summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-01-29net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanupZilin Guan
In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak. Fix this by changing the loop to iterate from the current index i down to 0. Also, decrement i in the devlink_alloc failure path to point to the last successfully allocated index. Compile tested only. Issue found using code review. Fixes: f21fb3ed364b ("Add support of Cavium Liquidio ethernet adapters") Suggested-by: Simon Horman <horms@kernel.org> Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260128154440.278369-3-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: liquidio: Initialize netdev pointer before queue setupZilin Guan
In setup_nic_devices(), the netdev is allocated using alloc_etherdev_mq(). However, the pointer to this structure is stored in oct->props[i].netdev only after the calls to netif_set_real_num_rx_queues() and netif_set_real_num_tx_queues(). If either of these functions fails, setup_nic_devices() returns an error without freeing the allocated netdev. Since oct->props[i].netdev is still NULL at this point, the cleanup function liquidio_destroy_nic_device() will fail to find and free the netdev, resulting in a memory leak. Fix this by initializing oct->props[i].netdev before calling the queue setup functions. This ensures that the netdev is properly accessible for cleanup in case of errors. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: c33c997346c3 ("liquidio: enhanced ethtool --set-channels feature") Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260128154440.278369-2-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29Merge tag 'wireless-next-2026-01-29' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Another fairly large set of changes, notably: - cfg80211/mac80211 - most of EPPKE/802.1X over auth frames support - additional FTM capabilities - split up drop reasons better, removing generic RX_DROP - NAN cleanups/fixes - ath11k: - support for Channel Frequency Response measurement - ath12k: - support for the QCC2072 chipset - iwlwifi: - partial NAN support - UNII-9 support - some UHR/802.11bn FW APIs - remove most of MLO/EHT from iwlmvm (such devices use iwlmld) - rtw89: - preparations for RTL8922DE support * tag 'wireless-next-2026-01-29' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (184 commits) wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() wifi: mac80211: use u64_stats_t with u64_stats_sync properly wifi: p54: Fix memory leak in p54_beacon_update() wifi: cfg80211: treat deprecated INDOOR_SP_AP_OLD control value as LPI mode wifi: rtw88: sdio: Migrate to use sdio specific shutdown function wifi: rsi: sdio: Migrate to use sdio specific shutdown function sdio: Provide a bustype shutdown function wifi: nl80211/cfg80211: support operating as RSTA in PMSR FTM request wifi: nl80211/cfg80211: add negotiated burst period to FTM result wifi: nl80211/cfg80211: clarify periodic FTM parameters for non-EDCA based ranging wifi: nl80211/cfg80211: add new FTM capabilities wifi: iwlwifi: rename struct iwl_mcc_allowed_ap_type_cmd::offset_map wifi: iwlwifi: mvm: Remove link_id from time_events wifi: iwlwifi: mld: change cluster_id type to u8 array wifi: iwlwifi: support V13 of iwl_lari_config_change_cmd wifi: iwlwifi: split bios_value_u32 to separate the header wifi: iwlwifi: uefi: cache the DSM functions wifi: iwlwifi: acpi: cache the DSM functions wifi: iwlwifi: mvm: Cleanup MLO code ... ==================== Link: https://patch.msgid.link/20260129110136.176980-39-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29Merge branch 'airoha-an8811hb-2-5-gbps-phy-support'Jakub Kicinski
Bjørn Mork says: ==================== Airoha AN8811HB 2.5 Gbps phy support The RFC patch posted earlier has been split into a series based on the feedback received: 1/3: preparing the EN8811H driver for maximum reuse 2/3: adding support for the new AN8811HB hardware 3/3: adding (optional) clock driver for AN8811HB Patch 3/3 is not required for a functional device. It is included here for full feature parity between the EN8811H and AN8811HB drivers. The AN8811HB phy requires new firmware, which is now available with the 20260110 release of linux-firmware, ==================== Link: https://patch.msgid.link/20260127125547.1475164-1-bjorn@mork.no Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: phy: air_en8811h: Add clk provider for an8811hbBjørn Mork
