[GIT PULL] Networking for v7.0-rc4
From: Paolo Abeni
Date: Thu Mar 12 2026 - 11:22:56 EST
Hi Linus!
The following changes since commit abacaf559950eec0d99d37ff6b92049409af5943:
Merge tag 'net-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-03-05 11:00:46 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git net-7.0-rc4
for you to fetch changes up to c38b8f5f791ecce13ab77e2257f8fd2444ba80f6:
net: prevent NULL deref in ip[6]tunnel_xmit() (2026-03-12 16:03:41 +0100)
----------------------------------------------------------------
Including fixes from CAN and netfilter.
Current release - regressions:
- eth: mana: Null service_wq on setup error to prevent double destroy
Previous releases - regressions:
- nexthop: fix percpu use-after-free in remove_nh_grp_entry
- sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
- bpf: fix nd_tbl NULL dereference when IPv6 is disabled
- neighbour: restore protocol != 0 check in pneigh update
- tipc: fix divide-by-zero in tipc_sk_filter_connect()
- eth: mlx5:
- fix crash when moving to switchdev mode
- fix DMA FIFO desync on error CQE SQ recovery
- eth: iavf: fix PTP use-after-free during reset
- eth: bonding: fix type confusion in bond_setup_by_slave()
- eth: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
Previous releases - always broken:
- core: add xmit recursion limit to tunnel xmit functions
- net-shapers: don't free reply skb after genlmsg_reply()
- netfilter:
- fix stack out-of-bounds read in pipapo_drop()
- fix OOB read in nfnl_cthelper_dump_table()
- mctp:
- fix device leak on probe failure
- i2c: fix skb memory leak in receive path
- can: keep the max bitrate error at 5%
- eth: bonding: fix nd_tbl NULL dereference when IPv6 is disabled
- eth: bnxt_en: fix RSS table size check when changing ethtool channels
- eth: amd-xgbe: prevent CRC errors during RX adaptation with AN disabled
- eth: octeontx2-af: devlink: fix NIX RAS reporter recovery condition
Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
----------------------------------------------------------------
Alok Tiwari (3):
i40e: fix src IP mask checks and memcpy argument names in cloud filter
octeontx2-af: devlink: fix NIX RAS reporter recovery condition
octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status
Bastien Curutchet (Schneider Electric) (1):
net: dsa: microchip: Fix error path in PTP IRQ setup
Carolina Jubran (1):
net/mlx5: Fix peer miss rules host disabled checks
Chengfeng Ye (1):
mctp: route: hold key->lock in mctp_flow_prepare_output()
Chintan Vankar (1):
net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support
Cosmin Ratiu (1):
net/mlx5: Fix deadlock between devlink lock and esw->wq
Daniel Golle (1):
net: dsa: mxl862xx: don't set user_mii_bus
Dave Hansen (1):
MAINTAINERS: Remove bouncing T7XX reviewer
David Dull (1):
netfilter: x_tables: guard option walkers against 1-byte tail reads
Dragos Tatulea (2):
net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
Eric Dumazet (2):
MAINTAINERS: include/net/tc_wrapper.h belongs to TC subsystem
net: prevent NULL deref in ip[6]tunnel_xmit()
Fan Wu (1):
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
Florian Westphal (1):
netfilter: nf_tables: always walk all pending catchall elements
Gal Pressman (1):
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
Haibo Chen (1):
can: dev: keep the max bitrate error at 5%
Haiyue Wang (1):
mctp: i2c: fix skb memory leak in receive path
Hangbin Liu (2):
bonding: do not set usable_slaves for broadcast mode
bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
Hyunwoo Kim (2):
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
Jakub Kicinski (11):
