)]}' { "log": [ { "commit": "96f01b53c2d05e003b040892256de54a586e8529", "tree": "b2d73dc2b12900d8de34e1790397a604b9e44c93", "parents": [ "3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa" ], "author": { "name": "Wyatt Feng", "email": "wf.kernel.dev@gmail.com", "time": "Sat Aug 29 23:44:32 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Sep 01 12:24:11 2026 +0200" }, "message": "net: xfrm: reject unrepresentable espintcp transport headers\n\nESP-in-TCP can hand xfrm packets whose transport header offset no longer\nfits after the stream parser trims the TCP envelope. The plain transport\nheader reset truncates that offset and triggers the skb warning path.\n\nUse the careful transport-header helper and drop the skb through the\nexisting XFRM error path when the offset cannot be represented.\n\nFixes: e27cca96cd68 (\"xfrm: add espintcp (RFC 8229)\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nAssisted-by: Codex:GPT-5.4\nSigned-off-by: Wyatt Feng \u003cwf.kernel.dev@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cweir@nebusec.ai\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa", "tree": "1bad23ec4e1b098ced6168b68eae8985ee9a6740", "parents": [ "9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1" ], "author": { "name": "Zhiling Zou", "email": "zhilinz@nebusec.ai", "time": "Sat Aug 29 17:24:24 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Sep 01 12:24:11 2026 +0200" }, "message": "xfrm: save input state data before secpath resets\n\nxfrm_input() stores the current xfrm_state in the skb secpath while it\ncontinues receive-side processing. Some input paths can reset that secpath\nbefore xfrm_input() has finished dereferencing the state.\n\nReceive callback users such as VTI and XFRM interfaces can reset the\nsecpath. The VTI receive path does so before checking whether the packet\ncrosses network namespaces, while the XFRM interface path does so only for\ncross-network-namespace packets. The XFRM_MAX_DEPTH error path can also\nreset the secpath before the final drop callback reports the current\nstate\u0027s protocol.\n\nIf secpath_reset() drops the last state reference while the state is\nconcurrently deleted, xfrm_input() can still dereference the freed state\nwhen selecting transport_finish() or reporting the drop callback protocol.\n\nSave the state protocol on the stack while the state is still valid,\nand use the already saved address family for transport_finish(). A larval\nXFRM_STATE_ACQ state has no type, so retain nexthdr as its protocol. This\npreserves the existing drop-path fallback while avoiding the post-reset\nstate dereferences without adding an extra state reference to every\nreceived packet.\n\nFixes: df3893c176e9 (\"vti: Update the ipv4 side to use it\u0027s own receive hook.\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nSigned-off-by: Zhiling Zou \u003czhilinz@nebusec.ai\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1", "tree": "567cf04f9b5a574353c4e474284f77511353a36f", "parents": [ "f89416eb3db151170a6f3c6dfc5239d26cdce4d2" ], "author": { "name": "Cen Zhang (Microsoft Security FORGE Labs)", "email": "blbllhy@gmail.com", "time": "Wed Aug 26 16:17:45 2026 -0400" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Sep 01 12:24:10 2026 +0200" }, "message": "xfrm: hold net_device reference under RCU in bundle creation\n\nxfrm_bundle_create() and xfrm_create_dummy_bundle() read dst-\u003edev into\na local pointer without taking a device reference, then pass it to\nxfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst-\u003edev via\ndst_dev_put() and frees the old net_device, causing a use-after-free\nwhen xfrm6_fill_dst() later dereferences the stale dev pointer.\n\n BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860\n (net/ipv6/xfrm6_policy.c:86 netdev_hold())\n Read of size 8 at addr ffff8880142fe588 by task exploit/153\n Call Trace:\n xfrm6_fill_dst+0x82c/0x860\n xfrm_resolve_and_create_bundle+0x21d4/0x2bd0\n xfrm_lookup_with_ifid+0x485/0x1640\n ip6_dst_lookup_flow+0x19b/0x1e0\n udpv6_sendmsg+0x1443/0x2dd0\n\nFix this by reading dst-\u003edev via dst_dev_rcu() and keeping the RCU\nread-side critical section active until xfrm_fill_dst() has taken the\nrequired device references.\n\nFixes: 25ee3286dcbc (\"[IPSEC]: Merge common code into xfrm_bundle_create\")\nFixes: a0073fe18e71 (\"xfrm: Add a state resolution packet queue\")\nSuggested-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nReported-by: Xiang Mei (Microsoft) \u003cxmei5@asu.edu\u003e\nLink: https://lore.kernel.org/all/20260820200245.44312-1-blbllhy@gmail.com/\nCc: AutonomousCodeSecurity@microsoft.com\nAssisted-by: GitHub-Copilot:claude-opus-4.6\nSigned-off-by: Cen Zhang (Microsoft Security FORGE Labs) \u003cblbllhy@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "f89416eb3db151170a6f3c6dfc5239d26cdce4d2", "tree": "4d9fd74f47bc3f407c0d5b35de5f38d0e95cc451", "parents": [ "2afb8dc1f4390f164db8352f8e685e126e9db566" ], "author": { "name": "Maher Azzouzi", "email": "maherazz04@gmail.com", "time": "Mon Aug 17 14:37:52 2026 +0100" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Aug 24 09:21:23 2026 +0200" }, "message": "esp: downgrade zerocopy managed frags before mutating skb frags\n\nOn the out-of-place output path (esp-\u003einplace \u003d\u003d false) ESP rewrites the\nskb frag array: esp_output_head() appends a trailer frag and\nesp_output_tail() replaces the frags with a destination page, both\nreferenced with get_page().\n\nWhen the skb carries zerocopy managed frags (SKBFL_MANAGED_FRAG_REFS) the\npayload frags are owned by the ubuf and must not be referenced or\nunreferenced individually, but ESP mutates the frag array without ever\ndowngrading the skb. This breaks the managed-frag invariant two ways:\n\n - esp_ssg_unref() walks the source scatterlist and drops a page\n reference for every frag, including the ubuf-owned payload frags,\n pushing their refcount below the GUP pin bias while the pages are\n still pinned, i.e. a use-after-free of the zerocopy pages;\n\n - esp_output_tail() installs its destination page as frag 0 with\n get_page() but leaves SKBFL_MANAGED_FRAG_REFS set, so\n skb_release_data() takes the skip_unref branch and never drops that\n reference, leaking the x-\u003exfrag page at packet rate.\n\nFix this the way every other frag-mutating site does (__ip_append_data(),\n__ip6_append_data(), tcp_sendmsg_locked()) and call\nskb_zcopy_downgrade_managed() before ESP touches the frag array: it takes\na real reference on each existing frag and clears SKBFL_MANAGED_FRAG_REFS,\nso the per-frag unref in esp_ssg_unref() and the frag release in\nskb_release_data() are both balanced and no mixed-ownership frag array is\nleft behind.\n\nFixes: 753f1ca4e1e5 (\"net: introduce managed frags infrastructure\")\nSigned-off-by: Maher Azzouzi \u003cmaherazz04@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "2afb8dc1f4390f164db8352f8e685e126e9db566", "tree": "da2126107c0abb019488fa76947e9ebee624a841", "parents": [ "d2f5082f9e84653fa1a9e8aebaaff23e688f5e19" ], "author": { "name": "Siwei Zhang", "email": "fourdizhang@tencent.com", "time": "Thu Jul 30 19:40:08 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Aug 24 07:27:48 2026 +0200" }, "message": "xfrm: use hlist_del_init_rcu for state_cache and state_cache_input\n\nCommit 14acf9652e56 (\"xfrm: defensively unhash xfrm_state lists in\n__xfrm_state_delete\") converted bydst/bysrc/byseq/byspi from\nhlist_del_rcu() to hlist_del_init_rcu() so that a second\n__xfrm_state_delete() on the same object becomes a no-op rather than a\nwrite through LIST_POISON pprev. It missed state_cache and\nstate_cache_input, which kept hlist_del_rcu():\n\n- hlist_del_rcu() leaves pprev \u003d LIST_POISON2 (non-NULL), so\n hlist_unhashed() returns false.\n- hlist_del_init_rcu() leaves pprev \u003d NULL, so hlist_unhashed()\n returns true.\n\nA second __xfrm_state_delete() therefore enters __hlist_del() on the\nalready-deleted state_cache/state_cache_input nodes and does\nWRITE_ONCE(*pprev, next) through LIST_POISON2 — a write use-after-free\nonce the slab is reused. The corruption can in turn cause a subsequent\nhlist_for_each_entry_rcu traversal to follow a dangling next pointer,\nproducing the read use-after-free reported in xfrm_input_state_lookup().\n\nSwitch state_cache and state_cache_input to hlist_del_init_rcu() to\nmatch the other four lists, closing the write use-after-free and, with\nit, the read use-after-free it spawns.\n\nAssisted-by: CodeBuddy:GLM-5.2\nFixes: 0045e3d80613 (\"xfrm: Cache used outbound xfrm states at the policy.\")\nFixes: 81a331a0e72d (\"xfrm: Add an inbound percpu state cache.\")\nCc: stable@vger.kernel.org\nSigned-off-by: Siwei Zhang \u003cfourdizhang@tencent.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "d2f5082f9e84653fa1a9e8aebaaff23e688f5e19", "tree": "948f52a9518413f08383b8b195a09f8b57462d89", "parents": [ "d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Aug 07 17:15:33 2026 +0000" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Aug 18 12:16:20 2026 +0200" }, "message": "xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()\n\nsyzbot reported a suspicious RCU usage warning in ip6_pkt_drop():\n\n WARNING: suspicious RCU usage in ip6_pkt_drop\n include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!\n\n Call Trace:\n __in6_dev_get_safely include/net/addrconf.h:389 [inline]\n ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620\n ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651\n xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806\n process_one_work kernel/workqueue.c:3322 [inline]\n process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486\n\nWhen commit 4f4920669d21 (\"xfrm: Reinject transport-mode packets through\nworkqueue\") converted xfrm_trans_reinject from a tasklet to a workqueue,\nthe reinjection loop ceased running in softirq context. Workqueue workers\nrun in process context where local_bh_disable() does not enter an RCU\nread-side critical section under CONFIG_PREEMPT_RCU.\n\nBecause finish callbacks (such as ip6_rcv_finish) expect to run under an\nRCU read lock (performing route lookups, l3mdev lookups, and accessing\nRCU-protected data structures), invoking them in workqueue context without\nrcu_read_lock() triggers RCU lockdep warnings.\n\nFurthermore, packets queued to the workqueue via xfrm_trans_queue_net()\nmay carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).\nAdditionally, on netdevice unregistration, dst_dev_put() replaces dst-\u003edev\nwith blackhole_netdev, so dst entries do not keep skb-\u003edev alive while\nqueued in the workqueue.\n\nFix these issues by:\n1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the\n caller\u0027s RCU section to ensure dst is reference-counted before queuing.\n2. Holding a reference on skb-\u003edev via dev_hold()/dev_put() across workqueue\n deferral so skb-\u003edev remains valid during finish() callback processing.\n3. Acquiring rcu_read_lock() around the finish callback invocation loop in\n xfrm_trans_reinject().\n\nFixes: 4f4920669d21 (\"xfrm: Reinject transport-mode packets through workqueue\")\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nCc: Liu Jian \u003cliujian56@huawei.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320", "tree": "909fcaf5a8105f7aa09955d507395d96fb25dc70", "parents": [ "6973a21ee73c5567f883813c8ef414774b45892f" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Tue Aug 04 06:10:37 2026 +0000" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Aug 18 12:16:19 2026 +0200" }, "message": "xfrm: fix compat ALLOCSPI request use-after-free\n\nxfrm_state_netlink() builds the ALLOCSPI response with\ndump_one_state(), which already calls alloc_compat() with the response\nskb and header.\n\nxfrm_alloc_userspi() then calls alloc_compat() again, but passes the\noriginal request skb and its header. For a compat request, the\ntranslator therefore interprets the 228-byte compat xfrm_userspi_info\nas the 232-byte native layout and reads four bytes past the declared\npayload. It also publishes the translated child through the request\u0027s\nfrag_list.\n\nA multicast clone of the request shares skb_shared_info and can observe\nthat child. xfrm_user_rcv_msg() frees it after the request handler\nreturns, racing a compat receiver which may still be copying from it and\nresulting in a use-after-free.\n\nRemove the redundant conversion. The response keeps its correct compat\ntranslation from dump_one_state(), and no child is attached to the\ninbound request.\n\nFixes: 5f3eea6b7e8f (\"xfrm/compat: Attach xfrm dumps to 64\u003d\u003e32 bit translator\")\nAssisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nCo-developed-by: David Lee \u003cdavid.lee@trailofbits.com\u003e\nSigned-off-by: David Lee \u003cdavid.lee@trailofbits.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "6973a21ee73c5567f883813c8ef414774b45892f", "tree": "bd1321867be8b207dd1ff42e0a9896feae1394d2", "parents": [ "dc33262be1fe43d0eb0b84fb58c6ed42e2f64a8c" ], "author": { "name": "Zhiling Zou", "email": "zhilinz@nebusec.ai", "time": "Mon Aug 03 21:28:58 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Aug 18 12:16:18 2026 +0200" }, "message": "ipv6: xfrm: use full sockets in local error paths\n\nxfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb-\u003esk as if it\nalways pointed at a full IPv6 socket.\n\nThat is not guaranteed. TCP SYN-ACK skbs can be owned by a\nTCP_NEW_SYN_RECV request_sock while the output path itself is driven by the\nfull listener. If rerouting selects an IPv6 XFRM tunnel route with a lower\nMTU, the local PMTU/error handling path can reach these callbacks with that\nmini-socket still attached to the skb.\n\nThe callbacks then miscast the request socket as a full inet/IPv6 socket and\ncan read beyond the request_sock allocation when they access inet_sock or\nipv6_pinfo state.\n\nResolve the owner with skb_to_full_sk() in both callbacks and bail out when\nno full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error\nlogic, which already reasons about full sockets with skb_to_full_sk().\n\nFixes: dd767856a36e (\"xfrm6: Don\u0027t call icmpv6_send on local error\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nSigned-off-by: Zhiling Zou \u003czhilinz@nebusec.ai\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "dc33262be1fe43d0eb0b84fb58c6ed42e2f64a8c", "tree": "84d7295475d2bd283a793f89e38b8075950d710b", "parents": [ "42d100f5232f39b8ea7b00a7c2482325c7f032a4" ], "author": { "name": "Henry Martin", "email": "bsdhenrymartin@gmail.com", "time": "Mon Aug 03 12:01:54 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Aug 18 12:16:18 2026 +0200" }, "message": "xfrm: iptfs: fix runt reassembly panic from short inner tot_len\n\nWhen the start of an inner packet is split across two outer packets\nsuch that fewer than 4 bytes land at the end of the first one,\n__input_process_payload() saves those bytes as a runt and skips the\niplen/iphlen validation performed for in-place packets. When the\ncontinuation packet arrives, iptfs_reassem_cont() only requires the\ndeclared inner length to be \u003e\u003d sizeof(ra_runt) (6) before allocating\nthe reassembly skb with that attacker-controlled length.\n\nHowever, __iptfs_iphlen() always returns the fixed minimum IP header\nsize (20 for IPv4, 40 for IPv6), so for an inner IPv4 tot_len in\n[6, 19] the header-completion copy writes past the declared packet\nlength, and the subsequent \"ipremain -\u003d copylen\" underflows to ~4GB,\nleaving the payload copy length bounded only by blkoff (up to 64KB).\nAt runtime the skb_put() tailroom check turns this into\nskb_over_panic(), i.e. an unprivileged kernel panic (DoS), reachable\nlocally via userns+netns IPTFS SAs and remotely against IPTFS VPN\ngateways when the decrypted outer skb is linear (e.g. AF_PACKET taps,\ntun/tap delivery).