Implement clk provider driver so we can disable the clock output when it isn't needed. This helps to reduce EMF noise Signed-off-by: Bjørn Mork <bjorn@mork.no> Link: https://patch.msgid.link/20260127125547.1475164-4-bjorn@mork.no Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: phy: air_en8811h: add Airoha AN8811HB supportBjørn Mork
The Airoha AN8811HB is mostly compatible with the EN8811H, adding 10Base-T support and reducing power consumption. This driver is based on the air_an8811hb v0.0.4 out-of-tree driver written by "Lucien.Jheng <lucien.jheng@airoha.com>" Firmware is available in linux-firmware. The driver has been tested with firmware version 25110702 Signed-off-by: Bjørn Mork <bjorn@mork.no> Link: https://patch.msgid.link/20260127125547.1475164-3-bjorn@mork.no Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: phy: air_en8811h: factor out shareable codeBjørn Mork
Create reusable helpers in preparation for the AN8811HB support. Signed-off-by: Bjørn Mork <bjorn@mork.no> Link: https://patch.msgid.link/20260127125547.1475164-2-bjorn@mork.no Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30Merge tag 'drm-xe-next-fixes-2026-01-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next - Reduce LRC timestamp stuck message on VFs to notice (Brost) - Disable GuC Power DCC strategy on PTL (Vinay) - Unregister drm device on probe error (Lin) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/aXuyrtsnlAOmj_OB@intel.com
2026-01-30Merge tag 'drm-misc-next-fixes-2026-01-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Two fixes for NULL pointer dereference in imx8 following the bridge refcounting conversions, and one for the bridge connector following the HDMI audio reworks. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patch.msgid.link/20260129-efficient-jerboa-of-ecstasy-822832@houat
2026-01-29ublk: restore auto buf unregister refcount optimizationCaleb Sander Mateos
Commit 1ceeedb59749 ("ublk: optimize UBLK_IO_UNREGISTER_IO_BUF on daemon task") optimized ublk request buffer unregistration to use a non-atomic reference count decrement when performed on the ublk_io's daemon task. The optimization applied to auto buffer unregistration, which happens as part of handling UBLK_IO_COMMIT_AND_FETCH_REQ on the daemon task. However, commit b749965edda8 ("ublk: remove ublk_commit_and_fetch()") reordered the ublk_sub_req_ref() for the completed request before the io_buffer_unregister_bvec() call. As a result, task_registered_buffers is already 0 when io_buffer_unregister_bvec() calls ublk_io_release() and the non-atomic refcount optimization doesn't apply. Move the io_buffer_unregister_bvec() call back to before ublk_need_complete_req() to restore the reference counting optimization. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Fixes: b749965edda8 ("ublk: remove ublk_commit_and_fetch()") Reviewed-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-29eth: bnxt: make sure we populate the qcfg defaults on old FW/HWJakub Kicinski
The driver now depends on the core to tell it what the rx page size should be for the agg ring. We must populate the ndo_default_qcfg callback even if we don't support any queue ops. This fixes: Oops: divide error: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN RIP: 0010:bnxt_alloc_rx_page_pool (drivers/net/ethernet/broadcom/bnxt/bnxt.c:3852) with fw version 225.1.109.0. Link: https://lore.kernel.org/20250421222827.283737-20-kuba@kernel.org Fixes: f96e1b35779e ("eth: bnxt: support qcfg provided rx page size") Reviewed-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260128193258.125274-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29Merge branch 'net-hinic3-fix-code-styles'Jakub Kicinski
