[GIT PULL] Networking for v7.0-rc7
From: Jakub Kicinski
Date: Thu Apr 02 2026 - 12:31:16 EST
Hi Linus!
The following changes since commit 453a4a5f97f0c95b7df458e6afb98d4ab057d90b:
Merge tag 'net-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-03-26 09:53:08 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git tags/net-7.0-rc7
for you to fetch changes up to ec7067e661193403a7a00980bda8612db5954142:
eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64 (2026-04-02 08:38:34 -0700)
----------------------------------------------------------------
With fixes from wireless, bluetooth and Netfilter included we're back
to each PR carrying 30%+ more fixes than in previous era. The good
news is that so far none of the "extra" fixes are themselves
causing real regressions. Not sure how much comfort that is.
Current release - fix to a fix:
- netdevsim: fix build if SKB_EXTENSIONS=n
- eth: stmmac: skip VLAN restore when VLAN hash ops are missing
Previous releases - regressions:
- wifi: iwlwifi: mvm: don't send a 6E related command when
not supported
Previous releases - always broken:
- some info leak fixes
- add missing clearing of skb->cb[] on ICMP paths from tunnels
- ipv6: flowlabel: defer exclusive option free until RCU teardown
- ipv6: avoid overflows in ip6_datagram_send_ctl()
- mpls: add seqcount to protect platform_labels from OOB access
- bridge: improve safety of parsing ND options
- Bluetooth: fix leaks, overflows and races in hci_sync
- netfilter: add more input validation, some to address bugs directly
some to prevent exploits from cooking up broken configurations
- wifi: ath: avoid poor performance due to stopping the wrong
aggregation session
- wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
- eth: fec: fix the PTP periodic output sysfs interface
- eth: enetc: safely reinitialize TX BD ring when it has unsent frames
Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
----------------------------------------------------------------
Alexander Popov (1):
wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
Alexey Velichayshiy (1):
wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
Buday Csaba (1):
net: fec: fix the PTP periodic output sysfs interface
Cen Zhang (1):
Bluetooth: SCO: fix race conditions in sco_sock_connect()
David Carlier (1):
net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch
Dimitri Daskalakis (3):
eth: fbnic: Account for page fragments when updating BDQ tail
eth: fbnic: Fix debugfs output for BDQ's with page frags
eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64
Dipayaan Roy (1):
net: mana: Fix RX skb truesize accounting
Emmanuel Grumbach (1):
wifi: iwlwifi: mvm: don't send a 6E related command when not supported
Eric Dumazet (3):
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
ipv6: avoid overflows in ip6_datagram_send_ctl()
Fedor Pchelkin (2):
net: macb: fix clk handling on PCI glue driver removal
net: macb: properly unregister fixed rate clocks
Florian Westphal (3):
netfilter: nfnetlink_log: account for netlink header size
netfilter: x_tables: ensure names are nul-terminated
netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
Guoyu Su (1):
net: use skb_header_pointer() for TCPv4 GSO frag_off check
Hangbin Liu (1):
ipv6: fix data race in fib6_metric_set() using cmpxchg
Jakub Kicinski (10):
Merge tag 'wireless-2026-03-26' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
Merge branch 'net-enetc-safely-reinitialize-tx-bd-ring-when-it-has-unsent-frames'
Merge branch 'fix-page-fragment-handling-when-page_size-4k'
Merge branch 'bridge-vxlan-harden-nd-option-parsing-paths'
Merge branch 'net-enetc-add-more-checks-to-enetc_set_rxfh'
Merge tag 'for-net-2026-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Merge tag 'nf-26-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Merge branch 'mlx5-misc-fixes-2026-03-30'
Merge branch 'bnxt_en-bug-fixes'
Merge branch 'net-hsr-fixes-for-prp-duplication-and-vlan-unwind'
Jiayuan Chen (1):
net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
Johannes Berg (3):
wifi: iwlwifi: mld: correctly set wifi generation data
Merge tag 'iwlwifi-fixes-2026-03-24' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next
Merge tag 'ath-current-20260324' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath
Jonathan Rissanen (1):
Bluetooth: hci_h4: Fix race during initialization
Keenan Dong (2):
Bluetooth: MGMT: validate LTK enc_size on load
Bluetooth: MGMT: validate mesh send advertising payload length
Li Xiasong (1):
mptcp: fix soft lockup in mptcp_recvmsg()
Lorenzo Bianconi (2):
net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
net: airoha: Delay offloading until all net_devices are fully registered
Luiz Augusto von Dentz (1):
Bluetooth: hci_sync: Fix UAF in le_read_features_complete
Luka Gejak (2):
net: hsr: serialize seq_blocks merge across nodes
net: hsr: fix VLAN add unwind on slave errors
Marek Behún (1):
net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
Martin Schiller (2):
net/x25: Fix potential double free of skb
net/x25: Fix overflow when accumulating packets
Michael Chan (2):
bnxt_en: Refactor some basic ring setup and adjustment logic
bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode()
Michal Piekos (1):
net: stmmac: skip VLAN restore when VLAN hash ops are missing
Oleh Konko (3):
Bluetooth: hci_event: move wake reason storage into validated event handlers
Bluetooth: SMP: force responder MITM requirements before building the pairing response
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
Pablo Neira Ayuso (4):
netfilter: flowtable: strictly check for maximum number of actions
netfilter: ctnetlink: ignore explicit helper on new expectations
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
netfilter: nf_tables: reject immediate NF_QUEUE verdict
Pagadala Yesu Anjaneyulu (1):
wifi: iwlwifi: mld: Fix MLO scan timing
Paolo Abeni (3):
ipv6: prevent possible UaF in addrconf_permanent_addr()
Merge branch 'correct-bd-length-masks-and-bql-accounting-for-multi-bd-tx-packets'
Merge branch 'net-x25-fix-overflow-and-double-free'
Pauli Virtanen (5):
Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails
Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
Pavan Chebbi (1):
bnxt_en: Restore default stat ctxs for ULP when resource is available
Pengpeng Hou (4):
wifi: wl1251: validate packet IDs before indexing tx_frames
net/ipv6: ioam6: prevent schema length wraparound in trace fill
bnxt_en: set backing store type from query type
NFC: pn533: bound the UART receive buffer
Qi Tang (2):
netfilter: nf_conntrack_helper: pass helper to expect cleanup
netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
Qingfang Deng (1):
netdevsim: fix build if SKB_EXTENSIONS=n
Reshma Immaculate Rajkumar (2):
wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session
wifi: ath12k: Pass the correct value of each TID during a stop AMPDU session
Sabrina Dubroca (1):
mpls: add seqcount to protect the platform_label{,s} pair
Saeed Mahameed (2):
net/mlx5: Avoid "No data available" when FW version queries fail
net/mlx5: Fix switchdev mode rollback in case of failure
Shay Drory (1):
net/mlx5: lag: Check for LAG device before creating debugfs
Srujana Challa (1):
virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN
Stefano Garzarella (1):
vsock: initialize child_ns_mode_locked in vsock_net_init()
Suraj Gupta (2):
net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets
Sven Eckelmann (Plasma Cloud) (1):
net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
Thomas Bogendoerfer (1):
tg3: Fix race for querying speed/duplex
Wei Fang (5):
net: enetc: reset PIR and CIR if they are not equal when initializing TX ring
net: enetc: add graceful stop to safely reinitialize the TX Ring
net: enetc: do not access non-existent registers on pseudo MAC
net: enetc: check whether the RSS algorithm is Toeplitz
net: enetc: do not allow VF to configure the RSS key
Weiming Shi (1):
rds: ib: reject FRMR registration before IB connection is established
Xiang Mei (7):
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
selftests/tc-testing: add test for HFSC divide-by-zero in rtsc_min()
net: bonding: fix use-after-free in bond_xmit_broadcast()
bridge: mrp: reject zero test interval to avoid OOM panic
net/sched: cls_fw: fix NULL pointer dereference on shared blocks
net/sched: cls_flow: fix NULL pointer dereference on shared blocks
selftests/tc-testing: add tests for cls_fw and cls_flow on shared blocks
Yang Yang (3):
bridge: br_nd_send: linearize skb before parsing ND options
bridge: br_nd_send: validate ND option lengths
vxlan: validate ND option lengths in vxlan_na_create
Yasuaki Torimaru (1):
wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
Yifan Wu (1):
netfilter: ipset: drop logically empty buckets in mtype_del
Yochai Eisenrich (2):
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
Yucheng Lu (1):
net/sched: sch_netem: fix out-of-bounds access in packet corruption
Yufan Chen (1):
net: ftgmac100: fix ring allocation unwind on open failure
Zhengchuan Liang (1):
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
hkbinbin (1):
Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
drivers/bluetooth/hci_h4.c | 3 -
drivers/net/bonding/bond_main.c | 2 +-
drivers/net/ethernet/airoha/airoha_eth.c | 20 ++-
drivers/net/ethernet/airoha/airoha_eth.h | 1 +
drivers/net/ethernet/airoha/airoha_ppe.c | 7 +
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 76 +++++---
drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 5 +-
drivers/net/ethernet/broadcom/tg3.c | 2 +-
drivers/net/ethernet/cadence/macb_pci.c | 10 +-
drivers/net/ethernet/faraday/ftgmac100.c | 28 ++-
drivers/net/ethernet/freescale/enetc/enetc.c | 13 +-
drivers/net/ethernet/freescale/enetc/enetc4_hw.h | 11 ++
drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 118 +++++++++++--
.../net/ethernet/freescale/enetc/enetc_ethtool.c | 10 +-
drivers/net/ethernet/freescale/fec_ptp.c | 3 -
drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 21 ++-
drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +-
.../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +
drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++++--
.../net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 +
.../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +-
drivers/net/ethernet/meta/fbnic/fbnic_debugfs.c | 2 +-
drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 6 +-
drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 2 +-
drivers/net/ethernet/microsoft/mana/mana_en.c | 7 +
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 14 +-
drivers/net/ethernet/ti/icssg/icssg_common.c | 2 +-
drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +-
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 9 +-
drivers/net/phy/sfp.c | 7 +-
drivers/net/virtio_net.c | 20 +--
drivers/net/vxlan/vxlan_core.c | 6 +-
drivers/net/wireless/ath/ath11k/dp_rx.c | 15 +-
drivers/net/wireless/ath/ath12k/dp_rx.c | 4 +-
.../net/wireless/intel/iwlwifi/fw/api/commands.h | 5 +
drivers/net/wireless/intel/iwlwifi/fw/api/scan.h | 10 ++
drivers/net/wireless/intel/iwlwifi/mld/iface.c | 101 +++++++----
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 19 ++
drivers/net/wireless/intel/iwlwifi/mld/mld.c | 1 +
drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 +-
drivers/net/wireless/intel/iwlwifi/mld/notif.c | 5 +
drivers/net/wireless/intel/iwlwifi/mld/scan.c | 30 +++-
drivers/net/wireless/intel/iwlwifi/mld/scan.h | 9 +-
drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 3 +-
drivers/net/wireless/microchip/wilc1000/hif.c | 2 +-
drivers/net/wireless/ti/wl1251/tx.c | 8 +-
drivers/net/wireless/virtual/virt_wifi.c | 1 -
drivers/nfc/pn533/uart.c | 3 +
include/linux/netfilter/ipset/ip_set.h | 2 +-
include/linux/skbuff.h | 1 +
include/net/netns/mpls.h | 1 +
net/bluetooth/hci_conn.c | 8 +-
net/bluetooth/hci_event.c | 127 ++++++-------
net/bluetooth/hci_sync.c | 88 ++++++---
net/bluetooth/mgmt.c | 17 +-
net/bluetooth/sco.c | 30 +++-
net/bluetooth/smp.c | 11 +-
net/bridge/br_arp_nd_proxy.c | 18 +-
net/bridge/br_mrp_netlink.c | 4 +-
net/core/dev.c | 11 +-
net/hsr/hsr_device.c | 32 ++--
net/hsr/hsr_framereg.c | 38 +++-
net/ipv6/addrconf.c | 6 +-
net/ipv6/datagram.c | 10 ++
net/ipv6/icmp.c | 3 +
net/ipv6/ioam6.c | 4 +-
net/ipv6/ip6_fib.c | 14 +-
net/ipv6/ip6_flowlabel.c | 5 -
net/ipv6/ip6_tunnel.c | 5 +
net/ipv6/ndisc.c | 3 +
net/mpls/af_mpls.c | 29 ++-
net/mptcp/protocol.c | 11 +-
net/netfilter/ipset/ip_set_core.c | 4 +-
net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
net/netfilter/ipset/ip_set_list_set.c | 4 +-
net/netfilter/nf_conntrack_helper.c | 2 +-
net/netfilter/nf_conntrack_netlink.c | 60 ++-----
net/netfilter/nf_flow_table_offload.c | 196 ++++++++++++++-------
net/netfilter/nf_tables_api.c | 7 +-
net/netfilter/nfnetlink_log.c | 2 +-
net/netfilter/x_tables.c | 23 +++
net/netfilter/xt_cgroup.c | 6 +
net/netfilter/xt_rateest.c | 5 +
net/qrtr/af_qrtr.c | 31 ++--
net/rds/ib_rdma.c | 7 +-
net/sched/cls_api.c | 1 +
net/sched/cls_flow.c | 10 +-
net/sched/cls_fw.c | 14 +-
net/sched/sch_hfsc.c | 4 +-
net/sched/sch_netem.c | 5 +-
net/vmw_vsock/af_vsock.c | 1 +
net/x25/x25_in.c | 9 +-
net/x25/x25_subr.c | 1 +
.../tc-testing/tc-tests/infra/filter.json | 44 +++++
.../tc-testing/tc-tests/infra/qdiscs.json | 25 +++
98 files changed, 1147 insertions(+), 493 deletions(-)