_mode_active) in mlx5e_del_vlan_rules().
Hit in internal regression testing, so kthread creation failed
with -EINTR:
WARNING: CPU: 3 PID: 170 at drivers/net/ethernet/mellanox/mlx5/core/en_fs.c:564 mlx5e_del_vlan_rules+0x295/0x2b0 [mlx5_core]
mlx5e_destroy_flow_steering+0x34/0xc0 [mlx5_core]
mlx5e_init_nic_rx+0x137/0x200 [mlx5_core]
mlx5e_attach_netdev+0x105/0x360 [mlx5_core]
Fix it by creating NIC flow steering with rx_mode_active cleared and
setting it only after profile->init_rx() succeeds. This also lets the
internal error paths of mlx5e_create_flow_steering() destroy partially
created steering without warning. The flag is set in
mlx5e_attach_netdev() rather than mlx5e_init_nic_rx() so that non-NIC
profiles, such as representors, also get it set after a detach/attach
cycle.
Fixes: 8c7353b6f716 ("net/mlx5e: Fix VLAN cleanup flow")
Signed-off-by: Alexei Lazar <alazar@nvidia.com>
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Shahar Shitrit <shshitrit@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20261111082142.3131746-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The mentioned commit introduced support for upper protocol selectors
(protocol & ports) to mlx5 IPsec offload. In crypto offload mode this
causes offloaded TX SAs to stop matching traffic.
In tx_add_rule(), setup_fte_upper_proto_match() is called for all
offload types and programs a match on the upper protocol (TCP/UDP) and
ports. For crypto offload, setup_fte_esp() is then called and sets
ip_protocol to ESP. The resulting rule requires both ESP as the IP
protocol and TCP/UDP ports, which no packet can satisfy, so TX crypto
offload silently stops working for such SAs.
In crypto offload mode the stack builds the ESP packet and the HW only
encrypts it, so the SA rule should only match on the SPI. Move the
setup_fte_upper_proto_match() call under the XFRM_DEV_OFFLOAD_PACKET
case, where the rule matches the plaintext packet and upper protocol
selectors apply.
The other three callers are unaffected: rx_add_rule_sa_selector() is
already only invoked for packet offload, and tx_add_policy() /
rx_add_policy() are only reachable in packet offload mode, since xfrm
policy offload is exclusively of type XFRM_DEV_OFFLOAD_PACKET.
Fixes: a7385187a386 ("net/mlx5e: IPsec, support upper protocol selector field offload")
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20261111081337.3129580-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
cdc_ncm_ndp16() and cdc_ncm_ndp32() verify that the new NDP and the
datagram fit into the NTB with an unsigned subtraction:
if ((ctx->tx_curr_size - skb->len - reserve) < ctx->max_ndp_size)
return NULL;
Nothing guarantees that skb->len plus the reserve stays below
tx_curr_size, and when it does not the subtraction wraps around to a
huge value, the check passes, and the skb_put_zero() of max_ndp_size
bytes that follows overruns the NTB:
skbuff: skb_over_panic: text:ffff80000db33558 len:428 put:172
head:ffff0000c2c66100 tail:0x1ac end:0x140
kernel BUG at net/core/skbuff.c:200
skb_put_zero include/linux/skbuff.h:2595 [inline]
cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1132 [inline]
cdc_ncm_fill_tx_frame+0xdf0/0x30e0 drivers/net/usb/cdc_ncm.c:1309
Here tx_curr_size is 0x140 = 320, skb->len is already 256 and the
skb_put_zero() wants another 172 bytes.
Two device controlled settings make this reachable:
- dwNtbOutMaxSize = 320 caps tx_max at 320. The lower bound computed
in cdc_ncm_check_tx_max() is max_datagram_size + max_ndp_size + the
NTH header, but cdc_ncm_setup() clamps tx_max before
cdc_ncm_set_dgram_size() runs, so max_datagram_size is still 0 and
the bound is only max_ndp_size + the NTH header. It does not
reserve room for one datagram plus one NDP.
- wNdpOutAlignment = 256 is accepted by cdc_ncm_fix_modulus() as long
as it is smaller than tx_max, and cdc_ncm_align_tail() then pads the
12 byte NTH header up to 256 bytes right before this check.
An NDP can also be added to an NTB that already holds datagrams through
cdc_mbim_tx_fixup(), which uses a different signature per MBIM session.
On plain cdc_ncm the chain lookup in cdc_ncm_ndp16() returns the
existing NDP for the single signature, so there the create path is
normally reached for the first datagram of each NTB.
Rewrite the test as an addition, which cannot underflow and gives the
same answer whenever the original subtraction did not wrap.
