[GIT PULL] Networking for v7.2-rc7
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-08-06 18:30:00
Also in:
lkml
Hi Linus!
The following changes since commit 2812e64e1575e05500a35c405aaa6e99b7d7930b:
Merge tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-07-30 09:18:49 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git tags/net-7.2-rc7
for you to fetch changes up to b0ce5fd9fabe7c79463cf4602217d4dfeff5b1fd:
igc: fix netdev not re-attached after resume if interface is down (2026-08-06 10:21:28 -0700)
----------------------------------------------------------------
Including fixes from netfilter.
Looks like our attempt to keep the PRs smaller have only prevented
this one from getting even bigger. In the last 9 days there were
405 postings explicitly tagged with [PATCH net], vs 687
with [PATCH net-next]. 37% of posted patches being fixes is pretty
crazy, and that's likely undercounting because LLM "researchers"
more often post fixes without knowing to tag the patches for specific
trees. I don't have historic data.
In any case, we keep adjusting the criteria. The next PR will be smaller.
Current release - regressions:
- net: defer netdev KOBJ_ADD uevent until the device is published,
previously rtnl_lock would serialize the accesses vs publishing
- net: explicitly cancel work to avoid races with ref tracker exit
- qrtr: ns: raise lookup limit to 128
- eth: hns3: fix speed configuration residue after driver reload
Previous releases - regressions:
- tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss(),
regressed flows with MSS and scaling_ratio variability
- Revert "net: thunderbolt: Enable end-to-end flow control also
in transmit", broke some platforms (no packets coming thru)
- eth: stmmac: resume PHY before hardware setup when opening
the interface
Previous releases - always broken:
- another pile of fixes for less common protocols (SCTP, TLS, SMC etc.)
- close a couple of AF_PACKET bugs and ways it can build skbs
problematic for the rest of the stack
- bridge: mrp: fix uninitialised bytes on the wire
- net: devmem: prevent net-iov / page mixing, avoid crashes
- eth: atlantic: free RX pages of consumed but not refilled buffers
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
----------------------------------------------------------------
Ahmad Byagowi (1):
ptp: ocp: Fix board ID over-read
Ahmed Naseef (1):
net: phy: mediatek: fix TX blink masks using the RX bits
Alexandra Winter (1):
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
Alok Tiwari (2):
bnge: Fix NULL pointer dereference in aux device release
bnge: use int for bnge_fix_rings_count() return value
Antonio Quartulli (7):
ovpn: skip rehash for peers already removed from by_id
ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET
ovpn: ensure socket is owned by ovpn before deref sk_user_data
ovpn: zero-initialize sockaddr before learning a floated endpoint
ovpn: hash floated peer by transport identity only
ovpn: disable IPv4 redirects on MP interfaces
ovpn: ensure TCP vars are initialized first
Baul Lee (3):
net/x25: fix use-after-free of the socket by its timers
net: bridge: mrp: fix uninitialised bytes on the wire
sctp: keep chunk->transport in step with the list it is queued on
Bhargava Marreddy (1):
bnge: Fix resource leak in bnge_init_nic() error path
Bobby Eshleman (1):
net/mlx5e: fix BQL reset on SQ re-activation
Cen Zhang (Microsoft) (1):
net/openvswitch: check Ethernet header length in key_extract()
Chengfeng Ye (1):
netfilter: ebt_nflog: pin the NFLOG backend
Chris Mi (1):
net/mlx5: SF, Handle function changed event
Daming Li (1):
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
Dongli Zhang (1):
net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
Doruk Tan Ozturk (2):
net/packet: reset the MAC header on the packet-socket transmit path
net: usb: ipheth: fix carrier_work UAF on disconnect
Dragos Tatulea (1):
net: Defer netdev KOBJ_ADD uevent until the device is published
Eric Dumazet (3):
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
net: remove WARN_ON_ONCE() from sk_mc_loop()
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
Fan XinRan (1):
net: thunderbolt: Tear down DMA paths before stopping the rings
Fan Ye (1):
Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
Florian Westphal (3):
netfilter: ipset: add small wrappers for hash and bucket sizes
netfilter: ipset: add and use mtype_del_cidr_all helper
netfilter: ipset: switch to rcu work
Gang Yan (1):
selftests: mptcp: join: mark tests with data corruption as failed
Henry Martin (1):
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
Hidayath Khan (2):
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
dibs: initialise dibs->lock in dibs_dev_alloc()
Ivan Vecera (1):
MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li
Jakub Kicinski (10):
Merge branch 'vsock-virtio-fix-worker-access-after-virtqueue-teardown'
Merge branch 'xsk-harden-tx-metadata-validation-against-races'
Merge tag 'ovpn-net-20260730' of https://github.com/OpenVPN/ovpn-net-next
Merge branch 'net-atlantic-fix-two-ring-teardown-leaks'
Merge branch 'bnxt_en-bug-fixes'
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Merge branch 'mptcp-misc-fixes-for-v7-2-rc6'
Merge branch 'tls-fix-plaintext-sk_msg-ring-over-fill'
Merge branch 'net-fix-hard_header_len-races-in-packet-send-paths'
net: avoid theoretical races with ref drain
Jamal Hadi Salim (2):
net/sched: cls_route: fix fastmap use-after-free on filter
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
Jiawen Liu (1):
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
Jiayuan Chen (1):
tcp: fix TFO max_qlen accounting across reuseport migration
Jijie Shao (2):
net: hns3: fix speed configuration residue after driver reload
MAINTAINERS: add myself as a maintainer for Hisilicon Network Subsystem
Jozsef Kadlecsik (2):
netfilter: ipset: rework cidr bookkeeping
netfilter: ipset: switch ext_size to atomic64_t
Julian Anastasov (2):
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
ipvs: return the csum validation for forward hook
Jérémy Jean (1):
tls: rx: restore msg_iter before TLS 1.3 optimistic retry
Keegan Freyhof (1):
bnxt_en: Fix PTP PPS setting bug
Kyle Zeng (1):
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
Laurent Vivier (1):
usbnet: cap max_mtu for drivers without bind callback
Mahanta Jambigi (1):
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
Marco Baffo (1):
ovpn: limit keepalive values to one day
Matthieu Baerts (NGI0) (3):
mptcp: options: reset DSS fields in case of unexpected size
mptcp: avoid combining some incoming suboptions
mptcp: remove MPC && MPJ check
Maximilian Immanuel Brandtner (1):
tls: don't abort the connection on signal-interrupted sends
Michael Chan (1):
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
Michael Guralnik (1):
net/mlx5: fw_tracer, return NULL on create error
Nathan Gao (1):
tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
Nikhil P. Rao (2):
pds_core: keep the health thread stopped during reset
pds_core: cancel pending PCI reset work on AER recovery
Or Har-Toov (1):
devlink: fix net namespace reference leak in reload
Paolo Abeni (2):
Merge branch 'net-sched-fix-qdisc-graft-hierarchy-validation'
mptcp: reclaim forward-allocated memory on RX path errors
Pavel Begunkov (1):
net: devmem: prevent net-iov / page mixing
Pengpeng Hou (1):
net: prestera: validate firmware header length
Philipp David (1):
igc: fix netdev not re-attached after resume if interface is down
Qihang Tang (3):
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
packet: use consistent hard_header_len in non-ring send paths
packet: use consistent hard_header_len in TX_RING send path
Qing Luo (2):
sctp: fix addip_serial increment on ASCONF_ACK allocation failure
mptcp: pm: fix data race in add_addr timer callback
Qingfang Deng (1):
ovpn: fix incorrect use of rcu_access_pointer()
Ralf Lici (1):
ovpn: add missing rtnl_link_ops->get_size callback
Satish Kharat (1):
enic: fix tx_hang_reset use-after-free on device removal
Sergey V. Frolov (1):
net: octeontx2-pf: Fix UB in shift operation
Shardul Bankar (1):
mptcp: pm: fix memory leak from alloc-during-teardown race
Shay Drory (1):
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
Shravya KN (3):
bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
bnxt_en: Determine and store default RX ring in vnic structure
bnxt_en: Refresh VNIC default ring on queue restart if needed
Sidraya Jayagond (1):
net/smc: fix TOCTOU race between smc_listen_out() and listener close
Stanislav Fomichev (6):
xsk: require at least 16 bytes of TX metadata
xsk: pass TX metadata pointer by reference
xsk: clear metadata pointer when no timestamp is requested
xsk: validate launch-time metadata size
xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h
xsk: validate metadata when processing requests
Stefan Agner (1):
net: stmmac: resume PHY before hardware setup when opening the interface
Toke Høiland-Jørgensen (1):
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
Weiming Shi (2):
vsock/virtio: read virtqueues under worker locks
vsock/virtio: avoid refilling the RX queue after teardown
Will Chen (1):
bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
Wyatt Feng (1):
mptcp: fastopen: only mark MPTFO subflows with SYN data
Xiang Mei (Microsoft) (1):
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
Xin Long (1):
sctp: clear control chunk transport if it is being removed
Xuanqiang Luo (1):
udp: fix potential use-after-free in tunnel segmentation
Yangyu Chen (2):
net: atlantic: free stranded TX buffers on ring deinit
net: atlantic: free RX pages of consumed but not refilled buffers
Yi Cong (1):
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
Yuejie Shi (1):
ipv6: fix Route Information option length validation
Zhiling Zou (5):
ipvs: stop estimator after disabled calc phase
inet: frags: publish queues before arming timer
net: openvswitch: reallocate update replies for mismatched IDs
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
xdp: reject clones that overrun skb_shared_info tailroom
Zihan Xi (3):
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
packet: synchronize pressure clearing with ring reconfiguration
mac802154: fix netdev use-after-free in beacon worker
Zijie Huang (2):
net/sched: reject overly deep qdisc hierarchies
selftests/tc-testing: add qdisc hierarchy depth tests
chanyoung (2):
tls: don't leave a full plaintext sk_msg ring unpushed
selftests: tls: add a test for splicing onto a full plaintext record
Łukasz Patron (1):
net: qrtr: ns: Raise lookup limit to 128
Documentation/netlink/specs/ovpn.yaml | 4 +
MAINTAINERS | 3 +-
drivers/dibs/dibs_main.c | 2 +-
drivers/net/bonding/bond_alb.c | 10 +-
drivers/net/ethernet/amd/pds_core/core.h | 1 +
drivers/net/ethernet/amd/pds_core/main.c | 14 +-
drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 +++-
drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 +
drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +-
drivers/net/ethernet/broadcom/bnge/bnge_auxr.c | 9 +-
drivers/net/ethernet/broadcom/bnge/bnge_netdev.c | 2 -
drivers/net/ethernet/broadcom/bnge/bnge_resc.c | 3 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 64 +++--
drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +-
drivers/net/ethernet/cisco/enic/enic_main.c | 5 +-
drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 -
.../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +-
drivers/net/ethernet/intel/igc/igc_main.c | 10 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +-
.../net/ethernet/marvell/prestera/prestera_pci.c | 3 +
.../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +-
drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +-
.../net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 +
drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 15 +-
drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 4 +-
.../net/ethernet/mellanox/mlx5/core/en/xsk/tx.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +-
.../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 10 +-
.../net/ethernet/mellanox/mlx5/core/sf/devlink.c | 29 ++
.../mellanox/mlx5/core/sf/diag/sf_tracepoint.h | 8 +
.../net/ethernet/mellanox/mlx5/core/sf/hw_table.c | 22 ++
drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h | 12 +
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 13 +-
drivers/net/ovpn/main.c | 64 +++--
drivers/net/ovpn/netlink-gen.c | 20 +-
drivers/net/ovpn/netlink.c | 6 +
drivers/net/ovpn/peer.c | 172 +++++++++---
drivers/net/ovpn/peer.h | 1 +
drivers/net/ovpn/socket.c | 9 +
drivers/net/phy/mediatek/mtk.h | 8 +-
drivers/net/tap.c | 24 +-
drivers/net/thunderbolt/main.c | 33 ++-
drivers/net/usb/ax88179_178a.c | 4 +-
drivers/net/usb/ipheth.c | 11 +-
drivers/net/usb/usbnet.c | 3 +-
drivers/ptp/ptp_ocp.c | 4 +-
drivers/s390/net/ism_drv.c | 19 +-
drivers/s390/net/qeth_core_main.c | 3 +
drivers/s390/net/qeth_l3_main.c | 5 +
include/linux/dibs.h | 2 +-
include/linux/netdevice.h | 11 +-
include/linux/netfilter/ipset/ip_set.h | 6 +-
include/net/addrconf.h | 4 +-
include/net/ip_vs.h | 21 +-
include/net/libeth/xsk.h | 2 +-
include/net/sch_generic.h | 1 +
include/net/xdp_sock.h | 47 +---
include/net/xdp_sock_drv.h | 77 +++++-
net/atm/common.c | 14 +-
net/bridge/br_mrp.c | 6 +-
net/bridge/netfilter/ebt_nflog.c | 17 +-
net/core/datagram.c | 3 +
net/core/dev.c | 2 +
net/core/dev.h | 1 +
net/core/net-sysfs.c | 14 +
net/core/net-sysfs.h | 1 +
net/core/netdev_work.c | 16 ++
net/core/sock.c | 1 -
net/core/xdp.c | 2 +-
net/devlink/dev.c | 1 +
net/ipv4/fib_semantics.c | 67 +++--
net/ipv4/inet_connection_sock.c | 20 +-
net/ipv4/inet_fragment.c | 10 +-
net/ipv4/tcp_input.c | 2 +-
net/ipv4/udp_offload.c | 4 +-
net/ipv6/ip6_tunnel.c | 3 +
net/ipv6/route.c | 8 +-
net/mac802154/scan.c | 4 +
net/mptcp/fastopen.c | 7 +-
net/mptcp/options.c | 67 ++++-
net/mptcp/pm.c | 19 +-
net/mptcp/pm_userspace.c | 4 +
net/mptcp/protocol.c | 6 +
net/mptcp/protocol.h | 8 +-
net/mptcp/subflow.c | 5 -
net/ncsi/ncsi-netlink.c | 4 +
net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +-
net/netfilter/ipset/ip_set_core.c | 52 ++--
net/netfilter/ipset/ip_set_hash_gen.h | 306 ++++++++++++++-------
net/netfilter/ipset/ip_set_hash_ipportnet.c | 4 +-
net/netfilter/ipset/ip_set_hash_net.c | 4 +-
net/netfilter/ipset/ip_set_hash_netiface.c | 4 +-
net/netfilter/ipset/ip_set_hash_netnet.c | 12 +-
net/netfilter/ipset/ip_set_hash_netport.c | 4 +-
net/netfilter/ipset/ip_set_hash_netportnet.c | 12 +-
net/netfilter/ipset/ip_set_list_set.c | 4 +-
net/netfilter/ipvs/ip_vs_core.c | 69 ++---
net/netfilter/ipvs/ip_vs_est.c | 10 +-
net/netfilter/ipvs/ip_vs_proto_sctp.c | 2 +-
net/netfilter/ipvs/ip_vs_xmit.c | 2 +-
net/netfilter/nf_flow_table_ip.c | 3 +
net/openvswitch/datapath.c | 29 +-
net/openvswitch/flow.c | 11 +-
net/packet/af_packet.c | 72 +++--
net/qrtr/ns.c | 2 +-
net/sched/cls_api.c | 17 +-
net/sched/cls_route.c | 35 ++-
net/sched/sch_api.c | 9 +
net/sched/sch_cake.c | 1 -
net/sctp/associola.c | 4 +
net/sctp/outqueue.c | 1 +
net/sctp/sm_make_chunk.c | 3 +-
net/smc/af_smc.c | 3 +-
net/smc/smc_llc.c | 3 +-
net/smc/smc_rx.c | 19 +-
net/tls/tls_sw.c | 18 +-
net/vmw_vsock/virtio_transport.c | 14 +-
net/x25/af_x25.c | 4 +-
net/x25/x25_timer.c | 25 +-
net/xdp/xdp_umem.c | 2 +
net/xdp/xsk.c | 11 +-
net/xdp/xsk_buff_pool.c | 6 +-
tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +-
tools/testing/selftests/net/tls.c | 94 +++++++
.../tc-testing/tc-tests/qdiscs/depth.json | 74 +++++
127 files changed, 1583 insertions(+), 590 deletions(-)
create mode 100644 tools/testing/selftests/tc-testing/tc-tests/qdiscs/depth.json