Merge tag 'net-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from Bluetooth, IPsec, WiFi and CAN.
Current release - regressions:
- eth: wwan: mhi_wwan_ctrl: send a DTR drop before it can be coalesced
Previous releases - regressions:
- core:
- use a dedicated flag to track disabled napi instances
- frags: limit the truesize of a reassembly queue
- reject a negative TCP header offset in qdisc_pkt_len_segs_init()y
- tcp:
- reject unhashed sockets during established lookups
- free ireq->ipv6_opt after an RCU grace period
[63 lines not shown]
Merge tag 'platform-drivers-x86-v7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull platform driver fixes from Ilpo Järvinen:
- arm64: asus-glymur-ec: Resolve config loop due to THERMAL symbol
- uniwill-laptop: Add .hw_offloaded() to avoid leds subsystem warning
about missing callback
* tag 'platform-drivers-x86-v7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
platform/x86: uniwill-laptop: Implement .hw_offloaded trigger callback
platform: arm64: drop the vacuous THERMAL dependency from EC_ASUS_GLYMUR
Merge tag 'chrome-platform-firmware-fixes-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux
Pull chrome platform firmware fixes from Tzung-Bi Shih:
- Don't skip CBMEM entries outside of known memory resources
- Fix a Coccinelle warning for error-pointer handling in coreboot-cfr
* tag 'chrome-platform-firmware-fixes-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
firmware: coreboot: Fix CFR error-pointer handling warning
firmware: coreboot: Don't skip CBMEM entries outside of known memory
Merge tag 'hwmon-for-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:
- acpi_power_meter: Check for 32-bit and 64-bit unknown ACPI values,
Fix missing locking in sysfs show callbacks and resume, and Prevent
spurious power alarm when power is unknown
- aquacomputer_d5next: Avoid truncating scaled sensor readings, Check
maxcollection when probing AQUAERO devices, and reject short status
reports
- asus_rog_ryujin: Fix pump control source on the Ryujin III, and Fix
timeout when reading 0% duty cycle
- asus_wmi_sensors: Avoid global struct mutation
- chipcap2: Series of fixes addressing various bugs in the driver
[56 lines not shown]
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
Pull virtio fixes from Michael Tsirkin:
"vhost, virtio, and vdpa bugfixes.
Just a bunch of fixes all over the place"
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (38 commits)
virtio_pci: don't take the MSI mutex under cpu_hotplug_lock
virtio_ring: Initialize id field in packed indirect descriptors
vhost-scsi: fix page reference leak in misaligned I/O fallback
vduse: fix VA/PA confusion in the coherent page fault path
hwrng: virtio - prevent use-after-free after a failed restore
virtio: use consistent virtqueue terminology
virtio_balloon: initialize wakeup_lock before virtqueues are set up
MAINTAINERS: add missing virtio/vdpa/vduse/vhost headers
vhost-vdpa: initialize state before publishing cdev
vhost: reject backend enable without a kick file
vhost-scsi: reject delayed virtqueue setup
[10 lines not shown]
Merge tag 'mm-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/core
Pull core memory management fixes from David Hildenbrand:
"Here's a bigger set of MM fixes that we didn't manage to have ready
for -rc1. All fixes are stable-worthy; the majority fixes nasty
long-standing bugs instead of being purely hotfixes.
We have some more of these kinds of stable-worthy fixes in the
pipeline, but we'll focus on the really urgent fixes as we get closer
to the release.
(Leaving urgent MM fixes lurking for various weeks is not good, but
having too many changes close to the release is also not good, it's
tricky ...)
Most issues were reported by Anthropic. Others were found while
reworking proposed fixes, and of course some of the fixes were just
reported and fixed on the mailing list.
[53 lines not shown]
Merge tag 'mm-nonmm-hotfixes-stable-2026-11-04-20-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull non-MM fixes from Andrew Morton:
"22 patches. 17 are cc:stable.
Most are OCFS2 fixes. These address extended-attribute corruption,
missing attributes and kernel BUGs, along with crashes during cluster
configuration, lock migration, recovery and unmount. Extent movement
is also fixed to validate its range against a stable file size.
Three FAT changes prevent a failed-write/FIBMAP race from spuriously
making the filesystem read-only, correct directory link counts after
rename, and speed up file expansion. The reported QEMU benchmarks show
particularly large improvements on synchronous mounts.
A taint-string fix prevents an out-of-bounds read which can expose
slab contents in the kernel log. There are also build fixes for
OpenRISC modules on CPUs without hardware multiply and for Clang 24"
[22 lines not shown]
Merge tag 'mm-hotfixes-stable-2026-11-04-20-02' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM fixes from Andrew Morton:
- "mm: avoid losing atomic VMA flags" (Lorenzo Stoakes):
Preserve guard-page and soft-dirty state across VMA changes. Prevent
fork and THP collapse from losing guard markers, and keep changes
visible to applications which track modified memory.
- "MAINTAINERS: MM updates" (David Hildenbrand):
Start routing more MM components through mm/core.git and add Zi Yan
as a THP co-maintainer. Update component coverage and integration
branches as part of the transition to separate MM component trees.
- "mm/hugetlb: fix mremap bugs" (Li Zhe):
Fix hugetlb mremap deadlocks and truncated move lengths. Prevent
[80 lines not shown]
tcp: ipv6: free ireq->ipv6_opt after an RCU grace period
ireq->ipv6_opt is only set by calipso_req_setattr(), when a CALIPSO
NetLabel mapping is configured.
Request socket migration (net.ipv4.tcp_migrate_req=1, or a
BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program) clones the request
socket with inet_reqsk_clone(), so that the old request socket and
its clone share the same ipv6_opt, then reqsk_migrate_reset() clears
the pointer in the old one.
Another cpu holding a reference on the old request socket can still
be using these options, sending a SYNACK from tcp_v6_send_synack()
or creating a child in tcp_v6_syn_recv_sock(), when the clone
is freed. tcp_v6_reqsk_destructor() frees ipv6_opt with a plain
kfree(), leading to a use-after-free.
Both readers already run under RCU, like their IPv4 counterparts.
Use kfree_rcu() in tcp_v6_reqsk_destructor(), as commit e3f33b0a1d89
[13 lines not shown]
mptcp: pm: kernel: use RCU to free endpoint listeners
mptcp_pm_nl_create_listen_socket() starts the TCP listener directly
instead of going through mptcp_listen(). It consequently misses setting
SOCK_RCU_FREE on the parent MPTCP socket.
tcp_child_process() can invoke the listener's subflow_data_ready()
callback without holding the MPTCP parent lock or a reference to the
parent. An authenticated MP_JOIN racing with endpoint teardown can
therefore access the parent after its last reference has been dropped.
The ADD_ADDR error path can also close an already published listener.
Set SOCK_RCU_FREE before __inet_listen_sk() publishes the TCP listener,
matching mptcp_listen(). This protects the parent on every subsequent
close path, including a failed endpoint addition.
Fixes: 1729cf186d8a ("mptcp: create the listening socket for new port")
Cc: stable at vger.kernel.org
Signed-off-by: Kyle Zeng <kylebot at openai.com>
[3 lines not shown]
tcp: initialize send sequence numbers before deferring TFO
TCP_FASTOPEN_CONNECT can return from connect() before tcp_connect_init()
when a cached cookie or cookieless Fast Open allows deferring the SYN.
At this point write_seq contains the initial sequence number, while
snd_una and snd_nxt have not been initialized to that sequence number.
Consequently, inet_diag and /proc/net/tcp{,6} report the initial
sequence number as the send queue length despite no SYN or payload being
queued.
Initialize snd_una and snd_nxt to write_seq before marking the
connection as deferred. Both sequence-based queue lengths then remain
zero until the first write starts the connection and runs
tcp_connect_init().
Fixes: 19f6d3f3c842 ("net/tcp-fastopen: Add new API support")
Signed-off-by: Qingfang Deng <qingfang.deng at linux.dev>
Reviewed-by: Eric Dumazet <edumazet at kernel.org>
[5 lines not shown]
net: bridge: disable MRP ports before the FDB flush in del_nbp()
del_nbp() flushes the port's FDB entries before it unregisters the RX
handler. For a normal port, br_stp_disable_port() moves the port to
BR_STATE_DISABLED before this cleanup.
That does not hold for an MRP ring port. br_set_state() ignores state
changes while BR_MRP_AWARE_BIT is set, so br_stp_disable_port() leaves
the port state alone. br_mrp_port_del() then restores forwarding when
the bridge is up before clearing the bit. A frame received between
br_fdb_cleanup_by_dst() and netdev_rx_handler_unregister() can therefore
create a new FDB entry referencing the dying port. Nothing removes that
entry before destroy_nbp_rcu() frees the port, so a later frame to the
learned MAC can be forwarded through the freed port.
Remove the MRP and CFM instances before disabling the port, so that
br_stp_disable_port() actually transitions it to BR_STATE_DISABLED.
With CONFIG_BRIDGE_VLAN_FILTERING=y, synchronize_net() in
nbp_vlan_group_unpublish() also drains receive paths that could still
[29 lines not shown]
net: stmmac: set XDP metadata length on the page_pool RX path
stmmac_rx() initializes the XDP buffer with the metadata area valid, so
an XDP program can reserve metadata with bpf_xdp_adjust_meta() and write
it in [xdp->data_meta, xdp->data), for example to export the RX hardware
timestamp obtained from the metadata kfunc. When such a frame is passed
to the stack, the skb is built in place around the same page with
napi_build_skb(), but skb_metadata_set() is never called.
napi_build_skb() clears skb_shared_info up to dataref, which includes
meta_len, so skb_metadata_len() stays zero. The stack and TC BPF then see
an empty metadata range even though the bytes are present in the skb
headroom. The AF_XDP zero-copy path already records the length in
stmmac_construct_skb_zc().
Record the metadata length after reserving the headroom and adding the
frame data. No copy is needed because the skb is built over the buffer the
XDP program wrote to. With the length recorded, the software VLAN
stripping path can move the metadata together with the MAC header, as it
[9 lines not shown]
bonding: fix missing down path on speed/duplex failure after FAIL->UP
In bond_miimon_commit(), when a slave is proposed as BOND_LINK_UP but
bond_update_speed_duplex() fails in bonding mode that needs speed/duplex
(802.3ad, tlb, alb), the slave is set to BOND_LINK_DOWN directly. This
bypasses bond_set_slave_link_state(), bond_miimon_link_change() and
failover.
This is fine for slave that coming from BOND_LINK_BACK, which was never
brought up and is not in use. But since commit 1899bb325149 ("bonding:
fix state transition issue in link monitoring") the commit phase also
handles BOND_LINK_FAIL -> BOND_LINK_UP which means a slave that is still
in use and may be curr_active_slave.
If the link recovers within downdelay and goes down again before the
commit phase reads speed/duplex, the slave is silently marked down while
remaining the active slave in worst cases. In alb/tlb the bond MAC stays
on the dead port, no failover happens and TLB/RLB state is not cleaned,
so the bond stops passing traffic until that link comes back even though
[34 lines not shown]
ip6mr: Serialize multicast router socket ownership
MRT6_TABLE checks whether the socket owns its current table before
acquiring RTNL. MRT6_INIT also looks up its table before taking RTNL.
Consequently, concurrent TABLE and INIT calls can initialize the old
table and then change the socket's selected table. Another INIT can
register the same socket in the new table.
rawv6_close() calls ip6mr_sk_done(), which clears only the first table
owned by the socket. After the socket's RCU-delayed free, the other
table retains a dangling mroute_sk pointer. A subsequent multicast cache
report passes that pointer to sock_queue_rcv_skb_reason(). This produces
a KASAN slab-use-after-free in sk_filter_trim_cap().
Look up the selected table in ip6mr_sk_init() after acquiring RTNL.
Likewise, re-read the current table and check its owner under RTNL in
MRT6_TABLE before updating the selection. This preserves the single-table
ownership invariant shared with ip6mr_sk_done(), without changing the
locking of the other multicast socket options.
[6 lines not shown]
bonding: 3ad: don't set BOND_LINK_FAIL on a slave that is not up
In 802.3ad mode, when bond_update_speed_duplex() fails on NETDEV_UP or
NETDEV_CHANGE, bond_slave_netdev_event() sets the slave link to FAIL if
the slave has ever been up (last_link_up != 0), and to DOWN otherwise,
so that miimon can set it right once speed/duplex are valid.
last_link_up is never cleared, so a slave that is currently DOWN but
was up before is set to FAIL as well. miimon then treats it as a slave
that is still in use and takes it through the full down path again:
the link failure count is incremented, "link status definitely down"
is logged and the 802.3ad port is disabled a second time, although the
slave has not been up since it went down.
