summaryrefslogtreecommitdiff
path: root/tools
AgeCommit message (Collapse)Author
14 daysiommufd/selftest: Cover invalid read counts on vEVENTQ FDNicolin Chen
The vEVENTQ file descriptor must reject reads whose buffer cannot hold even one event record. Add selftest coverage that exercises both the empty-queue path (the upfront size check) and the non-empty path (the in-loop check that fires only after an event is fetched). For iommufd_veventq_fops_read(): - count == 0 and count < sizeof(header) on an empty vEVENTQ both return -EINVAL. - count == 0 and count == sizeof(header) on a non-empty vEVENTQ (event has trailing payload) both return -EINVAL. Link: https://patch.msgid.link/r/7bcd153d306f2cf04c094c728c0ebe146855072a.1780343944.git.nicolinc@nvidia.com Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Nicolin Chen <nicolinc@nvidia.com> Reviewed-by: Pranjal Shrivastava <praan@google.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-06-04selftests: rds: report missing RDMA prereqs as XFAILAllison Henderson
Make the RDMA test return XFAIL rather than skip when RXE is not available, since the RDMA datapath is not run in netdev CI. Change the three RDMA-prerequisite checks in check_rdma_conf() and check_rdma_conf_enabled() to exit with KSFT_XFAIL (2) and tag their messages [XFAIL] instead of [SKIP]. Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260602050657.26389-5-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-04selftests: rds: support RDS built as loadable modulesAllison Henderson
Commit 92cc6708f4a2 ("selftests: rds: config: disable modules") set CONFIG_MODULES=n since run.sh required this kconfig. But disabling modules also forces every =m option to =n rather than =y, which can silently drop unrelated features. This patch removes CONFIG_MODULES=n from the rds selftest config and updates the check_*conf_enabled() routines to accept a config as either built-in (=y) or modular (=m). A new probe_module() function is added to load the backing module when a component is set to be modular (=m). config.sh no longer forces CONFIG_MODULES=n, so a user who follows the SKIP message to run config.sh does not silently end up with modules disabled again. rds.ko itself is auto-loaded on socket creation, and rds_rdma.ko is auto-loaded when SO_RDS_TRANSPORT is set with RDS_TRANS_IB, but the TCP transport (rds_tcp.ko) is not auto-loaded on the bind path, so the backing modules are loaded explicitly here. Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260602050657.26389-4-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-04selftests: rds: pin RDS sockets to their intended transportAllison Henderson
The RDS selftests create AF_RDS sockets but never selects a transport, so the transport is chosen implicitly based on network topology when the socket is bound. If underlying connection establishment fails, RDS can fall back to another transport (e.g. loopback) and the test still passes, silently bypassing the intended datapath it is meant to exercise. Set SO_RDS_TRANSPORT to the proper RDS_TRANS_IB or RDS_TRANS_TCP before they are bound, so the test fails loudly if the intended transport is unavailable rather than passing on a different path. Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260602050657.26389-3-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-04selftests: rds: Rename run.sh to rds_run.shAllison Henderson
This patch renames run.sh to rds_run.sh. This gives the test a self-describing name that appears in the netdev CI dashboard. Suggested-by: Matthieu Baerts <matttbe@kernel.org> Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260602050657.26389-2-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-04tools: ynl: try to avoid the very slow YAML loaderJakub Kicinski
Turns out Python YAML defaults to a pure Python loader for YAML files which is a lot slower than the C loader (using libyaml). Try to use the C one whenever possible. The avg time to run: $ tools/net/ynl/pyynl/cli.py --family tc --no-schema drops from 300+ ms to 115 ms with this change (40 samples). We could drop the load time further to 85 ms if we "compiled" the specs to JSON. Slightly tricky parts are that we don't currently install the specs at all on make install, so it's unclear where to put the conversion. Also JSON has questionable support for comments and we need an SPDX line. Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Donald Hunter <donald.hunter@gmail.com> Link: https://patch.msgid.link/20260603210810.2636193-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-04Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.1-rc7). Silent conflicts: net/wireless/nl80211.c cb9959ab5f99 ("wifi: cfg80211: enforce HE/EHT cap/oper consistency") a384ae969902 ("wifi: cfg80211: move AP HT/VHT/... operation to beacon info") https://lore.kernel.org/aiGJDaHV4UlCexIQ@sirena.org.uk Conflicts: drivers/net/wireless/intel/iwlwifi/mld/ap.c a342c99cb70d ("wifi: iwlwifi: mld: honor BSS_CHANGED_BEACON_ENABLED") 9bf1b409afc7 ("wifi: iwlwifi: mld: send tx power constraints before link activation") https://lore.kernel.org/ah2bfedhV45ZxMO8@sirena.org.uk drivers/net/wireless/intel/iwlwifi/pcie/drv.c 093305d801fa ("wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used") e2323929a68a ("wifi: iwlwifi: pcie: add debug print for resume flow if powered