\n\nAlign the runt path with the normal path by requiring the declared\ninner length to cover at least the IP header size. This also subsumes\nthe previous \u003e\u003d sizeof(ra_runt) check, since the minimum IP header\nis always larger than the runt buffer.\n\nThis issue was found by the autokbug dynamic kernel fuzzer at\nTencent Yunding Lab.\n\nFixes: 075694765446 (\"xfrm: iptfs: handle received fragmented inner packets\")\nReported-by: Henry Martin \u003cbsdhenrymartin@gmail.com\u003e\nSigned-off-by: Henry Martin \u003cbsdhenrymartin@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "42d100f5232f39b8ea7b00a7c2482325c7f032a4", "tree": "a9b6f1077c2821e85f738b2964d667a75917a290", "parents": [ "89fefad9f971bc637fb22373078144f2563c4be9" ], "author": { "name": "Aleksandr Nogikh", "email": "nogikh@google.com", "time": "Fri Jul 31 10:06:20 2026 +0000" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Aug 18 12:16:17 2026 +0200" }, "message": "xfrm: add missing RCU read lock in xfrm_send_migrate_state()\n\nxfrm_nlmsg_multicast() requires the RCU read lock to be held because it\nsafely dereferences the net-\u003exfrm.nlsk pointer using rcu_dereference().\nWhen it is called from xfrm_send_migrate_state(), the RCU read lock is not\nheld, which triggers a suspicious RCU usage warning:\n\nWARNING: suspicious RCU usage\nnet/xfrm/xfrm_user.c:1630 suspicious rcu_dereference_check() usage!\n\nCall Trace:\n lockdep_rcu_suspicious+0x13f/0x1d0 kernel/locking/lockdep.c:6876\n xfrm_nlmsg_multicast+0x1d8/0x1f0 net/xfrm/xfrm_user.c:1630\n xfrm_send_migrate_state+0x870/0xae0 net/xfrm/xfrm_user.c:3340\n xfrm_do_migrate_state+0x1749/0x1e90 net/xfrm/xfrm_user.c:3507\n xfrm_user_rcv_msg+0x7a8/0xf30 net/xfrm/xfrm_user.c:3907\n\nFix this by wrapping the xfrm_nlmsg_multicast() call in\nxfrm_send_migrate_state() with rcu_read_lock() and rcu_read_unlock().\n\nFixes: a9d155ea9b44 (\"xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration\")\nAssisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot\nReported-by: syzbot+c0e99a1aa85a286d7a3b@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dc0e99a1aa85a286d7a3b\nLink: https://syzkaller.appspot.com/ai_job?id\u003d8977f559-3a7e-4bb5-b4d6-1196956260b6\nSigned-off-by: Aleksandr Nogikh \u003cnogikh@google.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "89fefad9f971bc637fb22373078144f2563c4be9", "tree": "7244e0f9ec934f906eb0a100645ae711efa6aa5f", "parents": [ "d042487dc118e494db2e2c1382310255c90ff544" ], "author": { "name": "Chengfeng Ye", "email": "nicoyip.dev@gmail.com", "time": "Thu Jul 30 18:35:43 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Aug 18 12:16:16 2026 +0200" }, "message": "xfrm: serialize state GC with device state flush\n\nThe deferred-device pass in xfrm_dev_state_flush() finds states under\nxfrm_state_dev_gc_lock, but drops the lock before calling\nxfrm_dev_state_free() because the driver callback may sleep. The device\nGC list does not hold an xfrm_state reference, so the state GC worker can\ndestroy the same state concurrently.\n\nThe race can proceed as follows:\n\n CPU 0 CPU 1\n find x on the device GC list\n drop xfrm_state_dev_gc_lock\n read x-\u003exso.dev\n xfrm_state_gc_destroy(x)\n xfrm_dev_state_free(x)\n xfrm_state_free(x)\n continue xfrm_dev_state_free(x)\n\nBoth paths can invoke the driver callback and drop the device reference.\nCPU 0 can also access the xfrm_state after CPU 1 has freed it.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in xfrm_dev_state_free+0x24c/0x2a0\n Read of size 8 at addr ffff88810bbaa960 by task poc/102\n\n Call Trace:\n xfrm_dev_state_free+0x24c/0x2a0\n xfrm_dev_state_flush+0x353/0x400\n xfrm_dev_event+0x26d/0x3a0\n notifier_call_chain+0xc0/0x280\n __dev_notify_flags+0x169/0x250\n netif_change_flags+0xe7/0x160\n dev_change_flags+0x96/0x220\n devinet_ioctl+0x7f4/0x1880\n\n Allocated by task 87:\n xfrm_state_alloc+0x1e/0x5c0\n xfrm_add_sa+0xe7f/0x5820\n xfrm_user_rcv_msg+0x4f3/0x940\n\n Freed by task 57:\n kmem_cache_free+0xcb/0x3d0\n xfrm_state_gc_task+0x4a8/0x650\n process_one_work+0x63a/0x1070\n\nSerialize xfrm_state destruction against the deferred-device pass with a\nmutex. Keep xfrm_state_dev_gc_lock limited to list operations and retain\nthe existing callback and device-reference release ordering.\n\nFixes: 07b87f9eea0c (\"xfrm: Fix unregister netdevice hang on hardware offload.\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "d042487dc118e494db2e2c1382310255c90ff544", "tree": "c8835bdb1b8d1d44777303676e3dd7be3904701e", "parents": [ "4e9442ce551ebd84b52ad649df721e2dc28af95a" ], "author": { "name": "Roshan Kumar", "email": "roshaen09@gmail.com", "time": "Tue Jul 28 10:56:08 2026 +0530" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Aug 18 12:15:41 2026 +0200" }, "message": "xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()\n\niptfs_skb_reset_frag_walk() advances to the fragment containing @offset\nwith an unbounded loop:\n\n\twhile (offset \u003e\u003d walk-\u003epast + walk-\u003efrags[walk-\u003efragi].len)\n\t\twalk-\u003epast +\u003d walk-\u003efrags[walk-\u003efragi++].len;\n\nwalk-\u003efragi is advanced and walk-\u003efrags[walk-\u003efragi] is dereferenced\nwithout ever checking fragi against walk-\u003enr_frags. When the requested\noffset is at or beyond the total length spanned by the walk\u0027s fragments,\nfragi runs past nr_frags and off the end of the fixed-size on-stack\nfrags[MAX_SKB_FRAGS + 1] array, reading out-of-bounds stack memory.\n\nThe two callers behave differently: iptfs_skb_add_frags() already guards\nagainst this with\n\n\tif (!walk-\u003enr_frags ||\n\t offset \u003e\u003d walk-\u003etotal + walk-\u003einitial_offset)\n\t\treturn len;\n\nbut iptfs_skb_can_add_frags() has no such guard and calls\niptfs_skb_reset_frag_walk() unconditionally, so it performs the\nout-of-range walk. Its own \"fragi \u003c walk-\u003enr_frags\" bound check runs only\nafterwards, too late to prevent the read.\n\nThis is reachable from the receive path: a crafted IP-TFS (AGGFRAG)\npayload delivered to an IPTFS SA drives iptfs_reassem_cont() -\u003e\niptfs_skb_can_add_frags() with an offset past the fragment total, e.g.:\n\n BUG: KASAN: stack-out-of-bounds in iptfs_skb_reset_frag_walk+0x235/0x250\n Read of size 4 at addr ffff888008ad7210 by task repro/345\n iptfs_skb_reset_frag_walk+0x235/0x250 net/xfrm/xfrm_iptfs.c:392\n iptfs_skb_can_add_frags+0x155/0x310 net/xfrm/xfrm_iptfs.c:420\n iptfs_reassem_cont+0xcf8/0x1140 net/xfrm/xfrm_iptfs.c:902\n iptfs_input_ordered+0x552/0x670 net/xfrm/xfrm_iptfs.c:1280\n iptfs_input+0x3d6/0xde0 net/xfrm/xfrm_iptfs.c:1741\n xfrm_input+0x282f/0x6140 net/xfrm/xfrm_input.c:700\n xfrm4_esp_rcv+0x93/0x120 net/ipv4/xfrm4_protocol.c:104\n ip_rcv+0x278/0x2d0 net/ipv4/ip_input.c:612\n\nGive iptfs_skb_can_add_frags() the same up-front guard that\niptfs_skb_add_frags() already has, so the walk is never entered with an\nout-of-range offset. When it triggers, the caller falls back to the\nexisting linearize-and-copy path, which is safe.\n\nFixes: 5f2b6a909574 (\"xfrm: iptfs: add skb-fragment sharing code\")\nReported-by: Roshan Kumar \u003croshaen09@gmail.com\u003e\nSigned-off-by: Roshan Kumar \u003croshaen09@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "4e9442ce551ebd84b52ad649df721e2dc28af95a", "tree": "6acd8871083151c120a76962bb1a0a59dabad8ee", "parents": [ "0fda52de8bbd4ca9a852c8a7ef6536cf82bd71fd" ], "author": { "name": "Zihan Xi", "email": "zihanx@nebusec.ai", "time": "Mon Aug 17 19:09:56 2026 +0000" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Aug 18 07:35:01 2026 +0200" }, "message": "xfrm: bound nat keepalive state collection\n\nThe v1 nat keepalive fix allocates a GFP_ATOMIC object for every state\nwhile collecting references for phase two. This makes the worker\u0027s\ntemporary memory use depend on the number of states and lets -ENOMEM abort\nthe scan.\n\nReplace the allocated list with a fixed-size batch. When the batch is full,\nreturn a private walk status so xfrm_state_walk() leaves a cursor; drain\nthe references after the walk releases xfrm_state_lock and resume from\nthe cursor. This bounds temporary memory use and avoids the allocation\nfailure path.\n\nThe v1 fix also moved nat_keepalive_send() out of the walk callback. Keep\nthe phase-two drain BH-disabled, as required by local_lock_nested_bh()\nused by the keepalive sockets.\n\nFixes: 763fe700b7c5 (\"xfrm: avoid lock inversion in nat keepalive work\")\nCc: stable@vger.kernel.org\nCc: Eyal Birger \u003ceyal.birger@gmail.com\u003e\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nAssisted-by: Codex:gpt-5.4\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "0fda52de8bbd4ca9a852c8a7ef6536cf82bd71fd", "tree": "847c98cd0bc943ad26a77456a3103f31e81fc883", "parents": [ "c12cbf56320fb633484ee0ca1fb7d68d6b64b213" ], "author": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Aug 17 07:17:58 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Aug 17 07:17:58 2026 +0200" }, "message": "Revert \"esp: do not unref managed frag pages in esp_ssg_unref()\"\n\nThis reverts commit 21697720ff43b8dfa25b8e8d9ca7f56f4597fc80.\n\nThe patch does not fix the issue completely, so revert for\nnow and wait for an updated version.\n\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "c12cbf56320fb633484ee0ca1fb7d68d6b64b213", "tree": "66f14b8a1a5ab0ecebdf98f292814b5a65f882ec", "parents": [ "7bad4bda74dc4713f398d3b7624ff05478e3a568" ], "author": { "name": "Zihan Xi", "email": "zihanx@nebusec.ai", "time": "Tue Jul 28 01:30:32 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Jul 28 10:48:18 2026 +0200" }, "message": "xfrm: fix xfrm_state_construct() auth-trunc leak\n\nattach_auth_trunc() can allocate x-\u003eaalg while leaving\nx-\u003eprops.aalgo at zero when the selected auth algorithm has no\nsadb_alg_id. One real case is cmac(aes).\n\nxfrm_state_construct() then treats !x-\u003eprops.aalgo as \"no auth\nalgorithm attached yet\" and calls attach_auth(). That overwrites\nx-\u003eaalg and loses the first allocation. Any later failure or teardown\nonly frees the replacement pointer.\n\nCheck whether x-\u003eaalg is already attached instead of inferring that\nstate from x-\u003eprops.aalgo.\n\nFixes: 4447bb33f094 (\"xfrm: Store aalg in xfrm_state with a user specified truncation length\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nAssisted-by: Codex:gpt-5.4\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nSigned-off-by: Ren Wei \u003cenjou1224z@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "7bad4bda74dc4713f398d3b7624ff05478e3a568", "tree": "2edaa892bd2b213f40f79fe4c558b8763a6e0dd1", "parents": [ "2aed51fc58d9ce450e2c116efb956160fd06fa02" ], "author": { "name": "Asim Viladi Oglu Manizada", "email": "manizada@pm.me", "time": "Thu Jul 23 09:35:48 2026 +0000" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Jul 27 09:40:23 2026 +0200" }, "message": "xfrm: ah6: validate routing header segments_left\n\nAH6 rearranges routing-header addresses before computing or verifying the\nICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than\nthe number of addresses described by the routing header\u0027s hdrlen field.\n\nThat assumption does not hold for raw IPv6 HDRINCL packets. A packet with\nhdrlen equal to 2 describes one address, but can carry an arbitrary\nsegments_left value. With segments_left equal to 255, the function moves\nits address pointer 4,064 bytes backwards and passes a 4,064-byte length to\nmemmove(), resulting in an out-of-bounds access.\n\nValidate the invariant locally before modifying the routing header or\nperforming any address-pointer arithmetic, and propagate malformed-header\nerrors to the existing AH6 input and output error paths.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nAssisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix\nSigned-off-by: Asim Viladi Oglu Manizada \u003cmanizada@pm.me\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "2aed51fc58d9ce450e2c116efb956160fd06fa02", "tree": "206bc78a832dbd4f9dcc4530770712a816c04b54", "parents": [ "763fe700b7c58ad64fe5202c5638848244dd4127" ], "author": { "name": "Sanghyun Park", "email": "sanghyun.park.cnu@gmail.com", "time": "Wed Jul 22 16:28:38 2026 +0900" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Thu Jul 23 10:07:21 2026 +0200" }, "message": "xfrm: Fix skb double-free in xfrm_dev_direct_output()\n\nA return value other than 1 from local_out() means that the skb has been\nconsumed or its ownership was transferred. xfrm_dev_direct_output()\nnevertheless frees the skb on this path, causing a double-free when\nnetfilter drops the packet and invalidating any other owner.\n\nReturn the local_out() result directly, matching the ownership handling\nin xfrm_output_resume().\n\nFixes: 5eddd76ec2fd (\"xfrm: fix tunnel mode TX datapath in packet offload mode\")\nSigned-off-by: Sanghyun Park \u003csanghyun.park.cnu@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "763fe700b7c58ad64fe5202c5638848244dd4127", "tree": "223a657f0b72c286e74dc20dac574a85f69f811d", "parents": [ "e1d7c5ac1c246ce5775f604515de0a59fbf2116e" ], "author": { "name": "Zihan Xi", "email": "xizh2024@lzu.edu.cn", "time": "Tue Jul 21 23:25:42 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Thu Jul 23 10:07:20 2026 +0200" }, "message": "xfrm: avoid lock inversion in nat keepalive work\n\nnat_keepalive_work() walks the state table while xfrm_state_walk()\nholds net-\u003exfrm.xfrm_state_lock. Its callback then acquires x-\u003elock,\nwhich conflicts with the delete path taking the same locks in reverse\norder via xfrm_state_delete() and __xfrm_state_delete(). This creates\nan AB-BA deadlock that is reported by lockdep when a NAT keepalive\nworker races with SA deletion.\n\nFix this by splitting the keepalive walk into two phases. First,\ncollect the candidate states while the walk holds xfrm_state_lock and\ntake a reference on each state. Then, after the walk completes, process\neach collected state and acquire x-\u003elock without nesting it under\nxfrm_state_lock.\n\nFixes: f531d13bdfe3 (\"xfrm: support sending NAT keepalives in ESP in UDP states\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nAssisted-by: Codex:gpt-5.4\nSigned-off-by: Zihan Xi \u003cxizh2024@lzu.edu.cn\u003e\nSigned-off-by: Ren Wei \u003cenjou1224z@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "e1d7c5ac1c246ce5775f604515de0a59fbf2116e", "tree": "bd0b13eeb0ec0e57cc2956eb3ad777a14cac4624", "parents": [ "deb232e884877bf10b4ce2580909eedec986c284" ], "author": { "name": "Zhiling Zou", "email": "roxy520tt@gmail.com", "time": "Sat Jul 18 15:12:50 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Jul 20 12:24:33 2026 +0200" }, "message": "xfrm: drop ESP-in-TCP packets with no ingress device\n\nESP-in-TCP receives records through the TCP strparser. handle_esp()\nrestores skb-\u003edev from the saved skb_iif before passing the packet into\nthe XFRM input path.\n\nQueued TCP data can be processed after the original ingress device has\nbeen removed, for example during veth or net namespace teardown. In that\ncase dev_get_by_index_rcu() returns NULL. The XFRM IPv4 and IPv6 input\npaths both expect skb-\u003edev to be valid while building the route lookup,\nso queued ESP-in-TCP data can dereference a NULL device.\n\nDrop the packet if the saved ingress device can no longer be resolved.\nSuch a packet can no longer be routed through the normal XFRM receive\npath, and this preserves the existing behaviour for packets whose ingress\ndevice still exists.