summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-08-27net: rose: convert 'use' field to refcount_tTakamitsu Iwai
The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Takamitsu Iwai <takamitz@amazon.co.jp> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20250823085857.47674-3-takamitz@amazon.co.jp Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-27net: rose: split remove and free operations in rose_remove_neigh()Takamitsu Iwai
The current rose_remove_neigh() performs two distinct operations: 1. Removes rose_neigh from rose_neigh_list 2. Frees the rose_neigh structure Split these operations into separate functions to improve maintainability and prepare for upcoming refcount_t conversion. The timer cleanup remains in rose_remove_neigh() because free operations can be called from timer itself. This patch introduce rose_neigh_put() to handle the freeing of rose_neigh structures and modify rose_remove_neigh() to handle removal only. Signed-off-by: Takamitsu Iwai <takamitz@amazon.co.jp> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20250823085857.47674-2-takamitz@amazon.co.jp Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-27reset: eyeq: fix OF node leakJohan Hovold
Make sure to drop the OF node reference taken when probing the auxiliary device when the device is later unbound. Fixes: 487b1b32e317 ("reset: eyeq: add platform driver") Cc: Théo Lebrun <theo.lebrun@bootlin.com> Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Link: https://lore.kernel.org/r/20250708085613.15823-1-johan@kernel.org Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
2025-08-27io_uring/kbuf: fix signedness in this_len calculationQingyue Zhang
When importing and using buffers, buf->len is considered unsigned. However, buf->len is converted to signed int when committing. This can lead to unexpected behavior if the buffer is large enough to be interpreted as a negative value. Make min_t calculation unsigned. Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption") Co-developed-by: Suoxing Zhang <aftern00n@qq.com> Signed-off-by: Suoxing Zhang <aftern00n@qq.com> Signed-off-by: Qingyue Zhang <chunzhennn@qq.com> Link: https://lore.kernel.org/r/tencent_4DBB3674C0419BEC2C0C525949DA410CA307@qq.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-27PCI: keystone: Use kcalloc() instead of kzalloc()Qianfeng Rong
Replace calls of devm_kzalloc() with devm_kcalloc() in ks_pcie_probe(). As noted in the kernel documentation [1], open-coded multiplication in allocator arguments is discouraged because it can lead to integer overflow. Using devm_kcalloc() provides built-in overflow protection, making the memory allocation safer when calculating the allocation size compared to explicit multiplication. [1]: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com> Link: https://patch.msgid.link/20250819131235.152967-1-rongqianfeng@vivo.com
2025-08-27drm/xe: Ensure GT is in C0 during resumesXin Wang
This patch ensures the gt will be awake for the entire duration of the resume sequences until GuCRC takes over and GT-C6 gets re-enabled. Before suspending GT-C6 is kept enabled, but upon resume, GuCRC is not yet alive to properly control the exits and some cases of instability and corruption related to GT-C6 can be observed. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4037 Suggested-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Xin Wang <x.wang@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4037 Link: https://lore.kernel.org/r/20250827000633.1369890-3-x.wang@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-08-27drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internallyXin Wang
Move forcewake_get() into xe_gt_idle_enable_c6() to streamline the code and make it easier to use. Suggested-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Xin Wang <x.wang@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://lore.kernel.org/r/20250827000633.1369890-2-x.wang@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-08-27dt-bindings: PCI: Add STM32MP25 PCIe Root Complex bindingsChristian Bruel
Document the bindings for STM32MP25 PCIe Controller configured in root complex mode with one root port. Supports 4 INTx and MSI interrupts from the ARM GICv2m controller. STM32 PCIe may be in a power domain which is the case for the STM32MP25 based boards. Supports WAKE# from wake-gpios Signed-off-by: Christian Bruel <christian.bruel@foss.st.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://patch.msgid.link/20250820075411.1178729-4-christian.bruel@foss.st.com
2025-08-27pinctrl: Add pinctrl_pm_select_init_state helper functionChristian Bruel
