)]}'
{
  "log": [
    {
      "commit": "f6f3b36c15ed44de1fbb44e645e4fae8c4a4453e",
      "tree": "231915a7bd593a5c440932544befe28a33a39982",
      "parents": [
        "71ac90cca6d8e6fcdd674a50157181ef4ac441a0"
      ],
      "author": {
        "name": "Wolfram Sang",
        "email": "wsa+renesas@sang-engineering.com",
        "time": "Sun Jul 05 18:41:59 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 13:03:00 2026 +0200"
      },
      "message": "net: ethernet: qualcomm: remove unneeded \u0027fast_io\u0027 parameter in regmap_config\n\nWhen using MMIO with regmap, fast_io is implied. No need to set it\nagain.\n\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nReviewed-by: Luo Jie \u003cjie.luo@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260705164208.2184-2-wsa+renesas@sang-engineering.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "71ac90cca6d8e6fcdd674a50157181ef4ac441a0",
      "tree": "f8d57c63e535c6946957daf9dc1897cd9e9ea64d",
      "parents": [
        "23dad2d088dfc82cae1f5a936f8ff7ffebb38dd9",
        "00a40d809207a61f0762488aa5ce72e941b367ce"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:54 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:54 2026 +0200"
      },
      "message": "Merge branch \u0027net-support-per-netns-device-unregistration\u0027\n\nKuniyuki Iwashima says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: Support per-netns device unregistration\n\nThe biggest blocker to per-netns RTNL is netdev unregistration.\n\nIt starts within a single netns, but it can eventually involve\nmultiple namespaces.\n\nThere are three types of such cross-netns devices:\n\n  1. Paired devices (e.g., netkit, veth, vxcan)\n     -\u003e Unregistering one device also deletes its peer, which\n        may reside in another netns.\n\n  2. Tunnel devices (e.g., bareudp, geneve, etc)\n     -\u003e Destroying a netns removes devices in another netns if\n        their backend sockets reside in the dying netns\n\n  3. Stacked devices (e.g., ipvlan, macvlan, etc)\n     -\u003e Removing the lower device also removes multiple upper\n        devices, each of which may reside in different namespaces.\n\nWhile the first two device types require at most two rtnl_net_lock()s,\nthe stacked type has no upper limit.  This makes it impossible to\nfreeze all necessary namespaces in advance.\n\nThis series introduces per-netns work, initially suggested at\nNetConf 2024, to delegate the unregistration of such cross-netns\ndevices.\n\n  https://netdev.bots.linux.dev/netconf/2024/kuniyu.pdf#page\u003d62\n\nThe first half of the series wraps NETDEV_UNREGISTER (in core) with\nper-netns RTNL, adds a helper for per-netns device unregistration,\nand forces per-netns device unregistration in the core code when\nCONFIG_DEBUG_NET_SMALL_RTNL\u003dy.\n\nThe latter half picks out one from each type (veth, bareudp, ipvlan)\nand converts them to support per-netns device unregistration,\nalthough the operations are **still serialised under RTNL** for now.\n\nPlease note that this series focuses only on the device unregistration\npaths.  For example, there are ASSERT_RTNL() left in other paths, and\nSashiko may point it out, but they are out of scope.\n\nThis is just the first step, and we need more incremental changes to\ncompletely remove RTNL anyway.\n\nNow, we can see that unregistering a lower device (veth0 below)\nremoves upper devices (ipvl2, ipvl3) in different namespaces using\nper-netns work with a different PID.  The lower device (veth0) is\nfreed only after all upper ipvlan devices have called netdev_put()\nin ipvlan_uninit().\n\n  # ip netns add ns1\n  # ip netns add ns2\n  # ip netns add ns3\n  # ip -n ns1 link add veth0 type veth peer veth1\n  # ip -n ns2 link add ipvl2 link veth0 link-netns ns1 type ipvlan mode l2\n  # ip -n ns3 link add ipvl3 link veth0 link-netns ns1 type ipvlan mode l2\n  # ip -n ns1 link del veth0\n\n  # bpftrace -e \u0027#include \u003clinux/netdevice.h\u003e\n  kprobe:ipvlan_uninit,\n  kprobe:veth_dellink,\n  kprobe:free_netdev {\n      $dev \u003d (struct net_device *)arg0;\n      printf(\"PID: %d | DEV: %s%s\\n\", pid, $dev-\u003ename, kstack());\n  }\u0027\n\n  PID: 2010 | DEV: veth0\n          veth_dellink+5\n          rtnl_dellink+1213\n          rtnetlink_rcv_msg+1791\n  ...\n  PID: 440 | DEV: ipvl2\n          ipvlan_uninit+5\n          unregister_netdevice_many_notify+7129\n          unregister_netdevice_many_net+1050\n          rtnl_net_work_func+136\n  ...\n  PID: 440 | DEV: ipvl2\n          free_netdev+5\n          netdev_run_todo+4798\n          process_scheduled_works+2538\n  ...\n  PID: 440 | DEV: ipvl3\n          ipvlan_uninit+5\n          unregister_netdevice_many_notify+7129\n          unregister_netdevice_many_net+1050\n          rtnl_net_work_func+136\n          process_scheduled_works+2538\n  ...\n  PID: 2010 | DEV: veth0\n          free_netdev+5\n          netdev_run_todo+4798\n          rtnl_dellink+1507\n          rtnetlink_rcv_msg+1791\n  ...\n  PID: 440 | DEV: ipvl3\n          free_netdev+5\n          netdev_run_todo+4798\n          process_scheduled_works+2538\n  ...\n\nv1: https://lore.kernel.org/netdev/20260701214334.266991-1-kuniyu@google.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260703001009.1572444-1-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "00a40d809207a61f0762488aa5ce72e941b367ce",
      "tree": "f8d57c63e535c6946957daf9dc1897cd9e9ea64d",
      "parents": [
        "35add1093e2fe62b755ef69b211d15b58ab915ab"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:25 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:50 2026 +0200"
      },
      "message": "ipvlan: Support per-netns netdev unregistration.\n\nWhen a lower device is unregistered, its upper ipvlan devices\nmust also be unregistered.  However, these upper devices may\nreside in different netns than the lower device.\n\nLet\u0027s use unregister_netdevice_queue_net() to support per-netns\ndevice unregistration for ipvlan.\n\nThe new dying flag in struct ipvl_dev is used to avoid a race\nthat ipvlan_link_delete() is called while its lower device is\nbeing removed in ipvlan_device_event().\n\nIf dying is true in ipvlan_link_delete(), the ipvlan device is\nalready destructed but not yet unregistered.  In this case,\nunregistration will be done in __rtnl_net_unlock() of the\n-\u003edellink() caller.\n\nTested:\n\n1. Create veth in ns1 and two ipvlan devices in ns2 and ns3.\n\n  # ip netns add ns1\n  # ip netns add ns2\n  # ip netns add ns3\n  # ip -n ns1 link add veth0 type veth peer veth1\n  # ip -n ns2 link add ipvl2 link veth0 link-netns ns1 type ipvlan mode l2\n  # ip -n ns3 link add ipvl3 link veth0 link-netns ns1 type ipvlan mode l2\n\n2. Run bpftrace to check that veth is unregistered first but\n   wait ipvlan to be unregistered\n\n  # bpftrace -e \u0027#include \u003clinux/netdevice.h\u003e\n  kprobe:ipvlan_uninit,\n  kprobe:veth_dellink,\n  kprobe:free_netdev {\n      $dev \u003d (struct net_device *)arg0;\n      printf(\"PID: %d | DEV: %s%s\\n\", pid, $dev-\u003ename, kstack());\n  }\u0027\n\n3. Remove the lower veth0 in ns1.\n\n  # ip -n ns1 link del veth0\n\nWe can see that veth0 is freed after unregistering ipvl2 and ipvl3\nin per-netns work because ipvl_port holds refcount of veth0.\n\n  PID: 2010 | DEV: veth0\n          veth_dellink+5\n          rtnl_dellink+1213\n          rtnetlink_rcv_msg+1791\n  ...\n  PID: 440 | DEV: ipvl2\n          ipvlan_uninit+5\n          unregister_netdevice_many_notify+7129\n          unregister_netdevice_many_net+1050\n          rtnl_net_work_func+136\n          process_scheduled_works+2538\n  ...\n  PID: 440 | DEV: ipvl2\n          free_netdev+5\n          netdev_run_todo+4798\n          process_scheduled_works+2538\n  ...\n  PID: 440 | DEV: ipvl3\n          ipvlan_uninit+5\n          unregister_netdevice_many_notify+7129\n          unregister_netdevice_many_net+1050\n          rtnl_net_work_func+136\n          process_scheduled_works+2538\n  ...\n  PID: 2010 | DEV: veth0\n          free_netdev+5\n          netdev_run_todo+4798\n          rtnl_dellink+1507\n          rtnetlink_rcv_msg+1791\n  ...\n  PID: 440 | DEV: ipvl3\n          free_netdev+5\n          netdev_run_todo+4798\n          process_scheduled_works+2538\n  ...\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-15-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "35add1093e2fe62b755ef69b211d15b58ab915ab",
      "tree": "a0a7294402713cf9f98723f2e8f2eb8822700131",
      "parents": [
        "aabbdb8c76d7b912d9a6bb2b1e835eba54a53a8d"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:24 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:50 2026 +0200"
      },
      "message": "ipvlan: Protect ipvl_port.ipvlans with mutex.\n\nstruct ipvl_port is shared between a lower device and its upper\nipvlan devices.\n\nAll upper devices are linked to ipvl_port.ipvlans.\n\nOnce RTNL is removed, the list can be modified concurrently from\ndifferent netns due to device removal.\n\nLet\u0027s protect it with a per-port mutex.\n\nNETDEV_PRECHANGEUPPER and NETDEV_CHANGEUPPER are explicitly\nskipped to avoid deadlock for netdev_upper_dev_unlink() called\nfrom NETDEV_UNREGISTER.\n\nNote that __ipvtap_dellink_ptr is added for CONFIG_IPVLAN\u003dy\nbut CONFIG_TAP\u003dm and CONFIG_IPVTAP\u003dm.\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-14-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "aabbdb8c76d7b912d9a6bb2b1e835eba54a53a8d",
      "tree": "ba4239adf7f7bc0600afef2b94a0c082aabdee75",
      "parents": [
        "acb351b5a899a45400daa154258d970077658848"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:23 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:50 2026 +0200"
      },
      "message": "ipvlan: Synchronise ipvlan_init() and ipvlan_uninit() for the same lower dev.\n\nipvlan_uninit() for the last ipvlan device resets the lower device\u0027s\nrx_handler_data to NULL.\n\nOnce RTNL is removed, ipvlan_init() would race with ipvlan_uninit(),\nwhich could leak a newly allocated ipvl_port.\n\n  ipvlan_init()                   ipvlan_uninit()\n  |                               |- if (refcount_dec_and_test(old_port))\n  ...                                |- ipvlan_port_destroy(old_port)\n  |                                     \u0027\n  |- refcount_inc_not_zero(old_port) \u003c-- fails\n  |- ipvlan_port_create(phy_dev)        .\n     |- new_port \u003d kzalloc()            |\n     |- phy_dev-\u003erx_handler_data \u003d new_port\n                                        |- phy_dev-\u003erx_handler_data \u003d NULL\n\t\t\t\t\t...\n\t\t\t\t\t`- kfree(old_port);\n\nLet\u0027s synchronise the two by holding the lower device\u0027s netdev_lock().\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-13-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "acb351b5a899a45400daa154258d970077658848",
      "tree": "5963c90571f452e0b206c79afab9679091641637",
      "parents": [
        "f1de92507a91ea99831461721714c44fa39ddd77"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:22 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:50 2026 +0200"
      },
      "message": "ipvlan: Convert ipvl_port.count to refcount_t.\n\nstruct ipvl_port is shared between a lower device and its upper\nipvlan devices.\n\nWhile each upper device can always access ipvl_port safely via\nipvlan_dev.port, the lower device relies on RTNL to access it\nvia net_device.rx_handler_data.\n\nOnce RTNL is removed, the lower device cannot read ipvl_port safely\nin ipvlan_device_event() because the port could be freed concurrently\nand net_device.rx_handler_data is set to NULL if the last ipvlan\ndevice in another namespace is unregistered.\n\nLet\u0027s convert ipvl_port.count to refcount_t and use RCU along with\nrefcount_inc_not_zero() in ipvlan_device_event().\n\nnetdev_put() in ipvlan_port_destroy() is also moved down after\ncancel_work_sync(), which is the last user of port-\u003edev.\n\nNote that ipvlan-\u003eport is now set in ipvlan_init() so that it can\nbe used in ipvlan_uninit(), instead of ipvlan_port_get_rtnl()\n(rtnl_dereference()).\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-12-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "f1de92507a91ea99831461721714c44fa39ddd77",
      "tree": "866c98bd7401fb5a92adede38b40253904cb2c09",
      "parents": [
        "a278ea7ba32a948c90da54caef9193b54652540d"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:21 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:50 2026 +0200"
      },
      "message": "bareudp: Support per-netns netdev unregistration.\n\nbareudp_exit_rtnl_net() iterates bareudp devices whose sockets\nare in the dying netns and queues them for destruction.\n\nSo the devices may reside in different netns.\n\nLet\u0027s use unregister_netdevice_queue_net() to support per-netns\ndevice unregistration.\n\nlist_del() is changed to list_del_init() to avoid queueing the\nsame device twice.\n\nEven after bareudp_exit_rtnl_net() queues a cross-netns bareudp\ndevice, bareudp_dellink() could be called concurrently for it\n(once RTNL is removed).  In such a case, __rtnl_net_unlock() will\nperform the unregistration.\n\nNote that bareudp uses register_pernet_subsys() instead of _device(),\nso default_device_exit_batch() guarantees that the async per-netns\nworks are flushed before -\u003eexit().\n\nTested:\n\n1. Create bareudp device across two netns.\n\n  # ip netns add ns1\n  # ip netns add ns2\n  # ip -n ns1 link add bareudp0 link-netns ns2 type bareudp \\\n    dstport 9292 ethertype ipv4\n\n2. Run bpftrace to check that bareudp_uninit() is called between\n   -\u003eexit_rtnl() and -\u003eexit().\n\n  # bpftrace -e \u0027#include \u003clinux/netdevice.h\u003e\n  kprobe:bareudp_uninit {\n      $dev \u003d (struct net_device *)arg0;\n      printf(\"PID: %d | DEV: %s%s\\n\", pid, $dev-\u003ename, kstack());\n  }\n  kprobe:bareudp_exit_rtnl_net,\n  kprobe:bareudp_exit_net {\n      printf(\"PID: %d%s\\n\", pid, kstack());\n  }\u0027\n\n3. Remove the netns where the bareudp socket resides\n\n  # ip netns del ns2\n\nNow, we can see bareudp0 is unregistered by per-netns work\ninstead of cleanup_net() and it finishes before -\u003eexit() to\navoid WARN_ON_ONCE(!list_empty(\u0026bn-\u003ebareudp_list)) there.\n\n  PID: 576\n          bareudp_exit_rtnl_net+5\n          ops_undo_list+702\n          cleanup_net+1122\n          process_scheduled_works+2538\n  ...\n  PID: 470 | DEV: bareudp0\n          bareudp_uninit+5\n          unregister_netdevice_many_notify+7129\n          unregister_netdevice_many_net+1050\n          rtnl_net_work_func+136\n          process_scheduled_works+2538\n  ...\n  PID: 576\n          bareudp_exit_net+5\n          ops_undo_list+1064\n          cleanup_net+1122\n          process_scheduled_works+2538\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-11-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "a278ea7ba32a948c90da54caef9193b54652540d",
      "tree": "6e66f8ce8e6578374f2e4741dacd526d316b370a",
      "parents": [
        "d7fda2c776b2a969b9d78c5ad00e30824df43add"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:20 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:50 2026 +0200"
      },
      "message": "bareudp: Protect bareudp_list with mutex.\n\nstruct bareudp_dev.net is the netns where the backend bareudp\nsocket resides.\n\nstruct bareudp_dev is linked to the bareudp_net.bareudp_list of\nthe socket\u0027s netns.\n\nDuring netns dismantle or module unload, bareudp_exit_rtnl_net()\niterates the list and queues devices for destruction regardless\nof the devices\u0027 netns.\n\nThus, once RTNL is removed, the list can be modified concurrently\nfrom different netns due to device removal.\n\nLet\u0027s protect it with per-netns mutex.\n\nbareudp_newlink() is still protected by rtnl_net_lock()s, so\nacquiring bn-\u003elock twice in bareudp_find_dev() and\nbareudp_configure() is not a problem.\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-10-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "d7fda2c776b2a969b9d78c5ad00e30824df43add",
      "tree": "7c0506d208f85a8fe8baf745f04800416e00e25e",
      "parents": [
        "d0008553a70a306c10ca2a596f449971d0579d50"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:19 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:50 2026 +0200"
      },
      "message": "veth: Support per-netns device unregistration.\n\nCurrently, veth_dellink() unregisters both local and peer devices\nsynchronously under RTNL.\n\nOnce RTNL is removed, it can be called concurrently from different\nnetns.\n\nLet\u0027s use xchg() and unregister_netdevice_queue_net() to support\nper-netns device unregistration.\n\nThis way, each device is queued for destruction only once by\nthe winner of the race.\n\nNote that the extra netdev_hold() ensures that @peer obtained by\nthe first xchg() is not freed during the subsequent access to\nnetdev_priv(peer).  The 2nd xchg() overwrites @dev to balance\nthe refcount.\n\nTested:\n\n1. Create two veth pairs (veth1-2, veth3-4) between two netns\n   (ns1 \u0026 ns2).\n\n  # ip netns add ns1\n  # ip netns add ns2\n  # ip -n ns1 link add veth1 type veth peer veth2 netns ns2\n  # ip -n ns1 link add veth3 type veth peer veth4 netns ns2\n\n2. Run bpftrace to check if the same process does NOT\n   unregister the paired veth devices\n\n  # bpftrace -e \u0027#include \u003clinux/netdevice.h\u003e\n  kprobe:free_netdev {\n      $dev \u003d (struct net_device *)arg0;\n      printf(\"PID: %d | DEV: %s%s\\n\", pid, $dev-\u003ename, kstack());\n  }\u0027\n\n3. Remove veth2 in ns2 and check bpftrace output\n\n  # ip -n ns2 link del veth2\n\n  PID: 2194 | DEV: veth2\n          free_netdev+5\n          netdev_run_todo+4798\n          rtnl_dellink+1507\n          rtnetlink_rcv_msg+1791\n  ...\n  PID: 448 | DEV: veth1\n          free_netdev+5\n          netdev_run_todo+4798\n          process_scheduled_works+2538\n  ...\n\n4. Remove ns2 (thus veth4) and check bpftrace output\n\n  # ip netns del ns2\n\n  PID: 571 | DEV: veth4\n          free_netdev+5\n          netdev_run_todo+4798\n          default_device_exit_batch+2271\n          ops_undo_list+993\n          cleanup_net+1122\n          process_scheduled_works+2538\n  ...\n  PID: 441 | DEV: veth3\n          free_netdev+5\n          netdev_run_todo+4798\n          process_scheduled_works+2538\n  ...\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-9-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "d0008553a70a306c10ca2a596f449971d0579d50",