Fixes: c78b7c586657 ("net: cdc_ncm: refactoring for tx multiplexing")
Fixes: 0fa81b304a79 ("cdc_ncm: Implement the 32-bit version of NCM Transfer Block")
Reported-by: syzbot+1994e2ecf323ed90f255@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1994e2ecf323ed90f255
Signed-off-by: Jiahao Xu <xujiahao@cmss.chinamobile.com>
Link: https://patch.msgid.link/20261111124156.637661-1-xujiahao@cmss.chinamobile.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
In amt_mldv1_leave_handler(), which handles IPv6 MLDv1 Done
(ICMPV6_MGM_REDUCTION) messages, the source address is mistakenly
extracted via ip_hdr(skb)->saddr into host.ip4 instead of copying the
IPv6 source address from ipv6_hdr(skb)->saddr into host.ip6 as
amt_mldv1_report_handler() does.
Because amt_lookup_group() compares the full union amt_addr for v6
groups, looking up the group with a 32-bit IPv4 header slice fails to
match the group entry created by amt_mldv1_report_handler(). As a
result, amt_del_group() is not called when an MLDv1 listener leaves,
and the AMT relay continues forwarding multicast traffic until the
group timer expires.
Use ipv6_hdr(skb) and copy ip6h->saddr into host.ip6 so that MLDv1
Done messages properly match and delete the corresponding IPv6 group.
This issue was found via LLM-assisted code review, confirmed by
reproducing the stale group forwarding in a User-Mode Linux (ARCH=um)
environment, and verified in UML by testing that AMT relay multicast
forwarding stops immediately after receiving an MLDv1 Done message.
Fixes: b75f7095d4d4 ("amt: add mld report message handler")
Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
Link: https://patch.msgid.link/20261111031147.105834-1-sunwenbo@cmss.chinamobile.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
virtio_net_hdr_tnl_to_skb() trusts the virtio header to describe a
UDP tunnel over IPv4 or IPv6, but never checks that the frame actually
carries such outer headers. Because VIRTIO_NET_HDR_F_NEEDS_CSUM is
mandatory for tunnel GSO, __virtio_net_hdr_to_skb() skips the flow
dissector, so virtio_net_hdr_match_proto() is never applied either.
A guest (or a tap writer) can then inject a frame with an arbitrary
outer ethertype, for example ETH_P_NSH, with SKB_GSO_UDP_TUNNEL set.
The GSO stack then runs nsh_gso_segment() on top of the UDP tunnel
segmentation, which assumes a different header layout. The result is
segments with skb->data before skb->head, and a host crash in
skb_under_panic() as soon as a later layer pushes a header:
skbuff: skb_under_panic: ... put:4 ... dev:gretap1
kernel BUG at net/core/skbuff.c:215!
skb_push
__gre_xmit
gre_tap_xmit
...
tun_get_user
Validate the outer headers with the parsing helpers from Michael's
series "net: resolve uncommon partial checksums at ingress":
- locate the L3 header: Ethernet with optional VLAN tags, or the
network header set by the caller. skb->protocol is not trusted when
it disagrees with the frame.
- require the outer L3 protocol to match the declared tunnel type.
- require the outer UDP header exactly at outer_th_offset, after IPv4
options or IPv6 extension headers, and reject fragments.
Unlike the original helpers:
- the callers tell whether the frame starts with an Ethernet header,
with a new has_eth argument of virtio_net_hdr_tnl_to_skb(), instead
of using the device type. tun frames packets from its IFF_TAP and
IFF_TUN flags, and TUNSETLINK can set the device type to any value.
virtio_net and tun_xdp_one() always pass true, tun_get_user() passes
whether the device is IFF_TAP.
- ipv6_find_hdr() stops at an AH header, as Willem suggested in the
review of that series.
Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
Reported-by: Hassan Sultan <hassansultan@google.com>
Suggested-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/netdev/93d0e37c99711bebdf60c120af03010455c2f2e2.1793276116.git.mst@redhat.com/
Co-developed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261110213628.3476051-4-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
With IFF_NAPI_FRAGS, tun_napi_alloc_frags() gets its skb from
napi_get_frags(). If GRO merged the previous frame with
GRO_MERGED_FREE, that skb was recycled by napi_reuse_skb(), which does
not reset skb->protocol set by napi_frags_skb() for the previous frame.
tun_get_user() calls tun_vnet_hdr_tnl_to_skb() before eth_type_trans(),
so the virtio header checks see the protocol of the previous frame:
GSO packets without VIRTIO_NET_HDR_F_NEEDS_CSUM are dissected with the
wrong protocol. A following change checks the outer protocol of UDP
tunnel GSO packets, which would then reject a valid frame when the two
ethertypes differ.
This needs GRO to hold packets across writes, and IFF_NAPI_FRAGS needs
CAP_NET_ADMIN.
Clear skb->protocol in tun_napi_alloc_frags(), like skbs allocated
by tun_alloc_skb() or build_skb(). eth_type_trans() sets it later.
Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/netdev/179386753589.488856.11455181721004759454@kernel.org/
Suggested-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261110213628.3476051-3-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
netif_close() must be called with RTNL held in addition to the netdev
instance lock: __dev_close_many() asserts it, and the NETDEV_GOING_DOWN
and NETDEV_DOWN notifier chains it runs rely on it for serialization.
