From: Paolo Abeni <pabeni@redhat.com>
To: torvalds@linux-foundation.org
Cc: kuba@kernel.org, davem@davemloft.net, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [GIT PULL] Networking for v7.2-rc3
Date: Thu, 9 Jul 2026 15:47:51 +0200 [thread overview]
Message-ID: <20260709134751.242764-1-pabeni@redhat.com> (raw)
Hi Linus!
The following changes since commit 87320be9f0d24fce67631b7eef919f0b79c3e45c:
Merge tag 'net-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-07-02 06:01:12 -1000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git net-7.2-rc3
for you to fetch changes up to f5089008f90c0a7c5520dff3934e0af00adf322d:
macsec: don't read an unset MAC header in macsec_encrypt() (2026-07-09 13:05:04 +0200)
----------------------------------------------------------------
Including fixes from netfilter, Bluetooth and batman-adv.
Current release - regressions:
- bluetooth: fix using chan->conn as indication to no remote netdev
Current release - new code bugs:
- netfilter: cap to maximum number of expectation per master on updates
Previous releases - regressions:
- bluetooth:
- fix UAF of hci_conn_params in add_device_complete
- fix null ptr deref in hci_abort_conn()
- igmp: remove multicast group from hash table on device destruction
- batman-adv: prevent TVLV OOB check overflow
- eth: mlx5/mlx5e:
- fix off-by-one in single-FDB error rollback
- skip peer flow cleanup when LAG seq is unavailable
- fix crashes in dynamic per-channel stats and HV VHCA agent
- eth: mana: Sync page pool RX frags for CPU
Previous releases - always broken:
- netfilter:
- mark malformed IPv6 extension headers for hotdrop
- terminate table name before find_table_lock()
- ipvs: use parsed transport offset in TCP state lookup
- sched: act_pedit: fix TOCTOU heap OOB write in tc offload
- ethtool: rss: fix hfunc and input_xfrm parsing on big endian
- ipv4/ipv6: fix UAF and memory leak in IGMP/MLD
- tls: consume empty data records in tls_sw_read_sock()
- eth: octeontx2-af: fix VF bringup affecting PF promiscuous state
- eth: gue: validate REMCSUM private option length
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
----------------------------------------------------------------
Cen Zhang (3):
Bluetooth: 6lowpan: avoid untracked enable work
Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
Bluetooth: MGMT: Fix adv monitor add failure cleanup
Chuck Lever (1):
net/tls: Consume empty data records in tls_sw_read_sock()
Daehyeon Ko (1):
macsec: don't read an unset MAC header in macsec_encrypt()
Dawei Feng (1):
octeontx2-pf: fix SQB pointer leak on init failure
Dexuan Cui (2):
net: mana: Validate the packet length reported by the NIC
net: mana: Sync page pool RX frags for CPU
Dong Yibo (1):
net: rnpgbe: fix mailbox endianness and remove pointer casts
Dust Li (1):
dibs: loopback: validate offset and size in move_data()
Enrico Pozzobon (1):
net: usb: lan78xx: disable VLAN filter in promiscuous mode
Eric Dumazet (4):
amt: fix size calculation in amt_get_size()
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
ipv6: mcast: Fix potential UAF in MLD delayed work
ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
Feng Liu (3):
net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
net/mlx5e: Fix HV VHCA stats agent registration race
net/mlx5e: Fix publication race for priv->channel_stats[]
Feng Wu (1):
netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
Florian Westphal (4):
netfilter: nf_nat_sip: reload possible stale data pointer
netfilter: ebtables: zero chainstack array
netfilter: ebtables: module names must be null-terminated
netfilter: handle unreadable frags
Gal Pressman (1):
ethtool: rss: Fix hfunc and input_xfrm parsing on big endian
Harman Kalra (1):
octeontx2-af: fix VF bringup affecting PF promiscuous state
Jamal Hadi Salim (2):
net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
Jens Emil Schulz Østergaard (1):
net: microchip: vcap: fix races on the shared Super VCAP block
Jozsef Kadlecsik (4):
netfilter: ipset: mark the rcu locked areas properly
netfilter: ipset: exclude gc when resize is in progress
netfilter: ipset: cleanup the add/del backlog when resize failed
netfilter: ipset: allocate the proper memory for the generic hash structure
Julian Anastasov (1):
ipvs: ensure inner headers in ICMP errors are in headroom
Kiran K (1):
Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()
Li RongQing (1):
net/mlx5: Fix L3 tunnel entropy refcount leak
Luiz Augusto von Dentz (1):
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
Maoyi Xie (1):
Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
Muhammad Bilal (2):
Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