      "tree": "1e0a02f3ad304e4b81ebcd46a66c1c08a601d216",
      "parents": [
        "af3634d4ac652cd93cb97dd2ad2f01536c2cebc7"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:18 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:50 2026 +0200"
      },
      "message": "net: Call unregister_netdevice_many() per netns.\n\nFor per-netns device unregistration, the list passed to\nunregister_netdevice_many() must contain devices from a single\nnetns only (once all callers are converted).\n\nLet\u0027s move collected devices in the following functions to\nnet-\u003edev_unreg_head and let __rtnl_net_unlock() pass them to\nunregister_netdevice_many().\n\n  * default_device_exit_batch()\n  * ops_exit_rtnl_list()\n  * __rtnl_kill_links()\n\nThis allows incremental conversion of each driver to support\nper-netns device unregistration without affecting the normal\nkernel where CONFIG_DEBUG_NET_SMALL_RTNL is disabled.\n\nNote that this change unbatches synchronize_rcu() etc in\nunregister_netdevice_many(), but we can later split it into\nmultiple stages to batch them again.\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-8-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "af3634d4ac652cd93cb97dd2ad2f01536c2cebc7",
      "tree": "b67310dfb1fa0d08ead953bbb8da42f301709f14",
      "parents": [
        "0fa296dd520eb388e18b97dc553926f82a09cc1d"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:17 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:49 2026 +0200"
      },
      "message": "net: Add per-netns netdev unregistration infra.\n\nWhen we need to unregister a netdev in a different netns, we will\ndelegate its unregistration to per-netns work.\n\nThere are three types of such cross-netns devices:\n\n  1. Paired devices (e.g., netkit, veth, vxcan)\n     -\u003e Unregistering one device also deletes its peer, which\n        may reside in another netns.\n\n  2. Tunnel devices (e.g., bareudp, geneve, etc)\n     -\u003e Destroying a netns removes devices in another netns if\n        their backend sockets reside in the dying netns\n\n  3. Stacked devices (e.g., ipvlan, macvlan, etc)\n     -\u003e Removing the lower device also removes multiple upper\n        devices, each of which may reside in different namespaces.\n\nIn these cases, we will use unregister_netdevice_queue_net() to\nqueue such potential cross-netns devices for destruction.\n\nEach driver must not call both unregister_netdevice_queue_net()\nand unregister_netdevice_queue() for the same device.  See the\nsubsequent veth/bareudp/ipvlan patches for how they avoid double\nqueueing.\n\nunregister_netdevice_queue_net() takes net and dev.  If dev resides\nin the net, it simply calls unregister_netdevice_queue().\n\nIf dev_net(dev) is different from the net, it enqueues the device\nto dev_net(dev)-\u003edev_unreg_head and schedules the per-netns work.\n\nWhen __rtnl_net_unlock() is called from the per-netns work (or another\nthread already holding the lock), unregister_netdevice_many_net()\ncollects the queued devices and calls unregister_netdevice_many()\nto perform the actual unregistration.\n\nDuring netns dismantle, rtnl_net_flush_workqueue() is called at the\nend of default_device_exit_batch() to ensure that cross-netns\ndevices in the other alive netns are unregistered.\n\nOnce RTNL is removed, a device could be moved to another netns while\nbeing queued to net-\u003edev_unreg_head.\n\n__dev_change_net_namespace() handles this race by acquiring\nnet-\u003edev_unreg_lock of both the old and new netns after dev_set_net()\nand moving the device between their dev_unreg_head lists.\n\nSince dev_set_net() and unregister_netdevice_queue_net() are\nsynchronised by netdev_lock(), the device is either queued to the\nold netns\u0027s dev_unreg_head and then moved, or queued directly to\nthe new netns.\n\nNote that unregister_netdevice_move_net() does not need to call\nrtnl_net_queue_work() because __dev_change_net_namespace() is\n(supposed to be) called with rtnl_net_lock().  (Not all callers\nhold it yet, but the race does not happen until all callers\nare converted and RTNL is removed.)\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-7-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "0fa296dd520eb388e18b97dc553926f82a09cc1d",
      "tree": "f4f3b38b2b1112cb6b08ef68890d2c1aa4d719d3",
      "parents": [
        "2b12ec25784954134df6cf0972a28f14dffdad50"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:16 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:49 2026 +0200"
      },
      "message": "net: Hold __rtnl_net_lock() in netdev_wait_allrefs_any().\n\nCurrently, netdev_run_todo() processes pending devices from multiple\nnamespaces in a batch.\n\nTo expand the per-netns RTNL coverage for NETDEV_UNREGISTER, let\u0027s\nacquire __rtnl_net_lock() in netdev_wait_allrefs_any().\n\nNote that netdev_run_todo() itself will need to be namespacified\nbefore RTNL is removed.\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-6-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "2b12ec25784954134df6cf0972a28f14dffdad50",
      "tree": "1b4fa8a661fc08a2b408bded32645b8a1ce5dff2",
      "parents": [
        "c6cfaf97837e18d50e65185d36b4a9d860f62a4a"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:15 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:49 2026 +0200"
      },
      "message": "net: Wrap default_device_exit_net() with __rtnl_net_lock().\n\ndefault_device_exit_net() could call dev_change_net_namespace()\nto move devices from a dying netns to init_net.\n\nLet\u0027s hold the two netns __rtnl_net_lock() around it.\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-5-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "c6cfaf97837e18d50e65185d36b4a9d860f62a4a",
      "tree": "759af44613d122d941d5d41b5b84766ac6769ea0",
      "parents": [
        "49c26d4bf1daa8ada5a2015646adbf7b1b716b8b"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:14 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:49 2026 +0200"
      },
      "message": "rtnetlink: Add per-netns rtnl_work.\n\nThe biggest blocker to per-netns RTNL is netdev unregistration.\n\nIt starts within a single netns (e.g., during a device lookup or\nnetns dismantle), but it can eventually involve multiple namespaces,\nsuch as when upper ipvlan devices reside in different netns.\n\nThis prevents us from acquiring multiple rtnl_net_lock()s beforehand.\n\nWhen we encounter such a cross-netns device, we must delegate the\nunregistration to the work of the netns where the device actually\nresides.\n\nLet\u0027s add per-netns rtnl_work to support the deferred netdev\nunregistration.\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-4-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "49c26d4bf1daa8ada5a2015646adbf7b1b716b8b",
      "tree": "6dddfdafe5899a2e676892140ee91e6eab0ca2fa",
      "parents": [
        "5ecbbb179e0c737eb1360a877508766efb16f010"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:13 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:49 2026 +0200"
      },
      "message": "rtnetlink: Call unregister_netdevice_many() only once in rtnl_link_unregister().\n\nWhen rtnl_link_unregister() is called during module unload, it\ncalls __rtnl_kill_links() for every netns.\n\n__rtnl_kill_links() collects all devices of the unloaded module\nand passes them to unregister_netdevice_many().\n\nLet\u0027s move unregister_netdevice_many() to rtnl_link_unregister()\nto unregister all devices across netns in a single batch.\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-3-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "5ecbbb179e0c737eb1360a877508766efb16f010",
      "tree": "0fe12710a118eef486c742f5d4297392ff291fed",
      "parents": [
        "23dad2d088dfc82cae1f5a936f8ff7ffebb38dd9"
      ],
      "author": {
        "name": "Kuniyuki Iwashima",
        "email": "kuniyu@google.com",
        "time": "Fri Jul 03 00:09:12 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Sat Jul 11 12:57:49 2026 +0200"
      },
      "message": "rtnetlink: Lock sock_net(skb-\u003esk) in rtnl_newlink().\n\nThere are a few cases where rtnl_net_lock() is not properly\nheld in rtnl_newlink().\n\nWhen either of IFLA_NET_NS_PID / IFLA_NET_NS_FD / IFLA_TARGET_NETNSID\nis specified but IFLA_LINK_NETNSID is not, sock_net(skb-\u003esk) is used\nas link_net in rtnl_newlink_link_net().\n\nIn addition, the do_setlink() path uses sock_net(skb-\u003esk) and one\nfrom the three netns attributes while rtnl_link_get_net_capable()\nreturns only one of four.\n\nLet\u0027s add sock_net(skb-\u003esk) to rtnl_nets in rtnl_newlink().\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260703001009.1572444-2-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "23dad2d088dfc82cae1f5a936f8ff7ffebb38dd9",
      "tree": "4f26137773f9d2639c23bec2a4392e0092d5a4cf",
      "parents": [
        "d5d7554052f3ac45c75d8e526ded2a70a7593929"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Mon Jul 06 16:35:17 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Fri Jul 10 17:29:43 2026 +0200"
      },
      "message": "tun: no longer rely on RTNL in tun_fill_info()\n\nUpdate tun_fill_info() to read device configuration fields (flags, owner,\ngroup, numqueues, numdisabled) locklessly using READ_ONCE().\n\nAnnotate all writes to these fields in the control paths with WRITE_ONCE()\nto prevent data races, as these fields can be modified concurrently via\nioctls (TUNSETPERSIST, TUNSETOWNER, TUNSETGROUP, TUNSETIFF) or queue\nattaching/detaching.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260706163517.2415530-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "d5d7554052f3ac45c75d8e526ded2a70a7593929",
      "tree": "73c01b51744d79310d22e02e7a2cf48e75359376",
      "parents": [
        "832255a6df491b6bfa41e6458d097f269b680d77"
      ],
      "author": {
        "name": "Thorsten Blum",
        "email": "thorsten.blum@linux.dev",
        "time": "Sat Jul 04 14:10:11 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Fri Jul 10 15:55:22 2026 +0200"
      },
      "message": "net: chelsio: cxgb4: Use str_plural() in mem_intr_handler()\n\nReplace the manual ternary \"s\" pluralization with str_plural() to\nsimplify the code.\n\nSigned-off-by: Thorsten Blum \u003cthorsten.blum@linux.dev\u003e\nReviewed-by: Potnuri Bharat Teja \u003cbharat@chelsio.com\u003e\nLink: https://patch.msgid.link/20260704121010.201016-3-thorsten.blum@linux.dev\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "832255a6df491b6bfa41e6458d097f269b680d77",
      "tree": "f22a74414a01986968d7229562601678c08f4f59",
      "parents": [
        "b470fde8f77b56ff273c5527484b99499b894e16"
      ],
      "author": {
        "name": "Praveen Rajendran",
        "email": "praveenrajendran2009@gmail.com",
        "time": "Fri Jul 03 20:01:30 2026 +0530"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Fri Jul 10 10:50:17 2026 +0200"
      },
      "message": "net: qed: Fix spelling typo in qed_dcbx.c comment\n\nCorrect a minor spelling error inside a comment block of the QLogic\nCore module where \"successfully\" was misspelled as \"successfuly\".\n\nSigned-off-by: Praveen Rajendran \u003cpraveenrajendran2009@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260703143130.3685-1-praveenrajendran2009@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "b470fde8f77b56ff273c5527484b99499b894e16",
      "tree": "bbf78ca301e5ead11fc65f51c1b2a4a06b5b81c7",
      "parents": [
        "fe3e786ef4eb6e47d2901f568a27bd920477bbe9",
        "2c7c88a412aa6d09cd04b414211b4ef8553b5309"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Fri Jul 10 10:05:52 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Fri Jul 10 10:20:05 2026 +0200"
      },
      "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nCross-merge networking fixes after downstream PR (net-7.2-rc3).\n\nConflicts:\n\ntools/testing/selftests/net/lib.sh\n  dd6a23bac306b (\"selftests: net: make busywait timeout clock portable\")\n  895bad9cc4cec (\"selftests: net: make busywait timeout clock portable\")\n\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "2c7c88a412aa6d09cd04b414211b4ef8553b5309",
      "tree": "79b8874287ea0f25641f509a0dec4591555a5711",
      "parents": [
        "6bad2e38fe7f2da7dc982b2b80814e632832e568",
        "f5089008f90c0a7c5520dff3934e0af00adf322d"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jul 09 08:26:51 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jul 09 08:26:51 2026 -0700"
      },
      "message": "Merge tag \u0027net-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter, Bluetooth and batman-adv.\n\n  Current release - regressions:\n\n   - bluetooth: fix using chan-\u003econn as indication to no remote netdev\n\n  Current release - new code bugs:\n\n   - netfilter: cap to maximum number of expectation per master on\n     updates\n\n  Previous releases - regressions:\n\n   - bluetooth:\n      - fix UAF of hci_conn_params in add_device_complete\n      - fix null ptr deref in hci_abort_conn()\n\n   - igmp: remove multicast group from hash table on device destruction\n\n   - batman-adv: prevent TVLV OOB check overflow\n\n   - eth: mlx5/mlx5e:\n      - fix off-by-one in single-FDB error rollback\n      - skip peer flow cleanup when LAG seq is unavailable\n      - fix crashes in dynamic per-channel stats and HV VHCA agent\n\n   - eth: mana: Sync page pool RX frags for CPU\n\n  Previous releases - always broken:\n\n   - netfilter:\n      - mark malformed IPv6 extension headers for hotdrop\n      - terminate table name before find_table_lock()\n      - ipvs: use parsed transport offset in TCP state lookup\n\n   - sched: act_pedit: fix TOCTOU heap OOB write in tc offload\n\n   - ethtool: rss: fix hfunc and input_xfrm parsing on big endian\n\n   - ipv4/ipv6: fix UAF and memory leak in IGMP/MLD\n\n   - tls: consume empty data records in tls_sw_read_sock()\n\n   - eth:\n      - octeontx2-af: fix VF bringup affecting PF promiscuous state\n      - gue: validate REMCSUM private option length\"\n\n* tag \u0027net-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (94 commits)\n  macsec: don\u0027t read an unset MAC header in macsec_encrypt()\n  dibs: loopback: validate offset and size in move_data()\n  octeontx2-af: fix VF bringup affecting PF promiscuous state\n  ethtool: rss: Fix hfunc and input_xfrm parsing on big endian\n  net/mlx5: Fix L3 tunnel entropy refcount leak\n  net: macb: drop in-flight Tx SKBs on close\n  net: mana: Sync page pool RX frags for CPU\n  net: mana: Validate the packet length reported by the NIC\n  selftests/net: fix EVP_MD_CTX leak in tcp_mmap\n  ipvs: ensure inner headers in ICMP errors are in headroom\n  ipvs: use parsed transport offset in SCTP state lookup\n  ipvs: use parsed transport offset in TCP state lookup\n  ipvs: pass parsed transport offset to state handlers\n  netfilter: handle unreadable frags\n  netfilter: flowtable: support IPIP tunnel with direct xmit\n  netfilter: flowtable: IPIP tunnel hardware offload is not yet support\n  netfilter: flowtable: use dst in this direction when pushing IPIP header\n  netfilter: ipset: allocate the proper memory for the generic hash structure\n  netfilter: ipset: cleanup the add/del backlog when resize failed\n  netfilter: ipset: exclude gc when resize is in progress\n  ...\n"
    },
    {
      "commit": "f5089008f90c0a7c5520dff3934e0af00adf322d",
      "tree": "9aa744bbade5e6d2a7146aa3bcbb0ba8bfaa880e",
      "parents": [
        "78237e3c0720fcc6eb9b87e90fd70f63eeca886f"
      ],
      "author": {
        "name": "Daehyeon Ko",
        "email": "4ncienth@gmail.com",
        "time": "Fri Jul 03 17:36:33 2026 +0900"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 13:05:04 2026 +0200"
      },
      "message": "macsec: don\u0027t read an unset MAC header in macsec_encrypt()\n\nmacsec_encrypt() reads the Ethernet header via eth_hdr(skb)\n(skb-\u003ehead + skb-\u003emac_header) to memmove() the 12 source/destination MAC\nbytes forward and make room for the SecTAG.\n\nOn the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb\nreaches the macsec ndo_start_xmit() with the MAC header unset, so\neth_hdr(skb) resolves to skb-\u003ehead + (u16)~0 and the read is out of\nbounds: a 12-byte heap over-read that is also emitted on the wire as the\nframe\u0027s outer source/destination MAC. KASAN reports a slab-out-of-bounds\nread in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET\nbuild flags it as an unset mac header in skb_mac_header().\n\nOn the TX path the L2 header is at skb-\u003edata, so use skb_eth_hdr(), added\nby commit 96cc4b69581d (\"macvlan: do not assume mac_header is set in\nmacvlan_broadcast()\") for exactly this purpose.\n\nFixes: c09440f7dcb3 (\"macsec: introduce IEEE 802.1AE driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://patch.msgid.link/20260703083634.2035145-1-4ncienth@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "78237e3c0720fcc6eb9b87e90fd70f63eeca886f",
      "tree": "626153581998515ed11af65563ec77f9bbc52837",
      "parents": [
        "fabb881df322da25442f98d23f5fa371e3c78ec4"
      ],
      "author": {
        "name": "Dust Li",
        "email": "dust.li@linux.alibaba.com",