Fan Gong says: ==================== net: hinic3: Fix code styles This patchset provides 4 code styles fixes: Remove empty lines between error handling. Remove defensive txq_num check. Use array_size instead of multiplying. SQ use SQ_CTXT_PREF_CI_HI to improve readability. ==================== Link: https://patch.msgid.link/cover.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29hinic3: RQ use RQ_CTXT_PREF_CI_HI instead of SQ_CTXT_PREF_CI_HIFan Gong
Separate the CTX_PREF_CI_HI of rq and sq to improve readability. Co-developed-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Fan Gong <gongfan1@huawei.com> Link: https://patch.msgid.link/7b34bf318c64398f34048c823c15b2eec5a679bc.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29hinic3: Use array_size instead of multiplyingFan Gong
Since commit 17fcb3dc12bb ("hinic3: module initialization and tx/rx logic") use "size * sizeof(u64)" in hinic3_feature_nego. Use array_size instead of multiplying can make it clearer. Link: https://lore.kernel.org/netdev/20250911123120.GG30363@horms.kernel.org/ Co-developed-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Fan Gong <gongfan1@huawei.com> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/b7d6d384ccc0bd4c0d3e7af1f90901d589cbd0b1.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29hinic3: Remove defensive txq_num checkFan Gong
Since commit 1f3838b84a63 ("hinic3: Add Rss function") nic_dev->num_txqs cannot be zero in hinic3_alloc_txqs(). So remove the check for this case. Link: https://lore.kernel.org/netdev/20250902180843.5ba05bf2@kernel.org/ Co-developed-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Fan Gong <gongfan1@huawei.com> Link: https://patch.msgid.link/c23daa9b79fa731c1caaec9b8245f6b2c4994afb.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29hinic3: Fix code Style(remove empty lines between error handling)Fan Gong
According to previous review comment, fix code style of removing empty lines between the actions on the error handling path to make it more idiomatic in the merged code. Link: https://lore.kernel.org/netdev/20250902180937.4c8d9eb3@kernel.org/ Co-developed-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Fan Gong <gongfan1@huawei.com> Link: https://patch.msgid.link/ccff2ae7abe91bb3618ded9bb5ef2dc9cb243d22.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30kprobes: Use dedicated kthread for kprobe optimizerMasami Hiramatsu (Google)
Instead of using generic workqueue, use a dedicated kthread for optimizing kprobes, because it can wait (sleep) for a long time inside the process by synchronize_rcu_task(). This means other works can be stopped until it finishes. Link: https://lore.kernel.org/all/176970170302.114949.5175231591310436910.stgit@devnote2/ Suggested-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-01-29ipv6: optimize fl6_update_dst()Eric Dumazet
fl6_update_dst() is called for every TCP (and others) transmit, and is a nop for common cases. Split it in two parts : 1) fl6_update_dst() inline helper, small and fast. 2) __fl6_update_dst() for the exception, out of line. Small size increase to get better TX performance. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 2/2 grow/shrink: 8/0 up/down: 296/-125 (171) Function old new delta __fl6_update_dst - 104 +104 rawv6_sendmsg 2244 2284 +40 udpv6_sendmsg 3013 3043 +30 tcp_v6_connect 1514 1534 +20 cookie_v6_check 1501 1519 +18 ip6_datagram_dst_update 673 690 +17 inet6_sk_rebuild_header 499 516 +17 inet6_csk_route_socket 507 524 +17 inet6_csk_route_req 343 360 +17 __pfx___fl6_update_dst - 16 +16 __pfx_fl6_update_dst 16 - -16 fl6_update_dst 109 - -109 Total: Before=22570304, After=22570475, chg +0.00% Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260128185548.3738781-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29octeontx2-af: Workaround SQM/PSE stalls by disabling stickyGeetha sowjanya