Bluetooth: L2CAP: validate option length before reading conf opt value
Nirmoy Das (1):
selftests: net: make busywait timeout clock portable
Pablo Neira Ayuso (5):
netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master on updates
netfilter: nft_set_rbtree: get command skips end element with open interval
netfilter: flowtable: use dst in this direction when pushing IPIP header
netfilter: flowtable: IPIP tunnel hardware offload is not yet support
netfilter: flowtable: support IPIP tunnel with direct xmit
Paolo Abeni (8):
Merge branch 'net-mlx5-lag-bug-fixes'
Merge branch 'net-mlx5e-fix-crashes-in-dynamic-per-channel-stats-and-hv-vhca-agent'
Merge tag 'nf-26-07-03' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Merge tag 'for-net-2026-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Merge branch 'ipv4-ipv6-fix-uaf-and-memory-leak-in-igmp-mld'
Merge branch 'fix-mana-rx-with-bounce-buffering'
Merge tag 'batadv-net-pullrequest-20260708' of https://git.open-mesh.org/batadv
Merge tag 'nf-26-07-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pauli Virtanen (3):
Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
Bluetooth: ISO: fix malformed ISO_END/CONT handling
Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
Qihang (1):
gue: validate REMCSUM private option length
Rosen Penev (1):
net: mdio: select REGMAP_MMIO instead of depending on it
Runyu Xiao (1):
Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
Samuel Moelius (1):
net/sched: cake: reject overhead values that underflow length
Samuel Page (1):
Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
Shay Drory (3):
net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable
Shigeru Yoshida (1):
qede: fix off-by-one in BD ring consumption on build_skb failure
Shuangpeng Bai (1):
llc: fix SAP refcount leak in llc_ui_autobind()
Siwei Zhang (2):
Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
Stig Hornang (1):
Bluetooth: L2CAP: fix tx ident leak for commands without a response
Suman Ghosh (1):
octeontx2-pf: check DMAC extraction support before filtering
Sungwoo Kim (1):
Bluetooth: sco: Fix a race condition in sco_sock_timeout()
Sven Eckelmann (9):
batman-adv: ensure minimal ethernet header on TX
batman-adv: fix VLAN priority offset
batman-adv: clean untagged VLAN on netdev registration failure
batman-adv: tt: avoid request storms during pending request
batman-adv: tt: prevent TVLV OOB check overflow
batman-adv: frag: free unfragmentable packet
batman-adv: frag: fix primary_if leak on failed linearization
batman-adv: mcast: avoid OOB read of num_dests header
batman-adv: dat: fix tie-break for candidate selection
Tamaki Yanagawa (1):
netfilter: nft_lookup: fix catchall element handling with inverted lookups
Théo Lebrun (1):
net: macb: drop in-flight Tx SKBs on close
Wang Yan (1):
selftests/net: fix EVP_MD_CTX leak in tcp_mmap
Weiming Shi (1):
Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
Wyatt Feng (2):
netfilter: xt_u32: reject invalid shift counts
netfilter: xt_connmark: reject invalid shift parameters
Xiang Mei (5):
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
net: qualcomm: rmnet: validate MAP frame length before ingress parsing
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
netfilter: ebtables: terminate table name before find_table_lock()
Yizhou Zhao (5):
ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
ipvs: pass parsed transport offset to state handlers
ipvs: use parsed transport offset in TCP state lookup
ipvs: use parsed transport offset in SCTP state lookup
Yousef Alhouseen (3):
mac802154: remove interfaces with RCU list deletion
Bluetooth: bnep: pin L2CAP connection during netdev registration
Bluetooth: fix UAF in bt_accept_dequeue()
Yuho Choi (1):
net/liquidio: drop cached VF pci_dev LUT
Yuyang Huang (1):
ipv4: igmp: remove multicast group from hash table on device destruction
Zhixing Chen (1):
netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
drivers/bluetooth/bpa10x.c | 8 +-
drivers/bluetooth/btintel_pcie.c | 102 +++++++--------
drivers/bluetooth/btnxpuart.c | 6 +
drivers/bluetooth/hci_ldisc.c | 14 ++-
drivers/dibs/dibs_loopback.c | 5 +
drivers/net/amt.c | 6 +-
drivers/net/ethernet/cadence/macb_main.c | 21 +++-
drivers/net/ethernet/cavium/liquidio/lio_main.c | 27 ----
.../net/ethernet/cavium/liquidio/octeon_device.h | 3 -
.../net/ethernet/cavium/liquidio/octeon_mailbox.c | 33 ++++-
.../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 64 +++++++---
drivers/net/ethernet/mellanox/mlx5/core/en.h | 12 ++
.../ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c | 37 ++++--