        "time": "Tue Jul 07 15:43:18 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 12:44:00 2026 +0200"
      },
      "message": "dibs: loopback: validate offset and size in move_data()\n\nThe loopback move_data() performs a memcpy into the registered DMB\nwithout checking whether offset + size exceeds the DMB length.  Unlike\nreal ISM hardware, which enforces memory region bounds natively, the\nsoftware loopback has no such protection.\n\nA peer-supplied out-of-bounds offset or oversized write would result in\nan OOB write past the allocated kernel buffer.  Add an explicit bounds\ncheck before the memcpy to reject such requests with -EINVAL.\n\nFixes: f7a22071dbf3 (\"net/smc: implement DMB-related operations of loopback-ism\")\nCc: stable@vger.kernel.org\nReported-by: Federico Kirschbaum \u003cfederico.kirschbaum@xbow.com\u003e\nSigned-off-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nReported-by: Baul Lee \u003cbaul.lee@xbow.com\u003e\nLink: https://patch.msgid.link/20260707074318.1448662-1-dust.li@linux.alibaba.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "fe3e786ef4eb6e47d2901f568a27bd920477bbe9",
      "tree": "b290e434a3761edaca1ee8d712aa0c887192cb81",
      "parents": [
        "0e74441edefce4cae60f572ca7da70fa9eabc168"
      ],
      "author": {
        "name": "Zinc Lim",
        "email": "limzhineng2@gmail.com",
        "time": "Thu Jul 02 09:49:31 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 12:38:20 2026 +0200"
      },
      "message": "selftests: drv-net: rss_ctx: Add retries to test_rss_context_overlap to reduce flakes\n\nSimilar to commit 690043b95c18 (\"selftests: drv-net: rss: Add\nretries to test_rss_key_indir to reduce flakes\"), implement the\nretry mechanism for test_rss_context_overlap. This gives the test\nmore attempts to distribute the flow evenly, as the chance of\nflow skewing to one queue is high.\n\nExample failures:\n\n # Check failed 5288 \u003c 7000 traffic on main context (1/2): [2727, 2561, 8961, 6648]\nnot ok 1 rss_ctx.test_rss_context_overlap\n\n # Check failed 6710 \u003c 7000 traffic on main context (2/2): [9280, 5217, 5358, 1352]\nnot ok 1 rss_ctx.test_rss_context_overlap\n\nRan test_rss_context_overlap and test_rss_context_overlap2\nover 1,000 consecutive runs with no failures.\n\nSigned-off-by: Zinc Lim \u003climzhineng2@gmail.com\u003e\nLink: https://patch.msgid.link/20260702164932.2832916-1-limzhineng2@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "0e74441edefce4cae60f572ca7da70fa9eabc168",
      "tree": "c6e68804951ecdb696f65fdec83ea73fb4923dbf",
      "parents": [
        "6d86ce0da0d5631721c142ea9bb5499cc129b347"
      ],
      "author": {
        "name": "Paritosh Potukuchi",
        "email": "paritoshpotukuchi@gmail.com",
        "time": "Fri Jul 03 12:55:12 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 12:29:56 2026 +0200"
      },
      "message": "net : bonding : Remove TODO comment about retrying setting the MAC\n\nAs correctly pointed out by Jay Vosburgh,\n\n\"This comment dates to sometime before git, when it was common for\nnetwork device drivers to lack the ability to change the MAC while the\ninterface is up.  To the best of my knowledge, that isn\u0027t a issue\ntoday.\"\n\nBased on the discussion in the RFC linked below, I am removing the\nTODO.\n\nLink to the RFC:\nhttps://lore.kernel.org/netdev/2001256.1782860341@famine/T/#t\n\nSigned-off-by: Paritosh Potukuchi \u003cparitosh.potukuchi@amd.com\u003e\nLink: https://patch.msgid.link/20260703125513.694324-1-paritosh.potukuchi@amd.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "fabb881df322da25442f98d23f5fa371e3c78ec4",
      "tree": "4e9eb98796be0e9a3e3cb9f272811f926b4c797e",
      "parents": [
        "24c4c88259464d38b35c3fbaecb68675de64137d"
      ],
      "author": {
        "name": "Harman Kalra",
        "email": "hkalra@marvell.com",
        "time": "Thu Jul 02 10:26:16 2026 +0530"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 12:00:04 2026 +0200"
      },
      "message": "octeontx2-af: fix VF bringup affecting PF promiscuous state\n\nMbox handling of nix_set_rx_mode for a VF with promiscuous and\nall_multi flags set to false causes deletion of the PF\u0027s promiscuous\nand allmulti MCAM rules. This occurs because the APIs that\nenable/disable these rules operate only on the PF, even when the\nmbox request is made via a VF interface.\n\nGuard both rvu_npc_enable_allmulti_entry() and\nrvu_npc_enable_promisc_entry() disable paths with an is_vf() check so\nthat a VF bringing up or tearing down its interface cannot inadvertently\nclear the PF\u0027s MCAM rules.\n\nFixes: 967db3529eca (\"octeontx2-af: add support for multicast/promisc packet replication feature\")\nSigned-off-by: Harman Kalra \u003chkalra@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nLink: https://patch.msgid.link/20260702045616.3002773-2-nshettyj@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "24c4c88259464d38b35c3fbaecb68675de64137d",
      "tree": "bd8b446a2d570f99eb0f7f0b6696585c11a01db3",
      "parents": [
        "b62869a81a7ce388d1fbb0fac5fa8300ea614d81",
        "3f7a535ff0fa627a0132803e4c2f903ceffcbc1c"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 11:42:56 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 11:42:57 2026 +0200"
      },
      "message": "Merge tag \u0027nf-26-07-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter: updates for net\n\nThe following patchset contains Netfilter fixes for *net*.\n\nMost of these are LLM fixes for old issues flagged by sashiko/LLMs.\n\nMany of these trigger drive-by-findings in sashiko. In particular:\n\n- many load/store tearing and missing memory barriers, races\n  etc. in ipset, esp. with GC and resizing.\n  Keeping the proposed patches spinning for yet-another-iteration\n  keeps legit fixes back, so I prefer to add these now and follow\n  up with other reports later.\n- flowtable work queue still has possible races with teardown,\n  but same rationale as with ipset: drive-by findings, not\n  problems coming with the flowtable IPIP changeset in this PR.\n- ever since unreadable frag skb support was added in 6.12, we can no\n  longer do: BUG_ON(skb_copy_bits( ...): it will fire with such skbs.\n  Mina Almasry is looking at similar patterns elsewhere in the stack.\n\n1) Guard skb-\u003emac_header adjustment after IPv6 defragmentation in\nnf_conntrack_reasm.  From Xiang Mei.\n\n2) NUL-terminate ebtables table names before calling find_table_lock() to\nprevent stack-out-of-bounds reads.  Also from Xiang Mei.\n\n3) Zero the ebtables chainstack array, else error unwind may free bogus\npointer when CPU mask is sparse.  All three issues date from 2.6 days.\n\n4) Ensure ebtables module names are c-strings, same bug pattern as 2).\nBug added in 4.6.\n\n5) Fix catchall element handling for inverted lookups in nft_lookup. Fold the\ncatchall lookup into ext before computing the match status.  Was like\nthis ever since catchall elements got introduced in 5.13.\nFrom Tamaki Yanagawa.\n\n6-9) ipset updates from Jozsef Kadlecsik:\n- mark rcu protected areas correctly\n- address gc and resize clash in the comment extension\n- add/del backlog cleanup in the error path\n- allocate right size for the generic hash structure\n\n10-12): IPIP flowtable updates from Pablo Neira Ayuso:\n - Use the current direction\u0027s route when pushing IPIP headers\n   Fix incorrect headroom and fragmentation offset calculations.\n - Avoid hardware offload for IPIP tunnels due to lack of driver support.\n - Support IPIP tunnels with direct xmit in netfilter flowtable.\n   dst_cache and dst_cookie are moved outside the union to share route\n   state across flows.  This is a followup to work done in 6.19 cycle.\n\n13) Don\u0027t BUG() on skb_copy_bits error. Handle unreadable fragments by\neither returning an error or restricting the copy operations to linear area,\nThis became an issue when unreable frag support was merged in 6.12.\n\n14-16): IPVS updates from Yizhou Zhao:\n - Pass parsed transport offset to IPVS state handlers.\n   update callback signatures.\n - use correct transport header offset on state lookp in TCP.\n   As-is it was possible for ipv6 extension header data to be\n   treated as L4 header.\n - same for SCTP.  This was also broken since 2.6 days.\n\n17) Ensure inner IP headers in ICMP errors are in the skb headroom after\nstripping outer headers. Add more checks for the length of inner headers.\nThis was broken since 3.7 days.\nFrom Julian Anastasov.\n\nnetfilter pull request nf-26-07-08\n\n* tag \u0027nf-26-07-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n  ipvs: ensure inner headers in ICMP errors are in headroom\n  ipvs: use parsed transport offset in SCTP state lookup\n  ipvs: use parsed transport offset in TCP state lookup\n  ipvs: pass parsed transport offset to state handlers\n  netfilter: handle unreadable frags\n  netfilter: flowtable: support IPIP tunnel with direct xmit\n  netfilter: flowtable: IPIP tunnel hardware offload is not yet support\n  netfilter: flowtable: use dst in this direction when pushing IPIP header\n  netfilter: ipset: allocate the proper memory for the generic hash structure\n  netfilter: ipset: cleanup the add/del backlog when resize failed\n  netfilter: ipset: exclude gc when resize is in progress\n  netfilter: ipset: mark the rcu locked areas properly\n  netfilter: nft_lookup: fix catchall element handling with inverted lookups\n  netfilter: ebtables: module names must be null-terminated\n  netfilter: ebtables: zero chainstack array\n  netfilter: ebtables: terminate table name before find_table_lock()\n  netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260708140309.19633-1-fw@strlen.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "b62869a81a7ce388d1fbb0fac5fa8300ea614d81",
      "tree": "d5c75ce06acb2855385de87132a2d45e3bb873ec",
      "parents": [
        "c914307e1d41c2cb7bcdcbfde4cd2f214f6aa027"
      ],
      "author": {
        "name": "Gal Pressman",
        "email": "gal@nvidia.com",
        "time": "Mon Jul 06 08:50:17 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 11:38:30 2026 +0200"
      },
      "message": "ethtool: rss: Fix hfunc and input_xfrm parsing on big endian\n\nETHTOOL_A_RSS_HFUNC and ETHTOOL_A_RSS_INPUT_XFRM are NLA_U32 attributes,\nbut ethnl_rss_set() and ethnl_rss_create_doit() parse them with\nethnl_update_u8(), which reads a single byte.\n\nOn little endian this happens to read the least significant byte and\nworks as long as the value fits in a byte. On big endian it reads the\nmost significant byte, so the requested value is parsed incorrectly.\n\nThe destination fields in struct ethtool_rxfh_param are u8, so the\nattribute can\u0027t be read directly with ethnl_update_u32().\nCap the hfunc policy at U8_MAX so an out of range value is rejected\ninstead of being silently truncated into the u8 field, and add\nethnl_update_u8_u32() to read the full u32 and narrow it into the u8\ndestination.\n\nFixes: 82ae67cbc423 (\"ethtool: rss: support setting hfunc via Netlink\")\nFixes: d3e2c7bab124 (\"ethtool: rss: support setting input-xfrm via Netlink\")\nFixes: a166ab7816c5 (\"ethtool: rss: support creating contexts via Netlink\")\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nReviewed-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nSigned-off-by: Gal Pressman \u003cgal@nvidia.com\u003e\nLink: https://patch.msgid.link/20260706055017.3355806-1-gal@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "c914307e1d41c2cb7bcdcbfde4cd2f214f6aa027",
      "tree": "66917c2f86085c3b89699b4d67cc3e554dd92b0e",
      "parents": [
        "604e9594449b9907181f4285d0cd6a398bfc9d08"
      ],
      "author": {
        "name": "Li RongQing",
        "email": "lirongqing@baidu.com",
        "time": "Fri Jul 03 22:14:23 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 11:21:12 2026 +0200"
      },
      "message": "net/mlx5: Fix L3 tunnel entropy refcount leak\n\nmlx5_tun_entropy_refcount_inc() counts both VXLAN and L2-to-L3\ntunnel reformat entries as entropy-enabling users. The matching\ndecrement path only handled VXLAN, leaving L2-to-L3 tunnel entries\ncounted after release.\n\nHandle MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL in\nmlx5_tun_entropy_refcount_dec() as well so the enabling entry\nrefcount remains balanced.\n\nFixes: f828ca6a2fb6 (\"net/mlx5e: Add support for hw encapsulation of MPLS over UDP\")\nSigned-off-by: Li RongQing \u003clirongqing@baidu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260703141423.1723-1-lirongqing@baidu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "6d86ce0da0d5631721c142ea9bb5499cc129b347",
      "tree": "71abeba7f91d2856b56d38ab71589e1b1a94bb7c",
      "parents": [
        "433f482add31b8f81c79fcafa739a5e7ab71daf2"
      ],
      "author": {
        "name": "Uwe Kleine-König (The Capable Hub)",
        "email": "u.kleine-koenig@baylibre.com",
        "time": "Mon Jul 06 11:29:19 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 11:13:24 2026 +0200"
      },
      "message": "net: phy: Drop #inclusion of \u003clinux/mod_devicetable.h\u003e from \u003clinux/mdio.h\u003e\n\n\u003clinux/mdio.h\u003e itself doesn\u0027t use any of the device id structures. The\nfiles #including \u003clinux/mdio.h\u003e use a variety of them:\n\n\t$ git grep -l \u0027\u003clinux/mdio.h\u003e\u0027 | xargs grep --color  -E \u0027\\\u003c(acpi_device_id|amba_id|ap_device_id|apr_device_id|auxiliary_device_id|bcma_device_id|ccw_device_id|cdx_device_id|coreboot_device_id|css_device_id|dfl_device_id|dmi_(device|system)_id|eisa_device_id|fsl_mc_device_id|hda_device_id|hid_device_id|hv_vmbus_device_id|i2c_device_id|i3c_device_id|ieee1394_device_id|input_device_id|ipack_device_id|isapnp_device_id|ishtp_device_id|mcb_device_id|mdio_device_id|mei_cl_device_id|mhi_device_id|mips_cdmm_device_id|of_device_id|parisc_device_id|pci_device_id|pci_epf_device_id|pcmcia_device_id|platform_device_id|pnp_(card_)?device_id|rio_device_id|rpmsg_device_id|sdio_device_id|sdw_device_id|serio_device_id|slim_device_id|spi_device_id|spmi_device_id|ssam_device_id|ssb_device_id|tb_service_id|tee_client_device_id|typec_device_id|ulpi_device_id|usb_device_id|vchiq_device_id|virtio_device_id|wmi_device_id|x86_(cpu|device)_id|zorro_device_id|cpu_feature)\\\u003e\u0027\n\t...\n\nbut none of them relies on \u003clinux/mdio.h\u003e\u0027s #include.\n\n\u003clinux/mod_devicetable.h\u003e is a bad header mixing many different device\nid structures and thus is an unfortunate dependency because if e.g.\nstruct wmi_device_id is modified all users of \u003clinux/mdio.h\u003e need to be\nrecompiled despite none of them using struct wmi_device_id.\n\nSo drop the unused header.\n\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/ca270a534d0f230a939a3fb4a661808b35d6436d.1783329817.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "604e9594449b9907181f4285d0cd6a398bfc9d08",
      "tree": "395b56dae56453835477545e0b7f024f5d1aa001",
      "parents": [
        "27f575836cfebbf872dec020428742b10650a955",
        "98052bdaf6ac1639a63ffc10244eeeab1f62ed2b"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 11:09:06 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 11:09:06 2026 +0200"
      },
      "message": "Merge tag \u0027batadv-net-pullrequest-20260708\u0027 of https://git.open-mesh.org/batadv\n\nSimon Wunderlich says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nHere are some batman-adv bugfixes, all by Sven Eckelmann:\n\n - ensure minimal ethernet header on TX\n\n - fix VLAN priority offset\n\n - clean untagged VLAN on netdev registration failure\n\n - tt: avoid request storms during pending request\n\n - tt: prevent TVLV OOB check overflow\n\n - frag: free unfragmentable packet\n\n - frag: fix primary_if leak on failed linearization\n\n - mcast: avoid OOB read of num_dests header\n\n - dat: fix tie-break for candidate selection\n\n* tag \u0027batadv-net-pullrequest-20260708\u0027 of https://git.open-mesh.org/batadv:\n  batman-adv: dat: fix tie-break for candidate selection\n  batman-adv: mcast: avoid OOB read of num_dests header\n  batman-adv: frag: fix primary_if leak on failed linearization\n  batman-adv: frag: free unfragmentable packet\n  batman-adv: tt: prevent TVLV OOB check overflow\n  batman-adv: tt: avoid request storms during pending request\n  batman-adv: clean untagged VLAN on netdev registration failure\n  batman-adv: fix VLAN priority offset\n  batman-adv: ensure minimal ethernet header on TX\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260708091821.314516-1-sw@simonwunderlich.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "433f482add31b8f81c79fcafa739a5e7ab71daf2",
      "tree": "fa8b2e5fda2d29e0dde77e7957f730245c428a20",
      "parents": [
        "08030ddb87b4c6c6a2c03c82731b5e188f02f5b9"
      ],
      "author": {
        "name": "Haiyang Zhang",
        "email": "haiyangz@microsoft.com",
        "time": "Thu Jul 02 15:01:04 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 10:54:00 2026 +0200"
      },
      "message": "net: mana: Add Interrupt Moderation support\n\nAdd Static and Dynamic Interrupt Moderation (DIM) support for\nRx and Tx.\nUpdate queue creation procedure with new data struct with the related\nsettings.\nAdd functions to collect stat for DIM, and workers to update DIM data\nand settings.\nUpdate ethtool handler to get/set the moderation settings from a user.\nTo avoid detach/re-attach ops, ring DIM doorbell to change settings\nat run time.\nBy default, adaptive-rx/tx (DIM) are enabled if supported by HW.\n\nSigned-off-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260702220123.815018-1-haiyangz@linux.microsoft.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "27f575836cfebbf872dec020428742b10650a955",
      "tree": "ca480038eecbd50ba8886cc7f2591b7f2bc43d59",
      "parents": [
        "c26c33e632248b334ccf132bc8c4877522c3db95"