If a platform requires an initial pinctrl state during probing, this helper function provides the client with access to the same initial state. eg: xxx_suspend_noirq ... pinctrl_pm_select_sleep_state xxx resume_noirq pinctrl_pm_select_init_state ... pinctrl_pm_select_default_state Signed-off-by: Christian Bruel <christian.bruel@foss.st.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://patch.msgid.link/20250820075411.1178729-3-christian.bruel@foss.st.com
2025-08-27Documentation: pinctrl: Describe PM helper functions for standard states.Christian Bruel
Clarify documentation for predefined standard state names 'default', 'init', 'sleep', 'idle' and their associated PM API. Signed-off-by: Christian Bruel <christian.bruel@foss.st.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://patch.msgid.link/20250820075411.1178729-2-christian.bruel@foss.st.com
2025-08-27selftests: pci_endpoint: Skip IRQ test if IRQ is out of range.Christian Bruel
The pci_endpoint_test tests the entire MSI/MSI-X range, which generates false errors on platforms that do not support the whole range. Skip the test in such cases and report accordingly. Signed-off-by: Christian Bruel <christian.bruel@foss.st.com> [mani: reworded description] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20250804170916.3212221-4-christian.bruel@foss.st.com
2025-08-27misc: pci_endpoint_test: Cleanup extra 0 initializationChristian Bruel
Initialization is not needed as memory is already set to 0 by devm_kzalloc. Signed-off-by: Christian Bruel <christian.bruel@foss.st.com> [mani: reworded description] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20250804170916.3212221-3-christian.bruel@foss.st.com
2025-08-27misc: pci_endpoint_test: Skip IRQ tests if irq is out of rangeChristian Bruel
The pci_endpoint_test tests the 32-bit MSI range. However, the device might not have all vectors configured. For example, if msi_interrupts is 8 in the ep function space or if the MSI Multiple Message Capable value is configured as 4 (maximum 16 vectors). In this case, do not attempt to run the test to avoid timeouts and directly return the error value. Signed-off-by: Christian Bruel <christian.bruel@foss.st.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20250804170916.3212221-2-christian.bruel@foss.st.com
2025-08-27ALSA: hda/tas2781: Fix EFI name for calibration beginning with 1 instead of 0Shenghao Ding
A bug reported by one of my customers that EFI name beginning with 0 instead of 1. Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib") Signed-off-by: Shenghao Ding <shenghao-ding@ti.com> Link: https://patch.msgid.link/20250827043404.644-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-08-27drm/stm: ltdc: unify log systemRaphael Gallais-Pou
DRM_ERROR and similar are deprecated. Use drm_dev based logging. Link: https://lore.kernel.org/r/20250821130356.883553-1-raphael.gallais-pou@foss.st.com Acked-by: Yannick Fertre <yannick.fertre@foss.st.com> Link: https://lore.kernel.org/r/20250825132951.547899-1-raphael.gallais-pou@foss.st.com Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
2025-08-27dt-bindings: panel: lvds: Append ampire,amp19201200b5tzqw-t03 in panel-lvdsRaphael Gallais-Pou
List Ampire AMP19201200B5TZQW-T03 in the LVDS panel enumeration. Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://lore.kernel.org/r/20250826-drm-misc-next-v1-1-980d0a0592b9@foss.st.com Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
2025-08-27dt-bindings: PCI: Correct example indentationKrzysztof Kozlowski
DTS example in the bindings should be indented with 2- or 4-spaces, so correct a mixture of different styles to keep consistent 4-spaces. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20250818142138.129327-2-krzysztof.kozlowski@linaro.org
2025-08-27fuse: zero initialize inode private dataMiklos Szeredi
This is slightly tricky, since the VFS uses non-zeroing allocation to preserve some fields that are left in a consistent state. Reported-by: Chunsheng Luo <luochunsheng@ustc.edu> Closes: https://lore.kernel.org/all/20250818083224.229-1-luochunsheng@ustc.edu/ Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27fuse: remove unused 'inode' parameter in fuse_passthrough_openChunsheng Luo
The 'inode' parameter in fuse_passthrough_open() is never referenced in the function implementation. Signed-off-by: Chunsheng Luo <luochunsheng@ustc.edu> Reviewed-by: Joanne Koong <joannelkoong@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27fuse: Block access to folio overlimitEdward Adam Davis
syz reported a slab-out-of-bounds Write in fuse_dev_do_write. When the number of bytes to be retrieved is truncated to the upper limit by fc->max_pages and there is an offset, the oob is triggered. Add a loop termination condition to prevent overruns. Fixes: 3568a9569326 ("fuse: support large folios for retrieves") Reported-by: syzbot+2d215d165f9354b9c4ea@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2d215d165f9354b9c4ea Tested-by: syzbot+2d215d165f9354b9c4ea@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> Reviewed-by: Joanne Koong <joannelkoong@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27virtio_fs: fix the hash table using in virtio_fs_enqueue_req()Li RongQing
The original commit be2ff42c5d6e ("fuse: Use hash table to link processing request") converted fuse_pqueue->processing to a hash table, but virtio_fs_enqueue_req() was not updated to use it correctly. So use fuse_pqueue->processing as a hash table, this make the code more coherent Co-developed-by: Fushuai Wang <wangfushuai@baidu.com> Signed-off-by: Fushuai Wang <wangfushuai@baidu.com> Signed-off-by: Li RongQing <lirongqing@baidu.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27mm: remove BDI_CAP_WRITEBACK_ACCTJoanne Koong
There are no users of BDI_CAP_WRITEBACK_ACCT now that fuse doesn't do its own writeback accounting. This commit removes BDI_CAP_WRITEBACK_ACCT. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Acked-by: David Hildenbrand <david@redhat.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27fuse: use default writeback accountingJoanne Koong
commit 0c58a97f919c ("fuse: remove tmp folio for writebacks and internal rb tree") removed temp folios for dirty page writeback. Consequently, fuse can now use the default writeback accounting. With switching fuse to use default writeback accounting, there are some added benefits. This updates wb->writeback_inodes tracking as well now and updates writeback throughput estimates after writeback completion. This commit also removes inc_wb_stat() and dec_wb_stat(). These have no callers anymore now that fuse does not call them. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Bernd Schubert <bschubert@ddn.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27virtio_fs: Remove redundant spinlock in virtio_fs_request_complete()Li RongQing
Since clear_bit is an atomic operation, the spinlock is redundant and can be removed, reducing lock contention is good for performance. Signed-off-by: Li RongQing <lirongqing@baidu.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27fuse: remove unneeded offset assignment when filling write pagesJoanne Koong
With the change in aee03ea7ff98 ("fuse: support large folios for writethrough writes"), this old line for setting ap->descs[0].offset is now obsolete and unneeded. This should have been removed as part of aee03ea7ff98. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Fixes: aee03ea7ff98 ("fuse: support large folios for writethrough writes") Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27fuse: use freezable wait in fuse_get_req()Sergey Senozhatsky
Use freezable wait in fuse_get_req() so that it won't block the system from entering suspend: Freezing user space processes failed after 20.009 seconds Call trace: __switch_to+0xcc/0x168 schedule+0x57c/0x1138 fuse_get_req+0xd0/0x2b0 fuse_simple_request+0x120/0x620 fuse_getxattr+0xe4/0x158 fuse_xattr_get+0x2c/0x48 __vfs_getxattr+0x160/0x1d8 get_vfs_caps_from_disk+0x74/0x1a8 __audit_inode+0x244/0x4d8 user_path_at_empty+0x2e0/0x390 __arm64_sys_faccessat+0xdc/0x260 Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27sched/wait: Add wait_event_state_exclusive()Sergey Senozhatsky
Allows exclusive waits with a custom @state. Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27Documentation: fuse: Consolidate FUSE docs into its own subdirectoryBagas Sanjaya
All four FUSE docs are currently in upper-level Documentation/filesystems/ directory, but these are distinct as a group of its own. Move them into Documentation/filesystems/fuse/ subdirectory. Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com> Acked-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27selftests: filesystems: Add functional test for the abort file in fusectlChen Linxuan
This patch add a simple functional test for the "abort" file in fusectlfs (/sys/fs/fuse/connections/ID/abort). A simple fuse daemon is added for testing. Related discussion can be found in the link below. Link: https://lore.kernel.org/all/CAOQ4uxjKFXOKQxPpxtS6G_nR0tpw95w0GiO68UcWg_OBhmSY=Q@mail.gmail.com/ Signed-off-by: Chen Linxuan <chenlinxuan@uniontech.com> Acked-by: Shuah Khan <skhan@linuxfoundation.org> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27doc: fuse: Add max_background and congestion_thresholdChen Linxuan
As I preparing patches adding selftests for fusectl, I notice that documentation of max_background and congestion_threshold is missing. This patch add some descriptions about these two files. Cc: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Chen Linxuan <chenlinxuan@uniontech.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27fuse: add COPY_FILE_RANGE_64 that allows large copiesMiklos Szeredi
The FUSE protocol uses struct fuse_write_out to convey the return value of copy_file_range, which is restricted to uint32_t. But the COPY_FILE_RANGE interface supports a 64-bit size copies and there's no reason why copies should be limited to 32-bit. Introduce a new op COPY_FILE_RANGE_64, which is identical, except the number of bytes copied is returned in a 64-bit value. If the fuse server does not support COPY_FILE_RANGE_64, fall back to COPY_FILE_RANGE. Reported-by: Florian Weimer <fweimer@redhat.com> Closes: https://lore.kernel.org/all/lhuh5ynl8z5.fsf@oldenburg.str.redhat.com/ Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-08-27drm/sysfb: Do not deref unexisting CRTC state in atomic_disableThomas Zimmermann
Do not access CRTC state in drm_sysfb_plane_helper_atomic_disable(). Use format from sysfb device for clearing scanout buffer. This is the behavior from before commit 061963cd9e5b ("drm/sysfb: Blit to CRTC destination format"). When being disabled, the plane has no associated CRTC. Trying to deref the format pointer results in a segmentation fault. An example stack track is shown below. [ 58.948915] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000023: 0000 [#1] SMP KASAN PTI [ 58.959971] KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] [...] [ 58.979308] RIP: 0010:drm_sysfb_plane_helper_atomic_disable+0x1af/0x520 [...] [ 59.084227] Call Trace: [ 59.086682] <TASK> [ 59.088793] ? __pfx_drm_sysfb_plane_helper_atomic_disable+0x10/0x10 [ 59.095155] ? crtc_disable+0xf2/0x5a0 [ 59.098920] drm_atomic_helper_commit_planes+0x848/0x1030 [ 59.104336] drm_atomic_helper_commit_tail+0x41/0xb0 [ 59.109316] commit_tail+0x204/0x330 [ 59.112903] drm_atomic_helper_commit+0x242/0x2e0 [ 59.117618] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 59.122851] drm_atomic_commit+0x1e1/0x290 [ 59.126957] ? drm_atomic_add_affected_connectors+0x266/0x330 [ 59.132714] ? __pfx_drm_atomic_commit+0x10/0x10 [ 59.137343] ? __pfx___drm_printfn_info+0x10/0x10 [ 59.142058] ? drm_atomic_set_crtc_for_connector+0x436/0x630 [ 59.147729] atomic_remove_fb+0x631/0x920 [ 59.151751] ? save_trace+0xcf/0x180 [ 59.155343] ? __pfx_atomic_remove_fb+0x10/0x10 [ 59.159890] ? __pfx___drm_dev_dbg+0x10/0x10 [ 59.164173] drm_framebuffer_remove+0x19a/0x710 Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: 061963cd9e5b ("drm/sysfb: Blit to CRTC destination format") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14874 Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Javier Martinez Canillas <javierm@redhat.com> Cc: dri-devel@lists.freedesktop.org Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://lore.kernel.org/r/20250826145044.954396-1-tzimmermann@suse.de
2025-08-27mmc: sdio: Drop dev_pm_domain_detach() callClaudiu Beznea
Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Link: https://lore.kernel.org/r/20250827101236.927313-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-08-27fs: stop accessing ->i_count directly in f2fs and gfs2Josef Bacik
Instead of accessing ->i_count directly in these file systems, use the appropriate __iget and iput helpers. Signed-off-by: Josef Bacik <josef@toxicpanda.com> Link: https://lore.kernel.org/b8e6eb8a3e690ce082828d3580415bf70dfa93aa.1755806649.git.josef@toxicpanda.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-27netfilter: conntrack: helper: Replace -EEXIST by -EBUSYPhil Sutter
The helper registration return value is passed-through by module_init callbacks which modprobe confuses with the harmless -EEXIST returned when trying to load an already loaded module. Make sure modprobe fails so users notice their helper has not been registered and won't work. Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu> Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
2025-08-27netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() ↵Wang Liang
after confirm When send a broadcast packet to a tap device, which was added to a bridge, br_nf_local_in() is called to confirm the conntrack. If another conntrack with the same hash value is added to the hash table, which can be triggered by a normal packet to a non-bridge device, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200 CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary) RIP: 0010:br_nf_local_in+0x168/0x200 Call Trace: <TASK> nf_hook_slow+0x3e/0xf0 br_pass_frame_up+0x103/0x180 br_handle_frame_finish+0x2de/0x5b0 br_nf_hook_thresh+0xc0/0x120 br_nf_pre_routing_finish+0x168/0x3a0 br_nf_pre_routing+0x237/0x5e0 br_handle_frame+0x1ec/0x3c0 __netif_receive_skb_core+0x225/0x1210 __netif_receive_skb_one_core+0x37/0xa0 netif_receive_skb+0x36/0x160 tun_get_user+0xa54/0x10c0 tun_chr_write_iter+0x65/0xb0 vfs_write+0x305/0x410 ksys_write+0x60/0xd0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> ---[ end trace 0000000000000000 ]--- To solve the hash conflict, nf_ct_resolve_clash() try to merge the conntracks, and update skb->_nfct. However, br_nf_local_in() still use the old ct from local variable 'nfct' after confirm(), which leads to this warning. If confirm() does not insert the conntrack entry and return NF_DROP, the warning may also occur. There is no need to reserve the WARN_ON_ONCE, just remove it. Link: https://lore.kernel.org/netdev/20250820043329.2902014-1-wangliang74@huawei.com/ Fixes: 62e7151ae3eb ("netfilter: bridge: confirm multicast packets before passing them up the stack") Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Wang Liang <wangliang74@huawei.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2025-08-27x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGONK Prateek Nayak
Prior to the topology parsing rewrite and the switchover to the new parsing logic for AMD processors in c749ce393b8f ("x86/cpu: Use common topology code for AMD"), the initial_apicid on these platforms was: - First initialized to the LocalApicId from CPUID leaf 0x1 EBX[31:24]. - Then overwritten by the ExtendedLocalApicId in CPUID leaf 0xb EDX[31:0] on processors that supported topoext. With the new parsing flow introduced in f7fb3b2dd92c ("x86/cpu: Provide an AMD/HYGON specific topology parser"), parse_8000_001e() now unconditionally overwrites the initial_apicid already parsed during cpu_parse_topology_ext(). Although this has not been a problem on baremetal platforms, on virtualized AMD guests that feature more than 255 cores, QEMU zeros out the CPUID leaf 0x8000001e on CPUs with CoreID > 255 to prevent collision of these IDs in EBX[7:0] which can only represent a maximum of 255 cores [1]. This results in the following FW_BUG being logged when booting a guest with more than 255 cores: [Firmware Bug]: CPU 512: APIC ID mismatch. CPUID: 0x0000 APIC: 0x0200 AMD64 Architecture Programmer's Manual Volume 2: System Programming Pub. 24593 Rev. 3.42 [2] Section 16.12 "x2APIC_ID" mentions the Extended Enumeration leaf 0xb (Fn0000_000B_EDX[31:0])(which was later superseded by the extended leaf 0x80000026) provides the full x2APIC ID under all circumstances unlike the one reported by CPUID leaf 0x8000001e EAX which depends on the mode in which APIC is configured. Rely on the APIC ID parsed during cpu_parse_topology_ext() from CPUID leaf 0x80000026 or 0xb and only use the APIC ID from leaf 0x8000001e if cpu_parse_topology_ext() failed (has_topoext is false). On platforms that support the 0xb leaf (Zen2 or later, AMD guests on QEMU) or the extended leaf 0x80000026 (Zen4 or later), the initial_apicid is now set to the value parsed from EDX[31:0]. On older AMD/Hygon platforms that do not support the 0xb leaf but support the TOPOEXT extension (families 0x15, 0x16, 0x17[Zen1], and Hygon), retain current behavior where the initial_apicid is set using the 0x8000001e leaf. Issue debugged by Naveen N Rao (AMD) <naveen@kernel.org> and Sairaj Kodilkar <sarunkod@amd.com>. [ bp: Massage commit message. ] Fixes: c749ce393b8f ("x86/cpu: Use common topology code for AMD") Suggested-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Tested-by: Naveen N Rao (AMD) <naveen@kernel.org> Cc: stable@vger.kernel.org Link: https://github.com/qemu/qemu/commit/35ac5dfbcaa4b [1] Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 [2] Link: https://lore.kernel.org/20250825075732.10694-2-kprateek.nayak@amd.com
2025-08-27wifi: mt76: fix linked list corruptionFelix Fietkau
Never leave scheduled wcid entries on the temporary on-stack list Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx") Link: https://patch.msgid.link/20250827085352.51636-6-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: free pending offchannel tx frames on wcid cleanupFelix Fietkau
Avoid leaking them or keeping the wcid on the tx list Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx") Link: https://patch.msgid.link/20250827085352.51636-5-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: mt7915: fix list corruption after hardware restartFelix Fietkau
Since stations are recreated from scratch, all lists that wcids are added to must be cleared before calling ieee80211_restart_hw. Set wcid->sta = 0 for each wcid entry in order to ensure that they are not added again before they are ready. Fixes: 8a55712d124f ("wifi: mt76: mt7915: enable full system reset support") Link: https://patch.msgid.link/20250827085352.51636-4-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: mt7996: add missing check for rx wcid entriesFelix Fietkau