Commit 004b5008016a ("eth: bnxt: remove most dependencies on RTNL")
replaced rtnl_lock() with netdev_lock() in bnxt_fw_reset_task() and
bnxt_fw_reset(). That is sufficient for the paths that only tear the
NIC down internally with __bnxt_close_nic(), but the abort paths close
the netdev via bnxt_fw_reset_abort() -> netif_close(), and the error
path in bnxt_fw_reset() calls netif_close() directly. Those now run
without RTNL and trigger a WARN_ONCE() cascade when a firmware reset is
aborted:
RTNL: assertion failed at net/core/dev.c (1740)
WARNING: net/core/dev.c:1740 at __dev_close_many+0x1be/0x1f0
Workqueue: bnxt_pf_wq bnxt_fw_reset_task [bnxt_en]
Call Trace:
netif_close_many+0xb5/0x190
netif_close+0xa2/0xd0
bnxt_fw_reset_task.cold+0x8d/0x213 [bnxt_en]
process_one_work+0x19d/0x3a0
worker_thread+0x1af/0x320
kthread+0xe3/0x120
followed by the same assertion from call_netdevice_notifiers_info(),
fib_rules_event(), inetdev_event(), rtnl_fill_ifinfo(),
devlink_compat_phys_port_name_get() and ip_mc_down().
This was observed on a machine in real use with a BCM57504 (4 PFs,
FW 236.1.153.0) running v7.1.6: the firmware crashed, announced a
"Fatal firmware reset event" and then failed to come back within the
advertised max wait, so bnxt_fw_reset_task() aborted the reset on all
ports:
bnxt_en 0000:c1:00.1 eno16905np1: Firmware reset aborted
bnxt_en 0000:c1:00.1 eno16905np1: fw_health_status 0x448100
Take RTNL (before the netdev instance lock, matching the OPENING state
which already uses rtnl_trylock()) in the fw_reset_abort path of
bnxt_fw_reset_task() and route the POLL_VF abort through that same
path.
In bnxt_fw_reset(), only a PF can reach the bnxt_get_registered_vfs()
error path that calls netif_close(), so take RTNL up front via
bnxt_rtnl_lock_sp() when BNXT_PF(bp) is true and keep bnxt_lock_sp() on
VFs. That avoids dropping the instance lock mid-reset (which would
expose a transient BNXT_STATE_IN_FW_RESET and let a concurrent devlink
health recover set BNXT_STATE_IN_SP_TASK), avoids racing with
bnxt_sriov_configure() updating active_vfs outside RTNL, and keeps VFs
from contending on RTNL during recovery while PFs already run on the
single-threaded bnxt_pf_wq.
The bug was found by inspecting the kernel log of the affected machine
and the driver source; the fix was prepared with the help of an AI
coding assistant (Gemini based) and reviewed by the submitter. It is
build tested (allmodconfig with W=1, plus the same change on top of
v7.1.6 built as a module for the affected BCM57504 host). The aborted
reset path itself only runs when the firmware fails to return from a
reset, which could not be reproduced on demand.
Fixes: 004b5008016a ("eth: bnxt: remove most dependencies on RTNL")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan Cochrane <bcochrane@google.com>
Link: https://patch.msgid.link/20261110044235.204386-1-bcochrane@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull power sequencing fixes from Bartosz Golaszewski:
- fix a use-after-free bug and a serdev reference leak in pwrseq-pcie-m2
- increase WCN7850 power-up delay in pwrseq-qcom-wcn
- make the API contract for pwrseq descriptor serialization clearer
* tag 'pwrseq-fixes-for-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
power: sequencing: pcie-m2: fix serdev controller reference leak
power: sequencing: pcie-m2: use devm_mutex_init()
power: sequencing: pcie-m2: fix use-after-free in pwrseq_pcie_m2_vregs_enable()
power: sequencing: core: add a note on descriptor serialization
power: sequencing: qcom-wcn: increase WCN7850 power-up delay
|
|
When firmware reports a function as not LAG capable (lag_master=0 or
num_lag_ports < 2), mlx5_lag_add_mdev() creates no LAG object for it.
Enabling multiport E-Switch on such a device returns 0 from
mlx5_lag_mpesw_queue_work(), so
"devlink dev param set ... esw_multiport value true" reports success
although nothing was enabled, and a following "devlink dev param show"
still reports false.
Return -EOPNOTSUPP instead. mlx5_lag_mpesw_disable() ignores the return
value, so disabling keeps its current behavior.
Fixes: a32327a3a02c ("net/mlx5: Lag, Control MultiPort E-Switch single FDB mode")
Signed-off-by: Uri Dar <udar@nvidia.com>
Reviewed-by: Shay Drori <shayd@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
Link: https://patch.msgid.link/20261110114350.2639891-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
A flower filter on a block shared across ports is offloaded as one
hardware rule per port, all carrying the same classifier cookie.
Deletion looked a rule up by cookie alone and could take another
port's copy: with skip_sw, a filter silently stopped being enforced
on a still-bound port, while the detached port kept enforcing it.
Delete the rule matching the port being unbound instead.