      ],
      "author": {
        "name": "Théo Lebrun",
        "email": "theo.lebrun@bootlin.com",
        "time": "Thu Jul 02 17:37:02 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 10:48:15 2026 +0200"
      },
      "message": "net: macb: drop in-flight Tx SKBs on close\n\nThe MACB driver has since forever leaked the outgoing SKBs that\nhave not yet been marked as completed. They live in queue-\u003etx_skb\nwhich gets freed without remorse nor checking.\n\nmacb_free_consistent() gets called in a few codepaths, but only close will\ntrigger the added expressions. In macb_open() and macb_alloc_consistent()\nfailure cases, queues\u0027 tx_skb just got allocated and are empty.\n\nFixes: 89e5785fc8a6 (\"[PATCH] Atmel MACB ethernet driver\")\nCc: stable@vger.kernel.org\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nSigned-off-by: Théo Lebrun \u003ctheo.lebrun@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-macb-drop-tx-v4-1-1c833eebdbc8@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "c26c33e632248b334ccf132bc8c4877522c3db95",
      "tree": "c9e8da1ecae2640b4a8e55b82428d239ac99b0cc",
      "parents": [
        "f4ef35efbb49527293309f668ea73ec5de9b8e7a",
        "c72a0f09c57f92113df69f9b902d11c9e4b132f5"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 10:36:14 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 10:36:15 2026 +0200"
      },
      "message": "Merge branch \u0027fix-mana-rx-with-bounce-buffering\u0027\n\nDexuan Cui says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nFix MANA RX with bounce buffering\n\nWith swiotlb\u003dforce, the MANA NIC fails to work properly due to commit\n730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers instead\nof full pages to improve memory efficiency.\").\n\nThis happens because, with the standard MTU\u003d1500, the aforementioned\ncommit uses page pool frags with PP_FLAG_DMA_MAP, but fails to call\npage_pool_dma_sync_for_cpu() to sync the received packet for CPU acces\nbefore handing the RX buffer to the stack.\n\nHere patch #2 adds the required page_pool_dma_sync_for_cpu().\n\nPatch #1 validates the packet length reported by the NIC. With patch #2,\npage_pool_dma_sync_for_cpu() uses the packet length, so we don\u0027t want\nto blindly trust the packet length, just in case.\n\nThere is no change between v2 and v3.\nv3 just swaps the order of the 2 patches in v2, as suggested by Simon [3].\n\nReferences:\n[1] v1: https://lore.kernel.org/netdev/20260618035029.249361-1-decui@microsoft.com/\n[2] v2: https://lore.kernel.org/netdev/20260624222605.1794719-1-decui@microsoft.com/\n[3] https://lore.kernel.org/netdev/20260626145048.GB1310988@horms.kernel.org/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260702041237.617719-1-decui@microsoft.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "c72a0f09c57f92113df69f9b902d11c9e4b132f5",
      "tree": "c9e8da1ecae2640b4a8e55b82428d239ac99b0cc",
      "parents": [
        "2e2a83b4998af4384e677d3b2ac08565274279bf"
      ],
      "author": {
        "name": "Dexuan Cui",
        "email": "decui@microsoft.com",
        "time": "Wed Jul 01 21:12:37 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 10:36:14 2026 +0200"
      },
      "message": "net: mana: Sync page pool RX frags for CPU\n\nMANA allocates RX buffers from page pool fragments when frag_count is\ngreater than 1. In that case the buffers remain DMA mapped by page pool\nand the RX completion path does not call dma_unmap_single(). As a result,\nthe implicit sync-for-CPU normally performed by dma_unmap_single() is\nmissing before the packet data is passed to the networking stack.\n\nThis breaks RX on configurations which require explicit DMA syncing, for\nexample when booted with swiotlb\u003dforce.\n\nFix this by recording the page pool page and DMA sync offset when the RX\nbuffer is allocated, and syncing the received packet range for CPU access\nbefore handing the RX buffer to the stack.\n\nFixes: 730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.\")\nCc: stable@vger.kernel.org\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nSigned-off-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nLink: https://patch.msgid.link/20260702041237.617719-3-decui@microsoft.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "2e2a83b4998af4384e677d3b2ac08565274279bf",
      "tree": "98f5e6830f439007b53bdce4ee00bf02b8da7837",
      "parents": [
        "f4ef35efbb49527293309f668ea73ec5de9b8e7a"
      ],
      "author": {
        "name": "Dexuan Cui",
        "email": "decui@microsoft.com",
        "time": "Wed Jul 01 21:12:36 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 10:35:54 2026 +0200"
      },
      "message": "net: mana: Validate the packet length reported by the NIC\n\nValidate the packet length reported in the RX CQE before passing it\nto skb processing. The CQE is supplied by the NIC device and should\nnot be blindly trusted.\n\nCc: stable@vger.kernel.org\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nSigned-off-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nFixes: ca9c54d2d6a5 (\"net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)\")\nLink: https://patch.msgid.link/20260702041237.617719-2-decui@microsoft.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "f4ef35efbb49527293309f668ea73ec5de9b8e7a",
      "tree": "8de65ddd4d680d2c3e3d9ff97fe01e22d86dd696",
      "parents": [
        "6d27e29a90bc6a717b97c6ddcd866db7bd8e4adc"
      ],
      "author": {
        "name": "Wang Yan",
        "email": "wangyan01@kylinos.cn",
        "time": "Thu Jul 02 10:59:49 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jul 09 10:32:58 2026 +0200"
      },
      "message": "selftests/net: fix EVP_MD_CTX leak in tcp_mmap\n\nIn tcp_mmap.c, both child_thread() and main() allocate an EVP_MD_CTX\nvia EVP_MD_CTX_new() when integrity checking is enabled, but neither\nfunction releases the context.  child_thread() misses the free in its\ncommon cleanup block, and main() returns without freeing the context.\n\nThis results in a SHA256 context leak on every run that uses the\n‑i (integrity) option.  Add the missing EVP_MD_CTX_free() calls to\nthe appropriate cleanup paths to fix the leak.\n\nFixes: 5c5945dc695c (\"selftests/net: Add SHA256 computation over data sent in tcp_mmap\")\nSigned-off-by: Wang Yan \u003cwangyan01@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260702025949.442523-1-wangyan01@kylinos.cn\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "6bad2e38fe7f2da7dc982b2b80814e632832e568",
      "tree": "2bf52fc532555d59cdbbad66cd785628a06a1db4",
      "parents": [
        "0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53",
        "b6eb022890c78285f55381589c1536bd66b8eaeb"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Jul 08 08:43:44 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Jul 08 08:43:44 2026 -0700"
      },
      "message": "Merge tag \u0027hid-for-linus-2026070801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Jiri Kosina:\n\n - OOB, UAF, NULL-deref fixes in core and picolcd, logitech, letsketch,\n   appleir and multitouch drivers (Georgiy Osokin, HyeongJun An, Lee\n   Jones, Manish Khadka, Maoyi Xie and Trung Nguyen)\n\n - fix for integer wraparound (and corresponding regression selftest) in\n   hid-bpf (Yiyang Chen)\n\n* tag \u0027hid-for-linus-2026070801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:\n  selftests/hid: multitouch: test a large ContactCountMaximum\n  HID: multitouch: fix out-of-bounds bit access on mt_io_flags\n  selftests/hid: Cover hid_bpf_get_data() size overflow\n  selftests/hid: Load only requested struct_ops maps\n  HID: bpf: Fix hid_bpf_get_data() range check\n  HID: lg-g15: cancel pending work on remove to fix a use-after-free\n  HID: logitech-dj: Fix maxfield check in DJ short report validation\n  HID: core: Fix OOB read in hid_get_report for numbered reports\n  HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()\n  HID: appleir: fix UAF on pending key_up_timer in remove()\n  HID: letsketch: fix UAF on inrange_timer at driver unbind\n"
    },
    {
      "commit": "3f7a535ff0fa627a0132803e4c2f903ceffcbc1c",
      "tree": "f92b10488f2616de428daa344ee86d11ecfeef01",
      "parents": [
        "2f75c0faa3361b28e36cc0512b3299e163e25789"
      ],
      "author": {
        "name": "Julian Anastasov",
        "email": "ja@ssi.bg",
        "time": "Tue Jul 07 21:25:46 2026 +0300"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:44 2026 +0200"
      },
      "message": "ipvs: ensure inner headers in ICMP errors are in headroom\n\nSashiko points out that after stripping the outer headers\nwith pskb_pull() we should ensure the inner IP headers\nin ICMP errors from tunnels are present in the skb headroom\nfor functions like ipv4_update_pmtu(), icmp_send() and\nIP_VS_DBG().\n\nAlso, add more checks for the length of the inner headers.\n\nFixes: f2edb9f7706d (\"ipvs: implement passive PMTUD for IPIP packets\")\nLink: https://sashiko.dev/#/patchset/20260702073430.67680-1-zhaoyz24%40mails.tsinghua.edu.cn\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "2f75c0faa3361b28e36cc0512b3299e163e25789",
      "tree": "1f5638b06f23ecbdfc7ef67fb5d779bb97ddb586",
      "parents": [
        "2500fa3958b1ba51c2b065e39db1b04dfa7e23a2"
      ],
      "author": {
        "name": "Yizhou Zhao",
        "email": "zhaoyz24@mails.tsinghua.edu.cn",
        "time": "Mon Jul 06 18:16:24 2026 +0800"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:44 2026 +0200"
      },
      "message": "ipvs: use parsed transport offset in SCTP state lookup\n\nset_sctp_state() reads the SCTP chunk header again in order to drive the\nIPVS SCTP state table. For IPv6 it computes the offset with\nsizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from\nip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped\nextension headers and found the real transport header.\n\nThis makes the state machine read from the wrong offset for IPv6 SCTP\npackets that carry extension headers. For example, an INIT packet with an\n8-byte destination options header can be scheduled correctly by\nsctp_conn_schedule(), but set_sctp_state() reads the first byte of the\nSCTP verification tag as a DATA chunk type. The connection then moves\nfrom NONE to ESTABLISHED instead of INIT1, gets the longer established\ntimeout, and updates the active/inactive destination counters\nincorrectly. This happens even though the SCTP handshake has not\ncompleted.\n\nUse the parsed transport offset passed down from ip_vs_set_state() for\nthe SCTP chunk-header lookup. For IPv4 and IPv6 packets without\nextension headers this preserves the existing offset.\n\nFixes: 2906f66a5682 (\"ipvs: SCTP Trasport Loadbalancing Support\")\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/netdev/20260705123040.35755-1-zhaoyz24@mails.tsinghua.edu.cn/\nReported-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nReported-by: Yuxiang Yang \u003cyangyx22@mails.tsinghua.edu.cn\u003e\nReported-by: Ao Wang \u003cwangao@seu.edu.cn\u003e\nReported-by: Xuewei Feng \u003cfengxw06@126.com\u003e\nReported-by: Qi Li \u003cqli01@tsinghua.edu.cn\u003e\nReported-by: Ke Xu \u003cxuke@tsinghua.edu.cn\u003e\nAssisted-by: Claude Code:GLM-5.2\nSigned-off-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "2500fa3958b1ba51c2b065e39db1b04dfa7e23a2",
      "tree": "dd12b9e64bf0acf870421762001c827076e4bb5b",
      "parents": [
        "bae7ce7bafb59e42dc0e0e2999fdd9d1cffe3866"
      ],
      "author": {
        "name": "Yizhou Zhao",
        "email": "zhaoyz24@mails.tsinghua.edu.cn",
        "time": "Mon Jul 06 18:16:23 2026 +0800"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:44 2026 +0200"
      },
      "message": "ipvs: use parsed transport offset in TCP state lookup\n\nTCP state handling reparses the skb to find the TCP header. For IPv6 it\nuses sizeof(struct ipv6hdr), while the surrounding IPVS code already\nparsed the packet with ip_vs_fill_iph_skb() and has the real\ntransport-header offset in iph.len.\n\nThis makes TCP state handling look at the wrong bytes when an IPv6\npacket carries extension headers. Use the parsed transport offset passed\ndown from ip_vs_set_state() when reading the TCP header.\n\nFor IPv4 and for IPv6 packets without extension headers, the passed\noffset matches the previous value.\n\nFixes: 0bbdd42b7efa6 (\"IPVS: Extend protocol DNAT/SNAT and state handlers\")\nLink: https://lore.kernel.org/netdev/20260705125659.37744-1-zhaoyz24@mails.tsinghua.edu.cn/\nReported-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nReported-by: Yuxiang Yang \u003cyangyx22@mails.tsinghua.edu.cn\u003e\nReported-by: Ao Wang \u003cwangao@seu.edu.cn\u003e\nReported-by: Xuewei Feng \u003cfengxw06@126.com\u003e\nReported-by: Qi Li \u003cqli01@tsinghua.edu.cn\u003e\nReported-by: Ke Xu \u003cxuke@tsinghua.edu.cn\u003e\nAssisted-by: Claude Code:GLM-5.2\nSigned-off-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "bae7ce7bafb59e42dc0e0e2999fdd9d1cffe3866",
      "tree": "ea27349d925829b2a7ba6cf97a031aaa63aee3cc",
      "parents": [
        "da5b58478a9c1b85608c9e40a3b8432d071b409e"
      ],
      "author": {
        "name": "Yizhou Zhao",
        "email": "zhaoyz24@mails.tsinghua.edu.cn",
        "time": "Mon Jul 06 18:16:22 2026 +0800"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:44 2026 +0200"
      },
      "message": "ipvs: pass parsed transport offset to state handlers\n\nIPVS callers already parse the packet into struct ip_vs_iphdr before\nupdating connection state. For IPv6 this records the real\ntransport-header offset after extension headers in iph.len.\n\nPass this parsed transport offset through ip_vs_set_state() and the\nprotocol state_transition() callback so protocol handlers can use the\nsame packet context as scheduling and NAT handling. This patch only\nchanges the common callback plumbing and adapts the protocol callback\nsignatures; TCP and SCTP start using the value in follow-up patches.\n\nSigned-off-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "da5b58478a9c1b85608c9e40a3b8432d071b409e",
      "tree": "77db84123781dc90946186a49c8fe0e62a25d837",
      "parents": [
        "fa7395c02d95e51bad2952325d2d6503bfbad437"
      ],
      "author": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Sun Jul 05 15:29:13 2026 +0200"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:44 2026 +0200"
      },
      "message": "netfilter: handle unreadable frags\n\nsashiko reports:\n When an skb with unreadable fragments (such as from devmem TCP, where\n skb_frags_readable(skb) returns false) is processed by the u32 module,\n skb_copy_bits() will safely return a negative error code [..]\n\nxt_u32: bail out with hotdrop in this case.\ngather_frags: return -1, just as if we had no fragment header.\nnfnetlink_queue: restrict to the linear part.\nnfnetlink_log: restrict to the linear part.\n\nv2:\n - skb_zerocopy helpers don\u0027t copy readable flag, i.e. nfnetlink_queue\n is broken too\n xt_u32 shouldn\u0027t return true if hotdrop was set.\n\nFixes: 65249feb6b3d (\"net: add support for skbs with unreadable frags\")\nCc: stable@vger.kernel.org\nAcked-by: Mina Almasry \u003calmasrymina@google.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "fa7395c02d95e51bad2952325d2d6503bfbad437",
      "tree": "b9991a1a077ab9620f64275ac7cbc90d01bacc49",
      "parents": [
        "6c5dcab95f4cd42a1648739ec9300fbb4b1a021f"
      ],
      "author": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Tue Jun 30 11:40:56 2026 +0200"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:44 2026 +0200"
      },
      "message": "netfilter: flowtable: support IPIP tunnel with direct xmit\n\nThe combination of IPIP tunnel with direct xmit, eg. bridge device,\nbreaks because no dst_entry is provided to check the skb headroom and to\nset the iph-\u003efrag_off field. This leads to invalid dst usage and can\ntrigger a crash in the tunnel transmit path.\n\nFix this by moving dst_cache and dst_cookie out of the runtime union so\nthat they can be shared by neighbour, xfrm, and direct tunnel flows.\nFor FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve\nroute state in these shared fields and release it through the common\ndst release path.\n\nSince dst_entry is now available to the three supported xmit modes and\ndst_release() already deals with NULL dst, remove the xmit type check\nin nft_flow_dst_release(). Moreover, skip the check if the dst entry\nis NULL in nf_flow_dst_check() which is now the case for the direct\nxmit case.\n\nBased on patch from Rein Wei \u003cn05ec@lzu.edu.cn\u003e.\n\nFixes: d30301ba4b07 (\"netfilter: flowtable: Add IPIP tx sw acceleration\")\nCc: stable@vger.kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nReported-by: Zhengyang Chen \u003cchzhengyang2023@lzu.edu.cn\u003e\nReported-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "6c5dcab95f4cd42a1648739ec9300fbb4b1a021f",
      "tree": "eb029386c666eab831231c882a9fbb7775bd975c",
      "parents": [
        "c328b90c17fc5fa7786503695152880b2afb9326"
      ],
      "author": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Tue Jun 30 11:40:55 2026 +0200"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:44 2026 +0200"
      },
      "message": "netfilter: flowtable: IPIP tunnel hardware offload is not yet support\n\nNo driver supports for IPIP tunnels yet, give up early on setting up the\nhardware offload for this scenario.\n\nThis patch adds a stub that can be enhanced to add more configuration\nthat are currently not supported. As of now, the offload work is\nenqueued to the worker, then ignored if the hardware offload\nconfiguration is not supported.\n\nCheck the NF_FLOW_HW flag to know if this entry was already tried once\nto be offloaded so this is not retried on refresh when unsupported. Move\nNF_FLOW_HW flag check to nf_flow_offload_add(). If this NF_FLOW_HW flag\nis unset the _del and _stats variants are never called.\n\nThis can be updated later on to skip hardware offload work to be queued\nin case hardware offload does not support it.\n\nFixes: d98103575dcd (\"netfilter: flowtable: Add IP6IP6 rx sw acceleration\")\nFixes: ab427db17885 (\"netfilter: flowtable: Add IPIP rx sw acceleration\")\nCc: stable@vger.kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nReported-by: Zhengyang Chen \u003cchzhengyang2023@lzu.edu.cn\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "c328b90c17fc5fa7786503695152880b2afb9326",
