summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2026-01-28wifi: rtw89: pci: validate release report content before using for RTL8922DEPing-Ke Shih
The commit 957eda596c76 ("wifi: rtw89: pci: validate sequence number of TX release report") does validation on existing chips, which somehow a release report of SKB becomes malformed. As no clear cause found, add rules ahead for RTL8922DE to avoid crash if it happens. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260123013957.16418-11-pkshih@realtek.com
2026-01-28wifi: rtw89: get designated link to replace link instance 0Zong-Zhe Yang
Clean up some places where still to get link instance 0 directly. Since now MLSR switch is supported, it's not guaranteed to always run on link instance 0. So, prefer to get designated link in most cases. For now, the only exception is MCC (multi-channel concurrency) case. How to fill content of its H2C command depends on how to choose link instance, so cannot simply change it as above. Will handle MCC case separately afterwards. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260123013957.16418-10-pkshih@realtek.com
2026-01-28wifi: rtw89: 8922a: configure FW version for SIM_SER_L0L1_BY_HALT_H2CZong-Zhe Yang
After FW version 0.35.97.0, 8922A supports SIM_SER_L0L1_BY_HALT_H2C FW feature. It allows to simulate FW L0/L1 crash under PS mode. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260123013957.16418-9-pkshih@realtek.com
2026-01-28wifi: rtw89: phy: add PHY C2H event dummy handler for func 1-7 and 2-10Ping-Ke Shih
The two functions aren't implemented and hard necessary by driver. Implement dummy handler to avoid messages: rtw89_8922de 0000:03:00.0: PHY c2h class 1 func 7 not support rtw89_8922de 0000:03:00.0: PHY c2h class 2 func 10 not support Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260123013957.16418-8-pkshih@realtek.com
2026-01-28wifi: rtw89: fw: correct content of DACK H2C commandPing-Ke Shih
The fields of command should be u8 instead of __le32. However, current firmware doesn't really use the data for now, so this mistake doesn't impact performance. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260123013957.16418-7-pkshih@realtek.com
2026-01-28wifi: rtw89: rfk: update RFK report format of IQK, DACK and TXGAPKPing-Ke Shih
The report formats of IQK, DACK and TXGAPK are changed. Update them accordingly. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260123013957.16418-6-pkshih@realtek.com
2026-01-28wifi: rtw89: rfk: add to print debug log of CIM3KPing-Ke Shih
Add calibration report of CIM3K, which does calibration in firmware and send a C2H event as debug purpose. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260123013957.16418-5-pkshih@realtek.com
2026-01-28wifi: rtw89: rfk: add firmware command to do CIM3KPing-Ke Shih
CIM is short for counter intermodulation products 3rd-order. Due to non-linearity in transmit path, need a calibration to yield performance for RF system. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260123013957.16418-4-pkshih@realtek.com
2026-01-28wifi: rtw89: rfk: add to print debug log of TX IQKPing-Ke Shih
Add report format for TX IQK, which do calibration in firmware and send a C2H event as debug purpose. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260123013957.16418-3-pkshih@realtek.com
2026-01-28wifi: rtw89: rfk: add firmware command to do TX IQKPing-Ke Shih
TX IQK is a RF calibration, which driver call this H2C command to trigger the calibration. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260123013957.16418-2-pkshih@realtek.com
2026-01-27gve: fix probe failure if clock read failsJordan Rhee
If timestamping is supported, GVE reads the clock during probe, which can fail for various reasons. Previously, this failure would abort the driver probe, rendering the device unusable. This behavior has been observed on production GCP VMs, causing driver initialization to fail completely. This patch allows the driver to degrade gracefully. If gve_init_clock() fails, it logs a warning and continues loading the driver without PTP support. Cc: stable@vger.kernel.org Fixes: a479a27f4da4 ("gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call") Signed-off-by: Jordan Rhee <jordanrhee@google.com> Reviewed-by: Shachar Raindel <shacharr@google.com> Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com> Link: https://patch.msgid.link/20260127010210.969823-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27net/mlx5e: Account for netdev stats in ndo_get_stats64Gal Pressman
The driver's ndo_get_stats64 callback is only reporting mlx5 counters, without accounting for the netdev stats, causing errors from the network stack to be invisible in statistics. Add netdev_stats_to_stats64() call to first populate the counters, then add mlx5 counters on top, ensuring both are accounted for (where appropriate). Fixes: f62b8bb8f2d3 ("net/mlx5: Extend mlx5_core to support ConnectX-4 Ethernet functionality") Signed-off-by: Gal Pressman <gal@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/1769411695-18820-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27net/mlx5e: TC, delete flows only for existing peersMark Bloch
When deleting TC steering flows, iterate only over actual devcom peers instead of assuming all possible ports exist. This avoids touching non-existent peers and ensures cleanup is limited to devices the driver is currently connected to. BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 133c8a067 P4D 0 Oops: Oops: 0002 [#1] SMP CPU: 19 UID: 0 PID: 2169 Comm: tc Not tainted 6.18.0+ #156 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_tc_del_fdb_peers_flow+0xbe/0x200 [mlx5_core] Code: 00 00 a8 08 74 a8 49 8b 46 18 f6 c4 02 74 9f 4c 8d bf a0 12 00 00 4c 89 ff e8 0e e7 96 e1 49 8b 44 24 08 49 8b 0c 24 4c 89 ff <48> 89 41 08 48 89 08 49 89 2c 24 49 89 5c 24 08 e8 7d ce 96 e1 49 RSP: 0018:ff11000143867528 EFLAGS: 00010246 RAX: 0000000000000000 RBX: dead000000000122 RCX: 0000000000000000 RDX: ff11000143691580 RSI: ff110001026e5000 RDI: ff11000106f3d2a0 RBP: dead000000000100 R08: 00000000000003fd R09: 0000000000000002 R10: ff11000101c75690 R11: ff1100085faea178 R12: ff11000115f0ae78 R13: 0000000000000000 R14: ff11000115f0a800 R15: ff11000106f3d2a0 FS: 00007f35236bf740(0000) GS:ff110008dc809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000157a01001 CR4: 0000000000373eb0 Call Trace: <TASK> mlx5e_tc_del_flow+0x46/0x270 [mlx5_core] mlx5e_flow_put+0x25/0x50 [mlx5_core] mlx5e_delete_flower+0x2a6/0x3e0 [mlx5_core] tc_setup_cb_reoffload+0x20/0x80 fl_reoffload+0x26f/0x2f0 [cls_flower] ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core] ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core] tcf_block_playback_offloads+0x9e/0x1c0 tcf_block_unbind+0x7b/0xd0 tcf_block_setup+0x186/0x1d0 tcf_block_offload_cmd.isra.0+0xef/0x130 tcf_block_offload_unbind+0x43/0x70 __tcf_block_put+0x85/0x160 ingress_destroy+0x32/0x110 [sch_ingress] __qdisc_destroy+0x44/0x100 qdisc_graft+0x22b/0x610 tc_get_qdisc+0x183/0x4d0 rtnetlink_rcv_msg+0x2d7/0x3d0 ? rtnl_calcit.isra.0+0x100/0x100 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x249/0x320 ? __alloc_skb+0x102/0x1f0 netlink_sendmsg+0x1e3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1ef/0x230 ? copy_msghdr_from_user+0x6c/0xa0 ___sys_sendmsg+0x7f/0xc0 ? ___sys_recvmsg+0x8a/0xc0 ? __sys_sendto+0x119/0x180 __sys_sendmsg+0x61/0xb0 do_syscall_64+0x55/0x640 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f35238bb764 Code: 15 b9 86 0c 00 f7 d8 64 89 02 b8 ff ff ff ff eb bf 0f 1f 44 00 00 f3 0f 1e fa 80 3d e5 08 0d 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 20 89 55 RSP: 002b:00007ffed4c35638 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000055a2efcc75e0 RCX: 00007f35238bb764 RDX: 0000000000000000 RSI: 00007ffed4c356a0 RDI: 0000000000000003 RBP: 00007ffed4c35710 R08: 0000000000000010 R09: 00007f3523984b20 R10: 0000000000000004 R11: 0000000000000202 R12: 00007ffed4c35790 R13: 000000006947df8f R14: 000055a2efcc75e0 R15: 00007ffed4c35780 Fixes: 9be6c21fdcf8 ("net/mlx5e: Handle offloads flows per peer") Signed-off-by: Mark Bloch <mbloch@nvidia.com> Reviewed-by: Shay Drori <shayd@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/1769411695-18820-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27net/mlx5: Fix Unbinding uplink-netdev in switchdev modeShay Drory