\n\nFixes: e27cca96cd68 (\"xfrm: add espintcp (RFC 8229)\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nSigned-off-by: Zhiling Zou \u003croxy520tt@gmail.com\u003e\nAssisted-by: Codex:gpt-5.4\nReviewed-by: Ren Wei \u003cenjou1224z@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "deb232e884877bf10b4ce2580909eedec986c284", "tree": "71ea1bb5c34ebbd55343935634becc21d04d1608", "parents": [ "21697720ff43b8dfa25b8e8d9ca7f56f4597fc80" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Thu Jul 16 22:54:59 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Jul 20 12:21:12 2026 +0200" }, "message": "xfrm: espintcp: fix UAF during close\n\nZDI reported and analyzed a race condition during close for espintcp\nsockets:\n\n espintcp_close() frees emsg-\u003eskb via kfree_skb() without holding\n any socket lock. Concurrently, the xfrm_trans_reinject work queue\n invokes esp_output_tcp_finish() -\u003e espintcp_push_skb() -\u003e\n espintcp_push_msgs() -\u003e skb_send_sock_locked(), which reads the\n same skb as a data source.\n\nFix this by adding a synchronize_rcu() call after resetting sk_prot,\nsince esp_output_tcp_finish() runs under RCU and won\u0027t use a socket\nwith sk_prot \u003d\u003d \u0026tcp_prot. Simply taking the socket lock in\nespintcp_close() could lead to leaks, if esp_output_tcp_finish()\nre-adds an skb in the slot we just freed. After this, the existing\nbarrier() is no longer needed.\n\nCc: stable@vger.kernel.org\nFixes: e27cca96cd68 (\"xfrm: add espintcp (RFC 8229)\")\nReported-by: zdi-disclosures@trendmicro.com\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "21697720ff43b8dfa25b8e8d9ca7f56f4597fc80", "tree": "778ba19ff2132afcb82c76fa165ca5458c416787", "parents": [ "5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc" ], "author": { "name": "Maher Azzouzi", "email": "maherazz04@gmail.com", "time": "Sun Jul 12 18:05:30 2026 +0100" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Jul 13 09:30:19 2026 +0200" }, "message": "esp: do not unref managed frag pages in esp_ssg_unref()\n\nesp_ssg_unref() releases the page references held on the source\nscatterlist after the AEAD operation completes. It calls\nskb_page_unref() on every frag page for an out-of-place transform\n(req-\u003esrc !\u003d req-\u003edst), and in the error path of esp_output_tail()\n(already_unref \u003d\u003d true) on the request\u0027s own scatterlist.\n\nThis is wrong when the skb carries managed frags\n(SKBFL_MANAGED_FRAG_REFS). Managed frags are owned by a zerocopy ubuf\nand the skb does not hold a per-frag page reference; io_uring SEND_ZC\nwith a registered buffer attaches the bvec pages this way via\nio_sg_from_iter(). The rest of the stack honours this invariant:\nskb_release_data() skips the per-frag unref when SKBFL_MANAGED_FRAG_REFS\nis set, and skb_zcopy_managed() is the guard used at the other unref\nsites.\n\nesp_ssg_unref() is missing that guard, so for a managed-frag skb it\ndrops a page reference the skb never acquired. This can underflow the\npage reference count and free a page that is still in use.\n\nGuard the function with skb_zcopy_managed() so both unref paths are\nskipped for managed-frag skbs, matching skb_release_data().\n\nFixes: cac2661c53f3 (\"esp4: Avoid skb_cow_data whenever possible\")\nFixes: 03e2a30f6a27 (\"esp6: Avoid skb_cow_data whenever possible\")\nSigned-off-by: Maher Azzouzi \u003cmaherazz04@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc", "tree": "53f826798095e0cb14fc39b931ed6b7afb04869e", "parents": [ "3f1f755366687d051174739fb99f7d560202f60b" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Sat Jul 04 14:03:32 2026 -0700" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Jul 13 09:30:18 2026 +0200" }, "message": "xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full\n\nThe depth check in xfrm6_input_addr() is off by one:\n\n if (1 + sp-\u003elen \u003d\u003d XFRM_MAX_DEPTH)\n goto drop;\n ...\n sp-\u003exvec[sp-\u003elen++] \u003d x;\n\nxfrm_input() can leave sp-\u003elen \u003d\u003d XFRM_MAX_DEPTH, and the transport-mode\nreceive path re-enters IPv6 input via xfrm_trans_reinject() with that\nsecpath preserved. If the inner packet carries a destination-options HAO\noption or a type-2 routing header, xfrm6_input_addr() is called with\nsp-\u003elen \u003d\u003d XFRM_MAX_DEPTH; the check (1 + 6 \u003d\u003d 6) is false, so\nsp-\u003exvec[sp-\u003elen++] writes one slot past the 6-element xvec[]. The write\nstays within the sec_path allocation (invisible to KASAN); UBSAN_BOUNDS\nflags it and panics under panic_on_warn.\n\nUse \"sp-\u003elen \u003e\u003d XFRM_MAX_DEPTH\", matching xfrm_input(). This also\nrestores one chain level the old check rejected at sp-\u003elen \u003d\u003d 5.\n\n UBSAN: array-index-out-of-bounds in net/ipv6/xfrm6_input.c:309:10\n index 6 is out of range for type \u0027xfrm_state *[6]\u0027\n\nFixes: 9473e1f631de (\"[XFRM] MIPv6: Fix to input RO state correctly.\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "3f1f755366687d051174739fb99f7d560202f60b", "tree": "21303d96eb90a3f888c1975b0d6bb319095ba0ad", "parents": [ "7410d11460eb90d6c9281162ccc6a128534d897d" ], "author": { "name": "Asim Viladi Oglu Manizada", "email": "manizada@pm.me", "time": "Mon Jul 06 09:44:10 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Sat Jul 11 13:09:11 2026 +0200" }, "message": "net: openvswitch: reject oversized nested action attrs\n\nOpen vSwitch stores generated flow actions as nlattrs, whose nla_len\nfield is u16. Commit a1e64addf3ff (\"net: openvswitch: remove\nmisbehaving actions length check\") allowed the total sw_flow_actions\nstream to grow beyond 64 KiB, which is valid, but also removed the last\nguard preventing a generated nested action attribute from exceeding\nU16_MAX.\n\nAn oversized generated container can thus be closed with a truncated\nnla_len. A later dump or teardown then walks a structurally different\nstream than the one that was validated. In particular, an oversized\nnested CLONE/CT action may cause subsequent bytes in the generated\nstream to be interpreted as independent actions.\n\nKeep the larger total-action-stream behavior, but make nested action\nclose reject generated containers that do not fit in nla_len, and return\nthe error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and\nCHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse\nconstruction order before discarding failed wrappers, so resources copied\ninto the rejected tails are released before the wrappers are removed.\n\nMost failed outer wrappers are discarded by truncating actions_len after\nchild resources have been released. CHECK_PKT_LEN also trims its parent\nafter branch resources are gone. SET/TUNNEL close failures unwind their\nknown tun_dst ownership directly, and SET_TO_MASKED has no external\nownership and truncates on close failure.\n\nFixes: a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\")\nCc: stable@vger.kernel.org\nAssisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix\nSigned-off-by: Asim Viladi Oglu Manizada \u003cmanizada@pm.me\u003e\nReviewed-by: Eelco Chaudron \u003cechaudro@redhat.com\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nLink: https://patch.msgid.link/20260706094336.38639-1-manizada@pm.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7410d11460eb90d6c9281162ccc6a128534d897d", "tree": "8bd14ae2e646a958030be512f1b65dbfd4f74262", "parents": [ "389704eb516b04c31f1b772f6385fd6ff1ba1b9a" ], "author": { "name": "James Raphael Tiovalen", "email": "jamestiotio@gmail.com", "time": "Sun Jul 05 19:36:29 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Sat Jul 11 12:52:15 2026 +0200" }, "message": "macsec: fix promiscuity refcount leak in macsec_dev_open()\n\nWhen a MACsec interface with IFF_PROMISC set is brought up on top of a\ndevice that has hardware offload enabled, macsec_dev_open() first calls\ndev_set_promiscuity(real_dev, 1) and then propagates the open to the\noffload device. If that propagation fails, the error path jumps to the\nclear_allmulti label, which only reverts allmulti and the unicast\naddress. The promiscuity taken on the lower device is never dropped, so\nreal_dev is left permanently stuck in promiscuous mode. Its promiscuity\ncount can no longer be balanced from software.\n\nAdd a clear_promisc label that drops the promiscuity reference and\nroute the two offload failure paths to it. The dev_set_promiscuity()\nfailure itself still jumps to clear_allmulti, since on that failure the\ncount was not incremented.\n\nFixes: 3cf3227a21d1 (\"net: macsec: hardware offloading infrastructure\")\nCc: stable@vger.kernel.org\nSigned-off-by: James Raphael Tiovalen \u003cjamestiotio@gmail.com\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://patch.msgid.link/20260705113629.187490-1-jamestiotio@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "389704eb516b04c31f1b772f6385fd6ff1ba1b9a", "tree": "e2329b073eec35b1f533d6e221b8f1a6ce72676e", "parents": [ "1cd23ca80784223fa2204e16203f754da4e821f8", "f38f8cce2f7e79775b3db7e8a5eacda04ac908e4" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Sat Jul 11 12:48:08 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Sat Jul 11 12:48:08 2026 +0200" }, "message": "Merge tag \u0027ipsec-2026-07-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2026-07-10\n\n1) xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()\n Return -EINPROGRESS from xfrm_output_one when validate_xmit_xfrm\n requeues the packet asynchronously, so the caller doesn\u0027t treat it\n as a real error and free the skb.\n\n2) xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment\n Re-derive skb-\u003eprev from the fragment list after async crypto splits\n a GSO skb, keeping the linked-list pointers validi.\n\n3) xfrm: nat_keepalive: avoid double free on send error\n Hold a state ref while the nat_keepalive timer is active and drop the\n timer before freeing the state, preventing a re-entered free on send\n error.\n\n4) xfrm: fix sk_dst_cache double-free in xfrm_user_policy()\n Null the skb dst cache before freeing the policy so a later skb\n destructor doesn\u0027t double-free it.\n\n5) xfrm: cache the offload ifindex for netlink dumps\n Cache the device ifindex at state-add time and use it for netlink\n dumps instead of dereferencing dst-\u003edev, which may have changed by\n the time the dump runs.\n\n6) xfrm: reject optional IPTFS templates in outbound policies\n Reject outbound policies with an optional IPTFS template,\n IPTFS must always be used if configured.\n\n7) xfrm: clear mode callbacks after failed mode setup\n Clear the mode-\u003einit_flags and init_state callbacks on the error path\n after xfrm_init_mode fails, so a partially-initialised mode isn\u0027t\n reused in xfrm_state_construct.\n\n8) xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()\n Propagate SKBFL_SHARED_FRAG from the original skb to fragments\n allocated by iptfs_skb_add_frags, keeping shared-fragment accounting\n correct after IPTFS reassembly.\n\n9) xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()\n Clear dst-\u003edev on the error path of xfrm6_fill_dst() so the caller\n doesn\u0027t release the netdev reference twice via dst_release.\n\n10) xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert\n Preallocate all inexact hash bins before existing entries are\n reinserted during xfrm_hash_rebuild, so reinsertion always hits an\n existing bin.\n\nPlease pull or let me know if there are problems.\n\nipsec-2026-07-10\n\n* tag \u0027ipsec-2026-07-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:\n xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert\n xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()\n xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()\n xfrm: clear mode callbacks after failed mode setup\n xfrm: reject optional IPTFS templates in outbound policies\n xfrm: cache the offload ifindex for netlink dumps\n xfrm: fix sk_dst_cache double-free in xfrm_user_policy()\n xfrm: nat_keepalive: avoid double free on send error\n xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment\n xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260710090349.343389-1-steffen.klassert@secunet.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1cd23ca80784223fa2204e16203f754da4e821f8", "tree": "ddb8350c4c33f193cf82c6e444e579ca41c5d86b", "parents": [ "a0d82fb8505326cbc53dc9a0c08f97d11197bb30" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Fri Jul 03 20:35:46 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 10 16:51:34 2026 +0200" }, "message": "sctp: validate STALE_COOKIE cause length before reading staleness\n\nWhen an ERROR chunk with a STALE_COOKIE cause is received in the\nCOOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure\nof Staleness that follows the cause header:\n\n\terr \u003d (struct sctp_errhdr *)(chunk-\u003eskb-\u003edata);\n\tstale \u003d ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));\n\nerr is the first cause in the chunk, not the STALE_COOKIE cause that\ncaused the dispatch, and nothing guarantees the staleness field is\npresent. sctp_walk_errors() only requires a cause to be as long as the\n4-byte header, so for a STALE_COOKIE cause of length 4 the read runs\npast the cause, and for a minimal ERROR chunk past skb-\u003etail. The value\nis echoed to the peer in the Cookie Preservative of the reply INIT,\nleaking uninitialized memory.\n\nsctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so\ncheck its length there and pass it to sctp_sf_do_5_2_6_stale(), which\nreads that cause instead of the first one. A STALE_COOKIE cause too\nshort to hold the staleness field is discarded.\n\nThe read is reachable by any peer that can drive an association into\nCOOKIE_ECHOED, including an unprivileged process using a raw SCTP socket\nin a user and network namespace.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nAssisted-by: Claude:claude-opus-4-8\nCc: stable@vger.kernel.org\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/20260704033545.2438373-2-bestswngs@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a0d82fb8505326cbc53dc9a0c08f97d11197bb30", "tree": "8c14417c2385a8671fb613af9af287861223643f", "parents": [ "4fa349156043dc119721d067329714179f501749", "cb8afea4655ff004fa7feee825d5c79783525383" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 10 16:27:44 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 10 16:27:45 2026 +0200" }, "message": "Merge tag \u0027wireless-2026-07-09\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nToo many robustness fixes to list. Mostly for\n - slight out-of-bounds reads of SKBs,\n - leaks on error conditions, and\n - malformed netlink input rejection.\n\n* tag \u0027wireless-2026-07-09\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (46 commits)\n wifi: cfg80211: bound element ID read when checking non-inheritance\n wifi: brcmfmac: cyw: fix heap overflow on a short auth frame\n wifi: brcmfmac: initialize SDIO data work before cleanup\n wifi: cfg80211: validate assoc response length before status and IE access\n wifi: cfg80211: validate rx/tx MLME callback frame lengths before access\n wifi: mac80211: ibss: wait for in-flight TX on disconnect\n wifi: mac80211: recalculate rx_nss on IBSS peer capability update\n wifi: cfg80211: use wiphy work for socket owner autodisconnect\n wifi: mac80211: fix memory leak in ieee80211_register_hw()\n wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock\n wifi: mac80211: validate deauth frame length before reason access\n wifi: mac80211: avoid non-S1G AID fallback for S1G assoc\n wifi: cfg80211: reject empty PMSR peer lists\n wifi: cfg80211: reject unsupported PMSR FTM location requests\n wifi: cfg80211: validate PMSR FTM preamble range\n wifi: cfg80211: validate PMSR measurement type data\n wifi: nl80211: constrain MBSSID TX link ID range\n wifi: nl80211: validate nested MBSSID IE blobs\n wifi: ieee80211: validate MLE common info length\n wifi: cfg80211: derive S1G beacon TSF from S1G fields\n ...