      "tree": "84b653b7bc72349c5a0347deb37544f30611137c",
      "parents": [
        "724f32699aeabcbd294377904b40b456fd5c67eb"
      ],
      "author": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Tue Jun 30 11:40:54 2026 +0200"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:44 2026 +0200"
      },
      "message": "netfilter: flowtable: use dst in this direction when pushing IPIP header\n\nWhen pushing the IPIP header, the route of the other direction is used\nto calculate the headroom, use the route in this direction. Accessing\nthe other tuple to set the IP source and destination is fine because\nthis tuple does not provide such information to avoid storing redundant\ninformation. However, this tuple already provides the dst for this\ndirection, this went unnoticed because this bug affects headroom and\niph-\u003efrag_off only at this stage.\n\nFixes: d30301ba4b07 (\"netfilter: flowtable: Add IPIP tx sw acceleration\")\nFixes: 93cf357fa797 (\"netfilter: flowtable: Add IP6IP6 tx sw acceleration\")\nCc: stable@vger.kernel.org\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "724f32699aeabcbd294377904b40b456fd5c67eb",
      "tree": "d6cab8baf89cbe8fa2e43bcfd6051663433c8eb0",
      "parents": [
        "672321302ed682ccb903004f435bbdb353534a9c"
      ],
      "author": {
        "name": "Jozsef Kadlecsik",
        "email": "kadlec@netfilter.org",
        "time": "Thu Jul 02 15:47:00 2026 +0200"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:44 2026 +0200"
      },
      "message": "netfilter: ipset: allocate the proper memory for the generic hash structure\n\nBecause a single create function is emitted for every hash type,\nfrom the IPv4 and IPv6 generic hash structure definitions the last\none, i.e. the IPv6 was in effect for IPv4 too. Use the proper size\nwhen allocating the structure. Comment properly that because create()\nrefers to elements of the generic hash structure, all referred ones\nmust come before the IPv4/IPv6 dependent \u0027next\u0027 member.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "672321302ed682ccb903004f435bbdb353534a9c",
      "tree": "b457f5dc1d9ef2ad3ba94d3fe27a001b0e172efc",
      "parents": [
        "cffcf57bf03cb7f7e83d10f760b5f34e5c51d9b3"
      ],
      "author": {
        "name": "Jozsef Kadlecsik",
        "email": "kadlec@netfilter.org",
        "time": "Thu Jul 02 15:46:59 2026 +0200"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:43 2026 +0200"
      },
      "message": "netfilter: ipset: cleanup the add/del backlog when resize failed\n\nSashiko pointed out that the add/del backlog was not cleaned up\nwhen resize failed. Fix it in the corresponding error path. Also,\nmake sure that the add/del backlog is htable-specific so when\nresize creates a new htable, old/new backlog can\u0027t be mixed up.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "cffcf57bf03cb7f7e83d10f760b5f34e5c51d9b3",
      "tree": "713bd6ca2ef3c591327e8b7045ee79736142fff0",
      "parents": [
        "5d0c22e73656d050daffad10a2ba8765ce8441c8"
      ],
      "author": {
        "name": "Jozsef Kadlecsik",
        "email": "kadlec@netfilter.org",
        "time": "Thu Jul 02 15:46:58 2026 +0200"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:43 2026 +0200"
      },
      "message": "netfilter: ipset: exclude gc when resize is in progress\n\nZhengchuan Liang and Eulgyu Kim reported that because resize\ndoes not copy the comment extension into the resized set but\nuses it\u0027s pointer, ongoing gc can free the extension in the\noriginal set which then results stale pointer in the resized\none. The proposed patch was to recreate the extensions for\nevery element in the resized set. It is both expensive and\nwastes memory, so better exclude gc when resizing in progress\ndetected: resizing will destroy the original set anyway,\nso doing gc on it is unnecessary.\n\nIntroduce a new spinlock to exclude parallel gc and resize.\nBecause we just set and check a bool value, there\u0027s no need\nfor the parameter to be atomic_t and rename it for better\nreadability.\n\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nReported by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nReported by: Eulgyu Kim \u003ceulgyukim@snu.ac.kr\u003e\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "5d0c22e73656d050daffad10a2ba8765ce8441c8",
      "tree": "5da16b9fc28bfc0d62198bfcbd500902ea7380a5",
      "parents": [
        "e6107a4c74b54cb33e3bce162a63048ae5a6b198"
      ],
      "author": {
        "name": "Jozsef Kadlecsik",
        "email": "kadlec@netfilter.org",
        "time": "Thu Jul 02 15:46:57 2026 +0200"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:43 2026 +0200"
      },
      "message": "netfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there\u0027s no need to keep\nthe rcu lock because the referred hash table can\u0027t\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "e6107a4c74b54cb33e3bce162a63048ae5a6b198",
      "tree": "7eb26e84bfb0137112bcfc8fc943d82d1246c37d",
      "parents": [
        "084d23f818321390509e9738a0b08bbf46df6425"
      ],
      "author": {
        "name": "Tamaki Yanagawa",
        "email": "ty@000ty.net",
        "time": "Fri Jul 03 16:22:57 2026 +0000"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:33:37 2026 +0200"
      },
      "message": "netfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv-\u003einvert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!\u003d @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval().\n\nFixes: aaa31047a6d2 (\"netfilter: nftables: add catch-all set element support\")\nSigned-off-by: Tamaki Yanagawa \u003cty@000ty.net\u003e\nAssisted-by: Claude:claude-sonnet-5\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "084d23f818321390509e9738a0b08bbf46df6425",
      "tree": "c2d58d5ef76495f2e67502c78a7af3c1f21365f3",
      "parents": [
        "cbfe53599eebffd188938ab6774cc41794f6f9d5"
      ],
      "author": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Sat Jul 04 12:05:15 2026 +0200"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:22:03 2026 +0200"
      },
      "message": "netfilter: ebtables: module names must be null-terminated\n\nWe need to explicitly check the length, else we may pass non-null\nterminated string to request_module().\n\nCc: stable@vger.kernel.org\nFixes: bcf493428840 (\"netfilter: ebtables: Fix extension lookup with identical name\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "cbfe53599eebffd188938ab6774cc41794f6f9d5",
      "tree": "1f4b8f3420ee8f703a2d8420599a26ad5663624d",
      "parents": [
        "a622d2e9608c9dff47fc2e5759ac7aa3a836b45d"
      ],
      "author": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Sat Jul 04 10:23:31 2026 +0200"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:22:03 2026 +0200"
      },
      "message": "netfilter: ebtables: zero chainstack array\n\nsashiko reports:\n looking at ebtables table\n translation, could a sparse cpu_possible_mask lead to an uninitialized pointer\n free?\n\n If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,\n but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at\n CPU 2, the cleanup loop will blindly decrement and call vfree() on\n newinfo-\u003echainstack[1].\n\nNot a real-world bug, such allocation isn\u0027t expected to fail\nin the first place.\n\nCc: stable@vger.kernel.org\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "a622d2e9608c9dff47fc2e5759ac7aa3a836b45d",
      "tree": "63725cf9f74fdd7fe611c12dfe6854b2b2b8574a",
      "parents": [
        "3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9"
      ],
      "author": {
        "name": "Xiang Mei",
        "email": "xmei5@asu.edu",
        "time": "Sun Jul 05 14:58:00 2026 -0700"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:22:03 2026 +0200"
      },
      "message": "netfilter: ebtables: terminate table name before find_table_lock()\n\nupdate_counters() and compat_update_counters() forward a user-supplied\n32-byte table name to find_table_lock() without NUL-terminating it. On a\nlookup miss, find_inlist_lock() calls try_then_request_module(..., \"%s%s\",\n\"ebtable_\", name), and vsnprintf() reads past the name field and the\nstack object until it hits a zero byte.\n\n  BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n  Read of size 1 at addr ffff8880119dfb20 by task exploit/147\n  Call Trace:\n  ...\n   string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n   vsnprintf (lib/vsprintf.c:2945)\n   __request_module (kernel/module/kmod.c:150)\n   do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)\n   update_counters (net/bridge/netfilter/ebtables.c:1440)\n   do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)\n   nf_setsockopt (net/netfilter/nf_sockopt.c:101)\n   ip_setsockopt (net/ipv4/ip_sockglue.c:1424)\n   raw_setsockopt (net/ipv4/raw.c:847)\n   __sys_setsockopt (net/socket.c:2393)\n  ...\n\ncompat_do_replace() shares the same unterminated name via\ncompat_copy_ebt_replace_from_user(); terminate it there too so all\nfind_table_lock() callers behave alike. The other callers already\nterminate the name after the copy.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nFixes: 81e675c227ec (\"netfilter: ebtables: add CONFIG_COMPAT support\")\nCc: stable@vger.kernel.org\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9",
      "tree": "f206d5080cbce8fa09322d9ab39ee0f3d300a13e",
      "parents": [
        "6d27e29a90bc6a717b97c6ddcd866db7bd8e4adc"
      ],
      "author": {
        "name": "Xiang Mei",
        "email": "xmei5@asu.edu",
        "time": "Sun Jul 05 16:36:29 2026 -0700"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Wed Jul 08 15:22:03 2026 +0200"
      },
      "message": "netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag\n\nnf_ct_frag6_reasm() slides the packet head forward to drop the IPv6\nfragment header and then unconditionally advances skb-\u003emac_header:\n\n\tskb-\u003emac_header +\u003d sizeof(struct frag_hdr);\n\nOn the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header\nyet, so skb-\u003emac_header is still the \"not set\" sentinel (u16)~0U. Adding\nsizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 \u003d\u003d 7),\nafter which skb_mac_header_was_set() wrongly reports a MAC header is\npresent and skb_mac_header() points into the headroom.\n\nThe reassembler has done this unconditional add since it was introduced;\nit was harmless while mac_header was a bare pointer, but wrong once\nmac_header became a u16 offset whose unset state is the ~0U sentinel\ntested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c\ndoes the same relocation and does guard the adjustment; mirror the\nguard here.\n\nFixes: 9fb9cbb1082d (\"[NETFILTER]: Add nf_conntrack subsystem.\")\nCc: stable@vger.kernel.org\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "6d27e29a90bc6a717b97c6ddcd866db7bd8e4adc",
      "tree": "7a4c1b196df327b7a7320515fb7e6afa3f8aeb1d",
      "parents": [
        "235acadd310533ba386ae61ad155b72bee381559",
        "3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 14:41:04 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 14:41:04 2026 +0200"
      },
      "message": "Merge branch \u0027ipv4-ipv6-fix-uaf-and-memory-leak-in-igmp-mld\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nipv4/ipv6: Fix UAF and memory leak in IGMP/MLD\n\nThis series addresses two potential UAF vulnerabilities\nand memory leaks in the IPv4 IGMP and IPv6 MLD subsystems.\n\nThe first two patches fix a UAF where the packet receive path races with\ndevice teardown. If the device refcount has already hit 0 (but the memory\nis still held by RCU), incoming IGMP/MLD packets trying to schedule delayed\nwork or timers would call refcount_inc() on the 0 refcount, triggering a\nwarning and eventually leading to a UAF when the work runs after the device\nhas been freed. This is fixed by introducing safe hold helpers using\nrefcount_inc_not_zero(). In MLD, we also ensure we only enqueue the skb\nif we successfully acquired the device reference, to avoid leaking skbs\nwhen the device is being destroyed.\n\nThe third patch fixes memory leaks in IPv4 IGMP when timers are deleted or\nstopped. When a timer is deleted (in igmp_mod_timer) or stopped (in\nigmp_stop_timer) and not re-armed, the code dropped the group refcount using\nrefcount_dec(). However, if the group was concurrently removed from the list,\nthis decrement could drop the refcount to 0 without triggering the\ncleanup/free path, leaking the group structure. This is fixed by using\nip_ma_put() instead, and deferring the put until after the lock is released.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260705181756.963063-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36",
      "tree": "7a4c1b196df327b7a7320515fb7e6afa3f8aeb1d",
      "parents": [
        "9b26518b6896a16b809b1e42986f4ebac7bccc1e"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Sun Jul 05 18:17:56 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 14:41:01 2026 +0200"
      },
      "message": "ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()\n\nWhen a timer is deleted and not re-armed in igmp_mod_timer(), or stopped\nin igmp_stop_timer(), the code currently decrements the reference counter\nof the multicast list entry @im using refcount_dec(\u0026im-\u003erefcnt).\n\nHowever, both functions can be called from the RCU reader path:\n- igmp_mod_timer() via igmp_heard_query() -\u003e for_each_pmc_rcu()\n- igmp_stop_timer() via igmp_rcv() -\u003e igmp_heard_report()\n\nIf the group im was concurrently removed from the list by ip_mc_dec_group(),\nits reference count might have already been decremented to 1.\n\nIn this case, timer_delete() succeeds, and refcount_dec() decrements\nthe refcount from 1 to 0. Since refcount_dec() does not free the object\nwhen it hits 0 (unlike ip_ma_put()), the im structure is leaked.\n\nFix this by using ip_ma_put(im) instead of refcount_dec(\u0026im-\u003erefcnt),\nand deferring the put until after the spinlock is released.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260705181756.963063-4-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "9b26518b6896a16b809b1e42986f4ebac7bccc1e",
      "tree": "fa4c8586487e9d668c7e58bc960a0b0edf063a5d",
      "parents": [
        "7b19c0f81ed1fdaec6bc522569be367199a9edf3"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Sun Jul 05 18:17:55 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 14:41:01 2026 +0200"
      },
      "message": "ipv6: mcast: Fix potential UAF in MLD delayed work\n\nA race condition exists between device teardown and incoming MLD query\nprocessing, leading to a Use-After-Free in the MLD delayed work.\n\nDuring device destruction, the primary reference to inet6_dev is dropped,\nwhich can drop its refcount to 0. The actual freeing of inet6_dev memory\nis deferred via RCU.\n\nConcurrently, the packet receive path runs under RCU read lock and obtains\nthe inet6_dev pointer. Because the memory is RCU-protected, CPU-0 can\nsafely dereference inet6_dev even if its refcount has hit 0.\n\nHowever, if CPU-0 calls igmp6_event_query() and schedules delayed work, it\nattempts to acquire a reference using in6_dev_hold(). This increments the\nrefcount from 0 to 1, triggering a \"refcount_t: addition on 0\" warning.\nSince the inet6_dev memory is still scheduled to be freed after the RCU\ngrace period, the device is freed while the work is still scheduled.\nWhen the work runs, it accesses the freed memory, causing a kernel panic.\n\nFix this by using refcount_inc_not_zero() (via a new helper\nin6_dev_hold_safe()) to prevent acquiring a reference if the device is\nalready being destroyed. If the refcount is 0, we do not schedule the work.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260705181756.963063-3-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "7b19c0f81ed1fdaec6bc522569be367199a9edf3",
      "tree": "254a8473aa09bd79729908ed1f527027a6c8c5d2",
      "parents": [
        "235acadd310533ba386ae61ad155b72bee381559"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Sun Jul 05 18:17:54 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 14:41:01 2026 +0200"
      },
      "message": "ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()\n\nA race condition exists between device teardown (inetdev_destroy) and\nincoming IGMP query processing (igmp_rcv), leading to a Use-After-Free\nin the IGMP timer callback.\n\nDuring device destruction, inetdev_destroy() drops the primary reference\nto in_device, which can drop its refcount to 0. The actual freeing of\nin_device memory is deferred via RCU (using call_rcu()).\n\nConcurrently, igmp_rcv() runs under RCU read lock and obtains the\nin_device pointer. Because the memory is RCU-protected, CPU-0 can safely\ndereference in_device even if its refcount has hit 0.\n\nHowever, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it\nattempts to acquire a reference using in_dev_hold(). This increments the\nrefcount from 0 to 1, triggering a \"refcount_t: addition on 0\" warning.\nSince the in_device memory is still scheduled to be freed after the RCU\ngrace period (as the free callback does not check the refcount again),\nthe device is freed while the timer is still armed. When the timer\nexpires, it accesses the freed memory, causing a kernel panic.\n\nFix this by using refcount_inc_not_zero() (via a new helper\nin_dev_hold_safe()) to prevent acquiring a reference if the device is\nalready being destroyed. If the refcount is 0, we do not arm the timer.\n\nA similar issue in IPv6 MLD is fixed in a subsequent patch.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Zero Day Initiative \u003czdi-disclosures@trendmicro.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260705181756.963063-2-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "08030ddb87b4c6c6a2c03c82731b5e188f02f5b9",