Reproduced in 802.3ad mode with miimon=100 by setting a slave down and
up again. On NETDEV_UP the speed is still unknown, so the notifier sets
FAIL, and the next miimon pass sees no carrier and proposes DOWN:
ip link add bond0 type bond mode 802.3ad miimon 100 lacp_rate 1
[24 lines not shown]
net: ethernet: ti: am65-cpsw-nuss: Enable timestamping of unicast PTP packets
On a BeagleY-AI (J722S), ptp4l as a unicast master (unicast_listen) logs
"received DELAY_REQ without timestamp" for each unicast Delay_Req, and
its port goes to FAULTY after "timed out while polling for tx timestamp"
for the first unicast Sync.
am65_cpsw_nuss_hwtstamp_set() does not set the TS_UNI_EN bit (bit 24) of
the port's TS_CTL_LTYPE2 register. According to the TRM (J722S TRM
SPRUJB3D, 12.2.1.4.7.13.5.1 Ethernet Port Receive Event and
12.2.1.4.7.13.5.2 Ethernet Port Transmit Event), this bit must be set
for the port to timestamp PTP event messages over UDP sent to a unicast
address; without it, only messages sent to the PTP multicast addresses
selected by the TS_107 and TS_129 to TS_132 bits are timestamped. TI's
netcp_ethss driver for the Keystone 2 Ethernet switch, which has the
same timestamping registers, always sets TS_UNI_EN.
Set TS_UNI_EN along with the other bits. With this change, ptp4l in the
same setup gets timestamps for the unicast Delay_Req and Sync messages.
[7 lines not shown]
net: 8139cp: keep Rx masked while NAPI is scheduled
cp_rx_poll() calls napi_complete_done() and only then takes cp->lock
with interrupts disabled to unmask the Rx interrupts. An interrupt
that is not masked while polling (TxOK, TxErr, ...) can arrive in
between. cp_interrupt() then sees the Rx status bits, which are still
set, finds NAPI no longer scheduled, masks Rx and schedules NAPI again.
cp_rx_poll() then carries on and unmasks Rx anyway.
From that point Rx interrupts are enabled while NAPI is scheduled:
cp_interrupt() leaves the Rx bits for the poll routine, does not mask
them because napi_schedule_prep() fails, and the level-triggered
interrupt fires again as soon as it returns. On an SH7751 LANDISK
under combined Tx/Rx load this interrupt storm was captured with a RAM
trace right before the board locked up hard.
Mask Rx in cp_interrupt() whenever Rx status is pending, not only when
NAPI gets scheduled. If the race leaves Rx unmasked, the next interrupt
masks it again, and the pending poll unmasks it when it completes.
[6 lines not shown]
net/smc: don't spin in smc_rx_recvmsg() while a pipe holds spliced data
While bytes spliced off the RMB are still in a pipe, recvmsg() waits
for the pipe to release them before it copies the data behind them.
The path to that wait skips the timeout and signal checks, and
smc_rx_wait() returns at once on RCV_SHUTDOWN. With a signal pending,
after SHUT_RD, or once the peer closes or shuts down writing,
recvmsg() spins on a CPU until the pipe is drained, and SIGKILL cannot
stop it. MSG_DONTWAIT and an expired SO_RCVTIMEO wait there too
instead of returning -EAGAIN.
Check the timeout and signals before that wait, and end it when the
pipe releases the data or the connection is killed, not on RCV_SHUTDOWN.
A zero-length read returns 0 without waiting for the pipe; a
non-blocking one returns -EAGAIN while poll() still reports the socket
readable (splice() can still take those bytes). The wait sets
SOCKWQ_ASYNC_WAITDATA like smc_rx_wait(), so a byte arriving behind
the pipe raises no SIGIO on a reader already asleep for it, and a full
barrier orders its wait queue entry before its read of splice_pending,
[8 lines not shown]
Merge tag 'linux-can-fixes-for-7.4-20261103' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2026-11-03
this is a pull request of 15 patches for net/main.
The first patch is by Vincent Mailhol and drops CAN-XL frames on non
CAN-XL devices.
A patch by Kaixuan Li for the CAN ISOTP protocol improves the check
for the correct CAN CC/FD frames.
The next 3 patches are by Cunhao Lu and make CAN skb freeing safe in
any context in several CAN helper functions.
A series by Oliver Hartkopp et al fixes several problems in the CAN
[43 lines not shown]
Merge branch 'fix-tcp-retransmissions-on-ns-nsp-socs'
Florian Fainelli says:
====================
Fix TCP retransmissions on NS/NSP SoCs
On Northstar and Northstar Plus SoCs we would see about 1000 TCP
retransmissions per second due to a rate mismatch between bgmac and b53,
make sure that we run at the same speed on both side to avoid dropping
packets on the floor.