Fixes: 8eb9e7520b17 ("net: dsa: yt921x: Add ACL support")
Signed-off-by: David Yang <mmyangfl@gmail.com>
Link: https://patch.msgid.link/20261110104930.223598-4-mmyangfl@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The hardware resolves one forward decision per ACL rule, but the
translation accumulated every action, so a later action silently changed
the verdict of the ones before it: an `action drop action trap` filter
with skip_sw trapped packets to the CPU instead of dropping them.
Resolve the list against its first terminal action, and ask for software
assistance if any action follows the redirect action.
Fixes: 8eb9e7520b17 ("net: dsa: yt921x: Add ACL support")
Signed-off-by: David Yang <mmyangfl@gmail.com>
Link: https://patch.msgid.link/20261110104930.223598-3-mmyangfl@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
No extack reasons were given to unsupported TC actions. Set a reason on
the default path before falling back, and drop the now-redundant
initializer of `reason`, so the compiler warns on any future path that
uses it without assigning one.
Fixes: 8eb9e7520b17 ("net: dsa: yt921x: Add ACL support")
Signed-off-by: David Yang <mmyangfl@gmail.com>
Link: https://patch.msgid.link/20261110104930.223598-2-mmyangfl@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Since commit abed42f9cd80 ("net/mlx5e: Conditionally create async
ICOSQ"), the async ICOSQ is only created when an XDP program is attached
or priv->ktls_rx_was_enabled is set. When TLS RX offload is enabled for
the first time, mlx5e_ktls_set_feature_rx() sets the flag and reopens
the channels so that they get the queue, but it ignores the return value
of mlx5e_safe_reopen_channels().
If the reopen fails, mlx5e_safe_switch_params() keeps the old channels,
which have no async ICOSQ, while NETIF_F_HW_TLS_RX is still reported as
enabled. The next offloaded RX connection then dereferences the NULL
c->async_icosq in post_rx_param_wqes(). Enabling the feature again does
not help, as the flag is already set and the reopen is skipped.
Propagate the error, clear the flag and destroy the accel TCP flow
tables again, so that the feature stays disabled and the next attempt
retries the reopen.
Fixes: abed42f9cd80 ("net/mlx5e: Conditionally create async ICOSQ")
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20261110101709.2589088-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio fixes from Bartosz Golaszewski:
"To no surprise, this batch was mostly driven by issues found by LLMs
(notably: sashiko) during reviews of other changes. This is why it's
bigger than what I normally send at this stage.
Fixes in GPIO core:
- fix a race in shared GPIO descriptor release path
- fix several issues in gpio-shared-proxy: race between concurrent
initial users, dropping votes in error paths and driving the
default value with no votes cast
- fix stack out-of-bounds access bugs in GPIO hog handling
- fix a race in GPIO descriptor consumer label update
- reset lookup flags on each hogged line
- fix GPIO descriptor leak and fast-path cancellation in
gpiod_get_array()
- fix return value in of_gpiochip_instance_match() stub for
!CONFIG_OF
- fix potential misconfiguration of flags for hogged lines on OF
systems
- fix a reference leak in deferred GPIO controller setup error path
Fixes in GPIO drivers:
- fix interrupt handling bugs in gpio-aspeed
- fix an interrupt leak and two UAF bugs in gpio-virtuser
- fix a UAF bugs in gpio-sodaville, gpio-mpc8xxx and gpio-brcmstb
- fix a sleeping-while-atomic bug in gpio-mvebu
- reject unsupported interrupt types in gpio-mpfs
- fix an irqchip leak in gpio-regmap helper
- fix debounce arithmetic in gpio-rockchip
- propagate runtime PM failures in gpio-omap
- defer GPIO chip registration to postcore_initcall() in gpio-sa1100"
* tag 'gpio-fixes-for-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (26 commits)
gpiolib: fix stack out-of-bounds access in gpiochip_add_hog()
gpio: shared: fix a race in shared desc release path
gpio: sodaville: fix use-after-free bug when registering the irqchip
gpio: virtuser: fix interrupt leak and UAF
gpio: mvebu: fix sleeping-while-atomic in mvebu_gpio_level_irq_mask()
gpiolib: synchronize updates of descriptor labels
gpiolib: of: return -ENOENT from of_gpio_count() stub
gpiolib: fix fast-path cancellation in gpiod_get_array()
gpiolib: fix GPIO descriptor leak in gpiod_get_array()
gpio: of: fix potential misconfiguration of hogged lines
gpio: mpfs: reject unsupported interrupt types
gpio: keep the chip reference when deferred setup fails
gpio: regmap: free the irqchip if adding the irq domain fails
gpio: aspeed: Preserve the pending G7 interrupt status on control writes
gpio: aspeed: Clear only the acked line's G4 interrupt status
gpiolib: reset lookup flags for each hogged line
gpio: virtuser: remove the debugfs files before freeing the line data
gpio: mpc8xxx: Fix potential use-after-free of IRQ domain
gpio: shared-proxy: Drop the vote when switching to input
gpio: shared-proxy: Drive the default value when no votes are cast
...
