linux/net/ipv4
Linus Torvalds 2812e64e15 This is again larger than usual: the backlog accumulated in the past weeks
is not done yet. I'm not aware of any known pending regression.
 
 Including fixes from netfilter, Bluetooth, WiFi and CAN.
 
 Current release - regressions:
 
   - eth: tun/vhost: revert avoid ptr_ring tail-drop when a qdisc is present
 
   - bluetooth: remove unnecessary hci_conn_get in create_conn_sync
 
   - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
 
 Previous releases - regressions:
 
   - core: do not send ICMP/NDISC Redirects when peer allocation fails
 
   - ipv6: take nexthop lock for f6i_list walks in replace check and notify
 
   - wifi: fix an ath12k MLO regression impacting WCN7850/QCC2072.
 
   - netfilter: nf_tables: make nft_object rhltable per table
 
   - af_unix: fix listen() succeeding on sockets in the wrong state
 
   - openvswitch: fix potential UAF on meter attach failure
 
   - bluetooth:
     - fix advertising data UAFs
     - avoid deadlocks in iso_sock_timeout
 
   - smc: fix socket use-after-free during link group termination
 
   - dpll: use pin owner's dpll ref for pin-level attribute reporting
 
   - eth: veth: convert frag_list skbs before running XDP
 
   - eth: ice: wait for reset completion in ice_resume()
 
   - eth: igc: remove napi_synchronize() in igc_down()
 
   - eth: vxlan: use pskb_network_may_pull() for transmit path header pulls
 
 Previous releases - always broken:
 
   - xsk: fix AF_XDP multi-buffer Tx descriptor reclaim
 
   - psp: fix NULL genl_sock deref race with concurrent netns teardown
 
   - netfilter: widen NAT rewrite delta to s32 in sip_help_tcp()
 
   - can: peak_usb: fix double free of transfer buffer on URB submit error
 
   - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
 
   - sctp: prevent peer transport count overflow
 
   - eth: idpf: bound interrupt-vector register fill to the allocated array
 
   - dsa: mt7530: error out on failed reads in MT7531 PHY polling
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmprXncSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOk1gIP/RUp/tHQX75kgUHHmWJTajPJA9tRjRVn
 7Ke6pr0Os4xmMP3ZsC6xo/se2fe1fOmoNoNpK9TdTThzp+AiBov/Vqdyxnlks06f
 9Y0L3JvffKJEJ8C2NhhKBZdIt0rFtED4PiqOxmht9NpQgNLeJpJSzg9ItPdgjG9S
 De5VNqbq3vFMPEF2AeAA6I8fUPwxneziGUxDHFJ0oarpkxUyQnv1vKAeDHFB1BGs
 IA04yVcqKmL9k/yY/rS0Lj4j568a5qygDnXikRwqFnrvOumqDn0DtAMDXaDgj9b1
 S0tQaFW6vAaA2fbxUlrkiaOpNrts1W0c1XtnMJcs5suU9CsJpyw3/QDYHA0QXSac
 fNVP9aqaPLEMw+84NMavpgdnW6l0jFY070SJ+WK3kXNwWSv+D1tumQgzqYo59Lut
 HDbu24TVJmLi+m6wrUBPLN4wHzpyBf7f3HOu+LARbPgK08J0JfiwPNgb2IUJEfE5
 czMc0Dy21JLR3C1uVrHKY3EeSodz7mcCKKAl+Cpbl83xkQjmCu+OJlJm18I5+oAI
 nTLO65RAKq0XvLEt1xHl0s1pp7fAJNWHVu167GdWS7l1AvbqtLeqz7VsPCN+Qj5+
 07YP+e7XRy3ODVTOl+XrwVK44Qd12ZXq/fTAm0ABULSMvRINOai6gy7I2aLx/sqK
 0xP7ex1tCG2I
 =jLD8
 -----END PGP SIGNATURE-----

Merge tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "This is again larger than usual: the backlog accumulated in the past weeks
  is not done yet. I'm not aware of any known pending regression.

  Including fixes from netfilter, Bluetooth, WiFi and CAN.