It is possible to unbind the uplink ETH driver while the E-Switch is in switchdev mode. This leads to netdevice reference counting issues[1], as the driver removal path was not designed to clean up from this state. During uplink ETH driver removal (_mlx5e_remove), the code now waits for any concurrent E-Switch mode transition to finish. It then removes the REPs auxiliary device, if exists. This ensures a graceful cleanup. [1] unregister_netdevice: waiting for eth2 to become free. Usage count = 2 ref_tracker: netdev@00000000c912e04b has 1/1 users at ib_device_set_netdev+0x130/0x270 [ib_core] mlx5_ib_vport_rep_load+0xf4/0x3e0 [mlx5_ib] mlx5_esw_offloads_rep_load+0xc7/0xe0 [mlx5_core] esw_offloads_enable+0x583/0x900 [mlx5_core] mlx5_eswitch_enable_locked+0x1b2/0x290 [mlx5_core] mlx5_devlink_eswitch_mode_set+0x107/0x3e0 [mlx5_core] devlink_nl_eswitch_set_doit+0x60/0xd0 genl_family_rcv_msg_doit+0xe0/0x130 genl_rcv_msg+0x183/0x290 netlink_rcv_skb+0x4b/0xf0 genl_rcv+0x24/0x40 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 __sys_sendto+0x119/0x180 __x64_sys_sendto+0x20/0x30 Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode") Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/1769411695-18820-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27net: usb: int51x1: use usbnet_cdc_update_filterEthan Nelson-Moore
The int51x1 driver uses the same requests as USB CDC to handle packet filtering, but provides its own definitions and function to handle it. The chip datasheet says the requests are CDC compliant. Replace this unnecessary code with a reference to usbnet_cdc_update_filter. Also fix the broken datasheet link and remove an empty comment. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260126044049.40359-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27Merge branch '100GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-01-26 (ice, idpf) For ice: Jake converts ring stats to utilize u64_stats APIs and performs some cleanups along the way. Alexander reorganizes layout of Tx and Rx rings for cacheline locality and utilizes __cacheline_group* macros on the new layouts. For idpf: YiFei Zhu adds support for BPF kfunc reporting of hardware Rx timestamps. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: idpf: export RX hardware timestamping information to XDP ice: reshuffle and group Rx and Tx queue fields by cachelines ice: convert all ring stats to u64_stats_t ice: shorten ring stat names and add accessors ice: use u64_stats API to access pkts/bytes in dim sample ice: remove ice_q_stats struct and use struct_group ice: pass pointer to ice_fetch_u64_stats_per_ring ==================== Link: https://patch.msgid.link/20260126224313.3847849-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27net: aquantia: Remove redundant UDP length adjustment with GSO_PARTIALGal Pressman
GSO_PARTIAL now takes care of updating the UDP header length, remove the redundant assignment in aq_nic_map_skb(). Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Gal Pressman <gal@nvidia.com> Link: https://patch.msgid.link/20260125121649.778086-4-gal@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27net/mlx5e: Remove redundant UDP length adjustment with GSO_PARTIALGal Pressman
GSO_PARTIAL now takes care of updating the UDP header length, mlx5e_udp_gso_handle_tx_skb() is redundant, remove it. Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260125121649.778086-3-gal@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27net: stmmac: don't pass ioaddr to fix_soc_reset() methodRussell King (Oracle)
As the stmmac_priv struct is passed to the fix_soc_reset() method which has the ioaddr, there is no need to pass ioaddr separately. Pass just the stmmac_priv struct. Fix up the glues that use it. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/E1vkLmM-00000005vE1-0nop@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27net: usb: sr9700: replace magic numbers with register bit macrosEthan Nelson-Moore
The first byte of the Rx frame is a copy of the Rx status register, so 0x40 corresponds to RSR_MF (meaning the frame is multicast). Replace 0x40 with RSR_MF for clarity. (All other bits of the RSR indicate errors. The fact that the driver ignores these errors will be fixed by a later patch.) The first byte of the status URB is a copy of the NSR, so 0x40 corresponds to NSR_LINKST. Replace 0x40 with NSR_LINKST for clarity. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Reviewed-by: Peter Korsgaard <peter@korsgaard.com> Link: https://patch.msgid.link/20260124032248.26807-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27ice: stop counting UDP csum mismatch as rx_errorsJesse Brandeburg