|
|
gtp0_handle_echo_resp() and gtp1u_handle_echo_resp() return the result
of genlmsg_multicast_netns() to gtp_encap_recv(). When the netlink
notification is delivered that result is 0, and gtp_encap_recv() treats
0 as "the skb has been consumed":
switch (ret) {
case 1:
netdev_dbg(gtp->dev, "pass up to the process\n");
break;
case 0:
break;
case -1:
netdev_dbg(gtp->dev, "GTP packet has been dropped\n");
kfree_skb(skb);
ret = 0;
break;
}
The echo response handlers only read from the skb and never free it or
pass it on, so every echo response that is reported to a listener on the
gtp multicast group leaks the skb. Echo responses are handled for any
peer when the UDP sockets were created by the kernel, so a remote host
can leak memory on the receiver by sending GTP echo responses while a
process with CAP_NET_ADMIN is subscribed to the gtp multicast group, for
example a daemon that monitors echo responses.
The error paths do not leak but have a related problem. -ENOMEM and the error from
genlmsg_multicast_netns() (-ESRCH when nobody listens) are not -1, so
they are returned unchanged to the UDP stack, which takes a negative
value from encap_rcv() as a request to resubmit the packet to the
protocol with that number.
Return -1 when the notification cannot be built, so that
gtp_encap_recv() drops the skb, and consume the skb once the
notification has been handed to netlink, whether or not anybody is
listening.
Found by LLM-assisted source review, untested.
Fixes: d33bd757d362 ("gtp: Implement GTP echo request")
Cc: stable@vger.kernel.org
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
Link: https://patch.msgid.link/20261110-gtp-echo-rsp-leak-v1-1-192c032f3dfa@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
R10 holds one divider for each recovered clock output, shared by all
ports. ice_ptp_link_change() sets it from the link speed of its own port
even when another port drives the output, and checks the mux only to
decide whether an error is worth reporting. With ports running at
different speeds, a link change on one port leaves the output of another
port with a wrong divider.
Skip the outputs that the port does not drive, and check the mux under
cgu_synce_lock, so that another PF cannot select its port in between.
The check computes the mux value as port % ports_per_phy + 3, while
ice_tspll_cfg_bypass_mux_e825c() and ice_dpll_rclk_update_e825c() use
port + 3. With the skip, a port from ports_per_phy up would never update
the divider, so use port + 3 as they do.
Tested on GNR-D with dual complex E825. With the RCLK pin of one port
connected, five down and up cycles of another port of the same complex
called ice_tspll_cfg_synce_ethdiv_e825c() 20 times without this patch
and never with it. Five cycles of the port driving the output still
called it 10 times. Both ports ran at 25 Gb/s, so the divider value did
not change on this setup.
Fixes: ad1df4f2d591 ("ice: dpll: Support E825-C SyncE and dynamic pin discovery")
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Reviewed-by: Petr Oros <poros@redhat.com>
Link: https://patch.msgid.link/20261110094350.184185-3-ivecera@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
All E825C PFs share the CGU registers R10 and R11. On dual complex E825
the second complex reaches the CGU of complex 0 through cgu_peer. RCLK pin
callbacks read, modify and write these registers under dpll_lock and the
pf->dplls.lock of their PF. ice_ptp_link_change() rewrites R10 under the
pf->dplls.lock of its PF only, so a link change on one PF can write back
a stale R10 and undo an RCLK pin change made by another PF.
Add a mutex to struct ice_adapter, which all E825C PFs share, and hold it
around these sequences.
Tested on GNR-D with dual complex E825, with a 2 to 4 ms delay after the
read of R10 in the link change path to widen the window. Toggling the
RCLK pin of one port while another port of the same complex went down
and up 143 times lost 120 of 86814 updates of the mux in R10 without
this patch, and none of 76992 with it.
Fixes: ad1df4f2d591 ("ice: dpll: Support E825-C SyncE and dynamic pin discovery")
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Reviewed-by: Petr Oros <poros@redhat.com>
Link: https://patch.msgid.link/20261110094350.184185-2-ivecera@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI fixes from Rafael Wysocki:
"These fix a mistake in the ACPI APEI GHES code causing recoverable
CPU, memory, CXL and vendor-specific errors reported through GHES to
never show up in a vmcore, address a potential deadlock related to
ACPI device hotplug that causes lockdep to complain and give up, and
fix up the recently added support for _Ixx GPEs:
- Make recoverable CPU, memory, CXL and vendor-specific errors
reported through GHES show up in vmcores by fixing a broken error
severity check in ghes_log_hwerr() (Breno Leitao)
- Avoid printing diagnostic messages for ACPI device objects after
dropping reference to them (Sasha Levin)
- Avoid holding the physical_node_lock for ACPI device objects across
device_offline() and device_online() due to a potential deadlock
that causes lockdep to complain and turn itself off (Sasha Levin)
- Avoid spurious system wakeups from suspend-to-idle on platforms
where an _Ixx GPE is shared by user-wakeup and background events
(Saranya Gopal)"
* tag 'acpi-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPI: s2idle: Handle shared _Ixx GPEs without an EC
ACPI: APEI: GHES: Fix severity check in ghes_log_hwerr()
ACPI: scan: Do not hold physical_node_lock across device_offline() and device_online()
ACPI: scan: Print the offline failure message in acpi_bus_offline()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These address a few issues in the cpufreq core and drivers, including
issues actually seen in the field, a few issues related to runtime PM,
including a false-positive warning introduced relatively recently and
a long-standing defect in the runtime PM core code related to
autosuspend, and revert a problematic recent update of the intel_rapl
power capping driver.