This issue was found during testing on a Northstar Plus reference board
(BCM958625HR) while running iperf3 to a test machine and noticing
retranmsisions:
Connecting to host 192.168.3.1, port 5201
[ 4] local 192.168.3.204 port 49856 connected to 192.168.3.1 port 5201
[ ID] Interval Transfer Bitrate Retr Cwnd
[20 lines not shown]
net: ethernet: bgmac: preserve forced 2.5 Gbps link speed
Northstar and Northstar Plus use a 2.5 Gbps internal link between the
AMAC and the switch. BGMAC_FEAT_FORCE_SPEED_2500 makes bgmac_miiconfig()
configure that speed, but bgmac_adjust_link() subsequently replaces it
with the synthetic fixed PHY's 1 Gbps speed.
Use the forced speed when processing link changes so the MAC remains at
2.5 Gbps. Together with configuring the switch IMP port for its 2 Gbps
mode, this eliminates the output queue discards that caused approximately
1000 TCP retransmissions per second during an iperf3 transmit test.
Restrict the platform forced-speed flag to Northstar Plus using the SoC
compatible, since Hurricane2 shares the AMAC compatible. Other platform
AMACs without a phy-handle must continue following the fixed PHY speed.
The BCMA path already selects the flag only for the Northstar family.
Fixes: f6a95a24957a ("net: ethernet: bgmac: Add platform device support")
Signed-off-by: Florian Fainelli <florian.fainelli at broadcom.com>
[3 lines not shown]
net: dsa: b53: restore the NSP IMP port 2 Gbps mode
The Northstar Plus IMP port uses the switch's proprietary 2 Gbps mode for
its internal link to the AMAC. Its fixed-link description reports 1 Gbps,
so applying that speed clears PORT_OVERRIDE_SPEED_2000M and leaves the two
ends of the internal link configured at different speeds.
Force the 2 Gbps mode and flow control for BCM5301x and NSP CPU ports. The
mismatch caused switch output queue discards on both copper and SerDes
ports, with one discard for every TCP retransmission. With both ends
restored to their high-speed modes, iperf3 reports no retransmissions.
Fixes: b6a8a5477fe9 ("net: dsa: b53: fix resetting speed and pause on forced link")
Signed-off-by: Florian Fainelli <florian.fainelli at broadcom.com>
Reviewed-by: Simon Horman <horms at kernel.org>
Link: https://patch.msgid.link/20261029211540.4123250-3-florian.fainelli@broadcom.com
Signed-off-by: Paolo Abeni <pabeni at redhat.com>
l2tp: only return sessions of the given tunnel in l2tp_session_get()
Commit 5f77c18ea556 ("l2tp: use IDR for all session lookups") made
pppol2tp_connect() and the netlink session commands find sessions with
l2tp_session_get(), passing the socket of the tunnel they name.
L2TPv3 session IDs are unique per network namespace, except that
sessions carried over UDP are only unique per UDP socket, the socket of
their tunnel. However, l2tp_v3_session_get() only checks the socket when
another session has the same session ID. Otherwise it returns the
session, whichever tunnel it belongs to. As of now, a session command
that names the wrong tunnel acts on a session of another tunnel, and a
PPPoL2TP socket for a second L2TPv3 tunnel fails with EEXIST, because it
finds session 0 of the first tunnel.
The issue can be reproduced with:
ip l2tp add tunnel tunnel_id 3 peer_tunnel_id 3 encap udp \
local 127.0.0.1 remote 127.0.0.1 udp_sport 5003 udp_dport 6003
[20 lines not shown]
tipc: raise the minimum bearer MTU to fit tunnel and crypto overhead
A peer can lower the link MTU to TIPC_MIN_BEARER_MTU (100 bytes, plus
the UDP encapsulation header) with the max_pkt field of a RESET or
ACTIVATE message; tipc_link_proto_rcv() only checks the lower bound
returned by tipc_bearer_min_mtu(). The same bound is applied to the
device MTU when a bearer is enabled.