NIX SQ manager sticky mode is known to cause stalls when multiple SQs share an SMQ and transmit concurrently. Additionally, PSE may deadlock on transitions between sticky and non-sticky transmissions. There is also a credit drop issue observed when certain condition clocks are gated. work around these hardware errata by: - Disabling SQM sticky operation: - Clear TM6 (bit 15) - Clear TM11 (bit 14) - Disabling sticky → non-sticky transition path that can deadlock PSE: - Clear TM5 (bit 23) - Preventing credit drops by keeping the control-flow clock enabled: - Set TM9 (bit 21) These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this configuration the SQM/PSE maintain forward progress under load without credit loss, at the cost of disabling sticky optimizations. Signed-off-by: Geetha sowjanya <gakula@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29selftests: drv-net: rss_flow_label: skip unsupported devicesNimrod Oren
The test_rss_flow_label_6only test case fails on devices that do not support IPv6 flow label hashing. Make it skip neatly, consistent with the behavior of the test_rss_flow_label case. Reviewed-by: Gal Pressman <gal@nvidia.com> Signed-off-by: Nimrod Oren <noren@nvidia.com> Link: https://patch.msgid.link/20260128090217.663366-1-noren@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zeroJunrui Luo
The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the device reports zero interfaces (either due to hardware configuration or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10) instead of NULL. Later in dpaa2_switch_probe(), the NAPI initialization unconditionally accesses ethsw->ports[0]->netdev, which attempts to dereference ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic. Add a check to ensure num_ifs is greater than zero after retrieving device attributes. This prevents the zero-sized allocations and subsequent invalid pointer dereference. Reported-by: Yuhao Jiang <danisjiang@gmail.com> Reported-by: Junrui Luo <moonafterrain@outlook.com> Fixes: 0b1b71370458 ("staging: dpaa2-switch: handle Rx path on control interface") Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/SYBPR01MB7881BEABA8DA896947962470AF91A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29Merge branch 'net-stmmac-rk-second-chunk-of-cleanups'Jakub Kicinski
Russell King says: ==================== net: stmmac: rk: second chunk of cleanups This series is a cut-down installment of the dwmac-rk cleanups, covering up to the point that the AI review had its first issue with the patches. Unfortunately, this means that we introduce ->init but do not add any users for it yet. That will be in the next round once this has got through AI review and merged. ==================== Link: https://patch.msgid.link/aXnrzIbZN-gaZTia@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: rk: add SoC specific ->init() methodRussell King (Oracle)
Add a SoC specific init method. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vl3G5-00000006v3X-2zfD@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: rk: add GMAC_CLK_xx constants, simplify RGMII definitionsRussell King (Oracle)
All the definitions of the RGMII related xxx_GMAC_CLK_xxx definitions use the same field values to select the clock rate. Provide common definitions for these field values, passing them in to a single macro for each variant that generates the appropriate values for the speed register. No change to produced code on aarch64. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/E1vl3G0-00000006v3R-2ZBc@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: rk: fix missing reset_control_put()Russell King (Oracle)
rk_gmac_setup() delves into the PHY's DT node to retrieve its reset control using of_reset_control_get(). However, it never releases it when the driver is removed. Add reset_control_put() to rk_gmac_exit() to clean this up. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Link: https://patch.msgid.link/E1vl3Fv-00000006v3L-215v@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: phylink: fix NULL pointer deref in phylink_major_config()Russell King (Oracle)