  Current release - regressions:

   - bluetooth: remove unnecessary hci_conn_get in create_conn_sync

   - can: isotp: fix timer drain order, wakeup handling and tx_gen
     ordering

   - eth:
       - tun/vhost: revert avoid ptr_ring tail-drop when a qdisc is
         present

  Previous releases - regressions:

   - core: do not send ICMP/NDISC Redirects when peer allocation fails

   - ipv6: take nexthop lock for f6i_list walks in replace check and
     notify

   - wifi: fix an ath12k MLO regression impacting WCN7850/QCC2072.

   - netfilter: nf_tables: make nft_object rhltable per table

   - af_unix: fix listen() succeeding on sockets in the wrong state

   - openvswitch: fix potential UAF on meter attach failure

   - bluetooth:
       - fix advertising data UAFs
       - avoid deadlocks in iso_sock_timeout

   - smc: fix socket use-after-free during link group termination

   - dpll: use pin owner's dpll ref for pin-level attribute reporting

   - eth:
       - veth: convert frag_list skbs before running XDP
       - ice: wait for reset completion in ice_resume()
       - igc: remove napi_synchronize() in igc_down()
       - vxlan: use pskb_network_may_pull() for transmit path header pulls

  Previous releases - always broken:

   - xsk: fix AF_XDP multi-buffer Tx descriptor reclaim

   - psp: fix NULL genl_sock deref race with concurrent netns teardown

   - netfilter: widen NAT rewrite delta to s32 in sip_help_tcp()

   - can: peak_usb: fix double free of transfer buffer on URB submit error

   - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

   - sctp: prevent peer transport count overflow

   - dsa: mt7530: error out on failed reads in MT7531 PHY polling

   - eth:
       - idpf: bound interrupt-vector register fill to the allocated array"

* tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (156 commits)
  qede: sync udp_tunnel ports outside qede_lock in the recovery path
  net: openvswitch: fix potential UAF on meter attach failure
  octeontx2-pf: Set correct sequence for carrier off and tx queue stop
  net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
  net: dsa: realtek: use devm_mutex_init for l2_lock
  net: dsa: realtek: use devm_mutex_init for vlan_lock
  net: dsa: realtek: use devm_mutex_init for regmap lock
  net: dsa: realtek: rtl8365mb: use devm_mutex_init for mib_lock
  ptp: netc: fix potential interrupt storm caused by incorrect unbind order
  net: mana: Return error code from mana_create_rxq()
  net: openvswitch: fix skb leak on flow key update failure during ct
  net: openvswitch: fix skb leak on flow key update failure during recirculation
  net: stmmac: Fix E2E delay mechanism
  net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
  net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling
  net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
  Revert "tun/tap: add ptr_ring consume helper with netdev queue wakeup"
  Revert "vhost-net: wake queue of tun/tap after ptr_ring consume"
  Revert "ptr_ring: move free-space check into separate helper"
  Revert "tun/tap & vhost-net: avoid ptr_ring tail-drop when a qdisc is present"
  ...
2026-07-30 09:18:49 -07:00
..
netfilter netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() 2026-07-22 20:34:28 +02:00
af_inet.c ipv4: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() 2026-06-05 17:47:07 -07:00
ah4.c xfrm: ah: use skb_to_full_sk in async output callbacks 2026-05-16 10:56:14 +02:00
arp.c net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
bpf_tcp_ca.c bpf: Reject TCP_NODELAY in bpf-tcp-cc 2026-04-22 12:58:57 -07:00
cipso_ipv4.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
datagram.c raw: annotate lockless match fields in raw_v4_match() 2026-07-23 07:46:12 -07:00
devinet.c ipv4: handle devconf post-set actions on netlink updates 2026-06-13 14:15:53 -07:00
esp4_offload.c xfrm: Fix inner mode lookup in tunnel mode GSO segmentation 2025-12-04 09:54:53 +01:00
esp4.c esp: fix page frag reference leak on skb_to_sgvec failure 2026-06-09 15:58:17 +02:00
fib_frontend.c ipv4: fib_rule: Move fib4_rules_exit() to ->exit(). 2026-06-16 15:42:53 -07:00
fib_lookup.h ipv4: fib: Annotate access to struct fib_alias.fa_state. 2026-01-28 19:33:07 -08:00
fib_notifier.c net: do not acquire rtnl in fib_seq_sum() 2024-10-11 15:35:05 -07:00
fib_rules.c ipv4: fib_rule: Move fib4_rules_exit() to ->exit(). 2026-06-16 15:42:53 -07:00
fib_semantics.c ipv4: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() 2026-06-05 17:47:07 -07:00
fib_trie.c ipv4: fib: free fib_alias with kfree_rcu() on insert error path 2026-07-10 16:00:41 +02:00
fou_bpf.c ip_tunnel: convert __be16 tunnel flags to bitmaps 2024-04-01 10:49:28 +01:00
fou_core.c fou: Fix use-after-free in fou_create() 2026-07-28 10:40:48 +02:00
fou_nl.c fou: Don't allow 0 for FOU_ATTR_IPPROTO. 2026-01-17 16:00:24 -08:00
fou_nl.h tools: ynl-gen: add regeneration comment 2025-11-25 19:20:42 -08:00
gre_demux.c gre: Count GRE packet drops 2026-04-12 12:33:33 -07:00
gre_offload.c net: gro: rename skb_gro_header_hard() 2024-03-05 13:30:11 +01:00
icmp.c ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup 2026-07-23 07:01:24 -07:00
igmp_internal.h netlink: support dumping IPv4 multicast addresses 2025-02-11 11:26:53 +01:00
igmp.c ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() 2026-07-08 14:41:01 +02:00
inet_connection_sock.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
inet_diag.c inet_diag: report delayed ack timer information 2026-03-06 16:32:26 -08:00
inet_fragment.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-11 14:33:35 -07:00
inet_hashtables.c net: remove some unused EXPORT_SYMBOL()s 2026-06-12 16:43:11 -07:00
inet_timewait_sock.c inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() 2025-10-17 16:08:43 -07:00
inetpeer.c inetpeer: add a missing read_seqretry() in inet_getpeer() 2026-05-06 17:44:13 -07:00
ip_forward.c net: fix IPSTATS_MIB_OUTFORWDATAGRAMS increment after fragment check 2023-10-13 09:58:45 -07:00
ip_fragment.c inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush 2026-06-04 18:05:23 -07:00
ip_gre.c net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM 2026-07-23 13:01:57 +02:00
ip_input.c tcp: move tcp_v4_early_demux() to net/ipv4/ip_input.c 2026-03-09 18:50:24 -07:00
ip_options.c ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options 2026-06-03 18:53:14 -07:00
ip_output.c ipv4: account for fraggap on the paged allocation path 2026-06-21 15:24:49 -07:00
ip_sockglue.c net: remove addr_len argument of recvmsg() handlers 2026-03-02 18:17:17 -08:00
ip_tunnel_core.c tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() 2026-05-26 18:11:47 -07:00
ip_tunnel.c ip_tunnel: annotate data-races around t->err_count and t->err_time 2026-06-12 16:40:32 -07:00