Specifics:
- Revert a recent update of the intel_rapl power capping driver that
caused perf to return bogus values (Dennis Chen)
- Fix the synchronization of boost state updates in cpufreq
(Christian Loehle)
- Fix issues related to system suspend-resume synchronization in the
cpufreq core and intel_pstate driver (Rafael Wysocki)
- Fix P-state index mismatch in extract_io() in the ACPI cpufreq
driver on systems with defective _PSS (Li RongQing)
- Fix issues related to target frequency caching in cpufreq (Rafael
Wysocki)
- Prevent a false-positive warning in pm_runtime_remove() introduced
by a previous fix during the 7.0 development cycle (Zhou Minqiang)
- Extend a recent improvement related to the handling of suppliers
during device runtime-suspend to some previously missed cases in
which it is relevant for consistency (Brian Norris)
- Update runtime PM documentation to reflect new behavior after
recent changes (Stanley Jhu)
- Add last_busy timestamp updates for devices requested to resume
from runtime suspend that are missing if those devices are not
actually suspended (Rafael Wysocki)"
* tag 'pm-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
Revert "powercap: intel_rapl: Expose all package CPUs in PMU cpumask"
PM: runtime: Update last_busy in rpm_resume() for active devices
cpufreq: Fix updates of cached resolved frequency and index
cpufreq: Cache post-resolution target frequency in __resolve_freq()
cpufreq: acpi-cpufreq: fix P-state index mismatch in extract_io()
cpufreq: Serialize global boost updates
cpufreq: Preserve global boost state on failed updates
PM: runtime: Update runtime_pm.rst for non-fatal resume errors
PM: runtime: Only queue an idle check for RPM-linked suppliers (part 2)
PM: runtime: Fix check_flush_dependency warning from pm_runtime_remove
cpufreq: intel_pstate: Use rdmsrq_safe() to read MSR_MISC_PWR_MGMT
cpufreq: intel_pstate: Clear last written P-state value on suspend
cpufreq: Force passing target frequency to driver during resume
cpufreq: Improve suspend-resume synchronization
cpufreq: Hold the policy write lock when changing boost state
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull TPM fixes from Jarkko Sakkinen:
- Add the missing check of the return value of crypto_kpp_set_secret()
when creating an authenticated HMAC session
- Check the payload size of EVENT_TAG entries before reading them, in
order to avoid out-of-bounds reads with a truncated TPM 1.x event log
- Flush the timeout work outside buffer_mutex in tpm_common_read(), as
the work itself takes the same mutex, which can lead to a deadlock
- Fix a memory leak of the event log buffer in the error path of
tpm_read_log_acpi()
* tag 'tpm-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
tpm: acpi: Fix memory leak at tpm_read_log_acpi() error path
tpm: flush timeout work outside buffer_mutex to avoid deadlock
tpm: eventlog: check the payload size before reading tag events
tpm: Check return value of crypto_kpp_set_secret()
|
|
The hardware validates TCP and UDP checksums for both IPv4 and IPv6 and
reports the result in rx_tcp_csum_succeed and rx_udp_csum_succeed.
However, mana_rx_skb() also requires rx_iphdr_csum_succeed before it
sets CHECKSUM_UNNECESSARY. That bit is only set for IPv4 (since IPv6
has no header checksum), so IPv6 TCP and UDP traffic is always
checksummed again in software.
So, only look at the L4 result. For IPv4 this makes no material
difference since CHECKSUM_UNNECESSARY only covers the L4 checksum, and
ip_rcv_core() always verifies the IPv4 header checksum in software.
Between two Azure Standard_E16s_v6 VMs (VF enabled), IPv6 TCP and UDP
packets (including VXLAN over IPv6), now arrive with
CHECKSUM_UNNECESSARY instead of CHECKSUM_NONE, so GRO no longer
checksums them in software. Calls to __skb_gro_checksum_complete() on
the receiver during an 8 second iperf3 run:
before after
TCP/IPv4, 12.2 Gbps 23 28
TCP/IPv6, 12.1 Gbps 8728419 25
UDP/IPv6, 1.5 Gbps 1071380 20
TCP/VXLAN/IPv6, 10.9 Gbps 7934373 18
Cc: stable@vger.kernel.org
Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
Link: https://patch.msgid.link/20261109142856.779955-1-hamzamahfooz@linux.microsoft.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
BIODASDCHECKFMT used to copy the entire format_check_t struct from
userspace, including the result/unit/rec/num_records/blksize/
key_length fields that are output fields only.
dasd_eckd_format_evaluate_tracks() relies on cdata->result being zero
to decide whether to apply an index correction (i--/pos--) after a
successful check. A caller that pre-sets result to a non-zero value
can suppress that correction, leaving pos advanced past the last valid
entry; the (partially out-of-bounds) fmt_buffer[pos] fields are then
copied back to userspace, leaking heap contents.