\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260709115038.243870-3-johannes@sipsolutions.net\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4fa349156043dc119721d067329714179f501749", "tree": "39e4f1b0afa78cd461c8a51293879d5e8b66f985", "parents": [ "f2f152e94a67bc746afaf05a1b2702c195553112" ], "author": { "name": "Bryam Vargas", "email": "hexlabsecurity@proton.me", "time": "Sun Jul 05 22:24:36 2026 -0500" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 10 16:24:43 2026 +0200" }, "message": "net/iucv: take a reference on the socket found in afiucv_hs_rcv()\n\nafiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock,\ndrops the lock, and then passes the socket to the afiucv_hs_callback_*()\nhandlers without holding a reference. AF_IUCV sockets are not\nRCU-protected and are freed synchronously by iucv_sock_kill() -\u003e\nsock_put(), so a concurrent close can free the socket in the window\nbetween read_unlock() and the handler, which then dereferences freed\nmemory (for example sk-\u003esk_data_ready() in afiucv_hs_callback_syn()).\n\nTake a reference with sock_hold() while the socket is still on the list\nand release it with sock_put() once the handler has run.\n\nFixes: 3881ac441f64 (\"af_iucv: add HiperSockets transport\")\nSigned-off-by: Bryam Vargas \u003chexlabsecurity@proton.me\u003e\nReviewed-by: Hidayath Khan \u003chidayath@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20260705-b4-disp-fc79c0dc-v1-1-d2cdcb57afa9@proton.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f2f152e94a67bc746afaf05a1b2702c195553112", "tree": "ee0f47749efde660c33cfa8457f96849cc6538fd", "parents": [ "ec4215683e47424c9c4762fd3c60f552a3119142" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Sat Jul 04 10:14:21 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 10 16:00:41 2026 +0200" }, "message": "ipv4: fib: free fib_alias with kfree_rcu() on insert error path\n\nfib_table_insert() publishes new_fa into the leaf\u0027s fa_list with\nfib_insert_alias() before calling the fib entry notifiers. When a\nnotifier fails, the error path removes new_fa with fib_remove_alias()\n(hlist_del_rcu) and frees it right away with kmem_cache_free().\n\nfib_table_lookup() walks that list under rcu_read_lock() only, so a\nconcurrent lookup that already reached new_fa keeps reading it after the\nfree:\n\n BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601)\n Read of size 1 at addr ffff88810676d4eb by task exploit/297\n Call Trace:\n fib_table_lookup (net/ipv4/fib_trie.c:1601)\n ip_route_output_key_hash_rcu (net/ipv4/route.c:2814)\n ip_route_output_key_hash (net/ipv4/route.c:2705)\n __ip4_datagram_connect (net/ipv4/datagram.c:49)\n udp_connect (net/ipv4/udp.c:2144)\n __sys_connect (net/socket.c:2167)\n __x64_sys_connect (net/socket.c:2173)\n do_syscall_64\n entry_SYSCALL_64_after_hwframe\n which belongs to the cache ip_fib_alias of size 56\n\nTriggering the error path needs CAP_NET_ADMIN and a registered fib\nnotifier that can reject a route; a netdevsim device whose IPv4 FIB\nresource is exhausted is enough.\n\nFree new_fa with alias_free_mem_rcu(), as fib_table_delete() already\ndoes for a fib_alias removed from the trie.\n\nFixes: a6c76c17df02 (\"ipv4: Notify route after insertion to the routing table\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260704171421.1786806-1-bestswngs@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ec4215683e47424c9c4762fd3c60f552a3119142", "tree": "c5efdc02ebba9db254e1da095d523ee0bbb5a253", "parents": [ "2c7c88a412aa6d09cd04b414211b4ef8553b5309" ], "author": { "name": "Norbert Szetei", "email": "norbert@doyensec.com", "time": "Mon Jul 06 11:01:59 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 10 13:31:47 2026 +0200" }, "message": "ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n\npppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:\n\n l2tp_udp_encap_recv() -\u003e l2tp_recv_common() -\u003e pppol2tp_recv()\n -\u003e ppp_input(\u0026po-\u003echan)\n\nIt runs under rcu_read_lock() holding only an l2tp_session reference and\ntakes NO reference on the internal PPP channel (struct channel,\nchan-\u003eppp) that ppp_input() dereferences.\n\nThe pppox socket is SOCK_RCU_FREE, so \u0027po\u0027 and the embedded ppp_channel\nare RCU-safe. But the internal struct channel is a separate allocation\nthat ppp_release_channel() frees with a plain kfree():\n\n close(data socket) -\u003e pppol2tp_release() -\u003e pppox_unbind_sock()\n -\u003e ppp_unregister_channel() -\u003e ppp_release_channel() -\u003e kfree(pch)\n\nFor a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit\n(no PPPIOCCONNECT, pch-\u003eppp \u003d\u003d NULL) and not bridged, teardown skips\nboth ppp_disconnect_channel()\u0027s synchronize_net() and\nppp_unbridge_channels()\u0027s synchronize_rcu(), so the kfree() has no grace\nperiod. rcu_read_lock() in pppol2tp_recv() does not protect against a\nplain kfree(), so an in-flight ppp_input() on one CPU can dereference\nthe channel just freed by close() on another CPU.\n\nThe bug is reachable by an unprivileged user.\n\nDefer the channel free to an RCU callback via call_rcu() so the grace\nperiod fences any in-flight ppp_input(). The disconnect and unbridge\nteardown paths already fence with synchronize_net()/synchronize_rcu();\ncall_rcu() does the same here without stalling the close() path.\n\nFixes: ee40fb2e1eb5 (\"l2tp: protect sock pointer of struct pppol2tp_session with RCU\")\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nReviewed-by: Qingfang Deng \u003cqingfang.deng@linux.dev\u003e\nLink: https://patch.msgid.link/E793FCF2-58DE-4387-A983-C7B4BC3158BD@doyensec.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2c7c88a412aa6d09cd04b414211b4ef8553b5309", "tree": "79b8874287ea0f25641f509a0dec4591555a5711", "parents": [ "6bad2e38fe7f2da7dc982b2b80814e632832e568", "f5089008f90c0a7c5520dff3934e0af00adf322d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 09 08:26:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 09 08:26:51 2026 -0700" }, "message": "Merge tag \u0027net-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter, Bluetooth and batman-adv.\n\n Current release - regressions:\n\n - bluetooth: fix using chan-\u003econn as indication to no remote netdev\n\n Current release - new code bugs:\n\n - netfilter: cap to maximum number of expectation per master on\n updates\n\n Previous releases - regressions:\n\n - bluetooth:\n - fix UAF of hci_conn_params in add_device_complete\n - fix null ptr deref in hci_abort_conn()\n\n - igmp: remove multicast group from hash table on device destruction\n\n - batman-adv: prevent TVLV OOB check overflow\n\n - eth: mlx5/mlx5e:\n - fix off-by-one in single-FDB error rollback\n - skip peer flow cleanup when LAG seq is unavailable\n - fix crashes in dynamic per-channel stats and HV VHCA agent\n\n - eth: mana: Sync page pool RX frags for CPU\n\n Previous releases - always broken:\n\n - netfilter:\n - mark malformed IPv6 extension headers for hotdrop\n - terminate table name before find_table_lock()\n - ipvs: use parsed transport offset in TCP state lookup\n\n - sched: act_pedit: fix TOCTOU heap OOB write in tc offload\n\n - ethtool: rss: fix hfunc and input_xfrm parsing on big endian\n\n - ipv4/ipv6: fix UAF and memory leak in IGMP/MLD\n\n - tls: consume empty data records in tls_sw_read_sock()\n\n - eth:\n - octeontx2-af: fix VF bringup affecting PF promiscuous state\n - gue: validate REMCSUM private option length\"\n\n* tag \u0027net-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (94 commits)\n macsec: don\u0027t read an unset MAC header in macsec_encrypt()\n dibs: loopback: validate offset and size in move_data()\n octeontx2-af: fix VF bringup affecting PF promiscuous state\n ethtool: rss: Fix hfunc and input_xfrm parsing on big endian\n net/mlx5: Fix L3 tunnel entropy refcount leak\n net: macb: drop in-flight Tx SKBs on close\n net: mana: Sync page pool RX frags for CPU\n net: mana: Validate the packet length reported by the NIC\n selftests/net: fix EVP_MD_CTX leak in tcp_mmap\n ipvs: ensure inner headers in ICMP errors are in headroom\n ipvs: use parsed transport offset in SCTP state lookup\n ipvs: use parsed transport offset in TCP state lookup\n ipvs: pass parsed transport offset to state handlers\n netfilter: handle unreadable frags\n netfilter: flowtable: support IPIP tunnel with direct xmit\n netfilter: flowtable: IPIP tunnel hardware offload is not yet support\n netfilter: flowtable: use dst in this direction when pushing IPIP header\n netfilter: ipset: allocate the proper memory for the generic hash structure\n netfilter: ipset: cleanup the add/del backlog when resize failed\n netfilter: ipset: exclude gc when resize is in progress\n ...\n" }, { "commit": "f5089008f90c0a7c5520dff3934e0af00adf322d", "tree": "9aa744bbade5e6d2a7146aa3bcbb0ba8bfaa880e", "parents": [ "78237e3c0720fcc6eb9b87e90fd70f63eeca886f" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Fri Jul 03 17:36:33 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 13:05:04 2026 +0200" }, "message": "macsec: don\u0027t read an unset MAC header in macsec_encrypt()\n\nmacsec_encrypt() reads the Ethernet header via eth_hdr(skb)\n(skb-\u003ehead + skb-\u003emac_header) to memmove() the 12 source/destination MAC\nbytes forward and make room for the SecTAG.\n\nOn the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb\nreaches the macsec ndo_start_xmit() with the MAC header unset, so\neth_hdr(skb) resolves to skb-\u003ehead + (u16)~0 and the read is out of\nbounds: a 12-byte heap over-read that is also emitted on the wire as the\nframe\u0027s outer source/destination MAC. KASAN reports a slab-out-of-bounds\nread in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET\nbuild flags it as an unset mac header in skb_mac_header().\n\nOn the TX path the L2 header is at skb-\u003edata, so use skb_eth_hdr(), added\nby commit 96cc4b69581d (\"macvlan: do not assume mac_header is set in\nmacvlan_broadcast()\") for exactly this purpose.\n\nFixes: c09440f7dcb3 (\"macsec: introduce IEEE 802.1AE driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://patch.msgid.link/20260703083634.2035145-1-4ncienth@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "78237e3c0720fcc6eb9b87e90fd70f63eeca886f", "tree": "626153581998515ed11af65563ec77f9bbc52837", "parents": [ "fabb881df322da25442f98d23f5fa371e3c78ec4" ], "author": { "name": "Dust Li", "email": "dust.li@linux.alibaba.com", "time": "Tue Jul 07 15:43:18 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 12:44:00 2026 +0200" }, "message": "dibs: loopback: validate offset and size in move_data()\n\nThe loopback move_data() performs a memcpy into the registered DMB\nwithout checking whether offset + size exceeds the DMB length. Unlike\nreal ISM hardware, which enforces memory region bounds natively, the\nsoftware loopback has no such protection.\n\nA peer-supplied out-of-bounds offset or oversized write would result in\nan OOB write past the allocated kernel buffer. Add an explicit bounds\ncheck before the memcpy to reject such requests with -EINVAL.\n\nFixes: f7a22071dbf3 (\"net/smc: implement DMB-related operations of loopback-ism\")\nCc: stable@vger.kernel.org\nReported-by: Federico Kirschbaum \u003cfederico.kirschbaum@xbow.com\u003e\nSigned-off-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nReported-by: Baul Lee \u003cbaul.lee@xbow.com\u003e\nLink: https://patch.msgid.link/20260707074318.1448662-1-dust.li@linux.alibaba.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "fabb881df322da25442f98d23f5fa371e3c78ec4", "tree": "4e9eb98796be0e9a3e3cb9f272811f926b4c797e", "parents": [ "24c4c88259464d38b35c3fbaecb68675de64137d" ], "author": { "name": "Harman Kalra", "email": "hkalra@marvell.com", "time": "Thu Jul 02 10:26:16 2026 +0530" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 12:00:04 2026 +0200" }, "message": "octeontx2-af: fix VF bringup affecting PF promiscuous state\n\nMbox handling of nix_set_rx_mode for a VF with promiscuous and\nall_multi flags set to false causes deletion of the PF\u0027s promiscuous\nand allmulti MCAM rules. This occurs because the APIs that\nenable/disable these rules operate only on the PF, even when the\nmbox request is made via a VF interface.\n\nGuard both rvu_npc_enable_allmulti_entry() and\nrvu_npc_enable_promisc_entry() disable paths with an is_vf() check so\nthat a VF bringing up or tearing down its interface cannot inadvertently\nclear the PF\u0027s MCAM rules.\n\nFixes: 967db3529eca (\"octeontx2-af: add support for multicast/promisc packet replication feature\")\nSigned-off-by: Harman Kalra \u003chkalra@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nLink: https://patch.msgid.link/20260702045616.3002773-2-nshettyj@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "24c4c88259464d38b35c3fbaecb68675de64137d", "tree": "bd8b446a2d570f99eb0f7f0b6696585c11a01db3", "parents": [ "b62869a81a7ce388d1fbb0fac5fa8300ea614d81", "3f7a535ff0fa627a0132803e4c2f903ceffcbc1c" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:42:56 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:42:57 2026 +0200" }, "message": "Merge tag \u0027nf-26-07-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter: updates for net\n\nThe following patchset contains Netfilter fixes for *net*.\n\nMost of these are LLM fixes for old issues flagged by sashiko/LLMs.\n\nMany of these trigger drive-by-findings in sashiko. In particular:\n\n- many load/store tearing and missing memory barriers, races\n etc. in ipset, esp. with GC and resizing.\n Keeping the proposed patches spinning for yet-another-iteration\n keeps legit fixes back, so I prefer to add these now and follow\n up with other reports later.\n- flowtable work queue still has possible races with teardown,\n but same rationale as with ipset: drive-by findings, not\n problems coming with the flowtable IPIP changeset in this PR.\n- ever since unreadable frag skb support was added in 6.12, we can no\n longer do: BUG_ON(skb_copy_bits( ...): it will fire with such skbs.\n Mina Almasry is looking at similar patterns elsewhere in the stack.\n\n1) Guard skb-\u003emac_header adjustment after IPv6 defragmentation in\nnf_conntrack_reasm. From Xiang Mei.\n\n2) NUL-terminate ebtables table names before calling find_table_lock() to\nprevent stack-out-of-bounds reads. Also from Xiang Mei.\n\n3) Zero the ebtables chainstack array, else error unwind may free bogus\npointer when CPU mask is sparse. All three issues date from 2.6 days.\n\n4) Ensure ebtables module names are c-strings, same bug pattern as 2).\nBug added in 4.6.\n\n5) Fix catchall element handling for inverted lookups in nft_lookup. Fold the\ncatchall lookup into ext before computing the match status. Was like\nthis ever since catchall elements got introduced in 5.13.\nFrom Tamaki Yanagawa.\n\n6-9) ipset updates from Jozsef Kadlecsik:\n- mark rcu protected areas correctly\n- address gc and resize clash in the comment extension\n- add/del backlog cleanup in the error path\n- allocate right size for the generic hash structure\n\n10-12): IPIP flowtable updates from Pablo Neira Ayuso:\n - Use the current direction\u0027s route when pushing IPIP headers\n Fix incorrect headroom and fragmentation offset calculations.\n - Avoid hardware offload for IPIP tunnels due to lack of driver support.\n - Support IPIP tunnels with direct xmit in netfilter flowtable.\n dst_cache and dst_cookie are moved outside the union to share route\n state across flows. This is a followup to work done in 6.19 cycle.\n\n13) Don\u0027t BUG() on skb_copy_bits error. Handle unreadable fragments by\neither returning an error or restricting the copy operations to linear area,\nThis became an issue when unreable frag support was merged in 6.12.\n\n14-16): IPVS updates from Yizhou Zhao:\n - Pass parsed transport offset to IPVS state handlers.\n update callback signatures.\n - use correct transport header offset on state lookp in TCP.\n As-is it was possible for ipv6 extension header data to be\n treated as L4 header.\n - same for SCTP. This was also broken since 2.6 days.\n\n17) Ensure inner IP headers in ICMP errors are in the skb headroom after\nstripping outer headers. Add more checks for the length of inner headers.\nThis was broken since 3.7 days.\nFrom Julian Anastasov.\n\nnetfilter pull request nf-26-07-08\n\n* tag \u0027nf-26-07-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n ipvs: ensure inner headers in ICMP errors are in headroom\n ipvs: use parsed transport offset in SCTP state lookup\n ipvs: use parsed transport offset in TCP state lookup\n ipvs: pass parsed transport offset to state handlers\n netfilter: handle unreadable frags\n netfilter: flowtable: support IPIP tunnel with direct xmit\n netfilter: flowtable: IPIP tunnel hardware offload is not yet support\n netfilter: flowtable: use dst in this direction when pushing IPIP header\n netfilter: ipset: allocate the proper memory for the generic hash structure\n netfilter: ipset: cleanup the add/del backlog when resize failed\n netfilter: ipset: exclude gc when resize is in progress\n netfilter: ipset: mark the rcu locked areas properly\n netfilter: nft_lookup: fix catchall element handling with inverted lookups\n netfilter: ebtables: module names must be null-terminated\n netfilter: ebtables: zero chainstack array\n netfilter: ebtables: terminate table name before find_table_lock()\n netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260708140309.19633-1-fw@strlen.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b62869a81a7ce388d1fbb0fac5fa8300ea614d81", "tree": "d5c75ce06acb2855385de87132a2d45e3bb873ec", "parents": [ "c914307e1d41c2cb7bcdcbfde4cd2f214f6aa027" ], "author": { "name": "Gal Pressman", "email": "gal@nvidia.com", "time": "Mon Jul 06 08:50:17 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:38:30 2026 +0200" }, "message": "ethtool: rss: Fix hfunc and input_xfrm parsing on big endian\n\nETHTOOL_A_RSS_HFUNC and ETHTOOL_A_RSS_INPUT_XFRM are NLA_U32 attributes,\nbut ethnl_rss_set() and ethnl_rss_create_doit() parse them with\nethnl_update_u8(), which reads a single byte.\n\nOn little endian this happens to read the least significant byte and\nworks as long as the value fits in a byte. On big endian it reads the\nmost significant byte, so the requested value is parsed incorrectly.\n\nThe destination fields in struct ethtool_rxfh_param are u8, so the\nattribute can\u0027t be read directly with ethnl_update_u32().\nCap the hfunc policy at U8_MAX so an out of range value is rejected\ninstead of being silently truncated into the u8 field, and add\nethnl_update_u8_u32() to read the full u32 and narrow it into the u8\ndestination.\n\nFixes: 82ae67cbc423 (\"ethtool: rss: support setting hfunc via Netlink\")\nFixes: d3e2c7bab124 (\"ethtool: rss: support setting input-xfrm via Netlink\")\nFixes: a166ab7816c5 (\"ethtool: rss: support creating contexts via Netlink\")\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nReviewed-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nSigned-off-by: Gal Pressman \u003cgal@nvidia.com\u003e\nLink: https://patch.msgid.link/20260706055017.3355806-1-gal@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c914307e1d41c2cb7bcdcbfde4cd2f214f6aa027", "tree": "66917c2f86085c3b89699b4d67cc3e554dd92b0e", "parents": [ "604e9594449b9907181f4285d0cd6a398bfc9d08" ], "author": { "name": "Li RongQing", "email": "lirongqing@baidu.com", "time": "Fri Jul 03 22:14:23 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:21:12 2026 +0200" }, "message": "net/mlx5: Fix L3 tunnel entropy refcount leak\n\nmlx5_tun_entropy_refcount_inc() counts both VXLAN and L2-to-L3\ntunnel reformat entries as entropy-enabling users. The matching\ndecrement path only handled VXLAN, leaving L2-to-L3 tunnel entries\ncounted after release.\n\nHandle MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL in\nmlx5_tun_entropy_refcount_dec() as well so the enabling entry\nrefcount remains balanced.\n\nFixes: f828ca6a2fb6 (\"net/mlx5e: Add support for hw encapsulation of MPLS over UDP\")\nSigned-off-by: Li RongQing \u003clirongqing@baidu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260703141423.1723-1-lirongqing@baidu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "604e9594449b9907181f4285d0cd6a398bfc9d08", "tree": "395b56dae56453835477545e0b7f024f5d1aa001", "parents": [ "27f575836cfebbf872dec020428742b10650a955", "98052bdaf6ac1639a63ffc10244eeeab1f62ed2b" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:09:06 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:09:06 2026 +0200" }, "message": "Merge tag \u0027batadv-net-pullrequest-20260708\u0027 of https://git.open-mesh.org/batadv\n\nSimon Wunderlich says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nHere are some batman-adv bugfixes, all by Sven Eckelmann:\n\n - ensure minimal ethernet header on TX\n\n - fix VLAN priority offset\n\n - clean untagged VLAN on netdev registration failure\n\n - tt: avoid request storms during pending request\n\n - tt: prevent TVLV OOB check overflow\n\n - frag: free unfragmentable packet\n\n - frag: fix primary_if leak on failed linearization\n\n - mcast: avoid OOB read of num_dests header\n\n - dat: fix tie-break for candidate selection\n\n* tag \u0027batadv-net-pullrequest-20260708\u0027 of https://git.open-mesh.org/batadv:\n batman-adv: dat: fix tie-break for candidate selection\n batman-adv: mcast: avoid OOB read of num_dests header\n batman-adv: frag: fix primary_if leak on failed linearization\n batman-adv: frag: free unfragmentable packet\n batman-adv: tt: prevent TVLV OOB check overflow\n batman-adv: tt: avoid request storms during pending request\n batman-adv: clean untagged VLAN on netdev registration failure\n batman-adv: fix VLAN priority offset\n batman-adv: ensure minimal ethernet header on TX\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260708091821.314516-1-sw@simonwunderlich.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "27f575836cfebbf872dec020428742b10650a955", "tree": "ca480038eecbd50ba8886cc7f2591b7f2bc43d59", "parents": [ "c26c33e632248b334ccf132bc8c4877522c3db95" ], "author": { "name": "Théo Lebrun", "email": "theo.lebrun@bootlin.com", "time": "Thu Jul 02 17:37:02 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:48:15 2026 +0200" }, "message": "net: macb: drop in-flight Tx SKBs on close\n\nThe MACB driver has since forever leaked the outgoing SKBs that\nhave not yet been marked as completed. They live in queue-\u003etx_skb\nwhich gets freed without remorse nor checking.\n\nmacb_free_consistent() gets called in a few codepaths, but only close will\ntrigger the added expressions. In macb_open() and macb_alloc_consistent()\nfailure cases, queues\u0027 tx_skb just got allocated and are empty.\n\nFixes: 89e5785fc8a6 (\"[PATCH] Atmel MACB ethernet driver\")\nCc: stable@vger.kernel.org\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nSigned-off-by: Théo Lebrun \u003ctheo.lebrun@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-macb-drop-tx-v4-1-1c833eebdbc8@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c26c33e632248b334ccf132bc8c4877522c3db95", "tree": "c9e8da1ecae2640b4a8e55b82428d239ac99b0cc", "parents": [ "f4ef35efbb49527293309f668ea73ec5de9b8e7a", "c72a0f09c57f92113df69f9b902d11c9e4b132f5" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:36:14 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:36:15 2026 +0200" }, "message": "Merge branch \u0027fix-mana-rx-with-bounce-buffering\u0027\n\nDexuan Cui says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nFix MANA RX with bounce buffering\n\nWith swiotlb\u003dforce, the MANA NIC fails to work properly due to commit\n730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers instead\nof full pages to improve memory efficiency.\").\n\nThis happens because, with the standard MTU\u003d1500, the aforementioned\ncommit uses page pool frags with PP_FLAG_DMA_MAP, but fails to call\npage_pool_dma_sync_for_cpu() to sync the received packet for CPU acces\nbefore handing the RX buffer to the stack.\n\nHere patch #2 adds the required page_pool_dma_sync_for_cpu().\n\nPatch #1 validates the packet length reported by the NIC. With patch #2,\npage_pool_dma_sync_for_cpu() uses the packet length, so we don\u0027t want\nto blindly trust the packet length, just in case.\n\nThere is no change between v2 and v3.\nv3 just swaps the order of the 2 patches in v2, as suggested by Simon [3].\n\nReferences:\n[1] v1: https://lore.kernel.org/netdev/20260618035029.249361-1-decui@microsoft.com/\n[2] v2: https://lore.kernel.org/netdev/20260624222605.1794719-1-decui@microsoft.com/\n[3] https://lore.kernel.org/netdev/20260626145048.GB1310988@horms.kernel.org/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260702041237.617719-1-decui@microsoft.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c72a0f09c57f92113df69f9b902d11c9e4b132f5", "tree": "c9e8da1ecae2640b4a8e55b82428d239ac99b0cc", "parents": [ "2e2a83b4998af4384e677d3b2ac08565274279bf" ], "author": { "name": "Dexuan Cui", "email": "decui@microsoft.com", "time": "Wed Jul 01 21:12:37 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:36:14 2026 +0200" }, "message": "net: mana: Sync page pool RX frags for CPU\n\nMANA allocates RX buffers from page pool fragments when frag_count is\ngreater than 1. In that case the buffers remain DMA mapped by page pool\nand the RX completion path does not call dma_unmap_single(). As a result,\nthe implicit sync-for-CPU normally performed by dma_unmap_single() is\nmissing before the packet data is passed to the networking stack.\n\nThis breaks RX on configurations which require explicit DMA syncing, for\nexample when booted with swiotlb\u003dforce.\n\nFix this by recording the page pool page and DMA sync offset when the RX\nbuffer is allocated, and syncing the received packet range for CPU access\nbefore handing the RX buffer to the stack.\n\nFixes: 730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.\")\nCc: stable@vger.kernel.org\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nSigned-off-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nLink: https://patch.msgid.link/20260702041237.617719-3-decui@microsoft.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2e2a83b4998af4384e677d3b2ac08565274279bf", "tree": "98f5e6830f439007b53bdce4ee00bf02b8da7837", "parents": [ "f4ef35efbb49527293309f668ea73ec5de9b8e7a" ], "author": { "name": "Dexuan Cui", "email": "decui@microsoft.com", "time": "Wed Jul 01 21:12:36 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:35:54 2026 +0200" }, "message": "net: mana: Validate the packet length reported by the NIC\n\nValidate the packet length reported in the RX CQE before passing it\nto skb processing. The CQE is supplied by the NIC device and should\nnot be blindly trusted.\n\nCc: stable@vger.kernel.org\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nSigned-off-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nFixes: ca9c54d2d6a5 (\"net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)\")\nLink: https://patch.msgid.link/20260702041237.617719-2-decui@microsoft.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f4ef35efbb49527293309f668ea73ec5de9b8e7a", "tree": "8de65ddd4d680d2c3e3d9ff97fe01e22d86dd696", "parents": [ "6d27e29a90bc6a717b97c6ddcd866db7bd8e4adc" ], "author": { "name": "Wang Yan", "email": "wangyan01@kylinos.cn", "time": "Thu Jul 02 10:59:49 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:32:58 2026 +0200" }, "message": "selftests/net: fix EVP_MD_CTX leak in tcp_mmap\n\nIn tcp_mmap.c, both child_thread() and main() allocate an EVP_MD_CTX\nvia EVP_MD_CTX_new() when integrity checking is enabled, but neither\nfunction releases the context. child_thread() misses the free in its\ncommon cleanup block, and main() returns without freeing the context.\n\nThis results in a SHA256 context leak on every run that uses the\n‑i (integrity) option. Add the missing EVP_MD_CTX_free() calls to\nthe appropriate cleanup paths to fix the leak.\n\nFixes: 5c5945dc695c (\"selftests/net: Add SHA256 computation over data sent in tcp_mmap\")\nSigned-off-by: Wang Yan \u003cwangyan01@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260702025949.442523-1-wangyan01@kylinos.cn\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6bad2e38fe7f2da7dc982b2b80814e632832e568", "tree": "2bf52fc532555d59cdbbad66cd785628a06a1db4", "parents": [ "0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53", "b6eb022890c78285f55381589c1536bd66b8eaeb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 08 08:43:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 08 08:43:44 2026 -0700" }, "message": "Merge tag \u0027hid-for-linus-2026070801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Jiri Kosina:\n\n - OOB, UAF, NULL-deref fixes in core and picolcd, logitech, letsketch,\n appleir and multitouch drivers (Georgiy Osokin, HyeongJun An, Lee\n Jones, Manish Khadka, Maoyi Xie and Trung Nguyen)\n\n - fix for integer wraparound (and corresponding regression selftest) in\n hid-bpf (Yiyang Chen)\n\n* tag \u0027hid-for-linus-2026070801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:\n selftests/hid: multitouch: test a large ContactCountMaximum\n HID: multitouch: fix out-of-bounds bit access on mt_io_flags\n selftests/hid: Cover hid_bpf_get_data() size overflow\n selftests/hid: Load only requested struct_ops maps\n HID: bpf: Fix hid_bpf_get_data() range check\n HID: lg-g15: cancel pending work on remove to fix a use-after-free\n HID: logitech-dj: Fix maxfield check in DJ short report validation\n HID: core: Fix OOB read in hid_get_report for numbered reports\n HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()\n HID: appleir: fix UAF on pending key_up_timer in remove()\n HID: letsketch: fix UAF on inrange_timer at driver unbind\n" }, { "commit": "3f7a535ff0fa627a0132803e4c2f903ceffcbc1c", "tree": "f92b10488f2616de428daa344ee86d11ecfeef01", "parents": [ "2f75c0faa3361b28e36cc0512b3299e163e25789" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Tue Jul 07 21:25:46 2026 +0300" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "ipvs: ensure inner headers in ICMP errors are in headroom\n\nSashiko points out that after stripping the outer headers\nwith pskb_pull() we should ensure the inner IP headers\nin ICMP errors from tunnels are present in the skb headroom\nfor functions like ipv4_update_pmtu(), icmp_send() and\nIP_VS_DBG().\n\nAlso, add more checks for the length of the inner headers.\n\nFixes: f2edb9f7706d (\"ipvs: implement passive PMTUD for IPIP packets\")\nLink: https://sashiko.dev/#/patchset/20260702073430.67680-1-zhaoyz24%40mails.tsinghua.edu.cn\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "2f75c0faa3361b28e36cc0512b3299e163e25789", "tree": "1f5638b06f23ecbdfc7ef67fb5d779bb97ddb586", "parents": [ "2500fa3958b1ba51c2b065e39db1b04dfa7e23a2" ], "author": { "name": "Yizhou Zhao", "email": "zhaoyz24@mails.tsinghua.edu.cn", "time": "Mon Jul 06 18:16:24 2026 +0800" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "ipvs: use parsed transport offset in SCTP state lookup\n\nset_sctp_state() reads the SCTP chunk header again in order to drive the\nIPVS SCTP state table. For IPv6 it computes the offset with\nsizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from\nip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped\nextension headers and found the real transport header.