That bound predates two later reductions of the link MSS:
tipc_link_mss() = mtu - INT_H_SIZE (tunnel header)
- EMSG_OVERHEAD (CONFIG_TIPC_CRYPTO)
With CONFIG_TIPC_CRYPTO=y, which is the default, an MTU of 100 gives an
MSS of 28. Once the link comes up, tipc_named_node_up() calls
named_distribute(), which computes
msg_dsz = ((tipc_node_get_mtu() - INT_H_SIZE) / ITEM_SIZE) * ITEM_SIZE;
[29 lines not shown]
mptcp: do not use Fast Open on MP_JOIN subflows
tcp_fastopen_create_child() hands the SYN packet itself to
subflow_syn_recv_sock(). For an MP_JOIN request this takes the
fatal fallback: the cloned child is destroyed and handed back with
drop_req flagged, but tcp_fastopen_create_child() does not check
the flag and queues it, so accept() can expose the freed child.
MP_JOIN cannot use Fast Open: data on a subflow requires the
completed HMAC exchange (RFC 8684, sec. 3.2). Refuse it (only the
TFO path passes a SYN skb here) and let tcp_conn_request() fall
back to the regular MP_JOIN handshake; also strip the Fast Open
cookie from MP_JOIN SYN/ACKs.
Fixes: 90bf45134d55 ("mptcp: add new sock flag to deal with join subflows")
Cc: stable at vger.kernel.org
Reported-by: Kimi Security Team <bug-report at moonshot.ai>
Suggested-by: Jiayuan Chen <jiayuan.chen at linux.dev>
Suggested-by: Paolo Abeni <pabeni at redhat.com>
[5 lines not shown]
hwmon: (asus_rog_ryujin) Fix timeout when reading 0% duty cycle
The device uses the same zero-duty report format for both legitimate 0%
duty GET responses and SET confirmation ACKs on cooler and controller
duty channels. To distinguish them, rog_ryujin_raw_event() checks
!completion_done() on cooler_duty_set and controller_duty_set, assuming
this is only true while a SET command is awaiting confirmation.
However, init_completion() initializes the completion count to zero, so
!completion_done() evaluates to true from probe until the first SET
command completes. Likewise, if rog_ryujin_execute_cmd() fails to send a
command, times out, or is interrupted after reinit_completion(), the
completion remains uncompleted. When a valid 0% duty GET response then
arrives, rog_ryujin_raw_event() consumes it as a SET confirmation and
leaves the pending *_duty_received completion uncompleted, causing
rog_ryujin_execute_cmd() to wait 1.5 seconds and fail with -ETIMEDOUT.
Mark all completions as done with complete_all() after initialization in
rog_ryujin_probe(), and complete status_completion on error in
[6 lines not shown]
tcp: ipv6: do not read ireq->pktopts from tcp_v6_send_synack()
When IPV6_FL_F_REFLECT is set on a listener, or the
net.ipv6.flowlabel_reflect sysctl has FLOWLABEL_REFLECT_ESTABLISHED,
tcp_v6_send_synack() reflects the flowlabel of the SYN packet,
reading it from the skb stored in ireq->pktopts.
Since commit 079096f103fa ("tcp/dccp: install syn_recv requests
into ehash table"), request sockets are processed without holding
the listener lock. A cpu can then process a retransmitted SYN for a
request socket, and send a SYNACK from tcp_check_req(), while another
cpu receives the ACK completing the 3WHS. tcp_v6_syn_recv_sock()
consumes ireq->pktopts when it wins the hashdance, and the first cpu
reads a freed skb:
BUG: KASAN: slab-use-after-free in tcp_v6_send_synack (include/linux/skbuff.h:3152 include/linux/ipv6.h:110 net/ipv6/tcp_ipv6.c:582)
Read of size 8 at addr ffff88802b08b608 by task poc-ipv6-pktopt/5076
Call Trace:
[44 lines not shown]
Merge branch 'ip-fix-route-leak-and-unregister_netdevice-stuck'
Kuniyuki Iwashima says:
====================
ip: Fix route leak and unregister_netdevice() stuck.
Jason Zhang fed commit 0346ec2f080b ("ipv6: Prevent
rt6_insert_exception() for dying fib6_info.") to LLM to
find tricks to cause the same symptom:
unregister_netdevice: waiting for gre6 to become free. Usage count = 4
ref_tracker: netdev at 000000009652f190 has 1/3 users at
dst_alloc+0x14b/0x490
ip6_rt_cache_alloc+0x27b/0x670
__ip6_rt_update_pmtu+0x572/0x850
This series treats them.
====================
[3 lines not shown]