Merge branch 'bond-fix-2-link-state-issues'
Merge branch 'mlx5-misc-fixes-2026-03-05'
Merge branch 'further-sja1105-phylink-link-replay-fixups'
Merge branch 'net-spacemit-a-few-error-handling-fixes'
Merge branch 'net-usb-lan78xx-accumulated-bug-fixes'
page_pool: store detach_time as ktime_t to avoid false-negatives
ipv6: move the disable_ipv6_mod knob to core code
Merge branch 'net-bpf-nd_tbl-fixes-for-when-ipv6-disable-1'
Merge branch 'neighbour-fix-update-of-proxy-neighbour'
Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue
Merge tag 'nf-26-03-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Jenny Guanni Qu (1):
netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
Jian Zhang (1):
net: ncsi: fix skb leak in error paths
Jiayuan Chen (1):
bonding: fix type confusion in bond_setup_by_slave()
Johan Hovold (1):
net: mctp: fix device leak on probe failure
Kevin Hao (1):
net: macb: Shuffle the tx ring before enabling tx
Laurent Vivier (1):
qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
Marek Behún (1):
net: dsa: realtek: Fix LED group port bit for non-zero LED group
Matt Vollrath (1):
e1000/e1000e: Fix leak in DMA error cleanup
Mehul Rao (2):
net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
tipc: fix divide-by-zero in tipc_sk_filter_connect()
Miaoqian Lin (1):
rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()
Mieczyslaw Nalewaj (1):
net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets
Nicolai Buchwitz (1):
net: bcmgenet: fix broken EEE by converting to phylib-managed state
Nikolay Aleksandrov (1):
drivers: net: ice: fix devlink parameters get without irdma
Oleksij Rempel (4):
net: usb: lan78xx: fix silent drop of packets with checksum errors
net: usb: lan78xx: fix TX byte statistics for small packets
net: usb: lan78xx: skip LTM configuration for LAN7850
net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
Paolo Abeni (3):
Merge branch 'net-enetc-fix-fallback-phy-address-handling-and-do-not-skip-setting-for-addr-0'
Merge branch 'amd-xgbe-rx-adaptation-and-phy-handling-fixes'
Merge tag 'linux-can-fixes-for-7.0-20260310' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
Patrisious Haddad (1):
net/mlx5: Fix crash when moving to switchdev mode
Paul Moses (1):
net-shapers: don't free reply skb after genlmsg_reply()
Pavan Chebbi (1):
bnxt_en: Fix RSS table size check when changing ethtool channels
Petr Oros (2):
iavf: fix PTP use-after-free during reset
iavf: fix incorrect reset handling in callbacks
Phil Sutter (1):
netfilter: nf_tables: Fix for duplicate device in netdev hooks
Raju Rangoju (3):
amd-xgbe: fix link status handling in xgbe_rx_adaptation
amd-xgbe: prevent CRC errors during RX adaptation with AN disabled
amd-xgbe: reset PHY settings before starting PHY
Ricardo B. Marlière (3):
net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
bpf: bpf_out_neigh_v4: Fix nd_tbl NULL dereference when IPv6 is disabled
bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled
Sabrina Dubroca (2):
neighbour: restore protocol != 0 check in pneigh update
selftests: rtnetlink: add neighbour update test
Shiraz Saleem (1):
net/mana: Null service_wq on setup error to prevent double destroy
Shuangpeng Bai (1):
serial: caif: hold tty->link reference in ldisc_open and ser_release
Vivian Wang (2):
net: spacemit: Fix error handling in emac_alloc_rx_desc_buffers()
net: spacemit: Fix error handling in emac_tx_mem_map()
Vladimir Oltean (2):
net: dsa: sja1105: reorder sja1105_reload_cbs() and phylink_replay_link_end()
net: dsa: sja1105: ensure phylink_replay_link_end() will not be missed
Wei Fang (2):
net: enetc: fix incorrect fallback PHY address handling