\n\nThis makes the state machine read from the wrong offset for IPv6 SCTP\npackets that carry extension headers. For example, an INIT packet with an\n8-byte destination options header can be scheduled correctly by\nsctp_conn_schedule(), but set_sctp_state() reads the first byte of the\nSCTP verification tag as a DATA chunk type. The connection then moves\nfrom NONE to ESTABLISHED instead of INIT1, gets the longer established\ntimeout, and updates the active/inactive destination counters\nincorrectly. This happens even though the SCTP handshake has not\ncompleted.\n\nUse the parsed transport offset passed down from ip_vs_set_state() for\nthe SCTP chunk-header lookup. For IPv4 and IPv6 packets without\nextension headers this preserves the existing offset.\n\nFixes: 2906f66a5682 (\"ipvs: SCTP Trasport Loadbalancing Support\")\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/netdev/20260705123040.35755-1-zhaoyz24@mails.tsinghua.edu.cn/\nReported-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nReported-by: Yuxiang Yang \u003cyangyx22@mails.tsinghua.edu.cn\u003e\nReported-by: Ao Wang \u003cwangao@seu.edu.cn\u003e\nReported-by: Xuewei Feng \u003cfengxw06@126.com\u003e\nReported-by: Qi Li \u003cqli01@tsinghua.edu.cn\u003e\nReported-by: Ke Xu \u003cxuke@tsinghua.edu.cn\u003e\nAssisted-by: Claude Code:GLM-5.2\nSigned-off-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "2500fa3958b1ba51c2b065e39db1b04dfa7e23a2", "tree": "dd12b9e64bf0acf870421762001c827076e4bb5b", "parents": [ "bae7ce7bafb59e42dc0e0e2999fdd9d1cffe3866" ], "author": { "name": "Yizhou Zhao", "email": "zhaoyz24@mails.tsinghua.edu.cn", "time": "Mon Jul 06 18:16:23 2026 +0800" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "ipvs: use parsed transport offset in TCP state lookup\n\nTCP state handling reparses the skb to find the TCP header. For IPv6 it\nuses sizeof(struct ipv6hdr), while the surrounding IPVS code already\nparsed the packet with ip_vs_fill_iph_skb() and has the real\ntransport-header offset in iph.len.\n\nThis makes TCP state handling look at the wrong bytes when an IPv6\npacket carries extension headers. Use the parsed transport offset passed\ndown from ip_vs_set_state() when reading the TCP header.\n\nFor IPv4 and for IPv6 packets without extension headers, the passed\noffset matches the previous value.\n\nFixes: 0bbdd42b7efa6 (\"IPVS: Extend protocol DNAT/SNAT and state handlers\")\nLink: https://lore.kernel.org/netdev/20260705125659.37744-1-zhaoyz24@mails.tsinghua.edu.cn/\nReported-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nReported-by: Yuxiang Yang \u003cyangyx22@mails.tsinghua.edu.cn\u003e\nReported-by: Ao Wang \u003cwangao@seu.edu.cn\u003e\nReported-by: Xuewei Feng \u003cfengxw06@126.com\u003e\nReported-by: Qi Li \u003cqli01@tsinghua.edu.cn\u003e\nReported-by: Ke Xu \u003cxuke@tsinghua.edu.cn\u003e\nAssisted-by: Claude Code:GLM-5.2\nSigned-off-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "bae7ce7bafb59e42dc0e0e2999fdd9d1cffe3866", "tree": "ea27349d925829b2a7ba6cf97a031aaa63aee3cc", "parents": [ "da5b58478a9c1b85608c9e40a3b8432d071b409e" ], "author": { "name": "Yizhou Zhao", "email": "zhaoyz24@mails.tsinghua.edu.cn", "time": "Mon Jul 06 18:16:22 2026 +0800" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "ipvs: pass parsed transport offset to state handlers\n\nIPVS callers already parse the packet into struct ip_vs_iphdr before\nupdating connection state. For IPv6 this records the real\ntransport-header offset after extension headers in iph.len.\n\nPass this parsed transport offset through ip_vs_set_state() and the\nprotocol state_transition() callback so protocol handlers can use the\nsame packet context as scheduling and NAT handling. This patch only\nchanges the common callback plumbing and adapts the protocol callback\nsignatures; TCP and SCTP start using the value in follow-up patches.\n\nSigned-off-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "da5b58478a9c1b85608c9e40a3b8432d071b409e", "tree": "77db84123781dc90946186a49c8fe0e62a25d837", "parents": [ "fa7395c02d95e51bad2952325d2d6503bfbad437" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Sun Jul 05 15:29:13 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "netfilter: handle unreadable frags\n\nsashiko reports:\n When an skb with unreadable fragments (such as from devmem TCP, where\n skb_frags_readable(skb) returns false) is processed by the u32 module,\n skb_copy_bits() will safely return a negative error code [..]\n\nxt_u32: bail out with hotdrop in this case.\ngather_frags: return -1, just as if we had no fragment header.\nnfnetlink_queue: restrict to the linear part.\nnfnetlink_log: restrict to the linear part.\n\nv2:\n - skb_zerocopy helpers don\u0027t copy readable flag, i.e. nfnetlink_queue\n is broken too\n xt_u32 shouldn\u0027t return true if hotdrop was set.\n\nFixes: 65249feb6b3d (\"net: add support for skbs with unreadable frags\")\nCc: stable@vger.kernel.org\nAcked-by: Mina Almasry \u003calmasrymina@google.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "fa7395c02d95e51bad2952325d2d6503bfbad437", "tree": "b9991a1a077ab9620f64275ac7cbc90d01bacc49", "parents": [ "6c5dcab95f4cd42a1648739ec9300fbb4b1a021f" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Jun 30 11:40:56 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "netfilter: flowtable: support IPIP tunnel with direct xmit\n\nThe combination of IPIP tunnel with direct xmit, eg. bridge device,\nbreaks because no dst_entry is provided to check the skb headroom and to\nset the iph-\u003efrag_off field. This leads to invalid dst usage and can\ntrigger a crash in the tunnel transmit path.\n\nFix this by moving dst_cache and dst_cookie out of the runtime union so\nthat they can be shared by neighbour, xfrm, and direct tunnel flows.\nFor FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve\nroute state in these shared fields and release it through the common\ndst release path.\n\nSince dst_entry is now available to the three supported xmit modes and\ndst_release() already deals with NULL dst, remove the xmit type check\nin nft_flow_dst_release(). Moreover, skip the check if the dst entry\nis NULL in nf_flow_dst_check() which is now the case for the direct\nxmit case.\n\nBased on patch from Rein Wei \u003cn05ec@lzu.edu.cn\u003e.\n\nFixes: d30301ba4b07 (\"netfilter: flowtable: Add IPIP tx sw acceleration\")\nCc: stable@vger.kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nReported-by: Zhengyang Chen \u003cchzhengyang2023@lzu.edu.cn\u003e\nReported-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "6c5dcab95f4cd42a1648739ec9300fbb4b1a021f", "tree": "eb029386c666eab831231c882a9fbb7775bd975c", "parents": [ "c328b90c17fc5fa7786503695152880b2afb9326" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Jun 30 11:40:55 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "netfilter: flowtable: IPIP tunnel hardware offload is not yet support\n\nNo driver supports for IPIP tunnels yet, give up early on setting up the\nhardware offload for this scenario.\n\nThis patch adds a stub that can be enhanced to add more configuration\nthat are currently not supported. As of now, the offload work is\nenqueued to the worker, then ignored if the hardware offload\nconfiguration is not supported.\n\nCheck the NF_FLOW_HW flag to know if this entry was already tried once\nto be offloaded so this is not retried on refresh when unsupported. Move\nNF_FLOW_HW flag check to nf_flow_offload_add(). If this NF_FLOW_HW flag\nis unset the _del and _stats variants are never called.\n\nThis can be updated later on to skip hardware offload work to be queued\nin case hardware offload does not support it.\n\nFixes: d98103575dcd (\"netfilter: flowtable: Add IP6IP6 rx sw acceleration\")\nFixes: ab427db17885 (\"netfilter: flowtable: Add IPIP rx sw acceleration\")\nCc: stable@vger.kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nReported-by: Zhengyang Chen \u003cchzhengyang2023@lzu.edu.cn\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "c328b90c17fc5fa7786503695152880b2afb9326", "tree": "84b653b7bc72349c5a0347deb37544f30611137c", "parents": [ "724f32699aeabcbd294377904b40b456fd5c67eb" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Jun 30 11:40:54 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "netfilter: flowtable: use dst in this direction when pushing IPIP header\n\nWhen pushing the IPIP header, the route of the other direction is used\nto calculate the headroom, use the route in this direction. Accessing\nthe other tuple to set the IP source and destination is fine because\nthis tuple does not provide such information to avoid storing redundant\ninformation. However, this tuple already provides the dst for this\ndirection, this went unnoticed because this bug affects headroom and\niph-\u003efrag_off only at this stage.\n\nFixes: d30301ba4b07 (\"netfilter: flowtable: Add IPIP tx sw acceleration\")\nFixes: 93cf357fa797 (\"netfilter: flowtable: Add IP6IP6 tx sw acceleration\")\nCc: stable@vger.kernel.org\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "724f32699aeabcbd294377904b40b456fd5c67eb", "tree": "d6cab8baf89cbe8fa2e43bcfd6051663433c8eb0", "parents": [ "672321302ed682ccb903004f435bbdb353534a9c" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@netfilter.org", "time": "Thu Jul 02 15:47:00 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "netfilter: ipset: allocate the proper memory for the generic hash structure\n\nBecause a single create function is emitted for every hash type,\nfrom the IPv4 and IPv6 generic hash structure definitions the last\none, i.e. the IPv6 was in effect for IPv4 too. Use the proper size\nwhen allocating the structure. Comment properly that because create()\nrefers to elements of the generic hash structure, all referred ones\nmust come before the IPv4/IPv6 dependent \u0027next\u0027 member.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "672321302ed682ccb903004f435bbdb353534a9c", "tree": "b457f5dc1d9ef2ad3ba94d3fe27a001b0e172efc", "parents": [ "cffcf57bf03cb7f7e83d10f760b5f34e5c51d9b3" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@netfilter.org", "time": "Thu Jul 02 15:46:59 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:43 2026 +0200" }, "message": "netfilter: ipset: cleanup the add/del backlog when resize failed\n\nSashiko pointed out that the add/del backlog was not cleaned up\nwhen resize failed. Fix it in the corresponding error path. Also,\nmake sure that the add/del backlog is htable-specific so when\nresize creates a new htable, old/new backlog can\u0027t be mixed up.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "cffcf57bf03cb7f7e83d10f760b5f34e5c51d9b3", "tree": "713bd6ca2ef3c591327e8b7045ee79736142fff0", "parents": [ "5d0c22e73656d050daffad10a2ba8765ce8441c8" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@netfilter.org", "time": "Thu Jul 02 15:46:58 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:43 2026 +0200" }, "message": "netfilter: ipset: exclude gc when resize is in progress\n\nZhengchuan Liang and Eulgyu Kim reported that because resize\ndoes not copy the comment extension into the resized set but\nuses it\u0027s pointer, ongoing gc can free the extension in the\noriginal set which then results stale pointer in the resized\none. The proposed patch was to recreate the extensions for\nevery element in the resized set. It is both expensive and\nwastes memory, so better exclude gc when resizing in progress\ndetected: resizing will destroy the original set anyway,\nso doing gc on it is unnecessary.\n\nIntroduce a new spinlock to exclude parallel gc and resize.\nBecause we just set and check a bool value, there\u0027s no need\nfor the parameter to be atomic_t and rename it for better\nreadability.\n\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nReported by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nReported by: Eulgyu Kim \u003ceulgyukim@snu.ac.kr\u003e\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "5d0c22e73656d050daffad10a2ba8765ce8441c8", "tree": "5da16b9fc28bfc0d62198bfcbd500902ea7380a5", "parents": [ "e6107a4c74b54cb33e3bce162a63048ae5a6b198" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@netfilter.org", "time": "Thu Jul 02 15:46:57 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:43 2026 +0200" }, "message": "netfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there\u0027s no need to keep\nthe rcu lock because the referred hash table can\u0027t\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "e6107a4c74b54cb33e3bce162a63048ae5a6b198", "tree": "7eb26e84bfb0137112bcfc8fc943d82d1246c37d", "parents": [ "084d23f818321390509e9738a0b08bbf46df6425" ], "author": { "name": "Tamaki Yanagawa", "email": "ty@000ty.net", "time": "Fri Jul 03 16:22:57 2026 +0000" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:37 2026 +0200" }, "message": "netfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv-\u003einvert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!\u003d @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval().\n\nFixes: aaa31047a6d2 (\"netfilter: nftables: add catch-all set element support\")\nSigned-off-by: Tamaki Yanagawa \u003cty@000ty.net\u003e\nAssisted-by: Claude:claude-sonnet-5\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "084d23f818321390509e9738a0b08bbf46df6425", "tree": "c2d58d5ef76495f2e67502c78a7af3c1f21365f3", "parents": [ "cbfe53599eebffd188938ab6774cc41794f6f9d5" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Sat Jul 04 12:05:15 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:22:03 2026 +0200" }, "message": "netfilter: ebtables: module names must be null-terminated\n\nWe need to explicitly check the length, else we may pass non-null\nterminated string to request_module().\n\nCc: stable@vger.kernel.org\nFixes: bcf493428840 (\"netfilter: ebtables: Fix extension lookup with identical name\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "cbfe53599eebffd188938ab6774cc41794f6f9d5", "tree": "1f4b8f3420ee8f703a2d8420599a26ad5663624d", "parents": [ "a622d2e9608c9dff47fc2e5759ac7aa3a836b45d" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Sat Jul 04 10:23:31 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:22:03 2026 +0200" }, "message": "netfilter: ebtables: zero chainstack array\n\nsashiko reports:\n looking at ebtables table\n translation, could a sparse cpu_possible_mask lead to an uninitialized pointer\n free?\n\n If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,\n but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at\n CPU 2, the cleanup loop will blindly decrement and call vfree() on\n newinfo-\u003echainstack[1].\n\nNot a real-world bug, such allocation isn\u0027t expected to fail\nin the first place.\n\nCc: stable@vger.kernel.org\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "a622d2e9608c9dff47fc2e5759ac7aa3a836b45d", "tree": "63725cf9f74fdd7fe611c12dfe6854b2b2b8574a", "parents": [ "3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Sun Jul 05 14:58:00 2026 -0700" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:22:03 2026 +0200" }, "message": "netfilter: ebtables: terminate table name before find_table_lock()\n\nupdate_counters() and compat_update_counters() forward a user-supplied\n32-byte table name to find_table_lock() without NUL-terminating it. On a\nlookup miss, find_inlist_lock() calls try_then_request_module(..., \"%s%s\",\n\"ebtable_\", name), and vsnprintf() reads past the name field and the\nstack object until it hits a zero byte.\n\n BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n Read of size 1 at addr ffff8880119dfb20 by task exploit/147\n Call Trace:\n ...\n string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n vsnprintf (lib/vsprintf.c:2945)\n __request_module (kernel/module/kmod.c:150)\n do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)\n update_counters (net/bridge/netfilter/ebtables.c:1440)\n do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)\n nf_setsockopt (net/netfilter/nf_sockopt.c:101)\n ip_setsockopt (net/ipv4/ip_sockglue.c:1424)\n raw_setsockopt (net/ipv4/raw.c:847)\n __sys_setsockopt (net/socket.c:2393)\n ...