      "tree": "edead07d3c376d77e2a4e1337e755b8bd87a5a88",
      "parents": [
        "155c68aef2397f8c5d72ef10acf48ae159bf1869",
        "acb138b8235c63564aa1bcd2666fdc9707e2f1e0"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 14:30:45 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 14:32:05 2026 +0200"
      },
      "message": "Merge branch \u00271GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-07-01 (igc, igb)\n\nKohei Enju adds ethtool support for get/set hash key on igc and adds\nsetting of skb hash type based on values from Rx descriptor on igb.\n\nTakashi Kozu adds ethtool support for get/set hash key on igb.\n\nFaizal adds support for forcing link speed via ethtool when\nautonegotiation is disabled on the igc driver.\n\n* \u00271GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue:\n  igc: add support for forcing link speed without autonegotiation\n  igc: replace goto out with direct returns in igc_config_fc_after_link_up()\n  igc: move autoneg-enabled settings into igc_handle_autoneg_enabled()\n  igc: remove unused autoneg_failed field\n  igb: set skb hash type from RSS_TYPE\n  igb: allow configuring RSS key via ethtool set_rxfh\n  igb: expose RSS key via ethtool get_rxfh\n  igb: prepare for RSS key get/set support\n  igc: allow configuring RSS key via ethtool set_rxfh\n  igc: expose RSS key via ethtool get_rxfh\n  igc: prepare for RSS key get/set support\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260701210303.1745310-1-anthony.l.nguyen@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "155c68aef2397f8c5d72ef10acf48ae159bf1869",
      "tree": "91b145df24eb5b43abc804989e46935759c30539",
      "parents": [
        "2f1671d45247d7973f9b51b3ed8dbdab8c3ee7f7"
      ],
      "author": {
        "name": "Jiri Slaby (SUSE)",
        "email": "jirislaby@kernel.org",
        "time": "Thu Jul 02 08:04:20 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 13:16:55 2026 +0200"
      },
      "message": "ppp/ppp_{async,synctty}: drop unused {a,}syncppp::bytes_{sent,rcvd}\n\nThe bytes_sent and bytes_rcvd members of structs asyncppp and syncppp\nare not used. Drop them.\n\nSigned-off-by: Jiri Slaby (SUSE) \u003cjirislaby@kernel.org\u003e\nCc: Andrew Lunn \u003candrew+netdev@lunn.ch\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Jakub Kicinski \u003ckuba@kernel.org\u003e\nCc: Paolo Abeni \u003cpabeni@redhat.com\u003e\nLink: https://patch.msgid.link/20260702060420.95023-1-jirislaby@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "2f1671d45247d7973f9b51b3ed8dbdab8c3ee7f7",
      "tree": "d32b1bae6daba34998d544827916224140a85216",
      "parents": [
        "bcd2e8b40ef955038d9af137d3ebeb0de786d835",
        "47467501cb88d65f5f3b6eee1cf0b6704b6c43e1"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 12:34:35 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 12:34:36 2026 +0200"
      },
      "message": "Merge branch \u0027selftests-drv-net-run-xdp-tests-with-both-ip-versions\u0027\n\nNimrod Oren says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nselftests: drv-net: run XDP tests with both IP versions\n\nThe driver selftest environment picks a single address family for tests\nwhich use the generic address fields. When both IPv4 and IPv6 are\navailable it prefers IPv6, which can leave IPv4 paths untested and hide\nIPv4-only bugs.\n\nThis happened recently in the XDP selftest, where an IPv4 checksum bug\nwas missed when IPv6 was also configured. XDP traffic handling has\nIP-version-specific code paths, and the follow-up discussion concluded\nthat the XDP tests should run against both IP versions [1].\n\nThis series changes NetDrvEpEnv from exposing only the initially selected\naddress family to allowing tests to switch the generic address fields\nbetween IP versions. xdp.py uses this to run the XDP traffic cases over\nboth IPv4 and IPv6. Test variants whose required IP version is not\nconfigured are skipped.\n\n[1] https://lore.kernel.org/20260518143138.74839bf9@kernel.org/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260702062348.2123960-1-noren@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "47467501cb88d65f5f3b6eee1cf0b6704b6c43e1",
      "tree": "d32b1bae6daba34998d544827916224140a85216",
      "parents": [
        "432f4bab1adaaa7d572bc61216aeebb04aec27a4"
      ],
      "author": {
        "name": "Nimrod Oren",
        "email": "noren@nvidia.com",
        "time": "Thu Jul 02 09:23:48 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 12:34:23 2026 +0200"
      },
      "message": "selftests: drv-net: xdp: run with both IP versions\n\nParameterize test cases by IP version using @ksft_variants. Set the\nenvironment\u0027s IP version at the start of each case using a new local\nhelper, which also handles restoring the original value via defer().\n\nThe last case is left unparameterized because it does not send traffic\nor exercise IP-version-specific code.\n\nWhile here, fix an int vs str comparison bug `if cfg.addr_ipver \u003d\u003d 4`.\n\nSuggested-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Carolina Jubran \u003ccjubran@nvidia.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nSigned-off-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nLink: https://patch.msgid.link/20260702062348.2123960-3-noren@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "432f4bab1adaaa7d572bc61216aeebb04aec27a4",
      "tree": "7f13de1bca16eb73610b4ffad54039442351155f",
      "parents": [
        "bcd2e8b40ef955038d9af137d3ebeb0de786d835"
      ],
      "author": {
        "name": "Nimrod Oren",
        "email": "noren@nvidia.com",
        "time": "Thu Jul 02 09:23:47 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 12:34:23 2026 +0200"
      },
      "message": "selftests: drv-net: allow switching env IP version\n\nNetDrvEpEnv picks a single IP version at init time, preferring IPv6 when\nboth are configured.\n\nAdd NetDrvEpEnv.set_ipver() to reselect the IP version and recompute the\nderived address fields.\n\nReviewed-by: Carolina Jubran \u003ccjubran@nvidia.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nSigned-off-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nLink: https://patch.msgid.link/20260702062348.2123960-2-noren@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "235acadd310533ba386ae61ad155b72bee381559",
      "tree": "ffc3ca11b558ed1630e6f1208309b511a5c8c3c8",
      "parents": [
        "b7f97cae7ec1b6c3c32843c42be218690d310467"
      ],
      "author": {
        "name": "Suman Ghosh",
        "email": "sumang@marvell.com",
        "time": "Thu Jul 02 09:04:51 2026 +0530"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 12:01:13 2026 +0200"
      },
      "message": "octeontx2-pf: check DMAC extraction support before filtering\n\nCurrently, configuring a VF MAC address via the PF (e.g., \u0027ip link\nset \u003cpf\u003e vf 0 mac \u003cmac\u003e\u0027) blindly attempts to install a DMAC-based\nhardware filter. However, the hardware parser profile might not\nsupport DMAC extraction.\n\nCheck if the hardware parsing profile supports DMAC extraction\nbefore adding the filter. Additionally, emit a warning message\nto inform the operator if the MAC filter installation fails due\nto missing DMAC extraction support. Update config-\u003emac only\nafter hardware programming succeeds in otx2_set_vf_mac().\n\nFixes: f0c2982aaf98 (\"octeontx2-pf: Add support for SR-IOV management functions\")\nSigned-off-by: Suman Ghosh \u003csumang@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260702033451.2969880-1-nshettyj@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "b7f97cae7ec1b6c3c32843c42be218690d310467",
      "tree": "5350e2160fa6de99543e1bb73f1451635b4665bc",
      "parents": [
        "5258b4fdae44cf5ac9b7c6fd71c9e0394a9fad5e"
      ],
      "author": {
        "name": "Samuel Moelius",
        "email": "sam.moelius@trailofbits.com",
        "time": "Thu Jul 02 00:07:59 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:42:21 2026 +0200"
      },
      "message": "net/sched: cake: reject overhead values that underflow length\n\nCAKE accepts signed overhead values and stores them in an s16, but the\nadjusted packet length calculation uses unsigned arithmetic.  A negative\neffective length can therefore wrap to a large value.\n\nSuch configurations make rate accounting depend on integer wraparound\nrather than on the packet size userspace intended to model.  A static\nnetlink lower bound is not enough because packets reaching CAKE can be\nsmaller than any reasonable manual-overhead allowance.\n\nFold the signed overhead adjustment into the existing datapath MPU clamp\nso negative adjusted lengths are clamped before link-layer framing\nadjustments.\n\nFixes: a729b7f0bd5b (\"sch_cake: Add overhead compensation support to the rate shaper\")\nAssisted-by: Codex:gpt-5.5-cyber-preview\nSigned-off-by: Samuel Moelius \u003csam.moelius@trailofbits.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260702000758.297407.e5c888d9d99d.cake-overhead-underflow@trailofbits.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "bcd2e8b40ef955038d9af137d3ebeb0de786d835",
      "tree": "86e19c3050f3f843bd4f76a20b86b411bb04537d",
      "parents": [
        "a6cfd2762eb18cde4eb34906599ffa7b07c2ed60",
        "a49ea2e042af96a7f028ef0972f03589df134eba"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:23:50 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:23:51 2026 +0200"
      },
      "message": "Merge branch \u0027devlink-extend-phys_port_name-controller-prefix-to-non-external-ports\u0027\n\nTariq Toukan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ndevlink: extend phys_port_name controller prefix to non-external ports\n\nThis series by Moshe includes the controller number in phys_port_name\nfor non-external ports with a non-zero controller, and updates the mlx5\ndriver to mark satellite PFs as non-external.\n\nThe controller prefix (c) in phys_port_name was previously only included\nfor ports marked as external. However, newer devices can have multiple\ncontrollers within the DPU itself, even within a single host\nenvironment. For example, a SmartNIC may have additional local PCI\nphysical functions that are managed by the eswitch but are not on an\nexternal host. These ports use a non-zero controller number to\ndistinguish them from the eswitch manager\u0027s own functions, while the\nexternal flag remains unset.\n\nPatch 1 updates the devlink core to include the controller prefix in\nphys_port_name for any non-zero controller, regardless of the external\nflag. Documentation and kdoc are updated accordingly.\n\nPatch 2 updates the mlx5 driver to set satellite PF devlink ports as\nnon-external, since they are local to the DPU. It also distinguishes\nsatellite PF SFs from host PF SFs when setting the external attribute.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260702111726.816985-1-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "a49ea2e042af96a7f028ef0972f03589df134eba",
      "tree": "86e19c3050f3f843bd4f76a20b86b411bb04537d",
      "parents": [
        "f6ec46b7e2b227499200fb071752ea653f145f3d"
      ],
      "author": {
        "name": "Moshe Shemesh",
        "email": "moshe@nvidia.com",
        "time": "Thu Jul 02 14:17:26 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:23:49 2026 +0200"
      },
      "message": "net/mlx5: Set satellite PF devlink ports as non-external\n\nSatellite PFs are local to the DPU and are not on an external host.\nSet their devlink port external attribute to false to reflect this.\n\nFor satellite PF SFs, distinguish them from host PF SFs by comparing\nthe SF controller number against the host PF controller\n(hpf_host_number + 1). Only SFs whose controller matches the host PF\nare marked external, since their PF resides on an external host.\n\nSigned-off-by: Moshe Shemesh \u003cmoshe@nvidia.com\u003e\nReviewed-by: Parav Pandit \u003cparav@nvidia.com\u003e\nReviewed-by: Shay Drori \u003cshayd@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260702111726.816985-3-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "f6ec46b7e2b227499200fb071752ea653f145f3d",
      "tree": "1f475238b9cd5b06bb774993c153f3d1f4e96104",
      "parents": [
        "a6cfd2762eb18cde4eb34906599ffa7b07c2ed60"
      ],
      "author": {
        "name": "Moshe Shemesh",
        "email": "moshe@nvidia.com",
        "time": "Thu Jul 02 14:17:25 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:23:49 2026 +0200"
      },
      "message": "devlink: print controller prefix for non-zero controller\n\nThe controller prefix (c\u003cN\u003e) in phys_port_name is currently restricted\nto external host controllers. This layout sufficed when DPUs only had a\nsingle local controller and one or more external host controllers.\n\nHowever, newer devices can have multiple controllers within the DPU\nitself, even within a single host environment. To support these\ntopologies, allow drivers to report the controller number regardless of\nthe \"external\" flag status. Any non-zero controller number will now be\nexplicitly reported, even for single-host or local DPU controllers.\nExisting ports with controller\u003d0 are unaffected.\n\nUpdate documentation and kdoc to clarify that a non-zero controller\nnumber does not require the external flag to be set.\n\nSigned-off-by: Moshe Shemesh \u003cmoshe@nvidia.com\u003e\nReviewed-by: Parav Pandit \u003cparav@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260702111726.816985-2-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "5258b4fdae44cf5ac9b7c6fd71c9e0394a9fad5e",
      "tree": "b2a6859feb61e584a5129638ccbf1348bb5cd0c8",
      "parents": [
        "1a3267a8c9ecabb8e27f5cbda6d19295d5e41beb",
        "6e1930ece855a4c256f1c7e6632d634cfb9888b5"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:10:21 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:10:21 2026 +0200"
      },
      "message": "Merge tag \u0027for-net-2026-07-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\n - hci_conn: Fix null ptr deref in hci_abort_conn()\n - af_bluetooth: fix UAF in bt_accept_dequeue()\n - L2CAP: validate option length before reading conf opt value\n - L2CAP: cancel pending_rx_work before taking conn-\u003elock\n - L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n - L2CAP: fix tx ident leak for commands without a response\n - SCO: Fix a race condition in sco_sock_timeout()\n - ISO: avoid NULL deref of conn in iso_conn_big_sync()\n - ISO: fix malformed ISO_END/CONT handling\n - ISO: exclude RFU bits from ISO_SDU_Length\n - MGMT: Fix adv monitor add failure cleanup\n - MGMT: Fix UAF of hci_conn_params in add_device_complete\n - bnep: pin L2CAP connection during netdev registration\n - 6lowpan: avoid untracked enable work\n - 6lowpan: hold L2CAP conn across debugfs control\n - 6lowpan: Fix using chan-\u003econn as indication to no remote netdev\n - btintel_pcie: Refactor FLR to use device_reprobe()\n - btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()\n - hci_uart: clear HCI_UART_SENDING when write_work is canceled\n - bpa10x: avoid OOB read of revision string in bpa10x_setup()\n\n* tag \u0027for-net-2026-07-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n  Bluetooth: L2CAP: fix tx ident leak for commands without a response\n  Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()\n  Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length\n  Bluetooth: ISO: fix malformed ISO_END/CONT handling\n  Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()\n  Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n  Bluetooth: fix UAF in bt_accept_dequeue()\n  Bluetooth: bnep: pin L2CAP connection during netdev registration\n  Bluetooth: sco: Fix a race condition in sco_sock_timeout()\n  Bluetooth: MGMT: Fix adv monitor add failure cleanup\n  Bluetooth: 6lowpan: hold L2CAP conn across debugfs control\n  Bluetooth: 6lowpan: avoid untracked enable work\n  Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()\n  Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()\n  Bluetooth: L2CAP: validate option length before reading conf opt value\n  Bluetooth: L2CAP: cancel pending_rx_work before taking conn-\u003elock\n  Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()\n  Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete\n  Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev\n  Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260706145229.728127-1-luiz.dentz@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "a6cfd2762eb18cde4eb34906599ffa7b07c2ed60",
      "tree": "87a3b4d5d3a0d2bf5fd7f84830196ac9e5b881ae",
      "parents": [
        "06f42c77a95502df125adbf46ce2a2dbf3573ccd",
        "90c676dd4bb61e63a5e27522d32799b5667021ad"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:53 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:54 2026 +0200"
      },
