[GIT PULL] Networking for v7.2-rc2
From: Paolo Abeni
Date: Thu Jul 02 2026 - 08:55:50 EST
Hi Linus!
The following changes since commit 805185b7c7a1069e407b6f7b3bc98e44d415f484:
Merge tag 'net-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-06-25 12:25:36 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git net-7.2-rc2
for you to fetch changes up to d8e8b85a85fe21954d303db68034aac4639df88d:
Merge tag 'batadv-net-pullrequest-20260630' of https://git.open-mesh.org/batadv (2026-07-02 10:34:06 +0200)
----------------------------------------------------------------
Including fixes from netfilter and batman-adv.
Current release - new code bugs:
- netfilter: cthelper: cap to maximum number of expectation per master
Previous releases - regressions:
- netpoll: fix a use-after-free on shutdown path
- tcp: restore RCU grace period in tcp_ao_destroy_sock
- ipv6: fix NULL deref in fib6_walk_continiue() on multi-batch dump
- batman-adv: dat: ensure accessible eth_hdr proto field
- eth: virtio_net: disable cb when NAPI is busy-polled
- eth: lan743x: Initialize eth_syslock spinlock before use
Previous releases - always broken:
- netfilter:
- nft_set_pipapo: don't leak bad clone into future transaction
- sched:
- sch_teql: Introduce slaves_lock to avoid race condition and UAF
- replace direct dequeue call with peek and qdisc_dequeue_peeked
- sctp: add INIT verification after cookie unpacking
- tipc: fix out-of-bounds read in broadcast Gap ACK blocks
- seg6: validate SRH length before reading fixed fields
- eth: mlx5e: fix use-after-free of metadata_dst on RX SC delete
- eth: enetc: check the number of BDs needed for xdp_frame
- eth: fbnic: don't cache shinfo across skb realloc
Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
----------------------------------------------------------------
Andrea Righi (1):
net: lan743x: Initialize eth_syslock spinlock before use
Breno Leitao (1):
netpoll: fix a use-after-free on shutdown path
Bryam Vargas (2):
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Corey Leavitt (1):
net: pse-pd: scope pse_control regulator handle to kref lifetime
Dawei Feng (1):
net/mlx5: HWS, fix matcher leak on resize target setup failure
Dmitry Safonov (1):
tcp: Decrement tcp_md5_needed static branch
Doruk Tan Ozturk (1):
net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
Florian Westphal (5):
netfilter: nf_conntrack_expect: zero at allocation time
netfilter: nft_set_pipapo: don't leak bad clone into future transaction
netfilter: nfnetlink_queue: restrict writes to network header
netfilter: nftables: restrict linklayer and network header writes
netfilter: nftables: restrict checkum update offset
Gleb Markov (1):
cxgb4: Fix decode strings dump for T6 adapters
Haoxiang Li (3):
net: ipa: fix SMEM state handle leaks in SMP2P init
net: liquidio: fix BAR resource leak on PF number failure
fsl/fman: Free init resources on KeyGen failure in fman_init()
Ido Schimmel (1):
bridge: stp: Fix a potential use-after-free when deleting a bridge
Jakub Kicinski (6):
Merge branch 'net-sched-finish-the-qdisc_dequeue_peeked-conversion-taprio-multiq'
eth: fbnic: don't cache shinfo across skb realloc