\n\ncompat_do_replace() shares the same unterminated name via\ncompat_copy_ebt_replace_from_user(); terminate it there too so all\nfind_table_lock() callers behave alike. The other callers already\nterminate the name after the copy.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nFixes: 81e675c227ec (\"netfilter: ebtables: add CONFIG_COMPAT support\")\nCc: stable@vger.kernel.org\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9", "tree": "f206d5080cbce8fa09322d9ab39ee0f3d300a13e", "parents": [ "6d27e29a90bc6a717b97c6ddcd866db7bd8e4adc" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Sun Jul 05 16:36:29 2026 -0700" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:22:03 2026 +0200" }, "message": "netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag\n\nnf_ct_frag6_reasm() slides the packet head forward to drop the IPv6\nfragment header and then unconditionally advances skb-\u003emac_header:\n\n\tskb-\u003emac_header +\u003d sizeof(struct frag_hdr);\n\nOn the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header\nyet, so skb-\u003emac_header is still the \"not set\" sentinel (u16)~0U. Adding\nsizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 \u003d\u003d 7),\nafter which skb_mac_header_was_set() wrongly reports a MAC header is\npresent and skb_mac_header() points into the headroom.\n\nThe reassembler has done this unconditional add since it was introduced;\nit was harmless while mac_header was a bare pointer, but wrong once\nmac_header became a u16 offset whose unset state is the ~0U sentinel\ntested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c\ndoes the same relocation and does guard the adjustment; mirror the\nguard here.\n\nFixes: 9fb9cbb1082d (\"[NETFILTER]: Add nf_conntrack subsystem.\")\nCc: stable@vger.kernel.org\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "6d27e29a90bc6a717b97c6ddcd866db7bd8e4adc", "tree": "7a4c1b196df327b7a7320515fb7e6afa3f8aeb1d", "parents": [ "235acadd310533ba386ae61ad155b72bee381559", "3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 14:41:04 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 14:41:04 2026 +0200" }, "message": "Merge branch \u0027ipv4-ipv6-fix-uaf-and-memory-leak-in-igmp-mld\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nipv4/ipv6: Fix UAF and memory leak in IGMP/MLD\n\nThis series addresses two potential UAF vulnerabilities\nand memory leaks in the IPv4 IGMP and IPv6 MLD subsystems.\n\nThe first two patches fix a UAF where the packet receive path races with\ndevice teardown. If the device refcount has already hit 0 (but the memory\nis still held by RCU), incoming IGMP/MLD packets trying to schedule delayed\nwork or timers would call refcount_inc() on the 0 refcount, triggering a\nwarning and eventually leading to a UAF when the work runs after the device\nhas been freed. This is fixed by introducing safe hold helpers using\nrefcount_inc_not_zero(). In MLD, we also ensure we only enqueue the skb\nif we successfully acquired the device reference, to avoid leaking skbs\nwhen the device is being destroyed.\n\nThe third patch fixes memory leaks in IPv4 IGMP when timers are deleted or\nstopped. When a timer is deleted (in igmp_mod_timer) or stopped (in\nigmp_stop_timer) and not re-armed, the code dropped the group refcount using\nrefcount_dec(). However, if the group was concurrently removed from the list,\nthis decrement could drop the refcount to 0 without triggering the\ncleanup/free path, leaking the group structure. This is fixed by using\nip_ma_put() instead, and deferring the put until after the lock is released.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260705181756.963063-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36", "tree": "7a4c1b196df327b7a7320515fb7e6afa3f8aeb1d", "parents": [ "9b26518b6896a16b809b1e42986f4ebac7bccc1e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sun Jul 05 18:17:56 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 14:41:01 2026 +0200" }, "message": "ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()\n\nWhen a timer is deleted and not re-armed in igmp_mod_timer(), or stopped\nin igmp_stop_timer(), the code currently decrements the reference counter\nof the multicast list entry @im using refcount_dec(\u0026im-\u003erefcnt).\n\nHowever, both functions can be called from the RCU reader path:\n- igmp_mod_timer() via igmp_heard_query() -\u003e for_each_pmc_rcu()\n- igmp_stop_timer() via igmp_rcv() -\u003e igmp_heard_report()\n\nIf the group im was concurrently removed from the list by ip_mc_dec_group(),\nits reference count might have already been decremented to 1.\n\nIn this case, timer_delete() succeeds, and refcount_dec() decrements\nthe refcount from 1 to 0. Since refcount_dec() does not free the object\nwhen it hits 0 (unlike ip_ma_put()), the im structure is leaked.\n\nFix this by using ip_ma_put(im) instead of refcount_dec(\u0026im-\u003erefcnt),\nand deferring the put until after the spinlock is released.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260705181756.963063-4-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9b26518b6896a16b809b1e42986f4ebac7bccc1e", "tree": "fa4c8586487e9d668c7e58bc960a0b0edf063a5d", "parents": [ "7b19c0f81ed1fdaec6bc522569be367199a9edf3" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sun Jul 05 18:17:55 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 14:41:01 2026 +0200" }, "message": "ipv6: mcast: Fix potential UAF in MLD delayed work\n\nA race condition exists between device teardown and incoming MLD query\nprocessing, leading to a Use-After-Free in the MLD delayed work.\n\nDuring device destruction, the primary reference to inet6_dev is dropped,\nwhich can drop its refcount to 0. The actual freeing of inet6_dev memory\nis deferred via RCU.\n\nConcurrently, the packet receive path runs under RCU read lock and obtains\nthe inet6_dev pointer. Because the memory is RCU-protected, CPU-0 can\nsafely dereference inet6_dev even if its refcount has hit 0.\n\nHowever, if CPU-0 calls igmp6_event_query() and schedules delayed work, it\nattempts to acquire a reference using in6_dev_hold(). This increments the\nrefcount from 0 to 1, triggering a \"refcount_t: addition on 0\" warning.\nSince the inet6_dev memory is still scheduled to be freed after the RCU\ngrace period, the device is freed while the work is still scheduled.\nWhen the work runs, it accesses the freed memory, causing a kernel panic.\n\nFix this by using refcount_inc_not_zero() (via a new helper\nin6_dev_hold_safe()) to prevent acquiring a reference if the device is\nalready being destroyed. If the refcount is 0, we do not schedule the work.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260705181756.963063-3-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7b19c0f81ed1fdaec6bc522569be367199a9edf3", "tree": "254a8473aa09bd79729908ed1f527027a6c8c5d2", "parents": [ "235acadd310533ba386ae61ad155b72bee381559" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sun Jul 05 18:17:54 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 14:41:01 2026 +0200" }, "message": "ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()\n\nA race condition exists between device teardown (inetdev_destroy) and\nincoming IGMP query processing (igmp_rcv), leading to a Use-After-Free\nin the IGMP timer callback.\n\nDuring device destruction, inetdev_destroy() drops the primary reference\nto in_device, which can drop its refcount to 0. The actual freeing of\nin_device memory is deferred via RCU (using call_rcu()).\n\nConcurrently, igmp_rcv() runs under RCU read lock and obtains the\nin_device pointer. Because the memory is RCU-protected, CPU-0 can safely\ndereference in_device even if its refcount has hit 0.\n\nHowever, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it\nattempts to acquire a reference using in_dev_hold(). This increments the\nrefcount from 0 to 1, triggering a \"refcount_t: addition on 0\" warning.\nSince the in_device memory is still scheduled to be freed after the RCU\ngrace period (as the free callback does not check the refcount again),\nthe device is freed while the timer is still armed. When the timer\nexpires, it accesses the freed memory, causing a kernel panic.\n\nFix this by using refcount_inc_not_zero() (via a new helper\nin_dev_hold_safe()) to prevent acquiring a reference if the device is\nalready being destroyed. If the refcount is 0, we do not arm the timer.\n\nA similar issue in IPv6 MLD is fixed in a subsequent patch.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Zero Day Initiative \u003czdi-disclosures@trendmicro.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260705181756.963063-2-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "235acadd310533ba386ae61ad155b72bee381559", "tree": "ffc3ca11b558ed1630e6f1208309b511a5c8c3c8", "parents": [ "b7f97cae7ec1b6c3c32843c42be218690d310467" ], "author": { "name": "Suman Ghosh", "email": "sumang@marvell.com", "time": "Thu Jul 02 09:04:51 2026 +0530" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 12:01:13 2026 +0200" }, "message": "octeontx2-pf: check DMAC extraction support before filtering\n\nCurrently, configuring a VF MAC address via the PF (e.g., \u0027ip link\nset \u003cpf\u003e vf 0 mac \u003cmac\u003e\u0027) blindly attempts to install a DMAC-based\nhardware filter. However, the hardware parser profile might not\nsupport DMAC extraction.\n\nCheck if the hardware parsing profile supports DMAC extraction\nbefore adding the filter. Additionally, emit a warning message\nto inform the operator if the MAC filter installation fails due\nto missing DMAC extraction support. Update config-\u003emac only\nafter hardware programming succeeds in otx2_set_vf_mac().\n\nFixes: f0c2982aaf98 (\"octeontx2-pf: Add support for SR-IOV management functions\")\nSigned-off-by: Suman Ghosh \u003csumang@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260702033451.2969880-1-nshettyj@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b7f97cae7ec1b6c3c32843c42be218690d310467", "tree": "5350e2160fa6de99543e1bb73f1451635b4665bc", "parents": [ "5258b4fdae44cf5ac9b7c6fd71c9e0394a9fad5e" ], "author": { "name": "Samuel Moelius", "email": "sam.moelius@trailofbits.com", "time": "Thu Jul 02 00:07:59 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 11:42:21 2026 +0200" }, "message": "net/sched: cake: reject overhead values that underflow length\n\nCAKE accepts signed overhead values and stores them in an s16, but the\nadjusted packet length calculation uses unsigned arithmetic. A negative\neffective length can therefore wrap to a large value.\n\nSuch configurations make rate accounting depend on integer wraparound\nrather than on the packet size userspace intended to model. A static\nnetlink lower bound is not enough because packets reaching CAKE can be\nsmaller than any reasonable manual-overhead allowance.\n\nFold the signed overhead adjustment into the existing datapath MPU clamp\nso negative adjusted lengths are clamped before link-layer framing\nadjustments.\n\nFixes: a729b7f0bd5b (\"sch_cake: Add overhead compensation support to the rate shaper\")\nAssisted-by: Codex:gpt-5.5-cyber-preview\nSigned-off-by: Samuel Moelius \u003csam.moelius@trailofbits.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260702000758.297407.e5c888d9d99d.cake-overhead-underflow@trailofbits.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5258b4fdae44cf5ac9b7c6fd71c9e0394a9fad5e", "tree": "b2a6859feb61e584a5129638ccbf1348bb5cd0c8", "parents": [ "1a3267a8c9ecabb8e27f5cbda6d19295d5e41beb", "6e1930ece855a4c256f1c7e6632d634cfb9888b5" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 11:10:21 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 11:10:21 2026 +0200" }, "message": "Merge tag \u0027for-net-2026-07-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\n - hci_conn: Fix null ptr deref in hci_abort_conn()\n - af_bluetooth: fix UAF in bt_accept_dequeue()\n - L2CAP: validate option length before reading conf opt value\n - L2CAP: cancel pending_rx_work before taking conn-\u003elock\n - L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n - L2CAP: fix tx ident leak for commands without a response\n - SCO: Fix a race condition in sco_sock_timeout()\n - ISO: avoid NULL deref of conn in iso_conn_big_sync()\n - ISO: fix malformed ISO_END/CONT handling\n - ISO: exclude RFU bits from ISO_SDU_Length\n - MGMT: Fix adv monitor add failure cleanup\n - MGMT: Fix UAF of hci_conn_params in add_device_complete\n - bnep: pin L2CAP connection during netdev registration\n - 6lowpan: avoid untracked enable work\n - 6lowpan: hold L2CAP conn across debugfs control\n - 6lowpan: Fix using chan-\u003econn as indication to no remote netdev\n - btintel_pcie: Refactor FLR to use device_reprobe()\n - btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()\n - hci_uart: clear HCI_UART_SENDING when write_work is canceled\n - bpa10x: avoid OOB read of revision string in bpa10x_setup()\n\n* tag \u0027for-net-2026-07-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: L2CAP: fix tx ident leak for commands without a response\n Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()\n Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length\n Bluetooth: ISO: fix malformed ISO_END/CONT handling\n Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()\n Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n Bluetooth: fix UAF in bt_accept_dequeue()\n Bluetooth: bnep: pin L2CAP connection during netdev registration\n Bluetooth: sco: Fix a race condition in sco_sock_timeout()\n Bluetooth: MGMT: Fix adv monitor add failure cleanup\n Bluetooth: 6lowpan: hold L2CAP conn across debugfs control\n Bluetooth: 6lowpan: avoid untracked enable work\n Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()\n Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()\n Bluetooth: L2CAP: validate option length before reading conf opt value\n Bluetooth: L2CAP: cancel pending_rx_work before taking conn-\u003elock\n Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()\n Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete\n Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev\n Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260706145229.728127-1-luiz.dentz@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1a3267a8c9ecabb8e27f5cbda6d19295d5e41beb", "tree": "14819b2f9cd71ae2b30ed93f28172bb87025ecde", "parents": [ "60444706aa17616efc03190d099ac347e28b3d0a" ], "author": { "name": "Rosen Penev", "email": "rosenp@gmail.com", "time": "Wed Jul 01 20:26:52 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 10:04:01 2026 +0200" }, "message": "net: mdio: select REGMAP_MMIO instead of depending on it\n\nREGMAP_MMIO is a hidden (non-user-visible) tristate symbol. Using\ndepends on it is incorrect because there is no way for the user to\nenable it directly. Change to select, which is the convention used\nby every other driver in the tree that needs REGMAP_MMIO.\n\nFixes: 8057cbb8335c (\"net: mdio: mscc-miim: Add depend of REGMAP_MMIO on MDIO_MSCC_MIIM\")\nAssisted-by: opencode:big-pickle\nSigned-off-by: Rosen Penev \u003crosenp@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260702032653.1580616-1-rosenp@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "cb8afea4655ff004fa7feee825d5c79783525383", "tree": "a391d52020eb1377311f76d2e9a538260ba9d140", "parents": [ "240c8d2c717b3f8153e7e877b22a82518d78dbdc" ], "author": { "name": "HE WEI (ギカク)", "email": "skyexpoc@gmail.com", "time": "Tue Jul 07 18:48:28 2026 +0900" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jul 07 14:00:35 2026 +0200" }, "message": "wifi: cfg80211: bound element ID read when checking non-inheritance\n\ncfg80211_is_element_inherited() reads the first data octet of the\ncandidate element (id \u003d elem-\u003edata[0]) to look it up in an extension\nnon-inheritance list. It does so after testing elem-\u003eid, but without\nverifying that the element actually has a data octet. A zero-length\nextension element (WLAN_EID_EXTENSION with length 0) therefore makes it\nread one octet past the end of the element.