net: enetc: do not skip setting LaBCR[MDIO_PHYAD_PRTAD] for addr 0
Weiming Shi (2):
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
net: add xmit recursion limit to tunnel xmit functions
Wenyuan Li (1):
can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
Yuan Tan (1):
netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
Álvaro Fernández Rojas (1):
net: sfp: improve Huawei MA5671a fixup
MAINTAINERS | 2 +-
drivers/net/bonding/bond_main.c | 70 ++++++++++++++--
drivers/net/caif/caif_serial.c | 3 +
drivers/net/can/dev/calc_bittiming.c | 2 +-
drivers/net/can/spi/hi311x.c | 5 +-
drivers/net/dsa/microchip/ksz_ptp.c | 11 ++-
drivers/net/dsa/mxl862xx/mxl862xx.c | 1 -
drivers/net/dsa/realtek/rtl8365mb.c | 3 +-
drivers/net/dsa/realtek/rtl8366rb-leds.c | 6 +-
drivers/net/dsa/sja1105/sja1105_main.c | 7 +-
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 19 +++--
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 82 ++++++++++++++++--
drivers/net/ethernet/amd/xgbe/xgbe.h | 4 +
drivers/net/ethernet/arc/emac_main.c | 11 +++
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 31 +++----
drivers/net/ethernet/broadcom/genet/bcmgenet.h | 5 +-
drivers/net/ethernet/broadcom/genet/bcmmii.c | 10 +--
drivers/net/ethernet/cadence/macb_main.c | 98 +++++++++++++++++++++-
.../net/ethernet/freescale/enetc/netc_blk_ctrl.c | 24 +++---
drivers/net/ethernet/intel/e1000/e1000_main.c | 2 -
drivers/net/ethernet/intel/e1000e/netdev.c | 2 -
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 ++--
drivers/net/ethernet/intel/iavf/iavf.h | 3 +-
drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 19 ++---
drivers/net/ethernet/intel/iavf/iavf_main.c | 81 +++++++-----------
drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 1 -
drivers/net/ethernet/intel/ice/devlink/devlink.c | 4 +-
.../ethernet/marvell/octeontx2/af/rvu_devlink.c | 6 +-
.../ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1 -
.../mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 23 ++---
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 7 +-
drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 +
.../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 45 +++++-----
drivers/net/ethernet/microsoft/mana/gdma_main.c | 1 +
drivers/net/ethernet/spacemit/k1_emac.c | 19 +++--
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 16 ++--
drivers/net/ethernet/ti/am65-cpsw-nuss.h | 2 +-
drivers/net/mctp/mctp-i2c.c | 1 +
drivers/net/mctp/mctp-usb.c | 3 +-
drivers/net/phy/sfp.c | 8 +-
drivers/net/usb/lan78xx.c | 12 ++-
drivers/net/usb/lan78xx.h | 3 +
drivers/net/usb/qmi_wwan.c | 4 +-
drivers/net/usb/usbnet.c | 7 +-
fs/afs/addr_list.c | 8 +-
include/linux/ipv6.h | 7 +-
include/linux/netdevice.h | 32 +++++++
include/linux/usb/usbnet.h | 1 +
include/net/ip6_tunnel.h | 14 ++++
include/net/ip_tunnels.h | 7 ++
include/net/page_pool/types.h | 2 +-
net/core/dev.h | 35 --------
net/core/filter.c | 7 ++
net/core/neighbour.c | 3 +-
net/core/page_pool_user.c | 4 +-
net/ipv4/af_inet.c | 6 ++
net/ipv4/ip_tunnel_core.c | 15 ++++
net/ipv4/nexthop.c | 14 +++-
net/ipv6/af_inet6.c | 8 --
net/mctp/route.c | 11 ++-
net/ncsi/ncsi-aen.c | 3 +-
net/ncsi/ncsi-rsp.c | 16 +++-
net/netfilter/nf_tables_api.c | 4 +-
net/netfilter/nfnetlink_cthelper.c | 8 +-
net/netfilter/nfnetlink_queue.c | 4 +-
net/netfilter/nft_chain_filter.c | 2 +-
net/netfilter/nft_set_pipapo.c | 3 +-
net/netfilter/xt_IDLETIMER.c | 6 ++
net/netfilter/xt_dccp.c | 4 +-
net/netfilter/xt_tcpudp.c | 6 +-
net/rxrpc/af_rxrpc.c | 8 +-
net/sched/sch_teql.c | 1 +
net/shaper/shaper.c | 11 +--
net/tipc/socket.c | 2 +
tools/testing/selftests/net/rtnetlink.sh | 55 ++++++++++++
77 files changed, 667 insertions(+), 326 deletions(-)