Merge branch 'tcp-tcp-ao-connect-fixes'
Merge branch 'net-phy-sfp-fix-mii_bus-leak-and-revert-rollball-bridge-probe'
selftests: net: bump default cmd() timeout to 20 seconds
selftests: drv-net: tso: don't touch dangerous feature bits
Jamal Hadi Salim (1):
net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
Jason Wang (1):
MAINTAINERS: Update Jason Wang's email address
Jiawen Wu (1):
net: libwx: fix VMDQ mask for 1-queue mode
Linus Walleij (1):
net: dsa: Fix skb ownership in taggers
Longjun Tang (1):
virtio_net: disable cb when NAPI is busy-polled
Lorenzo Bianconi (2):
net: airoha: dma map xmit frags with skb_frag_dma_map()
net: airoha: fix max receive size configuration
Maoyi Xie (1):
net: wwan: iosm: bound device offsets in the MUX downlink decoder
Matvey Kovalev (1):
qede: fix out-of-bounds check for cqe->len_list[]
Michael Bommarito (2):
tcp: restore RCU grace period in tcp_ao_destroy_sock
tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
Nuoqi Gui (1):
seg6: validate SRH length before reading fixed fields
Pablo Neira Ayuso (2):
netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master
Paolo Abeni (2):
Merge tag 'nf-26-06-30' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Merge tag 'batadv-net-pullrequest-20260630' of https://git.open-mesh.org/batadv
Pengfei Zhang (1):
ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
Petr Wozniak (2):
net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
Revert "net: phy: sfp: probe for RollBall I2C-to-MDIO bridge in mdio-i2c"
Ratheesh Kannoth (1):
MAINTAINERS: Update Marvell octeontx2 driver maintainers
Rosen Penev (1):
net: gianfar: dispose irq mappings on probe failure and device removal
Samuel Moelius (2):
net/sched: dualpi2: clear stale classification on filter miss
net/sched: hhf: clear heavy-hitter state on reset
Samuel Page (1):
tipc: fix out-of-bounds read in broadcast Gap ACK blocks
Sechang Lim (1):
net/sched: act_bpf: use rcu_dereference_bh() to read the filter
Sven Eckelmann (6):
batman-adv: retrieve ethhdr after potential skb realloc on RX
batman-adv: access unicast_ttvn skb->data only after skb realloc
batman-adv: gw: acquire ethernet header only after skb realloc
batman-adv: dat: acquire ARP hw source only after skb realloc
batman-adv: bla: reacquire gw address after skb realloc
batman-adv: dat: ensure accessible eth_hdr proto field
Theodor Arsenij Larionov-Trichkine (1):
netfilter: nft_fib: reject fib expression on the netdev egress hook
Wei Fang (1):
net: enetc: check the number of BDs needed for xdp_frame
Xiang Mei (2):
usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
netfilter: ipset: fix race between dump and ip_set_list resize
Xin Long (2):
sctp: add INIT verification after cookie unpacking
sctp: fix addr_wq_timer race in sctp_free_addr_wq()
Yousef Alhouseen (2):
sctp: fix SCTP_RESET_STREAMS stream list length limit
netdevsim: remove ethtool debugfs files before freeing netdev
.mailmap | 1 +
MAINTAINERS | 19 +-
drivers/net/ethernet/airoha/airoha_eth.c | 129 +++++-----
drivers/net/ethernet/airoha/airoha_eth.h | 9 +
drivers/net/ethernet/airoha/airoha_ppe.c | 39 ++-
drivers/net/ethernet/airoha/airoha_regs.h | 9 +-
