wireguard-linux/rust, branch davem/net

rust: net: netlink: validate attribute length before casting to `c_int`

2026-09-29T10:28:03Z

`put()` trusted an unchecked `as` cast from `usize` to `c_int`. When the length exceeds `i32::MAX` that cast wraps around to a negative value. This ultimately resulted in a kernel panic when the reinterpreted value via `__nla_reserve()` and `skb_put()` became enormous. Validate payload and header both fit together in a `u16`, rejecting any payload that wouldn't leave room for `NLA_HDRLEN`. Fixes: 5eaa5fbb6e6c ("rust: netlink: add raw netlink abstraction") Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Reviewed-by: Carlos Llamas Reviewed-by: Gary Guo Signed-off-by: Sagar Taunk Link: https://patch.msgid.link/20260925085449.22553-1-sagartaunk@proton.me Signed-off-by: Paolo Abeni

Merge tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-09-17T17:40:48Z

Pull networking fixes from Paolo Abeni: "Including fixes from Netfilter, Bluetooth, IPSec and WiFi. Previous releases - regressions: - netfilter: hold reference on ct until flow is released - bridge: - move switchdev call outside rcu - vlan: fix bugs caused by switchdev deletion errors - wifi: - mac80211: reset state when starting AP fails - cfg80211: don't free driver-owned scan requests - tcp: don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv() - mptcp: return sk_wait_data() errors from recvmsg() - xfrm: serialize state GC with device state flush - drop_monitor: synchronize tracepoint unregistration on error path - bluetooth: - eir: validate service data length before reading UUID - hci_sync: serialize local codec list cleanup - RFCOMM: avoid socket lock inversion in listener cleanup - eth: - lan743x: fix RX checksum use-after-free - mvpp2: prevent buffer overflow in page_pool allocation Previous releases - always broken: - core: lock the socket in sock_gettstamp() - neighbour: enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. - sched: codel: bound the dropping loop per dequeue call - wifi: mac80211: include TIM bitmap control for buffered S1G mcast traffic - psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() - xfrm: fix stack OOB read in iptfs_skb_reset_frag_walk() - bluetooth: hci_qca: do not write to the serial port after it is closed - dsa: mxl862xx: disable the stats poll on teardown - eth: - stmmac: fix TSO header length truncation - ip_tunnel: initialize `options_len` before referencing options" * tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (159 commits) mptcp: fix bad accounting in __mptcp_subflow_push_pending() mptcp: close race between scheduler and state change mptcp: avoid unneeded actions on subflow reset net: skbuff: do not leave stale header offsets after pskb_carve() selftests: net: packetdrill: test exclusion of old ACK from TCP fast path tcp: exclude old ACKs from tcp fast path dpll: reject a reference sync pin which is not on the pin's dpll net: mvpp2: prevent buffer overflow in page_pool allocation net: macb: fix ordering around PTP timestamp read selftests: drv-net: psp: test PSP and TCP ULP mutual exclusion net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() net: stmmac: preserve real_num_tx_queues on mqprio setup failure net: stmmac: propagate FPE preemption-class mapping errors net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain net: ethernet: cortina: Ack RX overrun interrupt correctly net: lock the socket in sock_gettstamp() eth: fbnic: ring the doorbell if a burst ends in a drop net: netsec: fix device_node reference leak on phy_np ...

rust: net: phy: fix off-by-one bit positions in device status accessors

2026-09-15T01:56:16Z

The hand-written bitfield offsets in is_link_up(), is_autoneg_enabled() and is_autoneg_completed() were correct when the abstraction was merged: at that time autoneg, link, and autoneg_complete were at bits 13, 14, and 15 of struct phy_device's first bitfield unit. Commit 2796ff1e3dca ("net: phy: add flag is_genphy_driven to struct phy_device") later inserted is_genphy_driven just before autoneg, shifting the three fields up by one, so the accessors now read: is_link_up() reads bit 14 = autoneg is_autoneg_enabled() reads bit 13 = is_genphy_driven is_autoneg_completed() reads bit 15 = link The official ax88796b Rust driver uses all three accessors in its read_status() implementation, so it inherits the bug. phy_attach_direct() sets is_genphy_driven only when it falls back to the generic driver, and ax88796b has a real driver, so is_genphy_driven stays 0. The broken is_autoneg_enabled() therefore reads bit 13 as 0, compares it against AUTONEG_ENABLE (1), and always returns false, so read_status() never reaches the resolve_aneg_linkmode() call. The ordinary bindgen accessors take &self. Calling them through (*phydev).link() would create a shared reference to the complete bindings::phy_device, which is not appropriate for an object wrapped in Opaque. Use the bindgen-generated raw accessors (link_raw(), autoneg_raw(), and autoneg_complete_raw()) instead. They retain the bit positions and endianness handling generated from the C layout without creating a Rust reference to the complete phy_device. Drop the hand-written numbers together with the TODO comment that marked them as a stopgap. The raw accessors are only emitted by bindgen 0.71 and later, and were added at the Rust-for-Linux project's request, so this fix can only be backported to stable branches whose minimum bindgen version is at least that, hence the scope on the Cc: stable line below. Found by a static equivalence audit (C2RustDrv, a C-to-Rust driver migration tool) that compares hand-written bitfield offsets against the bindgen layout of struct phy_device. Verified by building the bindings and checking the generated accessors; no runtime testing was possible without PHY hardware. Fixes: 2796ff1e3dca ("net: phy: add flag is_genphy_driven to struct phy_device") Cc: stable@vger.kernel.org # Only 7.1.y and later (requires bindgen's raw pointer accessors). Link: https://github.com/rust-lang/rust-bindgen/issues/2674 Signed-off-by: Chunfeng Song Reviewed-by: FUJITA Tomonori Link: https://patch.msgid.link/20260910055110.167110-1-springbreeze@stu.pku.edu.cn Signed-off-by: Jakub Kicinski

Merge tag 'rust-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

2026-09-13T16:28:28Z

Pull Rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Work around a 'bindgen' 0.73.2 bug that emits an 'allow' attribute for 'unnecessary_transmutes', which is unknown in older compilers - Clean 'clippy::as_underscore' lints in generated code by the new 'bindgen' 0.73.0+ releases - Clean new 'clippy::needless_range_loop' lint for the upcoming Rust 1.100.0 (expected 2026-11-12) 'kernel' crate: - 'num' module: fix soundness issue in 'Bounded' by sealing the 'Integer' trait 'pin-init' crate: - Fix unreachable warning for the upcoming Rust 1.100.0 (expected 2026-11-12) due to 'Infallible' becoming an alias of '!' Samples: - Add missing newlines in 'pr_*!'s macro calls" * tag 'rust-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: allow `unknown_lints` in generated bindings for Rust < 1.88 rust: allow `clippy::as_underscore` in the generated bindings rust: num: seal Integer drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0 rust: samples: add missing newlines in rust_print_main rust: pin-init: use irrefutable pattern for `stack_pin_init`

rust: allow `unknown_lints` in generated bindings for Rust < 1.88

2026-09-08T21:29:18Z

Starting with bindgen 0.73.2 [1], `#[allow(unnecessary_transmutes)]` are used, even when `--rust-target 1.85` is passed. However, the lint was introduced in Rust 1.88.0. Thus building with older Rust versions warns like: error: unknown lint: `unnecessary_transmutes` --> rust/uapi/uapi_generated.rs:26294:13 | 26294 | #[allow(unnecessary_transmutes)] | ^^^^^^^^^^^^^^^^^^^^^^ | = note: `-D unknown-lints` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(unknown_lints)]` Thus allow `unknown_lints` in the generated bindings -- only when building with older Rust versions. I have asked upstream if this is intentional [1], i.e. if we are supposed to always allow unknown lints in case `bindgen` uses such attributes, or whether it is an oversight. [ Emilio said it wasn't intentional -- we will work around it for now on the kernel side. - Miguel ] Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Cc: Emilio Cobos Álvarez Link: https://github.com/rust-lang/rust-bindgen/pull/3455#issuecomment-5588526559 [1] Assisted-by: LLM Link: https://patch.msgid.link/20260908170539.345207-1-ojeda@kernel.org [ Removed the `cfg` for `allow(unnecessary_transmutes)` as suggested by Gary. - Miguel ] Signed-off-by: Miguel Ojeda

rust: allow `clippy::as_underscore` in the generated bindings

2026-09-06T23:06:23Z

A CLIPPY=1 build emitted about 15000 `as _` conversion warnings, all of them in bindgen's generated output and none in hand-written code. [ The lint messages look like: error: using `as _` conversion --> rust/bindings/bindings_generated.rs:18947:9 | 18947 | self._bitfield_1.get_const::<0usize, 16u8>() as u32 as _ | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^- | | | help: consider giving the type explicitly: `u32` | = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.98.0/index.html#as_underscore = note: `-D clippy::as-underscore` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(clippy::as_underscore)]` - Miguel ] bindgen 0.73 returns each bitfield read through a trailing `as _`, and 0.72 returns it through a transmute, which the lint ignores. The bindings and uapi crates allow `clippy::all` over the generated code. That group does not cover `clippy::as_underscore`, a restriction lint. Allow `clippy::as_underscore` by name in the bindings and uapi crates. Assisted-by: LLM Signed-off-by: John Hubbard Link: https://patch.msgid.link/20260906215822.1201022-1-jhubbard@nvidia.com Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). [ Removed CI sentence. - Miguel ] Signed-off-by: Miguel Ojeda

rust: num: seal Integer

2026-09-06T01:44:00Z

Bounded relies on Integer implementations to describe primitive integer semantics correctly. In particular, it uses Integer::BITS and Signedness to justify unchecked operations. Integer is currently safe and externally implementable, so an implementation can violate those assumptions and make safe Bounded operations reach undefined behavior. For example, an Integer implementation for a u8 wrapper can report BITS = 16. Safe code can then cast a Bounded containing 256 to that wrapper. Its TryFrom implementation returns Err, and Bounded::cast() calls unwrap_unchecked() on it, causing undefined behavior. Seal Integer so only the primitive implementations provided by the kernel crate can satisfy it. Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type") Reported-by: Miguel Ojeda Closes: https://lore.kernel.org/rust-for-linux/CANiq72mOfR33s4y+Ueivd5NrC5yre+Pcp57ZOBz0msw9A4AP1Q@mail.gmail.com/ Cc: stable@vger.kernel.org Suggested-by: Miguel Ojeda Signed-off-by: Younes Akhouayri Acked-by: Alexandre Courbot Link: https://patch.msgid.link/20260905-feature-rust-num-seal-integer-v2-1-f1311ffbe6e7@younes.io Signed-off-by: Miguel Ojeda

rust: pci: reject IRQ vector indices that do not fit in u32

2026-09-01T16:21:01Z

IrqVectorRegistration::index() accepts a usize, but pci_irq_vector() takes an unsigned int. On 64-bit architectures, casting an index larger than u32::MAX wraps it before the PCI core can validate it. In particular, u32::MAX + 1 becomes zero and can resolve to the first allocated vector. Use a checked conversion and return EINVAL when the index cannot be represented by the C API. Fixes: 2fb7755b0a7e ("rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector") Signed-off-by: Sophon Zhang Reviewed-by: Gary Guo Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260901-fix-pci-irq-vector-index-truncation-v4-1-f94aa6932fd9@hotmail.com Signed-off-by: Danilo Krummrich

rust: pin-init: use irrefutable pattern for `stack_pin_init`

2026-08-31T23:27:55Z

In Rust 1.100.0, `Infallible` will become an alias of `!`. The let binding in `stack_pin_init` will thus become unreachable and produce an "unreachable expression" warning for the subsequent match, and thus will fail a `-Dwarnings` build. For this macro, all we need to know is that the error type is uninhabited, so replace this with an irrefutable pattern instead. [ The error looks like (dummy reproducer): error: unreachable expression --> rust/kernel/sync.rs:177:5 | 177 | pin_init::stack_pin_init!(let num = 42u32); | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | | | unreachable expression | any code following this expression is unreachable | = note: `-D unreachable-code` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(unreachable_code)]` = note: this error originates in the macro `pin_init::stack_pin_init` (in Nightly builds, run with -Z macro-backtrace for more info) - Miguel ] Reported-by: Mohamad Alsadhan Closes: https://github.com/Rust-for-Linux/pin-init/pull/171 Signed-off-by: Gary Guo Cc: stable@vger.kernel.org # Needed in 7.1.y and later (for 6.12.y and 6.18.y a custom one is needed). Link: https://patch.msgid.link/20260828155033.2101924-1-gary@kernel.org [ Reworded for typos. - Miguel ] Signed-off-by: Miguel Ojeda

Merge tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

2026-08-30T16:47:39Z

Pull Rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Fix KCFI failures, such as in Rust doctests, by disabling function merging when CFI is enabled. Gary reported the LLVM bug to upstream and it is now fixed in their mainline. - Fix 'objtool' fallthrough warnings under the experimental 'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and helpers code) the LLVM options needed to preserve the unreachable traps that 'rustc' normally emits. In addition, fix 'objtool' errors when LTO is enabled on top, by also filtering out the LTO flags (for the combined Rust and helpers code) so that the traps are kept in place. - Fix 'objtool' warnings by adding one more 'noreturn' function. - Fix 'make rusttest' target when the 'rustc-dev' component is installed and Rust >= 1.82.0, <= 1.87.0 is used. 'kernel' crate: - 'num' module: fix soundness issue in the 'Bounded' conversion from 'bool' by restricting the conversions to unsigned 'Bounded'. - 'jump_label' module: fix future 'make rusttest' target failures when 'ARCH=' is set to an arch different than the host's. - 'list' module: fix incorrect 'pop_back()' comment" * tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: kbuild: disambiguate `zerocopy_derive` for `rusttest` rust: num: restrict bool conversion to unsigned Bounded kbuild: rust: keep Rust objects out of Clang LTO with inline helpers kbuild: rust: preserve unreachable traps with inline helpers rust: cfi: disable function merging if CFI is enabled rust: jump_label: skip arch-specific asm in `testlib` builds objtool/rust: add one more `noreturn` Rust function rust: kernel: list: fix incorrect pop_back example comment