Only expect is an Input field; copy just that member in and zero
the rest of cdata.
Fixes: 8fd575200db5 ("s390/dasd: Add new ioctl BIODASDCHECKFMT")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260722103704.1709668-1-sth@linux.ibm.com
Cc: stable@vger.kernel.org #4.7
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://patch.msgid.link/20261112102608.1057852-5-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
dasd_eckd_build_check_tcw() allocates its request with
dasd_fmalloc_request(), but its out_err path frees it with
dasd_sfree_request(). The latter uses a different pool and therefor,
leading to invalid pointer arithmetic and a crash.
Use the matching dasd_ffree_request() instead.
The same error path also leaves start_priv->count incremented
without ever decrementing it again.
This leaks a permanent reference on every build failure.
Decrement it before freeing the request.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260722103704.1709668-1-sth@linux.ibm.com
Fixes: 8fd575200db5 ("s390/dasd: Add new ioctl BIODASDCHECKFMT")
Cc: stable@vger.kernel.org #4.7
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Fixes: 5e2b17e712cf ("s390/dasd: Add dynamic formatting support for ESE volumes")
Link: https://patch.msgid.link/20261112102608.1057852-4-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
Under z/VM the Read Configuration Data (RCD) buffer has to start with
EBCDIC "V1.0" to request the virtual device SNEQ that carries the
minidisk UIT. The request and the response share the same buffer:
CP evaluates the magic on the way out and the RCD data is written into
the same buffer on the way back.
The magic is only written when the request is built and again in
read_conf_cb() when the original request fails.
Several restart paths do not run that callback:
- ERP use the same buffer and if the same error occurs again,
the ERP restarts the existing ERP request;
if a different error occurs, it adds another ERP request.
Neither re-initializes the magic.
- Terminated (timed out) ERP requests, killed requests and requests
requeued after the last path was gone are restarted without it.
- dasd_sleep_on_immediately() overwrites cqr->callback, so read_conf_cb()
never ran for dasd_eckd_read_conf_immediately(), and its fastpath
retries in dasd_int_handler() do not call a callback either.
If such a restart succeeds, z/VM omits the virtual device SNEQ, the UID
of that path is built without the UIT and the paths are reported as
"Not all channel paths lead to the same device" although they lead to
the same minidisk.
Every start of a request, whatever path led to it, goes through
dasd_start_IO(). Add an optional prepare_io function to the request
that dasd_start_IO() calls before every start of the request and of
its ERP requests, and use it to write the magic for RCD requests.
The ERP handling stays unchanged. read_conf_cb() is no longer needed
and is removed, which also gets rid of its memset() that only cleared
a single byte.
Fixes: 5915a873fcb1 ("[S390] dasd: re-initialize read_conf buffer for retries")
Cc: stable@vger.kernel.org
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://patch.msgid.link/20261112102608.1057852-3-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
Fix typo in function name dasd_sleep_on_immediatly().
Suggested-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://patch.msgid.link/20261112102608.1057852-2-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
In pwrseq_pcie_m2_create_serdev_one(), if serdev_ctrl->serdev is NULL but
pdev is already tracked in ctx->pci_devices, we return early from the
loop and skip the serdev_controller_put(), leaking the reference.
Initialize ret to 0 and jump directly to the label that ensures the
reference is released.
Cc: stable@vger.kernel.org
Closes: https://sashiko.dev/#/bug/linux-07754192-a8ad-42d6-ab1b-cd6f16bec846
Fixes: c4be520907a4 ("power: sequencing: pcie-m2: Create serdev for PCI devices present before probe")
Link: https://patch.msgid.link/20261105-pwrseq-pcie-m2-serdev-ref-leak-v1-1-e2e022ca17ec@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
|
|
Merge core ACPI support code fixes and an ACPI APEI fix for 7.4-rc3:
- Avoid printing diagnostic messages for ACPI device objects after
dropping reference to them (Sasha Levin)
- Avoid holding the physical_node_lock for ACPI device objects across
device_offline() and device_online() due to a potential deadlock that
causes lockdep to complain and turn itself off (Sasha Levin)
- Make recoverable CPU, memory, CXL and vendor-specific errors reported
through GHES show up in vmcores by fixing a broken error severity
check in ghes_log_hwerr() (Breno Leitao)
* acpi-scan:
ACPI: scan: Do not hold physical_node_lock across device_offline() and device_online()
ACPI: scan: Print the offline failure message in acpi_bus_offline()
* acpi-apei:
ACPI: APEI: GHES: Fix severity check in ghes_log_hwerr()
|
|
vc4_reset() masks the IRQ line through vc4_irq_disable(), which calls
disable_irq(), but nothing in the reset path calls enable_irq(). The line
stays disabled after the first GPU hang, so later jobs only retire through
further hangcheck resets.