.../ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 +-
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 -
drivers/net/ethernet/freescale/enetc/enetc.c | 7 +
drivers/net/ethernet/freescale/fman/fman.c | 4 +-
drivers/net/ethernet/freescale/gianfar.c | 16 +-
.../ethernet/mellanox/mlx5/core/en_accel/macsec.c | 47 ++--
.../ethernet/mellanox/mlx5/core/steering/hws/bwc.c | 1 +
drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 11 +-
drivers/net/ethernet/microchip/lan743x_main.c | 2 +-
drivers/net/ethernet/qlogic/qede/qede_fp.c | 4 +-
drivers/net/ethernet/wangxun/libwx/wx_lib.c | 1 +
drivers/net/ethernet/wangxun/libwx/wx_type.h | 1 +
drivers/net/ipa/ipa_smp2p.c | 30 ++-
drivers/net/mdio/mdio-i2c.c | 59 +----
drivers/net/netdevsim/ethtool.c | 6 +
drivers/net/netdevsim/netdev.c | 2 +
drivers/net/netdevsim/netdevsim.h | 2 +
drivers/net/phy/sfp.c | 15 +-
drivers/net/pse-pd/pse_core.c | 6 +-
drivers/net/usb/gl620a.c | 6 +-
drivers/net/virtio_net.c | 3 +
drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 40 ++-
include/net/tcp_ao.h | 1 +
net/batman-adv/distributed-arp-table.c | 28 ++-
net/batman-adv/gateway_client.c | 3 +-
net/batman-adv/main.c | 3 +
net/batman-adv/mesh-interface.c | 1 +
net/batman-adv/routing.c | 3 +-
net/bridge/br_if.c | 3 +
net/bridge/br_stp.c | 3 +-
net/core/netpoll.c | 9 +-
net/dsa/tag.c | 12 +-
net/dsa/tag_ar9331.c | 10 +-
net/dsa/tag_brcm.c | 39 +--
net/dsa/tag_dsa.c | 15 +-
net/dsa/tag_gswip.c | 8 +-
net/dsa/tag_hellcreek.c | 9 +-
net/dsa/tag_ksz.c | 44 +++-
net/dsa/tag_lan9303.c | 2 +
net/dsa/tag_mtk.c | 8 +-
net/dsa/tag_mxl-gsw1xx.c | 3 +
net/dsa/tag_mxl862xx.c | 3 +
net/dsa/tag_netc.c | 18 +-
net/dsa/tag_ocelot.c | 4 +-
net/dsa/tag_ocelot_8021q.c | 20 +-
net/dsa/tag_qca.c | 14 +-
net/dsa/tag_rtl4_a.c | 8 +-
net/dsa/tag_rtl8_4.c | 24 +-
net/dsa/tag_rzn1_a5psw.c | 8 +-
net/dsa/tag_sja1105.c | 42 ++--
net/dsa/tag_trailer.c | 16 +-
net/dsa/tag_vsc73xx_8021q.c | 1 +
net/dsa/tag_xrs700x.c | 12 +-
net/dsa/tag_yt921x.c | 7 +-
net/dsa/user.c | 7 +-
net/ipv4/tcp_ao.c | 5 +-
net/ipv4/tcp_ipv4.c | 4 +-
net/ipv4/tcp_output.c | 8 +-
net/ipv6/ip6_fib.c | 17 +-
net/ipv6/seg6.c | 3 +
net/netfilter/ipset/ip_set_core.c | 8 +-
net/netfilter/nf_conntrack_expect.c | 3 +-
net/netfilter/nf_conntrack_netlink.c | 11 +-
net/netfilter/nf_conntrack_sip.c | 7 +-
net/netfilter/nfnetlink_cthelper.c | 2 +
net/netfilter/nfnetlink_queue.c | 170 +++++++++++++
net/netfilter/nft_fib.c | 9 +
net/netfilter/nft_fib_netdev.c | 29 ++-
net/netfilter/nft_payload.c | 270 +++++++++++++++++++++
net/netfilter/nft_set_pipapo.c | 34 ++-
net/netfilter/nft_set_pipapo.h | 8 +
net/sched/act_bpf.c | 2 +-
net/sched/sch_dualpi2.c | 6 +-
net/sched/sch_hhf.c | 27 +++
net/sched/sch_multiq.c | 2 +-
net/sched/sch_taprio.c | 2 +-
net/sched/sch_teql.c | 125 +++++++---
net/sctp/protocol.c | 3 +-
net/sctp/sm_make_chunk.c | 5 +-
net/sctp/sm_statefuns.c | 36 ++-
net/sctp/socket.c | 9 +-
net/tipc/bcast.c | 22 +-
net/tipc/bcast.h | 2 +-
net/tipc/node.c | 15 +-
tools/testing/selftests/drivers/net/hw/tso.py | 16 +-
tools/testing/selftests/net/lib/py/utils.py | 4 +-
92 files changed, 1292 insertions(+), 455 deletions(-)