      "message": "Merge branch \u0027net-dsa-microchip-move-non-common-function-out-of-ksz_common-c\u0027\n\nBastien Curutchet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: dsa: microchip: move non-common function out of ksz_common.c\n\nThis series continues the rework of the KSZ driver initiated by three\nprevious series (see [1], [2] \u0026 [3]).\n\nThe KSZ driver handles more than 20 switches split in several families.\nThis was previously handled through a common set of dsa_switch_ops\noperations that used device-specific ksz_dev_ops callbacks. The three\nprevious series have split this common struct dsa_switch_ops into 5\nto connect the ksz_dev_ops\u0027s implentations directly to the new\ndsa_swicth ops.\n\nThis series continues in the same vein and moves out of ksz_common.c all\nthe functions that aren\u0027t truly common to all the families.\n\nOn top of this on-going rework I added PTP and periodic output support for\nthe KSZ8463 (which was my first goal). There are still more than 13 patches\nleft for all this so this series will be followed by two others and if you\nwant to see the full picture we can check my github ([4]).\n\nFYI, I only have a KSZ8463 so, unfortunately, I can\u0027t test other switches.\n\nThe next series is going to add PTP support for the KSZ8463. The final one\nwill add periodic output support for the KSZ8463.\n\n[1]: https://lore.kernel.org/r/20260505-clean-ksz-driver-v1-0-05d70fa42461@bootlin.com\n[2]: https://lore.kernel.org/r/20260521-clean-ksz-2nd-series-v3-0-75c38971c19a@bootlin.com\n[3]: https://lore.kernel.org/r/20260608-clean-ksz-3rd-v2-0-6e61b7be23c4@bootlin.com\n[4]: https://github.com/bastien-curutchet/linux/tree/ksz_rework\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260702-clean-ksz-4th-v1-0-93441e695fa4@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "90c676dd4bb61e63a5e27522d32799b5667021ad",
      "tree": "87a3b4d5d3a0d2bf5fd7f84830196ac9e5b881ae",
      "parents": [
        "da466bf62b01fdbbe4d2abeacec654a6e42b9e36"
      ],
      "author": {
        "name": "Bastien Curutchet (Schneider Electric)",
        "email": "bastien.curutchet@bootlin.com",
        "time": "Thu Jul 02 11:07:32 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:52 2026 +0200"
      },
      "message": "net: dsa: microchip: move the drive strength config out of the common section\n\nThe drive strength configuration is done during the setup of all\nswitches through a common function that then has specific behavior\ndepending on the switch identity.\n\nSplit the common configuration in two functions: one is dedicated to the\nKSZ8 family, the other is dedicated to the KSZ9477 family.\nRemove the drive strength configuration from the lan937x_setup since\nthe LAN937x family doesn\u0027t support it.\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-clean-ksz-4th-v1-10-93441e695fa4@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "da466bf62b01fdbbe4d2abeacec654a6e42b9e36",
      "tree": "eea67b1484918160523bd1212b0d271fc85915d7",
      "parents": [
        "e8de229a62ec3d004fb72246f77085f0d15c9068"
      ],
      "author": {
        "name": "Bastien Curutchet (Schneider Electric)",
        "email": "bastien.curutchet@bootlin.com",
        "time": "Thu Jul 02 11:07:31 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:51 2026 +0200"
      },
      "message": "net: dsa: microchip: rename ksz9477_drive_strength_write()\n\nksz9477_drive_strength_write() isn\u0027t used for the KSZ9477-family only.\nIt\u0027s also used for the KSZ87xx chip variants. This function name is\nmisleading.\n\nRename it ksz_drive_strength_write().\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-clean-ksz-4th-v1-9-93441e695fa4@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "e8de229a62ec3d004fb72246f77085f0d15c9068",
      "tree": "6f788f743760b2796c8c07ea8d561be2e84f84a2",
      "parents": [
        "610106257cd7cd1ba7dc014796f515a7bd3a480f"
      ],
      "author": {
        "name": "Bastien Curutchet (Schneider Electric)",
        "email": "bastien.curutchet@bootlin.com",
        "time": "Thu Jul 02 11:07:30 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:51 2026 +0200"
      },
      "message": "net: dsa: microchip: move ksz9477_set_default_prio_queue_mapping() to ksz9477.c\n\nksz9477_set_default_prio_queue_mapping() dictates a KSZ9477-specific\nbehavior but is defined in the common section of the code.\n\nMove its definition to the KSZ9477-specific area.\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-clean-ksz-4th-v1-8-93441e695fa4@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "610106257cd7cd1ba7dc014796f515a7bd3a480f",
      "tree": "1d23c4d0212b523b0c81e9ddda5fa0fe097d5a8b",
      "parents": [
        "ab4b571d44fbc849de7a7f57c232ff074c323704"
      ],
      "author": {
        "name": "Bastien Curutchet (Schneider Electric)",
        "email": "bastien.curutchet@bootlin.com",
        "time": "Thu Jul 02 11:07:29 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:51 2026 +0200"
      },
      "message": "net: dsa: microchip: handle KSZ8-specific tc setup in ksz8.c\n\nThe setup of QDISC_ETS isn\u0027t the same for the KSZ8 switches than for\nthe other switches. It leads to is_ksz8() branches in the common code.\n\nMove the KSZ8-specific portions into ksz8.c by creating two setup_tc()\nfunctions, one dedicated to the KSZ87xx family that only handles the\nTC_SETUP_QDISC_CBS case, one for the rest of the KSZ8 that handles both\nTC_SETUP_QDISC_CBS and TC_SETUP_QDISC_ETS cases.\nIt remains some is_kszXXXX() branches because inside the ksz88xx family,\nonly the ksz88x3 switches support QDISC_ETS.\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-clean-ksz-4th-v1-7-93441e695fa4@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "ab4b571d44fbc849de7a7f57c232ff074c323704",
      "tree": "f839c2f8b97b3b00fe4184f71dfc721265a5e686",
      "parents": [
        "7a83196e901258764aa53b52ee4d90b4b1d905be"
      ],
      "author": {
        "name": "Bastien Curutchet (Schneider Electric)",
        "email": "bastien.curutchet@bootlin.com",
        "time": "Thu Jul 02 11:07:28 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:51 2026 +0200"
      },
      "message": "net: dsa: microchip: move KSZ9477 errata handling to ksz9477.c\n\nThe KSZ9477 PHY errata is handled from the common ksz_r_mib_stat64().\nThis errata clearly belongs to the KSZ9477 family so it should be handled\nfrom the ksz9477-specific portion of the driver.\n\nCreate a ksz9477-specific r_mib_stat64() implementation that handles\nthis errata.\nRemove the errata handling from the common ksz_r_mib_stat64().\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-clean-ksz-4th-v1-6-93441e695fa4@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "7a83196e901258764aa53b52ee4d90b4b1d905be",
      "tree": "779929364fc756be2624315eeabe9e5a50d832eb",
      "parents": [
        "a7e806f11f37cc4d6a85cdbba568ed8d911be86f"
      ],
      "author": {
        "name": "Bastien Curutchet (Schneider Electric)",
        "email": "bastien.curutchet@bootlin.com",
        "time": "Thu Jul 02 11:07:27 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:51 2026 +0200"
      },
      "message": "net: dsa: microchip: move ksz_get_gbit() and ksz_get_xmii() to ksz9477.c\n\nksz_get_gbit() and ksz_get_xmii() are defined in the ksz_common while\nthey are only used by the ksz9477 driver.\n\nMove their definition into ksz9477.c\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-clean-ksz-4th-v1-5-93441e695fa4@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "a7e806f11f37cc4d6a85cdbba568ed8d911be86f",
      "tree": "e53e906a0cc1bbc499051c3ea4b14180e6faa203",
      "parents": [
        "caf5d68b51e61bfdd8aaa8d5aea6f5f24d76fca5"
      ],
      "author": {
        "name": "Bastien Curutchet (Schneider Electric)",
        "email": "bastien.curutchet@bootlin.com",
        "time": "Thu Jul 02 11:07:26 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:51 2026 +0200"
      },
      "message": "net: dsa: microchip: move ksz88xx stats handling in ksz8.c\n\nksz88xx_r_mib_stats64() is defined in ksz_common while it\u0027s clearly\nksz88xx-specific.\n\nMove its definition in ksz8.c\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-clean-ksz-4th-v1-4-93441e695fa4@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "caf5d68b51e61bfdd8aaa8d5aea6f5f24d76fca5",
      "tree": "0af39ba703f890ef5734bb7a34ccc038ab21c810",
      "parents": [
        "18a856b236800efb3cfc321e51580e00c4a6e497"
      ],
      "author": {
        "name": "Bastien Curutchet (Schneider Electric)",
        "email": "bastien.curutchet@bootlin.com",
        "time": "Thu Jul 02 11:07:25 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:51 2026 +0200"
      },
      "message": "net: dsa: microchip: make ksz_is_port_mac_global_usable() static\n\nksz_is_port_mac_global_usable() is exposed in ksz_common.h while it\u0027s\nonly used internally.\n\nMake ksz_is_port_mac_global_usable() static.\nMove its definition above its first call.\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-clean-ksz-4th-v1-3-93441e695fa4@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "18a856b236800efb3cfc321e51580e00c4a6e497",
      "tree": "3706a0f8874abd4454fd864841edd4651a2b7588",
      "parents": [
        "15604320877e09d84dd5f1d79ce138bf2263f2a1"
      ],
      "author": {
        "name": "Vladimir Oltean",
        "email": "vladimir.oltean@nxp.com",
        "time": "Thu Jul 02 11:07:24 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:51 2026 +0200"
      },
      "message": "net: dsa: microchip: split port_max_mtu() implementation\n\nksz_max_mtu() is a bit cluttered. It would be good for developers and\nreviewers if they didn\u0027t need to look at a common function for hardware\nthey likely don\u0027t have, and which is vastly different, when they are\ninterested in only a specific chip.\n\nBenefit from the fact that all families listed here have their own\ndsa_switch_ops, and provide separate implementations for the\nport_max_mtu() method.\n\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-clean-ksz-4th-v1-2-93441e695fa4@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "15604320877e09d84dd5f1d79ce138bf2263f2a1",
      "tree": "647c77185738e8b56e6472338daa643e42db420a",
      "parents": [
        "06f42c77a95502df125adbf46ce2a2dbf3573ccd"
      ],
      "author": {
        "name": "Vladimir Oltean",
        "email": "vladimir.oltean@nxp.com",
        "time": "Thu Jul 02 11:07:23 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 11:05:51 2026 +0200"
      },
      "message": "net: dsa: microchip: split ksz8_change_mtu()\n\nEven among the ksz8 family, there are big differences in the MTU change\nprocedure between KSZ87xx and KSZ88xx (KSZ8463 is like KSZ88xx here).\n\nSince we have 3 separate dsa_switch_ops for what constitutes \"KSZ8\", we\ncan split those procedures into separate functions.\n\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-clean-ksz-4th-v1-1-93441e695fa4@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "06f42c77a95502df125adbf46ce2a2dbf3573ccd",
      "tree": "2adbcb820760e2d9c4f6e46ca1a80458cbf7095a",
      "parents": [
        "4fa0619d039f561dd2207055cf21a10abaeebe0e",
        "e8cfc70720ea9c48150235321a4e8831e4735e8f"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 10:44:45 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 10:44:45 2026 +0200"
      },
      "message": "Merge branch \u0027drivers-net-ethernet-replace-__get_free_pages-with-kmalloc\u0027\n\nMike Rapoport says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ndrivers/net/ethernet: replace __get_free_pages() with kmalloc()\n\nThis is a (small) part of larger work of replacing page allocator calls\nwith kmalloc.\n\nMy initial intention a few month ago was to remove ugly casts [1], but then\nwilly pointed out that Linus objected to something like this [2] and it\nlooks like more than a decade old technical debt.\n\nLargely, anything that doesn\u0027t need struct page (or a memdesc in the\nfuture) should just use kmalloc() or kvmalloc() to allocate memory.\nkmalloc() guarantees alignment, physical contiguity and working\nvirt_to_phys() and beside nicer API that returns void * on alloc and\ndoesn\u0027t require to know the allocation size on free, kmalloc() provides\nbetter debugging capabilities than page allocator.\n\nAnother thing is that touching these allocation sites gives the reviewers\nopportunity to see if a PAGE_SIZE buffer is actually needed or maybe\nanother size is appropriate.\n\nFor larger allocations that don\u0027t need physically contiguous memory\nkvmalloc() can be a better option that __get_free_pages() because under\nmemory pressure it\u0027s is easier to allocate several order-0 pages than a\nphysically contiguous chunk with the same number of pages.\n\nAnd last, but not least, removing needless calls to page allocator should\nhelp with memdesc (aka project folio) conversion. There will be way less\nplaces to audit to see if the user was actually using struct page.\n\nAlso in git:\nhttps://git.kernel.org/pub/scm/linux/kernel/git/rppt/linux.git gfp-to-kmalloc/drivers-net-ethernet\n\n[1] https://lore.kernel.org/all/20251018093002.3660549-1-rppt@kernel.org/\n[2] https://lore.kernel.org/all/CA+55aFwp4iy4rtX2gE2WjBGFL\u003dNxMVnoFeHqYa2j1dYOMMGqxg@mail.gmail.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260701-b4-drivers-ethernet-v1-0-58776615db6e@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "e8cfc70720ea9c48150235321a4e8831e4735e8f",
      "tree": "2adbcb820760e2d9c4f6e46ca1a80458cbf7095a",
      "parents": [
        "50bfc5eac4cb9bfe5b4bedb5c55d21fe8bd1235c"
      ],
      "author": {
        "name": "Mike Rapoport (Microsoft)",
        "email": "rppt@kernel.org",
        "time": "Wed Jul 01 16:57:21 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 10:44:43 2026 +0200"
      },
      "message": "sfc: use kmalloc() to allocate logging buffer\n\nefx_mcdi_init() allocates a logging buffer for MCDI firmware\ncommunication diagnostics.\n\nThis buffer can be allocated with kmalloc() as there\u0027s nothing special\nabout it to go directly to the page allocator.\n\nkmalloc() provides a better API that does not require ugly casts and\nkfree() does not need to know the size of the freed object.\n\nPerformance difference between kmalloc() and __get_free_pages() is not\nmeasurable as both allocators take an object/page from a per-CPU list for\nfast path allocations.\n\nFor the slow path the performance is anyway determined by the amount of\nreclaim involved rather than by what allocator is used.\n\nReplace use of __get_free_page() with kmalloc() and free_page() with\nkfree().\n\nLink: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com\nSigned-off-by: Mike Rapoport (Microsoft) \u003crppt@kernel.org\u003e\nReviewed-by: Edward Cree \u003cecree.xilinx@gmail.com\u003e\nLink: https://patch.msgid.link/20260701-b4-drivers-ethernet-v1-4-58776615db6e@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "50bfc5eac4cb9bfe5b4bedb5c55d21fe8bd1235c",
      "tree": "c952bb3e0f4efdbb2e1d29c6d344e8adbd545123",
      "parents": [
        "764f2a0c6d1e5bc8f7c2438e0dd6572a322f8762"
      ],
      "author": {
        "name": "Mike Rapoport (Microsoft)",
        "email": "rppt@kernel.org",
        "time": "Wed Jul 01 16:57:20 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 10:44:43 2026 +0200"
      },
      "message": "sfc/siena: use kmalloc() to allocate logging buffer\n\nefx_siena_mcdi_init() allocates a logging buffer for MCDI firmware\ncommunication diagnostics.\n\nThis buffer can be allocated with kmalloc() as there\u0027s nothing special\nabout it to go directly to the page allocator.\n\nkmalloc() provides a better API that does not require ugly casts and\nkfree() does not need to know the size of the freed object.\n\nPerformance difference between kmalloc() and __get_free_pages() is not\nmeasurable as both allocators take an object/page from a per-CPU list for\nfast path allocations.\n\nFor the slow path the performance is anyway determined by the amount of\nreclaim involved rather than by what allocator is used.\n\nReplace use of __get_free_page() with kmalloc() and free_page() with\nkfree().\n\nLink: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com\nSigned-off-by: Mike Rapoport (Microsoft) \u003crppt@kernel.org\u003e\nReviewed-by: Edward Cree \u003cecree.xilinx@gmail.com\u003e\nLink: https://patch.msgid.link/20260701-b4-drivers-ethernet-v1-3-58776615db6e@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "764f2a0c6d1e5bc8f7c2438e0dd6572a322f8762",
      "tree": "9142049407cf8b425eef6720014206b869b717ed",
      "parents": [
        "28a236c54c9ae648fda9cc961e2343c70b8b3b49"
      ],
      "author": {
        "name": "Mike Rapoport (Microsoft)",
        "email": "rppt@kernel.org",
        "time": "Wed Jul 01 16:57:19 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 10:44:43 2026 +0200"
      },
      "message": "ice: use kzalloc() to allocate staging buffer for reading from GNSS\n\nice_gnss_read() uses get_zeroed_page() to  allocate a staging buffer for\nreading GNSS module data via I2C bus.\n\nThis buffer can be allocated with kmalloc() as there\u0027s nothing special\nabout it to go directly to the page allocator.\n\nkmalloc() provides a better API that does not require ugly casts and\nkfree() does not need to know the size of the freed object.\n\nPerformance difference between kmalloc() and __get_free_pages() is not\nmeasurable as both allocators take an object/page from a per-CPU list for\nfast path allocations.\n\nFor the slow path the performance is anyway determined by the amount of\nreclaim involved rather than by what allocator is used.\n\nReplace use of get_zeroed_page() with kzalloc() and free_page() with\nkfree().\n\nLink: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com\nSigned-off-by: Mike Rapoport (Microsoft) \u003crppt@kernel.org\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nLink: https://patch.msgid.link/20260701-b4-drivers-ethernet-v1-2-58776615db6e@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "28a236c54c9ae648fda9cc961e2343c70b8b3b49",
      "tree": "be4487d3c1d4d7d6f65c4a983772beb5c555ad95",