off") https://lore.kernel.org/ah2bfedhV45ZxMO8@sirena.org.uk Adjacent changes: drivers/net/ethernet/airoha/airoha_eth.c b38cae85d1c4 ("net: airoha: Fix use-after-free in metadata dst teardown") ec6c391bcca7 ("net: airoha: Introduce airoha_gdm_dev struct") drivers/net/ethernet/microchip/lan743x_main.c 8173d22b211f ("net: lan743x: permit VLAN-tagged packets up to configured MTU") e3c6508a46f5 ("net: lan743x: avoid netdev-based logging before netdev registration") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-04Merge tag 'net-7.1-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from Netfilter, wireless and Bluetooth. Current release - fix to a fix: - Bluetooth: MGMT: fix backward compatibility with bluetoothd which adds stray bytes to MGMT_OP_ADD_EXT_ADV_DATA Previous releases - regressions: - af_unix: fix inq_len update inaccuracy on partial read - eth: fec: fix pinctrl default state restore order on resume - wifi: iwlwifi: - mvm: don't support the reset handshake for old firmwares - pcie: simplify the resume flow if fast resume is not used, work around NIC access failures Previous releases - always broken: - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - sctp: fix a couple of bugs in COOKIE_ECHO processing - sched: fix pedit partial COW leading to page cache corruption - wifi: nl80211: reject oversized EMA RNR lists - netfilter: - conntrack_irc: fix possible out-of-bounds read - bridge: make ebt_snat ARP rewrite writable - appletalk: zero-initialize aarp_entry to prevent heap info leak - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - mptcp: fix number of bugs reported by AI scans and discovered during NVMe over MPTCP testing" * tag 'net-7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (85 commits) Reapply "bnxt_en: bring back rtnl_lock() in the bnxt_open() path" udp: clear skb->dev before running a sockmap verdict sctp: purge outqueue on stale COOKIE-ECHO handling bonding: annotate data-races arcound churn variables net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr rtase: Avoid sleeping in get_stats64() ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() ipv6: mcast: Fix use-after-free when processing MLD queries selftests: net: add vxlan vnifilter notification test vxlan: vnifilter: fix spurious notification on VNI update vxlan: vnifilter: send notification on VNI add rtase: Reset TX subqueue when clearing TX ring octeontx2-af: npc: Fix CPT channel mask in npc_install_flow dt-bindings: ethernet: eswin: fix hsp-sp-csr backward compatibility sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing net/sched: fix pedit partial COW leading to page cache corruption vsock/vmci: fix sk_ack_backlog leak on failed handshake net: bonding: fix NULL pointer dereference in bond_do_ioctl() geneve: fix length used in GRO hint UDP checksum adjustment net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown ...
2026-06-04selftests/bpf: ignore call depth accounting for retbleed in verifier testsAlexis Lothoré (eBPF Foundation)
When running the selftests on a retbleed-affected platform (eg: Skylake), with call depth accounting enabled (CONFIG_CALL_DEPTH_TRACKING=y) _and_ with retbleed=stuff, some verifier selftests fail to validate the jited instructions. For example: MATCHED SUBSTR: ' endbr64' MATCHED SUBSTR: ' nopl (%rax,%rax)' MATCHED SUBSTR: ' xorq %rax, %rax' MATCHED SUBSTR: ' pushq %rbp' MATCHED SUBSTR: ' movq %rsp, %rbp' MATCHED SUBSTR: ' endbr64' MATCHED SUBSTR: ' cmpq $0x21, %rax' MATCHED SUBSTR: ' ja L0' MATCHED SUBSTR: ' pushq %rax' MATCHED SUBSTR: ' movq %rsp, %rax' MATCHED SUBSTR: ' jmp L1' MATCHED SUBSTR: 'L0: pushq %rax' MATCHED SUBSTR: 'L1: pushq %rax' MATCHED SUBSTR: ' movq -0x10(%rbp), %rax' WRONG LINE REGEX: ' callq 0x{{.*}}' Those affected selftests allways fail on some call instruction: this failure is due to the JIT compiler emitting call depth accounting for retbleed mitigation (see x86_call_depth_emit_accounting calls in bpf_jit_comp.c), resulting in an additional instruction being inserted in front of every call instruction, similar to this one: sarq $0x5, %gs:-0x39882741(%rip) Fix those selftests by allowing them to ignore this possibly present call depth accounting instruction. Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/r/20260528-fix_tests_for_retbleed_stuff-v1-1-c2022a1f3bee@bootlin.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-04selftests/bpf: Test signed loader error pathsDaniel Borkmann
The positive path for signed BPF loaders is covered today by the signed lskels (fentry_test, fexit_test, atomics). But the runtime metadata check the generated loader performs (libbpf gen_loader's emit_signature_match), the map content hash it relies on, the load-time signature, and the immutability invariants of its metadata map are not yet covered. Thus, add a new, extensive test suite which drives libbpf's gen_loader (bpf_object__gen_loader, gen_hash=true), the same machinery which bpftool uses for signed light skeletons, and exercise corner cases so that we can assert this in BPF CI: # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t signed_loader [...] [ 1.840842] clocksource: Switched to clocksource tsc #405/1 signed_loader/metadata_check_shape:OK #405/2 signed_loader/metadata_match:OK #405/3 signed_loader/metadata_sha_mismatch:OK #405/4 