Commit 6abc8e4dcfbc ("drm/vc4: Disable the V3D interrupt across runtime
suspend") was written against drm-misc-fixes, where the GPU was still
reset with a runtime suspend/resume cycle and the resume callback
re-enabled the line. Commit b4448823f151 ("drm/vc4: Use the reset
controller to recover from a GPU hang") removed that cycle, so once both
landed, enable_irq() was no longer reached.
Move enable_irq() into vc4_irq_enable(), which both runtime resume and
vc4_irq_reset() call, so every path that disables V3D interrupts also
re-enables the IRQ line.
Fixes: b4448823f151 ("drm/vc4: Use the reset controller to recover from a GPU hang")
Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
Link: https://patch.msgid.link/20261111-vc4-irq-cleanup-v2-3-aa757bb742f2@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
|
|
The out-of-memory interrupt is armed once, by bin_bo_alloc(), when the
binner BO is allocated. vc4_irq_disable() masks it on the way down,
vc4_irq_enable() brings back only the render bits, and bin_bo_alloc() does
not run again for a binner BO that is still referenced. An overflow after
an autosuspend therefore raises nothing and the binner stalls, until the
hangcheck resets the GPU and arms the interrupt again.
Therefore, derive the out-of-memory bit in vc4_irq_enable() from whether a
binner BO exists, which is the condition bin_bo_alloc() was standing in
for.
While here, clear the complement of the wanted mask while enabling.
V3D_INTENA and V3D_INTDIS are set/clear registers and the driver only ever
set bits, so a source left enabled will stay enabled and can reach
vc4_irq(), which returns IRQ_NONE for anything outside the three bits it
handles.
Cc: stable@vger.kernel.org
Fixes: 35c8b4b2c0fe ("drm/vc4: Allocate binner bo when starting to use the V3D")
Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
Link: https://patch.msgid.link/20261111-vc4-irq-cleanup-v2-2-aa757bb742f2@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
|
|
bin_bo_alloc() arms the out-of-memory interrupt once it has allocated the
binner BO, and accessing a V3D register requires the block to be powered.
vc4_submit_cl_ioctl() already holds a runtime PM reference by the time it
reaches vc4_get_bcl(), but vc4_create_bo_ioctl() reaches vc4_grab_bin_bo()
without one, so the write can land on a suspended device.
Take the reference in vc4_v3d_bin_bo_get(), which covers both callers, and
take it before bin_bo_lock so that runtime PM is never waited for with the
mutex held.
Cc: stable@vger.kernel.org
Fixes: 35c8b4b2c0fe ("drm/vc4: Allocate binner bo when starting to use the V3D")
Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
Link: https://patch.msgid.link/20261111-vc4-irq-cleanup-v2-1-aa757bb742f2@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
|
|
Merge cpufreq fixes and fixes related to runtime PM for 7.4-rc3:
- Fix the synchronization of boost state updates in cpufreq (Christian
Loehle)
- Fix issues related to system suspend-resume synchronization in the
cpufreq core and intel_pstate driver (Rafael Wysocki)
- Fix P-state index mismatch in extract_io() in the ACPI cpufreq driver
on systems with defective _PSS (Li RongQing)
- Fix issues related to target frequency caching in cpufreq (Rafael
Wysocki)
- Prevent a false-positive warning in pm_runtime_remove() introduced
by a previous fix during the 7.0 development cycle (Zhou Minqiang)
- Extend a recent improvement related to the handling of suppliers
during device runtime-suspend to some previously missed cases in
which it is relevant for consistency (Brian Norris)
- Update runtime PM documentation to reflect new behavior after recent
changes (Stanley Jhu)
- Add last_busy timestamp updates for devices requested to resume from
runtime suspend that are missing if those devices are not actually
suspended (Rafael Wysocki)
* pm-cpufreq:
cpufreq: Fix updates of cached resolved frequency and index
cpufreq: Cache post-resolution target frequency in __resolve_freq()
cpufreq: acpi-cpufreq: fix P-state index mismatch in extract_io()
cpufreq: Serialize global boost updates
cpufreq: Preserve global boost state on failed updates
cpufreq: intel_pstate: Use rdmsrq_safe() to read MSR_MISC_PWR_MGMT
cpufreq: intel_pstate: Clear last written P-state value on suspend
cpufreq: Force passing target frequency to driver during resume
cpufreq: Improve suspend-resume synchronization
cpufreq: Hold the policy write lock when changing boost state
* pm-runtime:
PM: runtime: Update last_busy in rpm_resume() for active devices
PM: runtime: Update runtime_pm.rst for non-fatal resume errors
PM: runtime: Only queue an idle check for RPM-linked suppliers (part 2)
PM: runtime: Fix check_flush_dependency warning from pm_runtime_remove
|