Non-station wcid entries must not be passed to the rx functions. In case of the global wcid entry, it could even lead to corruption in the wcid array due to pointer being casted to struct mt7996_sta_link using container_of. Fixes: 7464b12b7d92 ("wifi: mt76: mt7996: rework mt7996_rx_get_wcid to support MLO") Link: https://patch.msgid.link/20250827085352.51636-3-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: do not add non-sta wcid entries to the poll listFelix Fietkau
Polling and airtime reporting is valid for station entries only Link: https://patch.msgid.link/20250827085352.51636-2-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: mt7996: fix crash on some tx status reportsFelix Fietkau
When a wcid can't be found, link_sta can be stale from a previous batch. The code currently assumes that if link_sta is set, wcid is also non-zero. Fix wcid NULL pointer dereference by resetting link_sta when a wcid entry can't be found. Fixes: 62da647a2b20 ("wifi: mt76: mt7996: Add MLO support to mt7996_tx_check_aggr()") Link: https://patch.msgid.link/20250827085352.51636-1-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: mt7996: use the correct vif link for scanning/rocChad Monroe
restore fix which was dropped during MLO rework Fixes: f0b0b239b8f3 ("wifi: mt76: mt7996: rework mt7996_mac_write_txwi() for MLO support") Signed-off-by: Chad Monroe <chad@monroe.io> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/180fffd409aa57f535a3d2c1951e41ae398ce09e.1754659732.git.chad@monroe.io Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: mt7996: disable beacons when going offchannelFelix Fietkau
Avoid leaking beacons on unrelated channels during scanning/roc Fixes: c56d6edebc1f ("wifi: mt76: mt7996: use emulated hardware scan support") Reported-by: Chad Monroe <chad.monroe@adtran.com> Link: https://patch.msgid.link/20250813121106.81559-1-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: prevent non-offchannel mgmt tx during scan/rocFelix Fietkau
Only put probe request packets in the offchannel queue if IEEE80211_TX_CTRL_DONT_USE_RATE_MASK is set and IEEE80211_TX_CTL_TX_OFFCHAN is unset. Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx") Reported-by: Chad Monroe <chad.monroe@adtran.com> Link: https://patch.msgid.link/20250813121106.81559-2-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: mt7925: skip EHT MLD TLV on non-MLD and pass conn_state for sta_cmdMing Yen Hsieh
Return early in mt7925_mcu_sta_eht_mld_tlv() for non-MLD vifs to avoid bogus MLD TLVs, and pass the proper connection state to sta_basic TLV. Cc: stable@vger.kernel.org Fixes: cb1353ef3473 ("wifi: mt76: mt7925: integrate *mlo_sta_cmd and *sta_cmd") Reported-by: Tal Inbar <inbartdev@gmail.com> Tested-by: Tal Inbar <inbartdev@gmail.com> Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> Link: https://patch.msgid.link/20250818030201.997940-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: mt7925u: use connac3 tx aggr check in tx completeMing Yen Hsieh
MT7925 is a connac3 device; using the connac2 helper mis-parses TXWI and breaks AMPDU/BA accounting. Use the connac3-specific helper mt7925_tx_check_aggr() instead, Cc: stable@vger.kernel.org Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Reported-by: Nick Morrow <morrownr@gmail.com> Tested-by: Nick Morrow <morrownr@gmail.com> Tested-on: Netgear A9000 USB WiFi adapter Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> Link: https://patch.msgid.link/20250818020203.992338-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: mt7925: fix the wrong bss cleanup for SAPMing Yen Hsieh
When in SAP mode, if a STA disconnect, the SAP's BSS should not be cleared. Fixes: 0ebb60da8416 ("wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure") Cc: stable@vger.kernel.org Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> Link: https://patch.msgid.link/20250728052612.39751-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-08-27wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()Harshit Mogalapalli
&dev->mt76.mutex lock is taken using mt792x_mutex_acquire(dev) but not released in one of the error paths, add the unlock to fix it. Fixes: 5cd0bd815c8a ("wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/202503031055.3ZRqxhAl-lkp@intel.com/ Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Link: https://patch.msgid.link/20250727140416.1153406-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
generated by cgit v1.3 (git 2.53.0) at 2026-11-15 19:19:00 +0000