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 14 ++-
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 9 +-
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 3 +
.../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 3 +-
.../net/ethernet/mellanox/mlx5/core/lag/mpesw.c | 7 +-
.../ethernet/mellanox/mlx5/core/lag/shared_fdb.c | 2 +-
.../net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c | 8 +-
.../net/ethernet/mellanox/mlx5/core/lib/hv_vhca.h | 6 +-
.../net/ethernet/mellanox/mlx5/core/lib/port_tun.c | 3 +-
.../ethernet/microchip/lan966x/lan966x_vcap_impl.c | 5 +-
.../ethernet/microchip/sparx5/sparx5_vcap_impl.c | 5 +-
drivers/net/ethernet/microchip/vcap/vcap_api.c | 72 ++++++-----
drivers/net/ethernet/microchip/vcap/vcap_api.h | 3 +-
.../net/ethernet/microchip/vcap/vcap_api_debugfs.c | 8 +-
.../microchip/vcap/vcap_api_debugfs_kunit.c | 3 +-
.../net/ethernet/microchip/vcap/vcap_api_kunit.c | 3 +-
.../net/ethernet/microchip/vcap/vcap_api_private.h | 3 +
drivers/net/ethernet/microsoft/mana/mana_en.c | 61 +++++++--
drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx.c | 26 ++--
drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx.h | 5 +-
drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c | 82 ++++++------
drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.h | 14 +++
drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +
.../net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 +-
drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h | 1 +
.../net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 72 ++++++-----
drivers/net/macsec.c | 2 +-
drivers/net/mdio/Kconfig | 3 +-
drivers/net/usb/lan78xx.c | 18 ++-
drivers/net/usb/net1080.c | 2 +-
include/linux/inetdevice.h | 5 +
include/net/addrconf.h | 5 +
include/net/bluetooth/hci.h | 5 +-
include/net/bluetooth/hci_core.h | 1 +
include/net/bluetooth/l2cap.h | 10 +-
include/net/gue.h | 2 +-
include/net/ip_vs.h | 3 +-
include/net/mana/mana.h | 8 ++
include/net/netfilter/nf_flow_table.h | 7 +-
include/net/tc_act/tc_pedit.h | 18 ++-
net/batman-adv/distributed-arp-table.c | 2 +-
net/batman-adv/fragmentation.c | 8 +-
net/batman-adv/main.c | 10 +-
net/batman-adv/mesh-interface.c | 16 +--
net/batman-adv/mesh-interface.h | 2 +
net/batman-adv/multicast_forw.c | 7 +-
net/batman-adv/translation-table.c | 5 +-
net/bluetooth/6lowpan.c | 84 ++++---------
net/bluetooth/af_bluetooth.c | 17 +--
net/bluetooth/bnep/core.c | 27 +++-
net/bluetooth/hci_conn.c | 21 +---
net/bluetooth/hci_sync.c | 133 +++++++++++++++++---
net/bluetooth/iso.c | 44 ++++---
net/bluetooth/l2cap_core.c | 140 ++++++++++++++++-----
net/bluetooth/l2cap_sock.c | 107 ++++++++--------
net/bluetooth/mgmt.c | 5 +
net/bluetooth/msft.c | 2 +-
net/bluetooth/sco.c | 15 ++-
net/bluetooth/smp.c | 27 +---
net/bridge/netfilter/ebtables.c | 12 +-
net/ethtool/netlink.h | 28 +++++
net/ethtool/rss.c | 14 ++-
net/ipv4/igmp.c | 29 +++--
net/ipv6/mcast.c | 40 ++++--
net/ipv6/netfilter/ip6t_ah.c | 5 +
net/ipv6/netfilter/ip6t_hbh.c | 1 +
net/ipv6/netfilter/ip6t_rt.c | 3 +-
net/ipv6/netfilter/nf_conntrack_reasm.c | 5 +-
net/llc/af_llc.c | 1 +
net/mac802154/iface.c | 2 +-
net/netfilter/ipset/ip_set_hash_gen.h | 85 ++++++++-----
net/netfilter/ipvs/ip_vs_conn.c | 4 +-
net/netfilter/ipvs/ip_vs_core.c | 33 +++--
net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 ++-
net/netfilter/ipvs/ip_vs_proto_tcp.c | 11 +-
net/netfilter/ipvs/ip_vs_proto_udp.c | 3 +-
net/netfilter/nf_flow_table_core.c | 19 +--
net/netfilter/nf_flow_table_ip.c | 21 ++--
net/netfilter/nf_flow_table_offload.c | 22 +++-
net/netfilter/nf_nat_sip.c | 11 ++
net/netfilter/nf_tables_api.c | 3 +
net/netfilter/nfnetlink_cthelper.c | 2 +
net/netfilter/nfnetlink_log.c | 26 ++--
net/netfilter/nfnetlink_queue.c | 16 ++-
net/netfilter/nft_lookup.c | 10 +-
net/netfilter/nft_set_rbtree.c | 8 +-
net/netfilter/xt_connmark.c | 14 ++-
net/netfilter/xt_rateest.c | 2 +-
net/netfilter/xt_u32.c | 28 ++++-
net/sched/act_api.c | 13 +-
net/sched/act_pedit.c | 13 +-
net/sched/cls_api.c | 22 +++-
net/sched/sch_cake.c | 5 +-
net/sched/sch_teql.c | 27 ++--
net/smc/smc_cdc.c | 15 ++-
net/tls/tls_sw.c | 11 ++
tools/testing/selftests/net/lib.sh | 25 +++-
tools/testing/selftests/net/tcp_mmap.c | 4 +
112 files changed, 1402 insertions(+), 740 deletions(-)
next reply other threads:[~2026-07-09 13:48 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-09 13:47 Paolo Abeni [this message]
2026-07-09 15:37 ` [GIT PULL] Networking for v7.2-rc3 pr-tracker-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260709134751.242764-1-pabeni@redhat.com \
--to=pabeni@redhat.com \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox