mirror-linux/net
Linus Torvalds a55f7f5f29 Including fixes from netfilter, IPsec and wireless. This is again
considerably bigger than the old average. No known outstanding
 regressions.
 
 Current release - regressions:
 
   - net: increase IP_TUNNEL_RECURSION_LIMIT to 5
 
   - eth: ice: fix PTP timestamping broken by SyncE code on E825C
 
 Current release - new code bugs:
 
   - eth: stmmac: dwmac-motorcomm: fix eFUSE MAC address read failure
 
 Previous releases - regressions:
 
   - core: fix cross-cache free of KFENCE-allocated skb head
 
   - sched: act_csum: validate nested VLAN headers
 
   - rxrpc: fix call removal to use RCU safe deletion
 
   - xfrm:
     - wait for RCU readers during policy netns exit
     - fix refcount leak in xfrm_migrate_policy_find
 
   - wifi: rt2x00usb: fix devres lifetime
 
   - mptcp: fix slab-use-after-free in __inet_lookup_established
 
   - ipvs: fix NULL deref in ip_vs_add_service error path
 
   - eth: airoha: fix memory leak in airoha_qdma_rx_process()
 
   - eth: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
 
 Previous releases - always broken:
 
   - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
 
   - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
 
   - bridge: guard local VLAN-0 FDB helpers against NULL vlan group
 
   - xsk: tailroom reservation and MTU validation
 
   - rxrpc:
     - fix to request an ack if window is limited
     - fix RESPONSE authenticator parser OOB read
 
   - netfilter: nft_ct: fix use-after-free in timeout object destroy
 
   - batman-adv: hold claim backbone gateways by reference
 
   - eth: stmmac: fix PTP ref clock for Tegra234
 
   - eth: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling
 
   - eth: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmnXtnsSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkZeYQAKfZCL4rCkeO7VuoZn8lMN4YrBqVphuU
 MFpLKnvU8muDamBSmXGwpsdryrzQdUtEl0C7E/YyKO8TKpmFkjQRKe/Ay5XSsmJi
 fqjQiZIC9TKgVbJJbQZ4yZqOO2EZXHMRx8awnDjIwIrSLTyJtD29XaJqvmm+rojw
 uAVECbXpVOWdRVyIgHf0N3y99ItvwQycv6npjXWGHDryGVH1uXz4CiWFgltFd827
 MgNx5gZ7wn6ls1B4E1EsIXZeCnVOoNMUBX+CtkSl7ctZD/nvqLZ0PqGEViqGZ+w7
 kEK9jWWvsmST3j0wG4IldbnQJORZrDXR5lAmvOJILxUDD4jG4zaqHPYs4ELS5sHK
 E1QOs6uNBNvu40neGe7zcH4DpQzv5/W5yj0ELPBZJhV/5madjEpETOh6yO7EJRBl
 sdd32LD0z8wFt8yJGEbXM7YC4A8tzNagWF0wKpRqbiKFlWHdJffwqcmEe6+2CiXx
 rg0q2DAfvTesmzdMgGuk4ZOeczfZ9JbxPYA0IYrUegYmbI6tAuCK5slaKGOwoyml
 hX2lXNBxaVmTk7F9Qq6I9Ona78XqO0Tg0UBzC2dIsQITvkue7ItJBpkurOwYSOGt
 a8SAVV0JwXSfPquKlOfLhagPZcuQuTQfIqRKVqM47KPPO/i99okRXQbfJGrpHJKM
 8bzRl6654nAs
 =uzl/
 -----END PGP SIGNATURE-----

Merge tag 'net-7.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter, IPsec and wireless. This is again
  considerably bigger than the old average. No known outstanding
  regressions.

  Current release - regressions:

   - net: increase IP_TUNNEL_RECURSION_LIMIT to 5

   - eth: ice: fix PTP timestamping broken by SyncE code on E825C

  Current release - new code bugs:

   - eth: stmmac: dwmac-motorcomm: fix eFUSE MAC address read failure

  Previous releases - regressions:

   - core: fix cross-cache free of KFENCE-allocated skb head

   - sched: act_csum: validate nested VLAN headers

   - rxrpc: fix call removal to use RCU safe deletion

   - xfrm:
      - wait for RCU readers during policy netns exit
      - fix refcount leak in xfrm_migrate_policy_find

   - wifi: rt2x00usb: fix devres lifetime

   - mptcp: fix slab-use-after-free in __inet_lookup_established

   - ipvs: fix NULL deref in ip_vs_add_service error path

   - eth:
      - airoha: fix memory leak in airoha_qdma_rx_process()
      - lan966x: fix use-after-free and leak in lan966x_fdma_reload()

  Previous releases - always broken:

   - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()

   - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group
     dump

   - bridge: guard local VLAN-0 FDB helpers against NULL vlan group

   - xsk: tailroom reservation and MTU validation

   - rxrpc:
      - fix to request an ack if window is limited
      - fix RESPONSE authenticator parser OOB read

   - netfilter: nft_ct: fix use-after-free in timeout object destroy

   - batman-adv: hold claim backbone gateways by reference

   - eth:
      - stmmac: fix PTP ref clock for Tegra234
      - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling
      - ipa: fix GENERIC_CMD register field masks for IPA v5.0+"

* tag 'net-7.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (104 commits)
  net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
  net: lan966x: fix page pool leak in error paths
  net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
  nfc: pn533: allocate rx skb before consuming bytes
  l2tp: Drop large packets with UDP encap
  net: ipa: fix event ring index not programmed for IPA v5.0+
  net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
  MAINTAINERS: Add Prashanth as additional maintainer for amd-xgbe driver
  devlink: Fix incorrect skb socket family dumping
  af_unix: read UNIX_DIAG_VFS data under unix_state_lock
  Revert "mptcp: add needs_id for netlink appending addr"
  mptcp: fix slab-use-after-free in __inet_lookup_established
  net: txgbe: leave space for null terminators on property_entry
  net: ioam6: fix OOB and missing lock
  rxrpc: proc: size address buffers for %pISpc output
  rxrpc: only handle RESPONSE during service challenge
  rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()
  rxrpc: Fix leak of rxgk context in rxgk_verify_response()
  rxrpc: Fix integer overflow in rxgk_verify_response()
  rxrpc: Fix missing error checks for rxkad encryption/decryption failure
  ...
2026-04-09 08:39:25 -07:00
..
6lowpan
9p Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
802 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
8021q Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
appletalk Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
atm atm: lec: fix use-after-free in sock_def_readable() 2026-03-14 08:05:47 -07:00
ax25 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
batman-adv Here are two batman-adv bugfixes: 2026-04-08 18:50:27 -07:00
bluetooth Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync 2026-04-01 16:48:28 -04:00
bpf Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
bridge bridge: guard local VLAN-0 FDB helpers against NULL vlan group 2026-04-03 14:45:51 -07:00
caif Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
can can: isotp: fix tx.buf use-after-free in isotp_sendmsg() 2026-03-19 17:16:02 +01:00
ceph libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() 2026-03-11 10:18:56 +01:00
core Including fixes from netfilter, IPsec and wireless. This is again 2026-04-09 08:39:25 -07:00
dcb Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
devlink devlink: Fix incorrect skb socket family dumping 2026-04-08 19:34:38 -07:00
dns_resolver
dsa Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ethernet bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
ethtool Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
handshake treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
hsr net: hsr: fix VLAN add unwind on slave errors 2026-04-02 08:23:49 -07:00
ieee802154 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ife
ipv4 ipsec-2026-04-08 2026-04-08 18:54:32 -07:00
ipv6 net: ioam6: fix OOB and missing lock 2026-04-08 19:08:56 -07:00
iucv Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
kcm kcm: fix zero-frag skb in frag_list on partial sendmsg error 2026-02-23 17:26:55 -08:00
key net: af_key: zero aligned sockaddr tail in PF_KEY exports 2026-04-07 11:08:24 +02:00
l2tp l2tp: Drop large packets with UDP encap 2026-04-09 10:19:05 +02:00
l3mdev
lapb treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
llc treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
mac80211 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure 2026-03-18 09:09:58 +01:00
mac802154 bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
mctp mctp: route: hold key->lock in mctp_flow_prepare_output() 2026-03-10 11:38:36 +01:00
mpls mpls: add seqcount to protect the platform_label{,s} pair 2026-03-26 18:32:14 -07:00
mptcp Revert "mptcp: add needs_id for netlink appending addr" 2026-04-08 19:31:16 -07:00
ncsi net: ncsi: fix skb leak in error paths 2026-03-06 17:34:48 -08:00
netfilter netfilter: nfnetlink_queue: make hash table per queue 2026-04-08 13:34:51 +02:00
netlabel Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
netlink Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
netrom Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
nfc nfc: nci: fix circular locking dependency in nci_close_device 2026-03-19 16:56:18 -07:00
nsh
openvswitch openvswitch: validate MPLS set/set_masked payload length 2026-03-20 18:37:31 -07:00
packet net: fix fanout UAF in packet_release() via NETDEV_UP race 2026-03-23 17:07:19 -07:00
phonet bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
psample treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
psp Including fixes from IPsec, Bluetooth and netfilter 2026-02-26 08:00:13 -08:00
qrtr net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak 2026-03-26 20:22:38 -07:00
rds rds: ib: reject FRMR registration before IB connection is established 2026-04-01 17:52:40 -07:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-07 12:35:04 +02:00
rose net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect 2026-03-12 19:23:59 -07:00
rxrpc rxrpc: proc: size address buffers for %pISpc output 2026-04-08 18:45:32 -07:00
sched net: sched: act_csum: validate nested VLAN headers 2026-04-03 14:34:56 -07:00
sctp Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
shaper net: shaper: protect from late creation of hierarchy 2026-03-19 13:47:15 +01:00
smc net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer 2026-03-20 18:59:30 -07:00
strparser
sunrpc nfsd-7.0 fixes: 2026-03-18 14:27:11 -07:00
switchdev treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
tipc tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG 2026-04-03 15:31:17 -07:00
tls net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption 2026-04-07 14:53:42 +02:00
unix af_unix: read UNIX_DIAG_VFS data under unix_state_lock 2026-04-08 19:33:52 -07:00
vmw_vsock vsock: initialize child_ns_mode_locked in vsock_net_init() 2026-04-02 08:18:56 -07:00
wireless wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down 2026-03-06 12:41:59 +01:00
x25 net/x25: Fix overflow when accumulating packets 2026-04-02 13:36:08 +02:00
xdp xsk: validate MTU against usable frame size on bind 2026-04-06 18:43:51 -07:00
xfrm xfrm_user: fix info leak in build_report() 2026-04-07 10:36:38 +02:00
Kconfig
Kconfig.debug
Makefile
compat.c
devres.c
socket.c net: Drop the lock in skb_may_tx_timestamp() 2026-02-24 11:27:29 +01:00
sysctl_net.c