Since the beginning, the Intel ice driver has counted receive checksum offload mismatches into the rx_errors member of the rtnl_link_stats64 struct. In ethtool -S these show up as rx_csum_bad.nic. I believe counting these in rx_errors is fundamentally wrong, as it's pretty clear from the comments in if_link.h and from every other statistic the driver is summing into rx_errors, that all of them would cause a "hardware drop" except for the UDP checksum mismatch, as well as the fact that all the other causes for rx_errors are L2 reasons, and this L4 UDP "mismatch" is an outlier. A last nail in the coffin is that rx_errors is monitored in production and can indicate a bad NIC/cable/Switch port, but instead some random series of UDP packets with bad checksums will now trigger this alert. This false positive makes the alert useless and affects us as well as other companies. This packet with presumably a bad UDP checksum is *already* passed to the stack, just not marked as offloaded by the hardware/driver. If it is dropped by the stack it will show up as UDP_MIB_CSUMERRORS. And one more thing, none of the other Intel drivers, and at least bnxt_en and mlx5 both don't appear to count UDP offload mismatches as rx_errors. Here is a related customer complaint: https://community.intel.com/t5/Ethernet-Products/ice-rx-errros-is-too-sensitive-to-IP-TCP-attack-packets-Intel/td-p/1662125 Fixes: 4f1fe43c920b ("ice: Add more Rx errors to netdev's rx_error counter") Cc: Tony Nguyen <anthony.l.nguyen@intel.com> Cc: Jake Keller <jacob.e.keller@intel.com> Cc: IWL <intel-wired-lan@lists.osuosl.org> Signed-off-by: Jesse Brandeburg <jbrandeburg@cloudflare.com> Acked-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-01-27ice: Fix NULL pointer dereference in ice_vsi_set_napi_queuesAaron Ma
Add NULL pointer checks in ice_vsi_set_napi_queues() to prevent crashes during resume from suspend when rings[q_idx]->q_vector is NULL. Tested adaptor: 60:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller E810-XXV for SFP [8086:159b] (rev 02) Subsystem: Intel Corporation Ethernet Network Adapter E810-XXV-2 [8086:4003] SR-IOV state: both disabled and enabled can reproduce this issue. kernel version: v6.18 Reproduce steps: Boot up and execute suspend like systemctl suspend or rtcwake. Log: <1>[ 231.443607] BUG: kernel NULL pointer dereference, address: 0000000000000040 <1>[ 231.444052] #PF: supervisor read access in kernel mode <1>[ 231.444484] #PF: error_code(0x0000) - not-present page <6>[ 231.444913] PGD 0 P4D 0 <4>[ 231.445342] Oops: Oops: 0000 [#1] SMP NOPTI <4>[ 231.446635] RIP: 0010:netif_queue_set_napi+0xa/0x170 <4>[ 231.447067] Code: 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 c9 74 0b <48> 83 79 30 00 0f 84 39 01 00 00 55 41 89 d1 49 89 f8 89 f2 48 89 <4>[ 231.447513] RSP: 0018:ffffcc780fc078c0 EFLAGS: 00010202 <4>[ 231.447961] RAX: ffff8b848ca30400 RBX: ffff8b848caf2028 RCX: 0000000000000010 <4>[ 231.448443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b848dbd4000 <4>[ 231.448896] RBP: ffffcc780fc078e8 R08: 0000000000000000 R09: 0000000000000000 <4>[ 231.449345] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 <4>[ 231.449817] R13: ffff8b848dbd4000 R14: ffff8b84833390c8 R15: 0000000000000000 <4>[ 231.450265] FS: 00007c7b29e9d740(0000) GS:ffff8b8c068e2000(0000) knlGS:0000000000000000 <4>[ 231.450715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 231.451179] CR2: 0000000000000040 CR3: 000000030626f004 CR4: 0000000000f72ef0 <4>[ 231.451629] PKRU: 55555554 <4>[ 231.452076] Call Trace: <4>[ 231.452549] <TASK> <4>[ 231.452996] ? ice_vsi_set_napi_queues+0x4d/0x110 [ice] <4>[ 231.453482] ice_resume+0xfd/0x220 [ice] <4>[ 231.453977] ? __pfx_pci_pm_resume+0x10/0x10 <4>[ 231.454425] pci_pm_resume+0x8c/0x140 <4>[ 231.454872] ? __pfx_pci_pm_resume+0x10/0x10 <4>[ 231.455347] dpm_run_callback+0x5f/0x160 <4>[ 231.455796] ? dpm_wait_for_superior+0x107/0x170 <4>[ 231.456244] device_resume+0x177/0x270 <4>[ 231.456708] dpm_resume+0x209/0x2f0 <4>[ 231.457151] dpm_resume_end+0x15/0x30 <4>[ 231.457596] suspend_devices_and_enter+0x1da/0x2b0 <4>[ 231.458054] enter_state+0x10e/0x570 Add defensive checks for both the ring pointer and its q_vector before dereferencing, allowing the system to resume successfully even when q_vectors are unmapped. Fixes: 2a5dc090b92cf ("ice: move netif_queue_set_napi to rtnl-protected sections") Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Aaron Ma <aaron.ma@canonical.com> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-01-27ixgbe: don't initialize aci lock in ixgbe_recovery_probe()Kohei Enju
