linux/net/core
Linus Torvalds e14aacefb7 There is a known WiFi/mt76 regression, waiting for a complete fix that
should land soonish.
 
 Including fixes from netfilter.
 
 Previous releases - regressions:
 
   - tcp: fix icsk_ack.ato bitfield overflow
 
   - af_unix: Unlink scc_entry in unix_del_edge().
 
   - ipv4: fix use-after-free in fib_nhc_update_mtu()
 
   - netfilter:
     - ipset: fix refcount race between list:set GC and swap
     - nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
 
   - sched: act_ct: fix sk_buff leak when the header checks reject a packet
 
   - sctp: clear new_transport when removing a peer
 
   - dibs: correct freeing of dmb_clientid_arr
 
   - ovpn: fix NULL dereference when killing missing key
 
   - eth: veth: fix queue index used to wake the peer txq in veth_poll
 
   - eth: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
 
   - eth: gve: fix zero-length skb frag with header-split
 
 Previous releases - always broken:
 
   - core: fix skb length accounting after generic XDP frag adjustment
 
   - af_packet: don't send zero-byte data in tpacket_snd().
 
   - eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
 
   - eth: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmp93xcSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkMMEP/AyjDJBRLMNyKkqY5lEK1ZvPqgaCTWuE
 U/A8ZBxveuCmRDCWkEJhQp2bQHuwJsqW9wYmFob8eEEsAmjey7362t3z7OxKuq7x
 kL8MOpkSY7MyB1kJBrzNMhBSHtSfbRQ/6vqJApoeXkMYxldi9NKvT1pndVwx1vdZ
 G0dVD0dMTR/bWuALfg1aQXAHziACL7eR19eJ/IR9IF2F+Tqi8LgrZpiv0FT9ZU8G
 vHeX9P1WpiorU4nnyqpBoNNpam3mTupcXg+ScqSKlkYKUCZV8ILA0rLZijZxXTrK
 WbO7VxzAjwoz//GMTHAdnw4m0lsPVpCXGzWm/CIUQ/Z1OO04NXGru6LPOlsgufZ1
 LNtbon7+GJ3JWl54/cvBYuDMBaYY+9CW6WdiWdlQuxlaZmixAWpbSxCZuwZMlV9Z
 5HRhQfbg1N20zSTNnmKi5o6uwWOWxpQpxIwDkmPlDIpFPX2HtD+gNJ8UqHwIhgcG
 j6h2oP2up6PS6NxtWm5+UFXqrwL/0AyI1R5x5hdbOO2rfyfcDDec4eo+qhrOhnkq
 uKvBADD4b9zO7hllOz/XQ0uDYfylZlnp4Gx3+6JMYkqeMbk+TmSxrras+g6jnPyk
 gTQ9MK2RHoFywDGMiNebDUJAX/fNWxWywzyzuY3izW4B1jho9YGMSLilaJ/xDDQ9
 AL7fWaTpvCty
 =asb8
 -----END PGP SIGNATURE-----

Merge tag 'net-7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter.

  There is a known WiFi/mt76 regression, waiting for a complete fix that
  should land soonish.

  Previous releases - regressions:

   - tcp: fix icsk_ack.ato bitfield overflow

   - af_unix: Unlink scc_entry in unix_del_edge()

   - ipv4: fix use-after-free in fib_nhc_update_mtu()

   - netfilter:
      - ipset: fix refcount race between list:set GC and swap
      - nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort
        path

   - sched: act_ct: fix sk_buff leak when the header checks reject a
     packet

   - sctp: clear new_transport when removing a peer

   - dibs: correct freeing of dmb_clientid_arr

   - ovpn: fix NULL dereference when killing missing key

   - eth:
      - veth: fix queue index used to wake the peer txq in veth_poll
      - ngbe: fix NULL pointer dereference in non-MSI-X interrupt
        enabling
      - gve: fix zero-length skb frag with header-split

  Previous releases - always broken:

   - core: fix skb length accounting after generic XDP frag adjustment

   - af_packet: don't send zero-byte data in tpacket_snd().

   - eth:
      - bnxt: avoid deadlock when canceling IRQ affinity notifier
      - ipvlan: inherit needed_headroom and needed_tailroom from
        phy_dev"

* tag 'net-7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (55 commits)
  l2tp: fix tunnel and session refcount leak on seq_file release
  net/sched: cls_bpf: reject dev-bound programs bound to a different device
  sctp: fix use-after-free of cached ASCONF chunk
  net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
  sctp: clear new_transport when removing a peer
  net/dibs: Correct freeing of dmb_clientid_arr
  net/sched: cls_u32: skip hash tables in u32_bind_class()
  gve: fix NULL dereference due to missing ptp adjfine
  gve: fix zero-length skb frag with header-split
  net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
  af_packet: Don't send zero-byte data in tpacket_snd().
  tipc: read le->link under the node lock in tipc_node_link_down()
  selftests: tls: cover splice after a failed decrypt
  net/tls: Fail tls_sw_splice_read() after a failed async decrypt
  net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
  net: tap: fix wrong transport_header when sending VLAN-tagged frame
  net: packet: fix wrong transport_header when sending VLAN-tagged frame
  vxlan: do not arm the ageing timer on a device that is down
  ipv4: fix use-after-free in fib_nhc_update_mtu()
  NTB: ntb_netdev: Preserve RX queue depth on allocation failure
  ...
2026-08-13 08:37:26 -07:00
..
bpf_sk_storage.c bpf: Fix UAF in sock clone early bailouts 2026-07-09 18:44:16 +02:00
datagram.c net: devmem: prevent net-iov / page mixing 2026-07-30 16:27:03 -07:00
dev_addr_lists_test.c net: cache snapshot entries for ndo_set_rx_mode_async 2026-04-21 12:50:13 +02:00
dev_addr_lists.c net: turn the rx_mode work into a generic netdev_work facility 2026-06-25 10:18:40 -07:00
dev_api.c net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work 2026-04-21 12:50:03 +02:00
dev_ioctl.c net: ethtool: make dev->hwprov ops-protected 2026-06-09 10:13:04 -07:00
dev.c net: fix skb length accounting after generic XDP frag adjustment 2026-08-07 17:01:05 -07:00
dev.h net: avoid theoretical races with ref drain 2026-08-06 09:37:03 -07:00
devmem.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-05-21 15:09:02 -07:00
devmem.h net: devmem: support TX over NETMEM_TX_NO_DMA devices 2026-05-18 18:49:06 -07:00
drop_monitor.c drop_monitor: perform u64_stats updates under IRQ-disabled section 2026-07-23 11:00:01 -07:00
dst_cache.c net: dst: annotate data-races around dst->obsolete 2025-07-02 14:32:29 -07:00
dst.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
failover.c net: net_failover: Fix the deadlock in slave register 2026-05-13 19:01:03 -07:00
fib_notifier.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
fib_rules.c net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). 2026-06-11 15:14:03 -07:00
filter.c bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie 2026-08-05 22:24:27 +02:00
flow_dissector.c flow_dissector: check device type before reading ETH_ADDRS 2026-06-18 18:07:00 -07:00
flow_offload.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
gen_estimator.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
gen_stats.c net/sched: add const qualifiers to gnet_stats helpers 2026-05-11 18:28:08 -07:00
gro_cells.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
gro.c net: gro: fix double aggregation of flush-marked skbs 2026-07-21 08:30:54 -07:00
gso.c net: introduce struct net_hotdata 2024-03-07 21:12:41 -08:00
hotdata.c net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros 2026-03-29 11:21:22 -07:00
hwbm.c
ieee8021q_helpers.c net: ieee8021q: fix insufficient table-size assertion 2025-07-01 12:55:49 +02:00
link_watch.c net: rename netdev_ops_assert_locked() 2026-06-04 14:04:55 -07:00
lock_debug.c net: document NETDEV_CHANGENAME as ops locked 2026-06-04 14:04:55 -07:00
lwt_bpf.c bpf: lwt: Fix dst reference leak on reroute failure 2026-07-28 13:22:11 +02:00
lwtunnel.c net: lwtunnel: Drop skb metadata before LWT encapsulation 2026-06-23 19:07:23 -07:00
Makefile net: turn the rx_mode work into a generic netdev_work facility 2026-06-25 10:18:40 -07:00
mp_dmabuf_devmem.h memory-provider: dmabuf devmem memory provider 2024-09-11 20:44:31 -07:00
neighbour.c neighbour: remove obsolete EXPORT_SYMBOL() 2026-06-08 15:59:17 -07:00
net_namespace.c Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
net_test.c pfcp: always set pfcp metadata 2024-04-01 10:49:28 +01:00
net-procfs.c net: add proper RCU protection to /proc/net/ptype 2026-02-03 19:20:30 -08:00
net-sysfs.c net: Defer netdev KOBJ_ADD uevent until the device is published 2026-08-06 09:36:18 -07:00
net-sysfs.h net: Defer netdev KOBJ_ADD uevent until the device is published 2026-08-06 09:36:18 -07:00
net-traces.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
netclassid_cgroup.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
netdev_config.c net: add queue config validation callback 2026-01-23 11:49:02 -08:00
netdev_queues.c net: expect instance lock in netdev_queue_get_dma_dev() 2026-08-10 15:54:42 -07:00
netdev_rx_queue.c net: Stop leased rxq before uninstalling its memory provider 2026-06-11 15:57:39 -07:00
netdev_work.c net: avoid theoretical races with ref drain 2026-08-06 09:37:03 -07:00
netdev-genl-gen.c net: devmem: allow bind-rx from non-init user namespaces 2026-06-05 18:10:31 -07:00
netdev-genl-gen.h net: Add queue-create operation 2026-04-09 18:21:45 -07:00
netdev-genl.c netdev-genl: report NAPI thread PID in the caller's pid namespace 2026-06-17 16:09:32 -07:00
netevent.c
netmem_priv.h Revert "mm: introduce a new page type for page pool in page type" 2026-05-21 19:06:13 -07:00
netpoll.c netpoll: fix a use-after-free on shutdown path 2026-06-27 15:39:59 -07:00
netprio_cgroup.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
of_net.c
page_pool_priv.h net: page_pool: don't try to stash the napi id 2025-01-27 14:37:41 -08:00
page_pool_user.c net: make page_pool_get_stats() void 2026-05-28 18:10:03 -07:00
page_pool.c net: make page_pool_get_stats() void 2026-05-28 18:10:03 -07:00
pktgen.c net: pktgen: fix proc entry use-after-free 2026-07-24 16:29:20 -07:00
ptp_classifier.c
rtnetlink.c net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink 2026-06-17 16:01:52 -07:00
scm.c net: use ktime_t in struct scm_timestamping_internal 2026-03-04 17:53:34 -08:00
secure_seq.c tcp: secure_seq: add back ports to TS offset 2026-03-04 17:44:35 -08:00
selftests.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
skb_fault_injection.c net: Implement fault injection forcing skb reallocation 2024-11-12 12:05:33 +01:00
skbuff.c veth: convert frag_list skbs before running XDP 2026-07-24 17:02:10 -07:00
skmsg.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
sock_diag.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
sock_map.c bpf, sockmap: Reject unhashed UDP sockets on sockmap update 2026-07-15 10:34:14 +02:00
sock_reuseport.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
sock.c net: remove WARN_ON_ONCE() from sk_mc_loop() 2026-08-06 13:10:16 +02:00
stream.c net: remove some unused EXPORT_SYMBOL()s 2026-06-12 16:43:11 -07:00
sysctl_net_core.c net: add skb_defer_disable_key static key 2026-03-12 19:25:33 -07:00
timestamping.c net: Add the possibility to support a selected hwtstamp in netdevice 2024-12-16 12:51:40 +00:00
tso.c net: tso: Introduce tso_dma_map and helpers 2026-04-12 10:54:31 -07:00
utils.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
xdp.c xdp: reject clones that overrun skb_shared_info tailroom 2026-08-06 08:49:19 -07:00