signed_loader/metadata_not_exclusive:OK #405/5 signed_loader/metadata_hash_not_computed:OK #405/6 signed_loader/signature_enforced:OK #405/7 signed_loader/signature_too_large:OK #405/8 signed_loader/signature_bad_keyring:OK #405/9 signed_loader/metadata_ctx_max_entries_ignored:OK #405/10 signed_loader/metadata_ctx_initial_value_ignored:OK #405/11 signed_loader/signature_authenticates_insns:OK #405/12 signed_loader/hash_requires_frozen:OK #405/13 signed_loader/no_update_after_freeze:OK #405/14 signed_loader/freeze_writable_mmap:OK #405/15 signed_loader/no_writable_mmap_frozen:OK #405/16 signed_loader/map_hash_matches_libbpf:OK #405/17 signed_loader/map_hash_multi_element:OK #405/18 signed_loader/map_hash_bad_size:OK #405/19 signed_loader/map_hash_unsupported_type:OK #405 signed_loader:OK Summary: 1/19 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260603211658.471212-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-04selftests/bpf: Cover exclusive map create-time validationDaniel Borkmann
map_excl exercises exclusive-map binding (allowed/denied), map-in-map and map iterator rejection. It does not cover the create-time validation of excl_prog_hash: the kernel only accepts a SHA-256-sized hash and requires the pointer and size to be consistent. Add map_excl_create_validation to check the rejected combinations: # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t map_excl [...] [ 1.780305] clocksource: Switched to clocksource tsc #215/1 map_excl/map_excl_allowed:OK #215/2 map_excl/map_excl_denied:OK #215/3 map_excl/map_excl_no_map_in_map:OK #215/4 map_excl/map_excl_no_map_iter:OK #215/5 map_excl/map_excl_create_validation:OK #215 map_excl:OK Summary: 1/5 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260603211658.471212-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-04selftests: net: add vxlan vnifilter notification testAndy Roulin
Add a selftest for VXLAN vnifilter netlink notifications that verifies RTM_NEWTUNNEL and RTM_DELTUNNEL are sent correctly when VNIs are added, deleted, or updated, and that no spurious notifications are sent when a VNI is re-added with the same attributes. Signed-off-by: Andy Roulin <aroulin@nvidia.com> Acked-by: Petr Machata <petrm@nvidia.com> Link: https://patch.msgid.link/20260602185138.253265-4-aroulin@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-04cxl/test: Fix __fortify_panicDan Williams
Fix a runtime assertion in setup_xor_mapping(). Fortify complains that it is potentially overflowing the xormaps array per __counted_by(nr_maps). Quiet the false positive by initializing @nr_maps earlier. memcpy: detected buffer overflow: 32 byte write of buffer size 0 WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0, CPU#8: modprobe/2728 Call Trace: __fortify_panic+0xd/0xf setup_xor_mapping+0x6c/0xa0 [cxl_translate] [ dj: Fixed up @nr_entries to @nr_maps in commit log. ] Fixes: 06377c54a133 ("cxl/test: Add cxl_translate module for address translation testing") Signed-off-by: Dan Williams <djbw@kernel.org> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260519221204.1517773-3-djbw@kernel.org Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-06-04cxl/test: Enforce PMD alignment for volatile mock regionsRichard Cheng
cxl_test allocates synthetic CFMWS HPA windows from a gen_pool with SZ_256M alignment. On arm64 with CONFIG_ARM64_64K_PAGES=y and CONFIG_PGTABLE_LEVELS=3, PMD_SIZE is 512M, so every CXL region carved from a volatile window inherits a non-PMD-aligned start, and cxl_dax_region_probe() -> alloc_dax_region() fails: """ cxl_dax_region dax_region1: probe with driver cxl_dax_region failed with error -12 """ Enforce that every volatile mock CFMWS is PMD-aligned in both start and size Reviewed-by: Dave Jiang <dave.jiang@intel.com> Acked-by: Kai-Heng Feng <kaihengf@nvidia.com> Signed-off-by: Richard Cheng <icheng@nvidia.com> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/20260527090332.30002-1-icheng@nvidia.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-06-04verification/rvgen: Fix ltl2k writing True as a literalGabriele Monaco
The rvgen parser for LTL stores literal true values in the python representation (capitalised True), this doesn't build in C. The Literal class should already handle this case but ASTNode skips its strigification method and converts the value (true/false) directly. Fix by delegating ASTNode stringification to the Literal and Variable classes instead of bypassing them. Fixes: 97ffa4ce6ab32 ("verification/rvgen: Add support for linear temporal logic") Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://lore.kernel.org/r/20260514152055.229162-8-gmonaco@redhat.com Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-06-04verification/rvgen: Fix options shared among commandsGabriele Monaco
After rvgen was refactored to use subparsers, the common options (-a and -D) were left in the main parser. This meant that they needed to be called /before/ the subcommand and using them without subcommand was allowed. This is not the original intent. rvgen -D "some description" container -n name Define the options as parent in the subparsers to allow them to be used from both subcommands together with other options. rvgen container -n name -D "some description" Fixes: 5270a0e3041c ("verification/dot2k: Replace is_container() hack with subparsers") Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://lore.kernel.org/r/20260514152055.229162-7-gmonaco@redhat.com Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-06-04verification/rvgen: Fix suffix strip in dot2kGabriele Monaco