ip_vti.c net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink 2026-06-17 16:01:52 -07:00
ipcomp.c xfrm: add extack to xfrm_init_state 2026-06-04 12:22:35 +02:00
ipconfig.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ipip.c net: ipip: require CAP_NET_ADMIN in the device netns for changelink 2026-06-17 16:01:52 -07:00
ipmr_base.c ipmr: Replace use of system_unbound_wq with system_dfl_wq 2026-05-19 18:21:39 -07:00
ipmr.c ipmr: Convert mr_table.cache_resolve_queue_len to u32. 2026-06-11 15:17:30 -07:00
Kconfig net/tcp: Remove tcp_sigpool 2026-04-30 09:38:56 +02:00
Makefile netfilter: add option for GCOV profiling 2026-05-24 22:55:47 +02:00
metrics.c net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros 2026-03-29 11:21:22 -07:00
netfilter.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
netlink.c
nexthop.c nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush 2026-07-24 15:00:56 -07:00
ping.c Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
proc.c udp: Remove UDP-Lite SNMP stats. 2026-03-13 18:57:44 -07:00
protocol.c
raw_diag.c inet_diag: change inet_diag_bc_sk() first argument 2025-08-29 19:29:24 -07:00
raw.c raw: annotate lockless match fields in raw_v4_match() 2026-07-23 07:46:12 -07:00
route.c net: do not send ICMP/NDISC Redirects when peer allocation fails 2026-07-27 13:54:16 -07:00
syncookies.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
sysctl_net_ipv4.c net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes 2026-06-17 16:35:13 -07:00
tcp_ao.c tcp: restore RCU grace period in tcp_ao_destroy_sock 2026-06-29 18:14:30 -07:00
tcp_bbr.c tcp_bbr: fix SPDX-License-Identifier to be GPL-2.0 OR BSD-3-Clause 2026-06-01 16:51:08 -07:00
tcp_bic.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_bpf.c bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() 2026-07-24 15:04:11 -07:00
tcp_cdg.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_cong.c tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers 2026-02-03 15:13:24 +01:00
tcp_cubic.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_dctcp.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_dctcp.h net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
tcp_diag.c inet_diag: report delayed ack timer information 2026-03-06 16:32:26 -08:00
tcp_fastopen.c net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros 2026-03-29 11:21:22 -07:00
tcp_highspeed.c
tcp_htcp.c tcp: Use clamp() in htcp_alpha_update() 2024-08-06 12:16:25 -07:00
tcp_hybla.c
tcp_illinois.c
tcp_input.c tcp: challenge ACK for non-exact RST in SYN-RECEIVED 2026-07-23 08:27:22 -07:00
tcp_ipv4.c bpf: tcp: fix double sock release on batch realloc 2026-07-23 12:20:34 +02:00
tcp_lp.c net: tcp_lp: fix kernel-doc warnings and update outdated reference links 2025-10-28 17:52:44 -07:00
tcp_metrics.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_minisocks.c tcp: challenge ACK for non-exact RST in SYN-RECEIVED 2026-07-23 08:27:22 -07:00
tcp_nv.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_offload.c gro: flushing when CWR is set negatively affects AccECN 2026-02-03 15:13:24 +01:00
tcp_output.c tcp: Decrement tcp_md5_needed static branch 2026-06-29 18:14:30 -07:00
tcp_plb.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
tcp_recovery.c tcp: move tcp_rack_advance() to tcp_input.c 2026-01-28 19:31:51 -08:00
tcp_scalable.c
tcp_timer.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
tcp_ulp.c
tcp_vegas.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_vegas.h tcp: add cwnd_event_tx_start to tcp_congestion_ops 2026-03-24 21:00:38 -07:00
tcp_veno.c tcp: add cwnd_event_tx_start to tcp_congestion_ops 2026-03-24 21:00:38 -07:00
tcp_westwood.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_yeah.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp.c net: remove some unused EXPORT_SYMBOL()s 2026-06-12 16:43:11 -07:00
tunnel4.c net: fill in MODULE_DESCRIPTION()s for ipv4 modules 2024-02-09 14:12:02 -08:00
udp_bpf.c sockmap: Fix use-after-free in udp_bpf_recvmsg() 2026-06-14 21:30:20 -07:00
udp_diag.c udp: Don't pass udptable to IPv4 socket lookup functions. 2026-03-13 18:57:46 -07:00
udp_offload.c udp: Fix UDP length on last GSO_PARTIAL segment 2026-05-20 15:03:47 -07:00
udp_tunnel_core.c udp_tunnel: Remove synchronize_rcu() in udp_tunnel_sock_release(). 2026-05-05 17:47:06 -07:00
udp_tunnel_nic.c net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() 2026-07-28 13:32:34 +02:00
udp_tunnel_stub.c
udp.c udp: clear skb->dev before running a sockmap verdict 2026-06-04 09:01:51 -07:00
xfrm4_input.c xfrm: Fix dev use-after-free in xfrm async resumption 2026-06-12 08:39:59 +02:00
xfrm4_output.c ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] 2025-07-02 14:32:30 -07:00
xfrm4_policy.c ipv4: Convert ->flowi4_tos to dscp_t. 2025-08-26 17:34:31 -07:00
xfrm4_protocol.c ipv4: Convert ip_route_input_noref() to dscp_t. 2024-10-03 16:21:21 -07:00
xfrm4_state.c
xfrm4_tunnel.c net: fill in MODULE_DESCRIPTION()s for ipv4 modules 2024-02-09 14:12:02 -08:00