hw->aci.lock is already initialized in ixgbe_sw_init(), so ixgbe_recovery_probe() doesn't need to initialize the lock. This function is also not responsible for destroying the lock on failures. Additionally, change the name of label in accordance with this change. Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode") Reported-by: Simon Horman <horms@kernel.org> Closes: https://lore.kernel.org/intel-wired-lan/aTcFhoH-z2btEKT-@horms.kernel.org/ Signed-off-by: Kohei Enju <enjuk@amazon.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-01-27ixgbe: fix memory leaks in the ixgbe_recovery_probe() pathKohei Enju
When ixgbe_recovery_probe() is invoked and this function fails, allocated resources in advance are not completely freed, because ixgbe_probe() returns ixgbe_recovery_probe() directly and ixgbe_recovery_probe() only frees partial resources, resulting in memory leaks including: - adapter->io_addr - adapter->jump_tables[0] - adapter->mac_table - adapter->rss_key - adapter->af_xdp_zc_qps The leaked MMIO region can be observed in /proc/vmallocinfo, and the remaining leaks are reported by kmemleak. Don't return ixgbe_recovery_probe() directly, and instead let ixgbe_probe() to clean up resources on failures. Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode") Signed-off-by: Kohei Enju <enjuk@amazon.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-01-27net: stmmac: rk: group MACPHY register offset and fields togetherRussell King (Oracle)
Group the MACPHY register offsets and associated bitfields together to become self-documenting which definitions are associated with which register. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vkL1y-00000005usW-1TKX@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27net: stmmac: rk: convert rk3328 to use bsp_priv->idRussell King (Oracle)
rk3328 contains two GMAC instances - gmac2io and gmac2phy. While the gmac2io instance may be connected to an external PHY, the gmac2phy instance is permanently connected via RMII to an on-SoC integrated PHY. The driver currently tests for the gmac2phy instance by checking bsp_priv->integrated_phy (determined from the PHY's phy-is-integrated property) and sometimes that the interface mode is RMII. This works because the rk3328.dtsi has: gmac2phy: ethernet@ff550000 { compatible = "rockchip,rk3328-gmac"; phy-mode = "rmii"; phy-handle = <&phy>; mdio { phy: ethernet-phy@0 { phy-is-integrated; }; }; }; The driver contains a mechanism to look up the MMIO address in a table to determine bsp_priv->id, which is used for every other Rockchip device. Switch rk3328 to use this mechanism to determine bsp_priv->id and use that to select which GRF register is used for configuration, similarly to how the other Rockchip SoCs handle such differences. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vkL1t-00000005usQ-0vjt@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27net: stmmac: rk: get rid of rk_phy_power_ctl()Russell King (Oracle)
It is not worth having a common rk_phy_power_ctl() when the only difference is which regulator function is called. Also, passing true/false is non-descriptive. Split this function, moving the code appropriately into rk_phy_powerup() and rk_phy_powerdown(). Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vkL1o-00000005usJ-08hy@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27net: stmmac: rk: avoid phy_power_on()Russell King (Oracle)
In https://lore.kernel.org/netdev/aDne1Ybuvbk0AwG0@shell.armlinux.org.uk/ I requested that a follow-up patch to change the name of dwmac-rk's phy_power_on() function, which clashes with the drivers/phy function of the same name. This can cause confusion when grepping for this function name, or when reviewing code. Thankfully, stmmac doesn't make use of drivers/phy which saves this from compile errors. However, as is the usual case when a request is made as part of a review, if the review leads to successful application of the patch the author doesn't bother following up with any such requests, and so the problem falls back onto the reviewer to address... so here is the solution. Rename dwmac-rk's function to rk_phy_power_ctl(), as the function both powers up and down. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vkL1i-00000005usD-3lhz@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-27bonding: fix use-after-free due to enslave fail after slave array updateNikolay Aleksandrov
Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems. It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy Then run in parallel: while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn" The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BAD_PAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000 [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84 [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000 [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0 [ 605.603373] Call Trace: [ 605.603392] <TASK> [ 605.603410] __dev_queue_xmit+0x448/0x32a0 [ 605.603434] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603461] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603484] ? __pfx___dev_queue_xmit+0x10/0x10 [ 605.603507] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603546] ? _printk+0xcb/0x100 [ 605.603566] ? __pfx__printk+0x10/0x10 [ 605.603589] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603627] ? add_taint+0x5e/0x70 [ 605.603648] ? add_taint+0x2a/0x70 [ 605.603670] ? end_report.cold+0x51/0x75 [ 605.603693] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603731] bond_start_xmit+0x623/0xc20 [bonding] Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver") Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reported-by: Chen Zhen <chenzhen126@huawei.com> Closes: https://lore.kernel.org/netdev/fae17c21-4940-5605-85b2-1d5e17342358@huawei.com/ CC: Jussi Maki <joamaki@gmail.com> CC: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://patch.msgid.link/20260123120659.571187-1-razor@blackwall.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-27Merge tag 'iwlwifi-next-2026-01-21' of ↵Johannes Berg
https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi features. Notably: - Partial NAN support - without DATA - Initial UHR support - UNII-9 support - EHT code cleanup in iwlmvm ==================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-27Merge tag 'ath-next-20260120' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v6.20 (#2) Highlights for some specific drivers include: ath11k: Add support for Channel Frequency Response measurement. ath12k: Add support for the QCC2072 chipset. And of course there is the usual set of cleanups and bug fixes across the entire family of "ath" drivers. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-27wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()Ziyi Guo
il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex. However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating that callers must hold this lock. All other callers of il_set_tx_power() properly acquire the mutex: - il_bg_scan_completed() acquires mutex at common.c:1683 - il_mac_config() acquires mutex at common.c:5006 - il3945_commit_rxon() and il4965_commit_rxon() are called via work queues that hold the mutex (like il4965_bg_alive_start) Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in the sysfs store function to fix the missing lock protection. Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Acked-by: Stanislaw Gruszka <stf_xl@wp.pl> Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-27wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()Ziyi Guo
il3945_store_measurement() calls il3945_get_measurement() which internally calls il_send_cmd_sync() without holding il->mutex. However, il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that callers must hold this lock. Other sysfs store functions in the same file properly acquire the mutex: - il3945_store_flags() acquires mutex at 3945-mac.c:3110 - il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144 Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call in the sysfs store function to fix the missing lock protection. Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Acked-by: Stanislaw Gruszka <stf_xl@wp.pl> Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-27wifi: p54: Fix memory leak in p54_beacon_update()Zilin Guan
In p54_beacon_update(), beacon is allocated via ieee80211_beacon_get(). If p54_beacon_format_ie_tim() fails, the function returns immediately without freeing the allocated beacon skb, which would lead to a memory leak. Since no other references to this memory exist, it must be freed locally before returning the error. Fix this by freeing the buffer using dev_kfree_skb_any() in the error path. Note that this error path is unreachable in practice because mac80211 guarantees a minimum TIM length of 4 bytes for non-S1G devices. This change primarily serves to silence static analysis warnings and keep the error handling logic complete. Compile tested only. Issue found using a prototype static analysis tool and code review. Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Acked-by: Christian Lamparter <chunkeey@gmail.com> Link: https://patch.msgid.link/20260122085945.444955-1-zilin@seu.edu.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-27wifi: rtw88: sdio: Migrate to use sdio specific shutdown functionUwe Kleine-König
This saves a cast in the driver. The motivation is stop using the callback .shutdown in rsi_driver.drv to make it possible to drop that. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/5a328658c20613068bbbfabd3d0e721b69b3d474.1768232321.git.u.kleine-koenig@baylibre.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-27wifi: rsi: sdio: Migrate to use sdio specific shutdown functionUwe Kleine-König
This saves a cast in the driver. The motivation is stop using the callback .shutdown in rsi_driver.drv to make it possible to drop that. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/2909323889b8ad4732ef6a8e05b5c40487a6c4bb.1768232321.git.u.kleine-koenig@baylibre.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-27net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bitsJijie Shao
Currently, HCLGE_FD_AD_COUNTER_NUM has only 7 bits and supports a maximum of 127 counter_id. However, there are actually scenarios where the counter_id exceeds 127. This patch adds an additional bit to HCLGE_FD_AD_QID to ensure that counter_id greater than 127 are supported. Signed-off-by: Jijie Shao <shaojijie@huawei.com> Link: https://patch.msgid.link/20260123094756.3718516-3-shaojijie@huawei.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-27net: hns3: extend HCLGE_FD_AD_QID to 11 bitsJijie Shao
Currently, HCLGE_FD_AD_QID has only 10 bits and supports a maximum of 1023 queues. However, there are actually scenarios where the queue_id exceeds 1023. This patch adds an additional bit to HCLGE_FD_AD_QID to ensure that queue_id greater than 1023 are supported. Signed-off-by: Jijie Shao <shaojijie@huawei.com> Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-27net: dsa: mxl-gsw1xx: add support for Intel GSW150Daniel Golle
Add support for the Intel GSW150 (aka. Lantiq PEB7084) switch IC to the mxl-gsw1xx driver. This switch comes with 5 Gigabit Ethernet copper ports (Intel XWAY PHY11G (xRX v1.2 integrated) PHYs) as well as one GMII/RGMII and one RGMII port. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/c84cf94337bf1be30940841b338b6368468c6e17.1769099517.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-27net: dsa: mxl-gsw1xx: only setup SerDes PCS if it existsDaniel Golle
Older Intel GSW150 chip doesn't have a SGMII/1000Base-X/2500Base-X PCS. Prepare for supporting Intel GSW150 by skipping PCS reset and initialization in case no .mac_select_pcs operation is defined. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/fd46a821b1535751cd7b478a04a9ffe1e9d4d289.1769099517.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-27net: dsa: lantiq: clean up phylink_get_caps switch statementDaniel Golle
Use case ranges for phylink_get_caps and remove the redundant "port N:" from the comments. Suggested-by: Vladimir Oltean <olteanv@gmail.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/423daf99b3d60f510ff048a261c62d3de7d39321.1769099517.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-27net: dsa: lantiq: allow arbitrary MII registersDaniel Golle
The Lantiq GSWIP and MaxLinear GSW1xx drivers are currently relying on a hard-coded mapping of MII ports to their respective MII_CFG and MII_PCDU registers and only allow applying an offset to the port index. While this is sufficient for the currently supported hardware, the very similar Intel GSW150 (aka. Lantiq PEB7084) cannot be described using this arrangement. Introduce two arrays to specify the MII_CFG and MII_PCDU registers for each port, replacing the current bitmap used to safeguard MII ports as well as the port index offset. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/63fc01195196384f5e244a0ce9ec2ae3a6c08fe3.1769099517.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-26net: ethernet: ti: netcp: Use u64_stats_t with u64_stats_sync properlyDavid Yang
On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. Convert to u64_stats_t to ensure atomic operations. Note that does not mean the code is now tear-free: there're u32 counters unprotected by u64_stats or anything else. Signed-off-by: David Yang <mmyangfl@gmail.com> Link: https://patch.msgid.link/20260123164841.2890054-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-26netdevsim: use u64_stats_t with u64_stats_sync properlyDavid Yang
On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. Convert to u64_stats_t to ensure atomic operations. Signed-off-by: David Yang <mmyangfl@gmail.com> Link: https://patch.msgid.link/20260123211101.2929547-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-26net: spacemit: Check for netif_carrier_ok() in emac_stats_update()Vivian Wang
Some PHYs stop the refclk for power saving, usually while link down. This causes reading stats to time out. Therefore, in emac_stats_update(), also don't update and reschedule if !netif_carrier_ok(). But that means we could be missing later updates if the link comes back up, so also reschedule when link up is detected in emac_adjust_link(). While we're at it, improve the comments and error message prints around this to reflect the better understanding of how this could happen. Hopefully if this happens again on new hardware, these comments will direct towards a solution. Closes: https://lore.kernel.org/r/20260119141620.1318102-1-amadeus@jmu.edu.cn/ Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC") Co-developed-by: Chukun Pan <amadeus@jmu.edu.cn> Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Link: https://patch.msgid.link/20260123-k1-ethernet-clarify-stat-timeout-v3-1-93b9df627e87@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-26r8169: remove optional size argument in calls to strscpyHeiner Kallweit
Minor simplification of the code by removing the optional size argument. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/d560ec66-848e-4290-818a-ce28f39de493@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-26r8169: add support for extended chip version id and RTL9151ASJaven Xu
The bits in register TxConfig used for chip identification aren't sufficient for the number of upcoming chip versions. Therefore a register is added with extended chip version information, for compatibility purposes it's called TX_CONFIG_V2. First chip to use the extended chip identification is RTL9151AS. Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> [hkallweit1@gmail.com: add support for extended XID where XID is printed] Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/a3525b74-a1aa-43f6-8413-56615f6fa795@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-26rocker: fix memory leak in rocker_world_port_post_fini()Kery Qi
In rocker_world_port_pre_init(), rocker_port->wpriv is allocated with kzalloc(wops->port_priv_size, GFP_KERNEL). However, in rocker_world_port_post_fini(), the memory is only freed when wops->port_post_fini callback is set: if (!wops->port_post_fini) return; wops->port_post_fini(rocker_port); kfree(rocker_port->wpriv); Since rocker_ofdpa_ops does not implement port_post_fini callback (it is NULL), the wpriv memory allocated for each port is never freed when ports are removed. This leads to a memory leak of sizeof(struct ofdpa_port) bytes per port on every device removal. Fix this by always calling kfree(rocker_port->wpriv) regardless of whether the port_post_fini callback exists. Fixes: e420114eef4a ("rocker: introduce worlds infrastructure") Signed-off-by: Kery Qi <qikeyu2017@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260123211030.2109-2-qikeyu2017@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-26net: usb: replace unnecessary get_link functions with usbnet_get_linkEthan Nelson-Moore
usbnet_get_link calls mii_link_ok if the device has a MII defined in its usbnet struct and no check_connect function defined there. This is true of these drivers, so their custom get_link functions which call mii_link_ok are useless. Remove them in favor of usbnet_get_link. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Peter Korsgaard <peter@korsgaard.com> Link: https://patch.msgid.link/20260124082217.82351-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-26net: usb: smsc95xx: use phy_do_ioctl_running functionEthan Nelson-Moore
The smsc95xx_ioctl function behaves identically to the phy_do_ioctl_running function. Remove it and use the phy_do_ioctl_running function directly instead. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260124080751.78488-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.46.0) at 2026-03-10 10:08:57 +0000