__start_to_invariant_check() and __get_constraint_env() parse the environment variable's name from sources that have it padded with the monitor name. This is removed using rstrip(), which is not meant to strip a substring but rather a set of characters. Use removesuffix() to actually get rid of the trailing _<monitor name>. Fixes: a82adadb16894 ("verification/rvgen: Add support for Hybrid Automata") Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://lore.kernel.org/r/20260601153840.124372-12-gmonaco@redhat.com Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-06-04tools/rv: Fix cleanup after failed trace setupGabriele Monaco
Currently if ikm_setup_trace_instance() fails, the tool returns without any cleanup, if rv was called with both -t and -r, this means the reactor is not going to be cleared. Jump to the cleanup label to restore the reactor if necessary. Fixes: 6d60f89691fc9 ("tools/rv: Add in-kernel monitor interface") Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://lore.kernel.org/r/20260514152055.229162-5-gmonaco@redhat.com Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-06-04tools/rv: Fix substring match when listing container monitorsGabriele Monaco
When listing monitors within a specific container (rv list <container>), the tool incorrectly matched monitors if the requested container name was only a prefix of the actual container (e.g., 'rv list sche' would incorrectly list monitors from 'sched:'). Fix this by ensuring the container name is an exact match and is immediately followed by the ':' separator. Fixes: eba321a16fc6 ("tools/rv: Add support for nested monitors") Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://lore.kernel.org/r/20260514152055.229162-3-gmonaco@redhat.com Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-06-04tools/rv: Fix substring match bug in monitor name searchGabriele Monaco
__ikm_find_monitor_name() relies on strstr() to find a monitor by name, which fails if the target monitor is a substring of a previously listed monitor. Fix it by tokenizing the available_monitors file and matching full tokens instead. Fixes: eba321a16fc6 ("tools/rv: Add support for nested monitors") Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://lore.kernel.org/r/20260514152055.229162-2-gmonaco@redhat.com Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-06-04tools/rv: Ensure monitor name and desc are NUL-terminatedGabriele Monaco
ikm_fill_monitor_definition() copies monitor name and description with strncpy(), but does not guarantee NUL termination when source strings are equal to or longer than the destination buffers. Clamp copies to sizeof(dst) - 1 and explicitly append '\0' for both fields to keep them safe for later string operations. Suggested-by: unknownbbqrx <dev@unknownbbqr.xyz> Fixes: 6d60f89691fc9 ("tools/rv: Add in-kernel monitor interface") Link: https://lore.kernel.org/r/20260604120946.90302-2-gmonaco@redhat.com Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-06-04rtla: Fix parsing of multi-character short optionsTomas Glozar
A bug was reported where the parsing of multi-character short options, be it a short option with an argument specified without space (e.g. "-p100") or multiple short options in one argument (e.g. -un), ignores options specific to individual tools. Furthermore, if the rest of the option is supposed to be an argument, it gets reinterpreted as a string of options. For example, -p100 gets interpreted as -100, which is due to hackish implementation read as --no-thread --no-irq --no-irq with timerlat hist, causing rtla to error out: $ rtla timerlat hist -p100 no-irq and no-thread set, there is nothing to do here This behavior is caused by getopt_long() being called twice on each argument, once in common_parse_options(), once in [tool]_parse_args(): - common_parse_options() calls getopt_long() with an array of options common for all rtla tools, while suppressing errors (opterr = 0). - If the option fails to parse, common_parse_options() returns 0. - If 0 is returned from common_parse_options(), [tool]_parse_args() calls getopt_long() again, with its own set of options. * [tool] means one of {osnoise,timerlat}_{top,hist} At least in glibc, getopt_long() increments its internal nextchar variable even if the option is not recognized. That means that in the case of "-p100", common_parse_options() sets nextchar pointing to '1', and timerlat_hist_parse_args() sees '1', not 'p'; the same then repeats for the first and second '0'. As there is no way to restore the correct internal state of getopt_long() reliably, fix the issue by merging the common options back to the longopt array and option string of the [tool]_parse_args() functions using a macro; only the switch part is left in the original function, which is renamed to set_common_option(). Fixes: 850cd24cb6d6 ("tools/rtla: Add common_parse_options()") Reported-by: John Kacur <jkacur@redhat.com> Tested-by: John Kacur <jkacur@redhat.com> Link: https://lore.kernel.org/r/20260602125506.3325345-1-tglozar@redhat.com Signed-off-by: Tomas Glozar <tglozar@redhat.com>
2026-06-04selftests/eventpoll: Add test for multiple waitersNam Cao
Add a test whichs creates 64 threads who all epoll_wait() on the same eventpoll. The source eventfd is written but never read, therefore all the threads should always see an EPOLLIN event. This test fails because of a kernel bug, which will be fixed by a follow-up commit. Signed-off-by: Nam Cao <namcao@linutronix.de> Link: https://patch.msgid.link/b11947013563875c046c0b0959c29fd95eeebd34.1780422138.git.namcao@linutronix.de Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-03selftests: mptcp: add test for extra_subflows underflow on userspace PMTao Cui
Add a test to verify that when userspace PM fails to create a subflow (e.g. using an unreachable address), the extra_subflows counter is not decremented below zero. Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos") Cc: stable@vger.kernel.org Signed-off-by: Tao Cui <cuitao@kylinos.cn> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-6-856831229976@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03tools/x86/kcpuid: Update bitfields to x86-cpuid-db v3.1Maciej Wieczor-Retman
Update kcpuid's CSV file to version 3.1, as generated by x86-cpuid-db. Summary of the v3.1 changes: * Fix a few typos that were found during the kernel CPUID data model review. Also include fixes found using an LLM agent review. * Rename thrd_director_nclasses to hw_feedback_nclasses as it's the name used in Intel SDM. See https://gitlab.com/x86-cpuid.org/x86-cpuid-db/-/blob/v3.1/CHANGELOG.rst for more info. Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/cbe9ff395b3269e112ff7ca414d726ffd7bf0787.1780506200.git.m.wieczorretman@pm.me
2026-06-03af_unix: Add test for SCM_INQ on partial readJianyu Li
Add test to verify that when a skb is partially consumed, unix_inq_len() return correct remaining byte count. Before: # RUN scm_inq.stream.partial_read ... # scm_inq.c:165:partial_read:Expected remain (512) == *(int *)CMSG_DATA(cmsg) (768) # partial_read: Test terminated by assertion # FAIL scm_inq.stream.partial_read not ok 2 scm_inq.stream.partial_read After: # RUN scm_inq.stream.partial_read ... # OK scm_inq.stream.partial_read ok 2 scm_inq.stream.partial_read Signed-off-by: Jianyu Li <jianyu.li@mediatek.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260601113640.231897-3-jianyu.li@mediatek.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03sched_ext: Make scx_bpf_kick_cid() return s32Tejun Heo
Switch scx_bpf_kick_cid() from void to s32 so future cap enforcement can surface failures. cid interface is introduced in this cycle and has no external users, so the ABI change is safe. Subsequent patches will add -EPERM returns when the calling sub-sched lacks the required cap on the target cid. v2: Return scx_cid_to_cpu()'s errno instead of -EINVAL. (Andrea) Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-06-03tools/sched_ext: Order single-cid cmask helpers as (cid, mask)Tejun Heo
The BPF arena single-cid cmask helpers take the cmask first and the cid second. Reorder them to (cid, mask) to match the kernel-side helpers and the test_bit(nr, addr), cpumask_test_cpu(cpu, mask) convention. Range and iteration helpers keep (mask, start). Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-06-03tools headers UAPI: sync linux/taskstats.h for procacct.cWang Yaxin
After commit 9b93f7e32774 ("tools/getdelays: use the static UAPI headers from tools/include/uapi"), the Makefile was changed to use -I../include/uapi/ instead of -I../../usr/include to ensure tools always use the up-to-date UAPI headers. However, only linux/taskstats.h was added to tools/include/uapi/ in commit e5bbb35a07b3 ("tools headers UAPI: sync linux/taskstats.h"), but linux/acct.h was missing. This causes procacct.c to fail to compile with: procacct.c:234:37: error: 'AGROUP' undeclared (first use in this function) gcc -I../include/uapi/ getdelays.c -o getdelays gcc -I../include/uapi/ procacct.c -o procacct procacct.c: In function `print_procacct': procacct.c:234:37: error: `AGROUP' undeclared (first use in this function) did you mean `NOGROUP'? 234 | , t->version >= 12 ? (t->ac_flag & AGROUP ? 'P' : 'T') : '?' | ^~~~~~ | NOGROUP procacct.c:234:37: note: each undeclared ident because procacct.c uses the AGROUP macro defined in linux/acct.h. Add the missing linux/acct.h to complete the static UAPI header set. Link: https://lore.kernel.org/20260527213558929EhiHHy9EDTMjmg3uuDOMi@zte.com.cn Fixes: 9b93f7e32774 ("tools/getdelays: use the static UAPI headers from tools/include/uapi") Signed-off-by: Wang Yaxin <wang.yaxin@zte.com.cn> Reviewed-by: Thomas Weißschuh <linux@weissschuh.net> Cc: Fan Yu <fan.yu9@zte.com.cn> Cc: Jonathan Corbet <corbet@lwn.net> Cc: xu xin <xu.xin16@zte.com.cn> Cc: Yang Yang <yang.yang29@zte.com.cn> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-03bpftool: Use libbpf error code for flow dissector queryWoojin Ji
bpf_prog_query() returns a negative errno on failure. query_flow_dissector() currently closes the namespace fd and then reads errno to decide whether -EINVAL means that the running kernel does not support flow dissector queries. That errno check controls behavior, not just diagnostics: -EINVAL is handled as a non-fatal old-kernel case, while any other error makes bpftool net fail. The namespace fd is opened read-only, so close() is not expected to commonly fail in normal use. Still, the BPF_PROG_QUERY error is already available in err, and reading errno after an intervening close() is fragile. If close() does change errno, the compatibility branch may be based on close()'s error instead of the BPF_PROG_QUERY result. This was reproduced with an LD_PRELOAD fault injector that forced BPF_PROG_QUERY for BPF_FLOW_DISSECTOR to fail with EINVAL and then forced close() on the netns fd to fail with EIO. The unpatched bpftool reported "can't query prog: Input/output error". With this change, the same injected failure is handled as the intended non-fatal EINVAL compatibility case. Use the libbpf-returned error code instead. Keep the existing errno reset in the non-fatal path to preserve batch mode behavior. The success path is unchanged. Fixes: 7f0c57fec80f ("bpftool: show flow_dissector attachment status") Signed-off-by: Woojin Ji <random6.xyz@gmail.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Acked-by: Leon Hwang <leon.hwang@linux.dev> Acked-by: Yonghong Song <yonghong.song@linux.dev> Acked-by: Quentin Monnet <qmo@kernel.org> Link: https://lore.kernel.org/bpf/20260603003339.33791-1-random6.xyz@gmail.com Assisted-by: ChatGPT:gpt-5.5
2026-06-03mm/slab: improve kmem_cache_alloc_bulkChristoph Hellwig
The kmem_cache_alloc_bulk return value is weird. It returns the number of allocated objects, but that must always be 0 or the requested number based on the implementations and the handling in the callers, but that assumption is not actually documented anywhere, which confuses automated review tools. Fix this by returning a bool if the allocation succeeded and adding a kerneldoc comment explaining the API. [rob.clark@oss.qualcomm.com: fixups in msm_iommu_pagetable_prealloc_allocate() ] Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> # skbuff Link: https://patch.msgid.link/20260528093437.2519248-2-hch@lst.de Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
2026-06-03Merge tag 'cgroup-for-7.1-rc6-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "One cpuset fix and a maintenance update, both low-risk: - Fix cpuset partition CPU accounting under sibling CPU exclusion that could produce wrong CPU assignments and trigger scheduling-domain warnings. Includes selftests. - Update an email address in MAINTAINERS" * tag 'cgroup-for-7.1-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/cpuset: Change Ridong's email cgroup/cpuset: Add test cases for sibling CPU exclusion on partition update cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask calculation
2026-06-03Merge tag 'sched_ext-for-7.1-rc6-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: "Two low-risk fixes: - Drop a spurious warning that can fire during cgroup migration while a sched_ext scheduler is loaded - Fix a drgn-based debug script that broke after scheduler state moved into a per-scheduler struct" * tag 'sched_ext-for-7.1-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() tools/sched_ext: Fix scx_show_state per-scheduler state reads
2026-06-03selftests: livepatch: set LC_ALL=C to fix locale-dependent test failureQiang Ma
When executing the command "make -C tools/testing/selftests TARGETS=livepatch run_tests", the following error message was reported. TEST: livepatch interaction with ftrace_enabled sysctl ... not ok ... livepatch: sysctlo : setting key "kernel.ftrace_enabled": Device or resource busy livepatch: sysctl: setting key "kernel.ftrace_enabled": 设备或资源忙 ... ERROR: livepatch kselftest(s) failed not ok 5 selftests: livepatch: test-ftrace.sh # exit=1 To fix it, set LC_ALL=C. Signed-off-by: Qiang Ma <maqianga@uniontech.com> Acked-by: Miroslav Benes <mbenes@suse.cz> Acked-by: Petr Mladek <pmladek@suse.com> Link: https://patch.msgid.link/20260527095929.1504032-1-maqianga@uniontech.com Signed-off-by: Petr Mladek <pmladek@suse.com>
2026-06-03rv: Add automatic cleanup handlers for per-task HA monitorsGabriele Monaco
Hybrid automata monitors may start timers, depending on the model, these may remain active on an exiting task and cause false positives or even access freed memory. Add an enable/disable hook in the HA code, currently only populated by the per-task handler for registration and deregistration. This hooks to the sched_process_exit event and ensures the timer is stopped for every exiting task. The handler is enabled automatically but may be disabled, for instance if the monitor uses the event for another purpose (but should still manually ensure timers are stopped). Fixes: f5587d1b6ec9 ("rv: Add Hybrid Automata monitor type") Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://lore.kernel.org/r/20260601153840.124372-8-gmonaco@redhat.com Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-06-03selftests: futex: Add tests for robust release operationsAndré Almeida
Add tests for __vdso_futex_robust_listXX_try_unlock() and for the futex() op FUTEX_ROBUST_UNLOCK. Test the contended and uncontended cases for the vDSO functions and all ops combinations for FUTEX_ROBUST_UNLOCK. [ tglx: Replace the VDSO function lookup ] Signed-off-by: André Almeida <andrealmeid@igalia.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260329-tonyk-vdso_test-v2-2-b7db810e44a1@igalia.com Link: https://patch.msgid.link/20260602090535.988101541@kernel.org
2026-06-02selftests/net: bind_bhash: fix memory leak in bind_socketlonglong yan
The getaddrinfo() call in bind_socket() dynamically allocates memory for the result linked list that must be freed with freeaddrinfo(). However, none of the code paths after a successful getaddrinfo() call free this memory, causing a leak in every invocation of bind_socket(). Signed-off-by: longlong yan <yanlonglong@kylinos.cn> Link: https://patch.msgid.link/20260601013927.1835-1-yanlonglong@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-02selftests: openvswitch: add dec_ttl action support and testMinxi Hou
Add dec_ttl action support to the OVS kernel datapath selftest framework: - Add dec_ttl nested NLA class to ovs-dpctl.py with proper OVS_DEC_TTL_ATTR_ACTION sub-attribute handling - Add parse support for dec_ttl(le_1(<inner_actions>)) action string, consistent with the odp-util.c format where le_1() holds the actions taken when TTL reaches 1 - Add dpstr output formatting for dec_ttl actions - Add test_dec_ttl() to openvswitch.sh that verifies: * Normal TTL packets are forwarded after decrement * TTL=1 packets are dropped (TTL expiry) * Graceful skip via ksft_skip if kernel lacks dec_ttl support The dec_ttl class uses late-binding type resolution to reference ovsactions for its inner action list, avoiding circular references at class definition time. Signed-off-by: Minxi Hou <houminxi@gmail.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260530021443.1734484-1-houminxi@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-02selftests/rseq: Add config fragmentMark Brown
Currently there is no config fragment for the rseq selftests but there are a couple of configuration options which are required for running them: - CONFIG_RSEQ is required for obvious reasons, it is enabled by default but it doesn't hurt to specify it in case the user is usinsg a defconfig that disables it. - CONFIG_RSEQ_SLICE_EXTENSION is tested by the slice_test test, the test will fail without it. Add a configuration fragment which enables these options, helping encourage CI systems and people doing manual testing to run the tests with all the features. This also requires CONFIG_EXPERT since it is a dependency for slice extension. Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260424-selftests-rseq-config-fragment-v2-1-a9475996edcb@kernel.org
2026-06-02selftests: drv-net: tso: add new tests for ip6tnl, ipip, and sit tunnelsDaniel Zahka
Add new tunnel test cases for ip6tnl, ipip, and sit. ip6tnl supports ipv[46] as inner l3 header, and the other two tunnels only support a single inner l3 type. Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com> Link: https://patch.msgid.link/20260529-tso-tunnels-v1-1-3771ee9eaaa9@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-02selftests: net: add socat syslog for PPPoL2TPQingfang Deng
As done in pppoe.sh, start socat as the syslog listener. In case the test fails, dump its log to see what's going on. Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev> Reviewed-by: Matthieu Baerts <matttbe@kernel.org> Link: https://patch.msgid.link/20260529021146.5739-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-02selftests/bpf: Test that exclusive maps are rejected as iter targetsDaniel Borkmann
Add a subtest to map_excl that creates an exclusive map and verifies a bpf_map_elem iterator cannot be attached to it, which would otherwise let an unrelated program read and overwrite the map's contents through the iterator's writable value buffer. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t map_excl [...] ./test_progs -t map_excl [ 1.704382] bpf_testmod: loading out-of-tree module taints kernel. [ 1.706068] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel #215/1 map_excl/map_excl_allowed:OK #215/2 map_excl/map_excl_denied:OK #215/3 map_excl/map_excl_no_map_in_map:OK #215/4 map_excl/map_excl_no_map_iter:OK #215 map_excl:OK Summary: 1/4 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260602133052.423725-5-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-02selftests/bpf: Keep verifier_map_ptr exercising ops pointer accessDaniel Borkmann
sashiko complained that 38498c0ebacd ("selftests/bpf: Adjust verifier_map_ptr for the map's excl field") would slightly decrease the test coverage given before the test was against the verifier rejecting the ops pointer. Recover the old test with the right offsets and add the existing one as an additional test case. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_map_ptr [ 1.672932] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel #637/1 verifier_map_ptr/bpf_map_ptr: read with negative offset rejected:OK #637/2 verifier_map_ptr/bpf_map_ptr: read with negative offset rejected @unpriv:OK #637/3 verifier_map_ptr/bpf_map_ptr: write rejected:OK #637/4 verifier_map_ptr/bpf_map_ptr: write rejected @unpriv:OK #637/5 verifier_map_ptr/bpf_map_ptr: read non-existent field rejected:OK #637/6 verifier_map_ptr/bpf_map_ptr: read non-existent field rejected @unpriv:OK #637/7 verifier_map_ptr/bpf_map_ptr: read beyond excl field rejected:OK #637/8 verifier_map_ptr/bpf_map_ptr: read beyond excl field rejected @unpriv:OK #637/9 verifier_map_ptr/bpf_map_ptr: read ops field accepted:OK #637/10 verifier_map_ptr/bpf_map_ptr: read ops field accepted @unpriv:OK #637/11 verifier_map_ptr/bpf_map_ptr: r = 0, map_ptr = map_ptr + r:OK #637/12 verifier_map_ptr/bpf_map_ptr: r = 0, map_ptr = map_ptr + r @unpriv:OK #637/13 verifier_map_ptr/bpf_map_ptr: r = 0, r = r + map_ptr:OK #637/14 verifier_map_ptr/bpf_map_ptr: r = 0, r = r + map_ptr @unpriv:OK #637 verifier_map_ptr:OK [...] Summary: 2/20 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260602133052.423725-4-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-02libbpf: Guard add_data() against size overflowDaniel Borkmann
add_data() computes size8 = roundup(size, 8) and then hands size8 to realloc_data_buf() before doing memcpy(gen->data_cur, data, size) with the original size. A wrapped size8 passes through the realloc_data_buf() INT32_MAX check. Harden this against overflow, though not realistic to happen in practice. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260602133052.423725-3-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-02Merge branch 'tip/sched/urgent'Peter Zijlstra
Pick up urgent fixes. Signed-off-by: Peter Zijlstra <peterz@infradead.org>
2026-06-02tools/testing/memblock: fix stale NUMA reservation testsPriyanshu Kumar
memblock allocations now reserve memory with MEMBLOCK_RSRV_KERN and, on NUMA configurations, record the requested node on the reserved region. Several memblock simulator NUMA tests still expected merges that only worked before those reservation semantics changed, so the suite aborted even though the allocator behavior was correct. Update the NUMA merge expectations in the memblock_alloc_try_nid() and memblock_alloc_exact_nid_raw() tests to match the current reserved region metadata rules. For cases that should still merge, create the pre-existing reservation with matching nid and MEMBLOCK_RSRV_KERN metadata. Also strengthen the memblock_alloc_node() coverage by checking the newly created reserved region directly instead of re-reading the source memory node descriptor. Finally, drop the stale README/TODO notes that still claimed memblock_alloc_node() could not be tested. The memblock simulator passes again with NUMA enabled after these updates. Signed-off-by: Priyanshu Kumar <priyanshukumarpu@gmail.com> Link: https://patch.msgid.link/20260415122731.1768912-1-priyanshukumarpu@gmail.com [rppt: dropped unrelated changes] Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-01selftests/bpf: Add tests for the new type-tag based __arena identifierEmil Tsalapatis
Add selftests that combine the new type-based __arena identifier with the volatile qualifier both in functions' arguments and return values. This way we test both that they are recognized as arena arguments and that they are not sensitive to the position they are placed in the type compared to other qualifiers. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/r/20260602004120.17087-7-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-01selftests/bpf: libarena: Directly return arena pointers from functionsEmil Tsalapatis
Now that the __arena annotation includes a BTF type tag, and the verifier can identify arena pointers at BTF loading time, return arena pointers as their true type instead of casting to u64. Remove the preprocessor typecast wrappers used to hide this from the caller. Acked-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/r/20260602004120.17087-6-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-01selftests/bpf: Remove __arg_arena from the codebaseEmil Tsalapatis
Now that BPF __arg_arena has been subsumed by __arena, remove __arg_arena from the codebase. This way the user has one fewer annotation to worry about. To remove __arg_arena we remove the typedefs we were previously using to minimize __arena annotations. This is because __arena now also includes a BTF type tag, which is ignored for non-pointer types. As a result, we cannot capture the whole __arena annotation inside a typedef and need to directly annotate the pointer type when declaring the variable. The extra verbosity is worth it because the use of the __arena tag is intuitive to the programmer and removes the __arg_arena tag that has been a consistent source of confusion for users. The typedefs can be reintroduced later (without __arg_arena) once compilers start supporting BTF type tags for non-pointer types. Acked-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/r/20260602004120.17087-5-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-01selftests/bpf: libarena: Add "arena" BTF type tag to __arena qualifierEmil Tsalapatis
The arena qualifier currently designates its associated type as belonging to address space 1. This property affects code generation, but is not reflected in the BTF information of the function. This lack of information at the BTF level prevents us from returning arena pointers from global subprograms. Subprogs cannot return any data structure more complex than a scalar, so pointers to structs are rejected as a return type. We have no way of marking the return type as a pointer to an arena, which is safe provided the two subprogs have the same arena. Expand the __arena qualifier to also attach a BTF type tag to the type. This lets us determine whether a variable belongs to an arena from its type alone through BTF parsing. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/r/20260602004120.17087-2-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
generated by cgit v1.2.3 (git 2.0.4) at 2026-06-19 04:17:56 +0000