      "parents": [
        "4fa0619d039f561dd2207055cf21a10abaeebe0e"
      ],
      "author": {
        "name": "Mike Rapoport (Microsoft)",
        "email": "rppt@kernel.org",
        "time": "Wed Jul 01 16:57:18 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 10:44:43 2026 +0200"
      },
      "message": "bnx2x: use kzalloc() to allocate mac filtering list\n\nbnx2x_mcast_enqueue_cmd() allocates memory for mac filtering list using\n__get_free_pages().\n\nThis memory can be allocated with kzalloc() as there\u0027s nothing special\nabout it to go directly to the page allocator.\n\nkmalloc() provides a better API that does not require ugly casts and\nkfree() does not need to know the size of the freed object.\n\nPerformance difference between kmalloc() and __get_free_pages() is not\nmeasurable as both allocators take an object/page from a per-CPU list for\nfast path allocations.\n\nFor the slow path the performance is anyway determined by the amount of\nreclaim involved rather than by what allocator is used.\n\nReplace use of __get_free_page() with kzalloc() and free_page() with\nkfree().\n\nLink: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com\nSigned-off-by: Mike Rapoport (Microsoft) \u003crppt@kernel.org\u003e\nLink: https://patch.msgid.link/20260701-b4-drivers-ethernet-v1-1-58776615db6e@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "4fa0619d039f561dd2207055cf21a10abaeebe0e",
      "tree": "3f9852bcd1c9e2f055e81afccfcc213ef5e5069e",
      "parents": [
        "0be5c3f0fbef3679f50f345b9237b8f9ea5de4e9"
      ],
      "author": {
        "name": "Runyu Xiao",
        "email": "runyu.xiao@seu.edu.cn",
        "time": "Wed Jul 01 20:40:17 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 10:34:21 2026 +0200"
      },
      "message": "net: rmnet: annotate endpoint lookup under RTNL\n\nrmnet_get_endpoint() is shared by packet receive paths and\nRTNL-protected control paths. The receive paths already run under RCU/BH\ncontext through the RX handler, while the control paths reach\nrmnet_get_endpoint() after obtaining the rmnet port with\nrmnet_get_port_rtnl().\n\nThe helper walks port-\u003emuxed_ep[] with hlist_for_each_entry_rcu(). Pass\nlockdep_rtnl_is_held() as the non-RCU protection condition so\nCONFIG_PROVE_RCU_LIST can see the RTNL-protected control-path calls\nwhile preserving the existing RCU-reader behavior for data paths.\n\nThis was found by our static analysis tool and then manually reviewed\nagainst the current tree. The dynamic triage evidence is a\ntarget-matched CONFIG_PROVE_RCU_LIST warning; the change is limited\nto documenting the existing protection contract.\n\nThis is a lockdep annotation cleanup. It does not change endpoint\nlifetime or hash updates.\n\nSigned-off-by: Runyu Xiao \u003crunyu.xiao@seu.edu.cn\u003e\nReviewed-by: Subash Abhinov Kasiviswanathan \u003csubash.a.kasiviswanathan@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260701124017.3205729-1-runyu.xiao@seu.edu.cn\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "0be5c3f0fbef3679f50f345b9237b8f9ea5de4e9",
      "tree": "def5e24718efa33e9b3f15a5c59fb935f6fe403c",
      "parents": [
        "a211b03fee2c87704b38db08b039bd2c597a2eea"
      ],
      "author": {
        "name": "Runyu Xiao",
        "email": "runyu.xiao@seu.edu.cn",
        "time": "Wed Jul 01 20:39:25 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 10:14:29 2026 +0200"
      },
      "message": "gtp: annotate PDP lookups under RTNL\n\nThe GTP PDP lookup helpers are shared by RCU-protected data and report\npaths and RTNL-protected control paths such as gtp_genl_new_pdp(). The\nhelpers walk RCU hlists, but they do not currently pass the RTNL\ncondition for the control-path lookups.\n\nPass lockdep_rtnl_is_held() to the PDP hlist iterators. Existing\nRCU-reader callers remain valid because the RCU-list macros also accept\nan active RCU read-side section; the added condition only documents the\nnon-RCU protection already used by RTNL control paths.\n\nThis was found by our static analysis tool and then manually reviewed\nagainst the current tree. The dynamic triage evidence is a\ntarget-matched CONFIG_PROVE_RCU_LIST warning; the change is limited\nto documenting the existing protection contract.\n\nThis is a lockdep annotation cleanup. It does not change PDP lifetime or\nhash updates.\n\nSigned-off-by: Runyu Xiao \u003crunyu.xiao@seu.edu.cn\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260701123925.3193089-1-runyu.xiao@seu.edu.cn\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "1a3267a8c9ecabb8e27f5cbda6d19295d5e41beb",
      "tree": "14819b2f9cd71ae2b30ed93f28172bb87025ecde",
      "parents": [
        "60444706aa17616efc03190d099ac347e28b3d0a"
      ],
      "author": {
        "name": "Rosen Penev",
        "email": "rosenp@gmail.com",
        "time": "Wed Jul 01 20:26:52 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 10:04:01 2026 +0200"
      },
      "message": "net: mdio: select REGMAP_MMIO instead of depending on it\n\nREGMAP_MMIO is a hidden (non-user-visible) tristate symbol. Using\ndepends on it is incorrect because there is no way for the user to\nenable it directly. Change to select, which is the convention used\nby every other driver in the tree that needs REGMAP_MMIO.\n\nFixes: 8057cbb8335c (\"net: mdio: mscc-miim: Add depend of REGMAP_MMIO on MDIO_MSCC_MIIM\")\nAssisted-by: opencode:big-pickle\nSigned-off-by: Rosen Penev \u003crosenp@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260702032653.1580616-1-rosenp@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "a211b03fee2c87704b38db08b039bd2c597a2eea",
      "tree": "0865aa9b02b0c3bb910ea9e4ee31cd6665e6de9e",
      "parents": [
        "4a13f31a92f35161b499bf29638336885259da78"
      ],
      "author": {
        "name": "Minxi Hou",
        "email": "houminxi@gmail.com",
        "time": "Thu Jul 02 03:49:26 2026 -0400"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Wed Jul 08 10:00:32 2026 +0200"
      },
      "message": "selftests/net/openvswitch: add output truncation test\n\nAdd test_trunc exercising the OVS_ACTION_ATTR_TRUNC action. The test\nverifies truncation limits in four steps: reject trunc(1) and\ntrunc(13) which are below ETH_HLEN, confirm normal forwarding works,\napply trunc(14) which truncates packets to the Ethernet header and\nverify ping fails, then restore normal forwarding and verify recovery.\n\nThe kernel requires max_len \u003e\u003d ETH_HLEN (14 bytes). trunc(14) sets\nOVS_CB(skb)-\u003ecutlen so pskb_trim strips the IP payload at output\ntime; the receiver drops the runt frame and no echo reply is\ngenerated.\n\nSigned-off-by: Minxi Hou \u003chouminxi@gmail.com\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260702074926.1174810-1-houminxi@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "4a13f31a92f35161b499bf29638336885259da78",
      "tree": "c28f46963c9a347daecd7335af0f6101d561c9d0",
      "parents": [
        "997bfb05c919d2c5ee77c594d354f6c61b99ccdf",
        "538d89fd914610852a6fb20b823ba70566153d46"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 15:31:38 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 15:31:39 2026 +0200"
      },
      "message": "Merge branch \u0027net-hold-instance-lock-around-netdev_down-and-netdev_going_down\u0027\n\nStanislav Fomichev says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: hold instance lock around NETDEV_DOWN and NETDEV_GOING_DOWN\n\nNETDEV_UP and NETDEV_REGISTER already run under the per-device\ninstance lock. The teardown side does not. Make it symmetric so\nops-locked drivers can rely on the lock being held in both\ndirections.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260702224150.3730033-1-sdf@fomichev.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "538d89fd914610852a6fb20b823ba70566153d46",
      "tree": "c28f46963c9a347daecd7335af0f6101d561c9d0",
      "parents": [
        "f540caaaca8d23a6bd3a8c424cd808037840b4af"
      ],
      "author": {
        "name": "Stanislav Fomichev",
        "email": "sdf.kernel@gmail.com",
        "time": "Thu Jul 02 15:41:50 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 15:31:37 2026 +0200"
      },
      "message": "net: document NETDEV_UNREGISTER unlocked rationale\n\nThe lock-state table marks UNREGISTER as unlocked without saying\nwhy. Add a short note that many handlers release the lowers via\ndev_close().\n\nSigned-off-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20260702224150.3730033-7-sdf@fomichev.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "f540caaaca8d23a6bd3a8c424cd808037840b4af",
      "tree": "b5e96d74f5d4c605c3c2d32d83e4c5a703fe942f",
      "parents": [
        "b8d2262b966a068dc567e72d493230f4ba62cc4a"
      ],
      "author": {
        "name": "Stanislav Fomichev",
        "email": "sdf.kernel@gmail.com",
        "time": "Thu Jul 02 15:41:49 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 15:31:37 2026 +0200"
      },
      "message": "net: require instance lock for NETDEV_DOWN/GOING_DOWN notifiers\n\nSprinkle a few asserts about ops lock: netif_close_many and __dev_notify_flags\nshould now consistently run under the lock\n\nSigned-off-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20260702224150.3730033-6-sdf@fomichev.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "b8d2262b966a068dc567e72d493230f4ba62cc4a",
      "tree": "975d0653fc2d8d5fdb94754d4eaf97839a26cdd3",
      "parents": [
        "6034bc4febc98801097e5c416a7fef8ccf883507"
      ],
      "author": {
        "name": "Stanislav Fomichev",
        "email": "sdf.kernel@gmail.com",
        "time": "Thu Jul 02 15:41:48 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 15:31:37 2026 +0200"
      },
      "message": "net: rtnetlink: take instance lock inside rtnl_configure_link\n\nrtnl_configure_link calls __dev_change_flags() and __dev_notify_flags,\nboth need the instance lock. rtnl_newlink_create grabs it but stacked\ndevices do not. Move the lock inside rtnl_configure_link.\n\nSigned-off-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20260702224150.3730033-5-sdf@fomichev.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "6034bc4febc98801097e5c416a7fef8ccf883507",
      "tree": "8f7204cf91f9769809f0a4eb03b2b94f168630fe",
      "parents": [
        "cefa18fab29cf0dc99f6e7aa10ee332826f305c0"
      ],
      "author": {
        "name": "Stanislav Fomichev",
        "email": "sdf.kernel@gmail.com",
        "time": "Thu Jul 02 15:41:47 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 15:31:37 2026 +0200"
      },
      "message": "net: mtk_eth_soc: hold instance lock around DMA-device-swap close\n\nnetif_close_many will soon assert ops lock (for locked DOWN/GOING_DOWN).\nUpdate mtk_eth_set_dma_device to manually grab and release the ops lock.\n\nSigned-off-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20260702224150.3730033-4-sdf@fomichev.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "cefa18fab29cf0dc99f6e7aa10ee332826f305c0",
      "tree": "09080273998d3479bc7e5feef123b2795ce0e9c0",
      "parents": [
        "5326fefb9fe8e7014f5d7246fa10ff0db7a968a3"
      ],
      "author": {
        "name": "Stanislav Fomichev",
        "email": "sdf.kernel@gmail.com",
        "time": "Thu Jul 02 15:41:46 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 15:31:36 2026 +0200"
      },
      "message": "net: dsa: hold instance lock on close-on-shutdown paths\n\nnetif_close_many will soon assert ops lock (for locked DOWN/GOING_DOWN).\nUpdate dsa_switch_shutdown to manually grab and release the ops lock.\n\nSigned-off-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20260702224150.3730033-3-sdf@fomichev.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "5326fefb9fe8e7014f5d7246fa10ff0db7a968a3",
      "tree": "ac6a882ab98766a982d30c73f4fee2b05716f9c1",
      "parents": [
        "997bfb05c919d2c5ee77c594d354f6c61b99ccdf"
      ],
      "author": {
        "name": "Stanislav Fomichev",
        "email": "sdf.kernel@gmail.com",
        "time": "Thu Jul 02 15:41:45 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 15:31:36 2026 +0200"
      },
      "message": "net: hold instance lock around NETDEV_DOWN/GOING_DOWN\n\nMirror what call_netdevice_register_net_notifiers does but for the\nteardown. Cover only DOWN and GOING_DOWN. UNREGISTER is still unlocked\nbecause of the SW devices using dev_xxx methods.\n\nSigned-off-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20260702224150.3730033-2-sdf@fomichev.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "60444706aa17616efc03190d099ac347e28b3d0a",
      "tree": "9553095845753edff48333bf9060938a70483e1a",
      "parents": [
        "7993211bde166471dffac074dc965489f86531f8"
      ],
      "author": {
        "name": "Enrico Pozzobon",
        "email": "enrico.pozzobon@dissecto.com",
        "time": "Wed Jul 01 16:47:23 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 13:07:51 2026 +0200"
      },
      "message": "net: usb: lan78xx: disable VLAN filter in promiscuous mode\n\nThe hardware VLAN filter (RFE_CTL_VLAN_FILTER_) drops VLAN-tagged frames\nwhose VID has not been registered via lan78xx_vlan_rx_add_vid(). It is\nleft enabled in promiscuous mode, so packet capture (e.g. tcpdump or\nWireshark) does not see tagged frames for unregistered VIDs.\n\nClear the filter while the interface is promiscuous and restore it from\nNETIF_F_HW_VLAN_CTAG_FILTER otherwise. Enforce the same condition in\nlan78xx_set_features() so netdev_update_features() cannot re-enable the\nfilter while promiscuous.\n\nFixes: 55d7de9de6c3 (\"Microchip\u0027s LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver\")\nSigned-off-by: Enrico Pozzobon \u003cenrico.pozzobon@dissecto.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20260701-lan78xx-vlan-promisc-v3-1-232266d32743@dissecto.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "997bfb05c919d2c5ee77c594d354f6c61b99ccdf",
      "tree": "c1705b53059249fc282c0b43b77c2892fc0a13ac",
      "parents": [
        "cefd16657c1d9008259e7f91ea3f3d67a933fece",
        "bd6550bcdb0c0bcc6e29706ffe2e64708192342b"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 12:51:16 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 12:51:17 2026 +0200"
      },
      "message": "Merge tag \u0027sfc-net-pullrequest-20260630\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl\n\nLucero Palau, Alejandro says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request: sfc 2026-07-01\n\nhere are the last CXL core changes for enabling CXL Type2 drivers to\ninitialize a CXL-capable device plus the netdev sfc driver changes using\nthis new CXL core Type2 support.\n\nPlease pull or let me know of any problem!\n\nSFC changes for CXL type2 enabling\n\n* tag \u0027sfc-net-pullrequest-20260630\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl:\n  sfc: support pio mapping based on cxl\n  sfc: obtain and map cxl range using devm_cxl_probe_mem\n  sfc: Initialize cxl dpa\n  sfc: Map cxl regs\n  sfc: add cxl support\n  cxl: Support dpa without a mailbox\n  cxl: Support Type2 cxl regs mapping\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260701113805.14072-1-alejandro.lucero-palau@amd.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "7993211bde166471dffac074dc965489f86531f8",
      "tree": "d60cc12a8cdd4366df15560646c9c23be8cb40fb",
      "parents": [
        "5c0e3ba4f500fd4314ceb42f07f16bc445156431"
      ],
      "author": {
        "name": "Yuyang Huang",
        "email": "yuyanghuang@google.com",
        "time": "Thu Jul 02 08:50:14 2026 +0900"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Jul 07 12:15:39 2026 +0200"
      },
      "message": "ipv4: igmp: remove multicast group from hash table on device destruction\n\nWhen a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through\nthe multicast list and calls ip_ma_put() on each membership, scheduling\nthem for RCU reclamation. However, they are not unlinked from the device\u0027s\nmulticast hash table (mc_hash).\n\nSince the device remains published in dev-\u003eip_ptr until after\nip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash\ncan still locate and access the multicast group after its refcount is\ndecremented. If the RCU callback runs and frees the group while a reader is\naccessing it, a use-after-free occurs.\n\nFix this by unlinking the multicast group from mc_hash using\nip_mc_hash_remove() before scheduling it for reclamation.\n\nBUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0\nRead of size 4 at addr ffff888009bf1408 by task mausezahn/2276\n\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x67/0x90\n print_report+0x175/0x7c0\n kasan_report+0x147/0x180\n ip_check_mc_rcu+0x149/0x3f0\n udp_v4_early_demux+0x36d/0x12d0\n ip_rcv_finish_core+0xb8b/0x1390\n ip_rcv_finish+0x54/0x120\n NF_HOOK+0x213/0x2b0\n __netif_receive_skb+0x126/0x340\n process_backlog+0x4f2/0xf00\n __napi_poll+0x92/0x2c0\n net_rx_action+0x583/0xc60\n handle_softirqs+0x236/0x7f0\n do_softirq+0x57/0x80\n \u003c/IRQ\u003e\n\nAllocated by task 2239:\n kasan_save_track+0x3e/0x80\n __kasan_kmalloc+0x72/0x90\n ____ip_mc_inc_group+0x31a/0xa40\n __ip_mc_join_group+0x334/0x3f0\n do_ip_setsockopt+0x16fa/0x2010\n ip_setsockopt+0x3f/0x90\n do_sock_setsockopt+0x1ad/0x300\n\nFreed by task 0:\n kasan_save_track+0x3e/0x80\n kasan_save_free_info+0x40/0x50\n __kasan_slab_free+0x3a/0x60\n __rcu_free_sheaf_prepare+0xd4/0x220\n rcu_free_sheaf+0x36/0x190\n rcu_core+0x8d9/0x12f0\n handle_softirqs+0x236/0x7f0\n\nFixes: e9897071350b (\"igmp: hash a hash table to speedup ip_check_mc_rcu()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Yuyang Huang \u003cyuyanghuang@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260701235014.73505-1-yuyanghuang@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    }
  ],
  "next": "cefd16657c1d9008259e7f91ea3f3d67a933fece"
}