When a MAC driver returns a PCS for an interface mode, and then we attempt to switch to a different mode that doesn't require a PCS, this causes phylink to oops: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Mem abort info: ESR = 0x0000000096000044 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000137f96000 [0000000000000010] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000044 [#1] SMP Modules linked in: -- CPU: 1 UID: 0 PID: 55 Comm: kworker/u33:0 Not tainted 6.19.0-rc5-00581-g73cb8467a63e #1 PREEMPT Hardware name: Qualcomm Technologies, Inc. Lemans Ride Rev3 (DT) Workqueue: events_power_efficient phylink_resolve pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS +BTYPE=--) pc : phylink_major_config+0x408/0x948 lr : phylink_major_config+0x3fc/0x948 sp : ffff800080353c60 x29: ffff800080353cb0 x28: ffffb305068a8a00 x27: ffffb305068a8000 x26: ffff000080092100 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000001 x22: 0000000000000000 x21: ffffb3050555b3d0 x20: ffff800080353d10 x19: ffff0000b6059400 x18: 00000000ffffffff x17: 74756f2f79687020 x16: ffffb305045e4f18 x15: 6769666e6f632072 x14: 6f6a616d203a3168 x13: 782d657361623030 x12: ffffb305068c6a98 x11: 0000000000000583 x10: 0000000000000018 x9 : ffffb305068c6a98 x8 : 0000000100006583 x7 : 0000000000000000 x6 : ffff00008083cc40 x5 : ffff00008083cc40 x4 : 0000000000000001 x3 : 0000000000000001 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000b269e5a8 Call trace: phylink_major_config+0x408/0x948 (P) phylink_resolve+0x294/0x6e4 process_one_work+0x148/0x28c worker_thread+0x2d8/0x3d8 kthread+0x134/0x208 ret_from_fork+0x10/0x20 Code: d63f0020 f9400e60 b4000040 f900081f (f9000ad3) ---[ end trace 0000000000000000 ]--- This is caused by "pcs" being NULL when we attempt to execute: pcs->phylink = pl; Make this conditional on pcs being non-null. Fixes: 486dc391ef43 ("net: phylink: allow mac_select_pcs() to remove a PCS") Reported-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vl39Q-00000006utm-229h@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29Merge branch 'net-stmmac-report-active-phy-interface'Jakub Kicinski
Russell King says: ==================== net: stmmac: report active phy interface The original patch needs dwmac-thead fixed so the PHY_INTF* definitions do not clash. ==================== Link: https://patch.msgid.link/aXnpTy6XckPGcmg0@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: report active PHY interfaceRussell King (Oracle)
Report the active PHY interface from the point of view of the dwmac hardware to the kernel log, where the core supports reading this. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/E1vl36F-00000006url-1fWA@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: thead: avoid conflicts with PHY_INTF_* definitionsRussell King (Oracle)
Avoid conflicts between stmmac PHY_INTF_* and GMAC_INTF_CTRL register definitions by replacing the PHY_ prefix with GMAC_. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/E1vl36A-00000006urf-19ox@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: qcom-ethqos: remove mac_baseRussell King (Oracle)
In commit 9b443e58a896 ("net: stmmac: qcom-ethqos: remove MAC_CTRL_REG modification"), ethqos->mac_base is only written, never read. Let's remove it. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vl39x-00000006uvc-0A3S@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29Merge branch 'net-fix-potential-crash-in-net-sched-cls_u32-c'Jakub Kicinski
Eric Dumazet says: ==================== net: fix potential crash in net/sched/cls_u32.c GangMin Kim provided a report and a repro fooling u32_classify(). Add skb_header_pointer_careful() variant of skb_header_pointer() and use it in net/sched/cls_u32.c. Later we can also use it in net/sched/act_pedit.c ==================== Link: https://patch.msgid.link/20260128141539.3404400-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net/sched: cls_u32: use skb_header_pointer_careful()Eric Dumazet
skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro fooling u32_classify(): BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221 Fixes: fbc2e7d9cf49 ("cls_u32: use skb_header_pointer() to dereference data safely") Reported-by: GangMin Kim <km.kim1503@gmail.com> Closes: https://lore.kernel.org/netdev/CANn89iJkyUZ=mAzLzC4GdcAgLuPnUoivdLaOs6B9rq5_erj76w@mail.gmail.com/T/ Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260128141539.3404400-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: add skb_header_pointer_careful() helperEric Dumazet
This variant of skb_header_pointer() should be used in contexts where @offset argument is user-controlled and could be negative. Negative offsets are supported, as long as the zone starts between skb->head and skb->data. Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260128141539.3404400-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29octeontx2-pf: Fix header guard comment in otx2_devlink.hAlok Tiwari
The closing #endif comment in otx2_devlink.h refers to RVU_DEVLINK_H, but the actual header guard is OTX2_DEVLINK_H. Fix the comment to match the correct header guard name. Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260127174333.1247747-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29dpll: expose fractional frequency offset in pptIvan Vecera
Currently, the dpll subsystem exports the fractional frequency offset (FFO) in parts per million (ppm). This granularity is insufficient for high-precision synchronization scenarios which often require parts per trillion (ppt) resolution. Add a new netlink attribute DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT to expose the FFO in ppt. Update the dpll netlink core to expect the driver-provided FFO value to be in ppt. To maintain backward compatibility with existing userspace tools, populate the legacy DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET attribute by dividing the new ppt value by 1,000,000. Update the zl3073x and mlx5 drivers to provide the FFO value in ppt: - zl3073x: adjust the fixed-point calculation to produce ppt (10^12) instead of ppm (10^6). - mlx5: scale the existing ppm value by 1,000,000. Signed-off-by: Ivan Vecera <ivecera@redhat.com> Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260126162253.27890-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30Merge tag 'drm-intel-next-fixes-2026-01-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Prevent u64 underflow in intel_fbc_stolen_end Signed-off-by: Dave Airlie <airlied@redhat.com> From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patch.msgid.link/aXsWGWjacEJ03rTs@jlahtine-mobl
2026-01-30Merge tag 'drm-misc-fixes-2026-01-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.19-rc8: - Fix a WARN_ON() when passing an invalid handle to drm_gem_change_handle_ioctl() - drop ddc device reference when unloading in imx/tve. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/a34d967e-b111-4b29-8c97-af3e77b5d33e@linux.intel.com
2026-01-30rust: kbuild: deduplicate pin-init flagsTamir Duberstein
Extract `pin_init{,_internal}-{cfgs,flags}` to reduce duplication. [ The new variables will be used later on to easily pass them to the `scripts/generate_rust_analyzer.py` script. - Miguel ] Acked-by: Benno Lossin <lossin@kernel.org> Signed-off-by: Tamir Duberstein <tamird@kernel.org> Link: https://patch.msgid.link/20260127-rust-analyzer-pin-init-duplication-v3-1-118c48c35e88@kernel.org [ Rebased. Moved new variables above. Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-01-30gpu: nova-core: remove imports available via preludeGary Guo
These imports are already in scope by importing `kernel::prelude::*` and does not need to be imported separately. Signed-off-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260123172007.136873-2-gary@garyguo.net Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-01-29netconsole: selftests: Move netconsole selftests to separate targetAndre Carvalho
This patch moves netconsole selftests from drivers/net to its own target in drivers/net/netconsole. This change helps saving some resources from CI since tests in drivers/net automatically run against real hardware which are not used by netconsole tests as they rely solely on netdevsim. lib_netcons.sh is kept under drivers/net/lib since it is also used by bonding selftests. Finally, drivers/net config remains unchanged as netpoll_basic.py requires netconsole (and does leverage real HW testing). Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Andre Carvalho <asantostc@gmail.com> Link: https://patch.msgid.link/20260127-netcons-selftest-target-v2-1-f509ab65b3bc@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-6.19-rc8). No adjacent changes, conflicts: drivers/net/ethernet/spacemit/k1_emac.c 2c84959167d64 ("net: spacemit: Check for netif_carrier_ok() in emac_stats_update()") f66086798f91f ("net: spacemit: Remove broken flow control support") https://lore.kernel.org/aXjAqZA3iEWD_DGM@sirena.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29MAINTAINERS: add an entry for PSPJakub Kicinski
We are missing a MAINTAINERS entry for PSP, create one. Acked-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260128210435.161061-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29Merge tag 'for-net-next-2026-01-29' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: core: - L2CAP: Add support for setting BT_PHY - HCI: Add LE Channel Sounding HCI Command/event structures - hci_conn: Set link_policy on incoming ACL connections - MGMT: Add idle_timeout to configurable system parameters drivers: - btusb: Add support for MediaTek7920 0489:e158 - btusb: Add device ID for Realtek RTL8761BU - btusb: Reject autosuspend if discovery is active - btusb: Add new VID/PID for RTL8852CE - btusb: Add USB ID 0489:e112 for Realtek 8851BE - dt-bindings: qcom: Split to separate schema - btqca: Add WCN6855 firmware priority selection feature * tag 'for-net-next-2026-01-29' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (40 commits) Bluetooth: hci_qca: Enable HFP hardware offload for WCN6855 and WCN7850 Bluetooth: hci_qca: Refactor HFP hardware offload capability handling Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB Bluetooth: L2CAP: Fix not tracking outstanding TX ident Bluetooth: MGMT: Fix memory leak in set_ssp_complete Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work Bluetooth: btusb: Remove duplicate entry for 0x13d3/0x3618 Bluetooth: btusb: Add device ID for Realtek RTL8761BU Bluetooth: btintel: Remove unneeded CONFIG_PM* #ifdef's Bluetooth: btnxpuart: Remove unneeded CONFIG_PM ifdef Bluetooth: btusb: Add new VID/PID for RTL8852CE Bluetooth: btintel_pcie: Remove unnecessary check before kfree_skb() Bluetooth: btusb: Reject autosuspend if discovery is active Bluetooth: hci_core: Export hci_discovery_active Bluetooth: btusb: Use pm_ptr instead of #ifdef CONFIG_PM dt-bindings: bluetooth: qcom,wcn7850-bt: Deprecate old supplies dt-bindings: bluetooth: qcom,wcn7850-bt: Split to separate schema dt-bindings: bluetooth: qcom,wcn6855-bt: Deprecate old supplies dt-bindings: bluetooth: qcom,wcn6855-bt: Split to separate schema dt-bindings: bluetooth: qcom,wcn6750-bt: Deprecate old supplies ... ==================== Link: https://patch.msgid.link/20260129203610.963067-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30Merge tag 'amd-drm-fixes-6.19-2026-01-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.19-2026-01-29: amdgpu: - SMU 13 fixes - SMU 14 fixes - GPUVM fault filter fix - Powergating fix - HDMI debounce fix - Xclk fix for soc21 APUs - Fix COND_EXEC handling for GC 11 - GC 10-12 KGQ init fixes - GC 11-12 KGQ reset fixes Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260129212518.22274-1-alexander.deucher@amd.com
2026-01-29kbuild: dummy-tools: Add python3Michal Suchanek
DRM_MSM_VALIDATE_XML depends on a python feature. Add a dummy python interpreter to make it possible to configure this option with dummy tools. Fixes: b587f413ca47 ("drm/msm/gen_header: allow skipping the validation") Signed-off-by: Michal Suchanek <msuchanek@suse.de> Acked-by: Rob Clark <robin.clark@oss.qualcomm.com> Link: https://patch.msgid.link/20260121105801.1827-1-msuchanek@suse.de [nathan: Remove empty shell comment line] Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-01-30rust: clk: replace `kernel::c_str!` with C-StringsTamir Duberstein
C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Benno Lossin <lossin@kernel.org> Acked-by: Stephen Boyd <sboyd@kernel.org> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Tamir Duberstein <tamird@gmail.com> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> Link: https://patch.msgid.link/20251222-cstr-clk-v1-1-ef0687717aa1@gmail.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-01-30MAINTAINERS: Update my email address to @kernel.orgBoqun Feng
I had issues using my gmail account multiple times this week, hence switch to @kernel.org. Signed-off-by: Boqun Feng <boqun@kernel.org> Reviewed-by: Paul E. McKenney <paulmck@kernel.org> Acked-by: Gary Guo <gary@garyguo.net> Acked-by: Kunwu Chan <kunwu.chan@linux.dev> Link: https://patch.msgid.link/20260129004520.62697-1-boqun@kernel.org [ Sorted alphabetically in mailmap. Removed Cc tag list. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-01-299p/xen: protect xen_9pfs_front_free against concurrent callsStefano Stabellini
The xenwatch thread can race with other back-end change notifications and call xen_9pfs_front_free() twice, hitting the observed general protection fault due to a double-free. Guard the teardown path so only one caller can release the front-end state at a time, preventing the crash. This is a fix for the following double-free: [ 27.052347] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [ 27.052357] CPU: 0 UID: 0 PID: 32 Comm: xenwatch Not tainted 6.18.0-02087-g51ab33fc0a8b-dirty #60 PREEMPT(none) [ 27.052363] RIP: e030:xen_9pfs_front_free+0x1d/0x150 [ 27.052368] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 55 41 54 55 48 89 fd 48 c7 c7 48 d0 92 85 53 e8 cb cb 05 00 48 8b 45 08 48 8b 55 00 <48> 3b 28 0f 85 f9 28 35 fe 48 3b 6a 08 0f 85 ef 28 35 fe 48 89 42 [ 27.052377] RSP: e02b:ffffc9004016fdd0 EFLAGS: 00010246 [ 27.052381] RAX: 6b6b6b6b6b6b6b6b RBX: ffff88800d66e400 RCX: 0000000000000000 [ 27.052385] RDX: 6b6b6b6b6b6b6b6b RSI: 0000000000000000 RDI: 0000000000000000 [ 27.052389] RBP: ffff88800a887040 R08: 0000000000000000 R09: 0000000000000000 [ 27.052393] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888009e46b68 [ 27.052397] R13: 0000000000000200 R14: 0000000000000000 R15: ffff88800a887040 [ 27.052404] FS: 0000000000000000(0000) GS:ffff88808ca57000(0000) knlGS:0000000000000000 [ 27.052408] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.052412] CR2: 00007f9714004360 CR3: 0000000004834000 CR4: 0000000000050660 [ 27.052418] Call Trace: [ 27.052420] <TASK> [ 27.052422] xen_9pfs_front_changed+0x5d5/0x720 [ 27.052426] ? xenbus_otherend_changed+0x72/0x140 [ 27.052430] ? __pfx_xenwatch_thread+0x10/0x10 [ 27.052434] xenwatch_thread+0x94/0x1c0 [ 27.052438] ? __pfx_autoremove_wake_function+0x10/0x10 [ 27.052442] kthread+0xf8/0x240 [ 27.052445] ? __pfx_kthread+0x10/0x10 [ 27.052449] ? __pfx_kthread+0x10/0x10 [ 27.052452] ret_from_fork+0x16b/0x1a0 [ 27.052456] ? __pfx_kthread+0x10/0x10 [ 27.052459] ret_from_fork_asm+0x1a/0x30 [ 27.052463] </TASK> [ 27.052465] Modules linked in: [ 27.052471] ---[ end trace 0000000000000000 ]--- Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com> Message-ID: <20260129230348.2390470-1-stefano.stabellini@amd.com> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
2026-01-29selftests: pci_endpoint: Add BAR subrange mapping test caseKoichiro Den
Add BAR_SUBRANGE_TEST to the pci_endpoint kselftest suite. The test uses the PCITEST_BAR_SUBRANGE ioctl and will skip when the chosen BAR is disabled (-ENODATA), when the endpoint/controller does not support subrange mapping (-EOPNOTSUPP), or when the BAR is reserved for the test register space (-EBUSY). Signed-off-by: Koichiro Den <den@valinux.co.jp> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260124145012.2794108-9-den@valinux.co.jp
2026-01-29misc: pci_endpoint_test: Add BAR subrange mapping test caseKoichiro Den
Add a new PCITEST_BAR_SUBRANGE ioctl to exercise EPC BAR subrange mapping end-to-end. The test programs a simple 2-subrange layout on the endpoint (via pci-epf-test) and verifies that: - the endpoint-provided per-subrange signature bytes are observed at the expected PCIe BAR offsets, and - writes to each subrange are routed to the correct backing region (i.e. the submap order is applied rather than accidentally working due to an identity mapping). Return -EOPNOTSUPP when the endpoint does not advertise subrange mapping, -ENODATA when the BAR is disabled, and -EBUSY when the BAR is reserved for the test register space. Signed-off-by: Koichiro Den <den@valinux.co.jp> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260124145012.2794108-8-den@valinux.co.jp
generated by cgit v1.2.3 (git 2.51.0) at 2026-10-27 23:18:20 +0000