\n\n_ieee802_11_parse_elems_full() runs this check for every element of a\nframe once a non-inheritance context exists -- e.g. while parsing a\nper-STA profile of a Multi-Link element in a (re)association response,\nor a non-transmitted BSS profile -- so a crafted frame from an AP can\ntrigger a one-octet slab-out-of-bounds read during element parsing:\n\n BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited\n Read of size 1 ... in net/wireless/scan.c\n\nReturn early (treat the element as inherited) when an extension element\ncarries no data, mirroring the existing handling of empty ID lists.\n\nThe bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.\n\nFixes: f7dacfb11475 (\"cfg80211: support non-inheritance element\")\nSigned-off-by: HE WEI (ギカク) \u003cskyexpoc@gmail.com\u003e\nLink: https://patch.msgid.link/20260707094828.16465-1-skyexpoc@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "60444706aa17616efc03190d099ac347e28b3d0a", "tree": "9553095845753edff48333bf9060938a70483e1a", "parents": [ "7993211bde166471dffac074dc965489f86531f8" ], "author": { "name": "Enrico Pozzobon", "email": "enrico.pozzobon@dissecto.com", "time": "Wed Jul 01 16:47:23 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 07 13:07:51 2026 +0200" }, "message": "net: usb: lan78xx: disable VLAN filter in promiscuous mode\n\nThe hardware VLAN filter (RFE_CTL_VLAN_FILTER_) drops VLAN-tagged frames\nwhose VID has not been registered via lan78xx_vlan_rx_add_vid(). It is\nleft enabled in promiscuous mode, so packet capture (e.g. tcpdump or\nWireshark) does not see tagged frames for unregistered VIDs.\n\nClear the filter while the interface is promiscuous and restore it from\nNETIF_F_HW_VLAN_CTAG_FILTER otherwise. Enforce the same condition in\nlan78xx_set_features() so netdev_update_features() cannot re-enable the\nfilter while promiscuous.\n\nFixes: 55d7de9de6c3 (\"Microchip\u0027s LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver\")\nSigned-off-by: Enrico Pozzobon \u003cenrico.pozzobon@dissecto.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20260701-lan78xx-vlan-promisc-v3-1-232266d32743@dissecto.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7993211bde166471dffac074dc965489f86531f8", "tree": "d60cc12a8cdd4366df15560646c9c23be8cb40fb", "parents": [ "5c0e3ba4f500fd4314ceb42f07f16bc445156431" ], "author": { "name": "Yuyang Huang", "email": "yuyanghuang@google.com", "time": "Thu Jul 02 08:50:14 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 07 12:15:39 2026 +0200" }, "message": "ipv4: igmp: remove multicast group from hash table on device destruction\n\nWhen a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through\nthe multicast list and calls ip_ma_put() on each membership, scheduling\nthem for RCU reclamation. However, they are not unlinked from the device\u0027s\nmulticast hash table (mc_hash).\n\nSince the device remains published in dev-\u003eip_ptr until after\nip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash\ncan still locate and access the multicast group after its refcount is\ndecremented. If the RCU callback runs and frees the group while a reader is\naccessing it, a use-after-free occurs.\n\nFix this by unlinking the multicast group from mc_hash using\nip_mc_hash_remove() before scheduling it for reclamation.\n\nBUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0\nRead of size 4 at addr ffff888009bf1408 by task mausezahn/2276\n\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x67/0x90\n print_report+0x175/0x7c0\n kasan_report+0x147/0x180\n ip_check_mc_rcu+0x149/0x3f0\n udp_v4_early_demux+0x36d/0x12d0\n ip_rcv_finish_core+0xb8b/0x1390\n ip_rcv_finish+0x54/0x120\n NF_HOOK+0x213/0x2b0\n __netif_receive_skb+0x126/0x340\n process_backlog+0x4f2/0xf00\n __napi_poll+0x92/0x2c0\n net_rx_action+0x583/0xc60\n handle_softirqs+0x236/0x7f0\n do_softirq+0x57/0x80\n \u003c/IRQ\u003e\n\nAllocated by task 2239:\n kasan_save_track+0x3e/0x80\n __kasan_kmalloc+0x72/0x90\n ____ip_mc_inc_group+0x31a/0xa40\n __ip_mc_join_group+0x334/0x3f0\n do_ip_setsockopt+0x16fa/0x2010\n ip_setsockopt+0x3f/0x90\n do_sock_setsockopt+0x1ad/0x300\n\nFreed by task 0:\n kasan_save_track+0x3e/0x80\n kasan_save_free_info+0x40/0x50\n __kasan_slab_free+0x3a/0x60\n __rcu_free_sheaf_prepare+0xd4/0x220\n rcu_free_sheaf+0x36/0x190\n rcu_core+0x8d9/0x12f0\n handle_softirqs+0x236/0x7f0\n\nFixes: e9897071350b (\"igmp: hash a hash table to speedup ip_check_mc_rcu()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Yuyang Huang \u003cyuyanghuang@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260701235014.73505-1-yuyanghuang@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5c0e3ba4f500fd4314ceb42f07f16bc445156431", "tree": "7b1c68c3a31c8980a095f588e588d461be376126", "parents": [ "d9d6d67f4c0877fde783c9d5beee013bcf1b1e85" ], "author": { "name": "Yuho Choi", "email": "dbgh9129@gmail.com", "time": "Wed Jul 01 00:08:47 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 07 11:03:35 2026 +0200" }, "message": "net/liquidio: drop cached VF pci_dev LUT\n\nThe PF SR-IOV enable path caches VF pci_dev pointers in\ndpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those\nentries do not own a reference, because the iterator drops the previous\ndevice reference on each step. The cached pointer is then dereferenced\nlater when handling OCTEON_VF_FLR_REQUEST.\n\nReplace the cached VF mapping with runtime lookup on the mailbox DPI\nring: derive the VF index from q_no, resolve the VF via exported PCI\nIOV helpers, validate it with the PF pointer and VF ID, then issue\npcie_flr() and drop the reference with pci_dev_put(). Remove the\nunused VF lookup table initialization and cleanup.\n\nFixes: ca6139ffc67ee (\"liquidio CN23XX: sysfs VF config support\")\nFixes: 8c978d059224 (\"liquidio CN23XX: Mailbox support\")\nSigned-off-by: Yuho Choi \u003cdbgh9129@gmail.com\u003e\nLink: https://patch.msgid.link/20260701040847.1897845-1-dbgh9129@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d9d6d67f4c0877fde783c9d5beee013bcf1b1e85", "tree": "255607792c371cdaf5e0999c7bee3f1574b072a4", "parents": [ "3be28e2c9cd0230cb51fd4967df095273afd3848" ], "author": { "name": "Dong Yibo", "email": "dong100@mucse.com", "time": "Wed Jul 01 11:22:08 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 07 10:45:42 2026 +0200" }, "message": "net: rnpgbe: fix mailbox endianness and remove pointer casts\n\nThe rnpgbe mailbox exchanges data through 32-bit MMIO registers in\nlittle-endian wire format. The original code had two problems:\n\n 1. FW structs (with __le16/__le32 fields) were cast to (u32 *)\n before reaching the mailbox transport, hiding the endian\n annotations from sparse.\n\n 2. No cpu_to_le32()/le32_to_cpu() conversion was done between\n CPU-endian MMIO values and the little-endian payload, causing\n data corruption on big-endian systems.\n\nFix by adding the missing byte-order conversions in the transport\nlayer and introducing union wrappers (mbx_fw_cmd_req_u,\nmbx_fw_cmd_reply_u) that overlay each FW struct with a __le32\ndwords[] array. Callers fill named fields using cpu_to_le16/32(),\nthen pass dwords[] to the transport, which now takes explicit\n__le32 * instead of u32 *. This eliminates all pointer casts on\nthe mailbox data path and lets sparse verify the conversions.\n\nFixes: 4543534c3ef5 (\"net: rnpgbe: Add basic mbx ops support\")\nSigned-off-by: Dong Yibo \u003cdong100@mucse.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260701032208.1843156-2-dong100@mucse.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "240c8d2c717b3f8153e7e877b22a82518d78dbdc", "tree": "360a780061defd2df3948f259f49e82e11cc2df9", "parents": [ "2a665946e0407a05a3f81bd56a08553c446498e0" ], "author": { "name": "Maoyi Xie", "email": "maoyixie.tju@gmail.com", "time": "Sat Jun 27 21:13:13 2026 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jul 07 10:22:35 2026 +0200" }, "message": "wifi: brcmfmac: cyw: fix heap overflow on a short auth frame\n\nbrcmf_notify_auth_frame_rx() takes the frame length from the firmware\nevent and copies the frame body with the management header offset\nsubtracted:\n\n\tu32 mgmt_frame_len \u003d e-\u003edatalen - sizeof(struct brcmf_rx_mgmt_data);\n\t...\n\tmemcpy(\u0026mgmt_frame-\u003eu, frame,\n\t mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));\n\nThe only length check is e-\u003edatalen \u003e\u003d sizeof(*rxframe), so mgmt_frame_len\ncan be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When\nmgmt_frame_len is below that, the subtraction wraps as an unsigned value to\na huge length. The memcpy then runs far past the kzalloc\u0027d buffer. A\nmalicious or malfunctioning AP can make the frame short during the\nexternal SAE auth exchange, so this is a remotely triggered heap overflow.\n\nReject frames shorter than the management header offset before the copy.\n\nFixes: 66f909308a7c (\"wifi: brcmfmac: cyw: support external SAE authentication in station mode\")\nLink: https://lore.kernel.org/r/178214417708.2368577.16740907093694208834@maoyixie.com\nCc: stable@vger.kernel.org\nCo-developed-by: Kaixuan Li \u003ckaixuan.li@ntu.edu.sg\u003e\nSigned-off-by: Kaixuan Li \u003ckaixuan.li@ntu.edu.sg\u003e\nSigned-off-by: Maoyi Xie \u003cmaoyixie.tju@gmail.com\u003e\nAcked-by: Arend van Spriel \u003carend.vanspriel@broadcom.com\u003e\nLink: https://patch.msgid.link/20260627131313.3878893-1-maoyixie.tju@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "3be28e2c9cd0230cb51fd4967df095273afd3848", "tree": "1817cfb3c25d059cebcd0302e8c18e264f6d8ad0", "parents": [ "9e05e91a9a847ed57926414bd7c2c5e54d6c56c6" ], "author": { "name": "Chuck Lever", "email": "cel@kernel.org", "time": "Tue Jun 30 15:15:51 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 07 10:12:11 2026 +0200" }, "message": "net/tls: Consume empty data records in tls_sw_read_sock()\n\nA peer may send a zero-length TLS application_data record; TLS 1.3\nexplicitly permits these as a traffic-analysis countermeasure (RFC\n8446, Section 5.1). After decryption such a record has full_len \u003d\u003d\n0. tls_sw_read_sock() hands it to the read_actor, which has no\npayload to consume and returns zero. The loop treats a zero return\nas backpressure (used \u003c\u003d 0), requeues the skb at the head of\nrx_list, and stops. rx_list is serviced head-first on the next\ncall, so the empty record is dequeued, fails the same way, and is\nrequeued again; every later record on the connection is blocked\nbehind it.\n\ntls_sw_recvmsg() does not stall on this: a zero-length data record\ncopies nothing and falls through to consume_skb(). Mirror that in\nthe read_sock() path by recognizing an empty data record before\nthe actor runs, consuming it, and continuing.\n\nFixes: 662fbcec32f4 (\"net/tls: implement -\u003eread_sock()\")\nSigned-off-by: Chuck Lever \u003ccel@kernel.org\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://patch.msgid.link/20260630191551.875664-1-cel@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2a665946e0407a05a3f81bd56a08553c446498e0", "tree": "afd7ae74c386e65cc4c08d27d99d4aaceb8f1c7f", "parents": [ "b760113aeca2e9362d56bf9e9263373ffe6c8eb3" ], "author": { "name": "Runyu Xiao", "email": "runyu.xiao@seu.edu.cn", "time": "Fri Jun 19 14:44:01 2026 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jul 07 10:10:40 2026 +0200" }, "message": "wifi: brcmfmac: initialize SDIO data work before cleanup\n\nbrcmf_sdio_probe() stores the newly allocated bus in sdiodev-\u003ebus before\nallocating the ordered workqueue. If that allocation fails, the function\njumps to fail and calls brcmf_sdio_remove().\n\nbrcmf_sdio_remove() unconditionally cancels bus-\u003edatawork. Initialize the\nwork item before the first failure path that can reach brcmf_sdio_remove(),\nso the cleanup path always observes a valid work object.\n\nThis issue was found by our static analysis tool and then confirmed by\nmanual review of the probe error path and the remove-time work drain. The\nproblem pattern is an early setup failure that reaches a cleanup helper\nwhich cancels an embedded work item before its initializer has run.\n\nA QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in\nbrcmf_sdio_probe(), before INIT_WORK(\u0026bus-\u003edatawork) is reached. The\nresulting fail path calls brcmf_sdio_remove(), and DEBUG_OBJECTS reports\nthe invalid work drain with brcmf_sdio_probe() and brcmf_sdio_remove() in\nthe stack.\n\nFixes: 9982464379e8 (\"brcmfmac: make sdio suspend wait for threads to freeze\")\nSigned-off-by: Runyu Xiao \u003crunyu.xiao@seu.edu.cn\u003e\nAcked-by: Arend van Spriel \u003carend.vanspriel@broadcom.com\u003e\nLink: https://patch.msgid.link/20260619064401.1048976-1-runyu.xiao@seu.edu.cn\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "b760113aeca2e9362d56bf9e9263373ffe6c8eb3", "tree": "1fabf6d178edf17b1e54ad60468b77aeae1f9363", "parents": [ "d5e4586546974179feca305a94e07fac3e9727fe" ], "author": { "name": "Zhao Li", "email": "enderaoelyther@gmail.com", "time": "Tue Jul 07 10:53:35 2026 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jul 07 09:31:38 2026 +0200" }, "message": "wifi: cfg80211: validate assoc response length before status and IE access\n\ncfg80211_rx_assoc_resp() initialises the status and response-IE fields\nof cfg80211_connect_resp_params from the management frame before\nproving that the frame is long enough for those offsets. S1G and\nregular association responses also have different IE offsets, but the\nS1G path only patched resp_ie after the unsafe initialiser had already\nrun.\n\nDefer resp_ie, resp_ie_len, and status to after the link-iteration\nloop. Use a bool to remember whether the frame is S1G, then validate\nthe appropriate minimum length and set all three fields in a single\nif/else block. Funnel short-frame and SME-reject cleanup through a\nshared free_bss label for the abandon paths.\n\nAssisted-by: Codex:gpt-5.5\nAssisted-by: Claude:claude-opus-4.8\nSigned-off-by: Zhao Li \u003cenderaoelyther@gmail.com\u003e\nLink: https://patch.msgid.link/20260707025336.22557-2-enderaoelyther@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "d5e4586546974179feca305a94e07fac3e9727fe", "tree": "7cdd8fff16e52e08cf171f375a97ceadd7419297", "parents": [ "d0e69d9afa59b93c30294eba89b1f15f69e91105" ], "author": { "name": "Zhao Li", "email": "enderaoelyther@gmail.com", "time": "Tue Jul 07 10:53:34 2026 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jul 07 09:29:26 2026 +0200" }, "message": "wifi: cfg80211: validate rx/tx MLME callback frame lengths before access\n\ncfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() call tracepoints\nbefore rejecting frames shorter than the frame-control field. After\nthat, they only require len \u003e\u003d 2 before dispatching into subtype\nhandlers that assume their fixed fields are present.\n\nThe frames that trip this are not shorter than 2 bytes; they are short\nrelative to their subtype. mwifiex is a concrete in-tree example on the\nlength side: mwifiex_process_mgmt_packet() only requires a 4-address\nieee80211_hdr plus the 2-byte firmware length prefix before handing the\nframe to cfg80211_rx_mlme_mgmt(). After stripping the length prefix and\nremoving addr4, pkt_len can be exactly 24: a bare 3-address management\nheader with no reason-code body. The existing WARN_ON(len \u003c 2) does not\nfire on such a frame, and cfg80211_process_deauth() then reads\nu.deauth.reason_code as a two-byte access starting at offset 24,\nimmediately past the 24-byte buffer.\n\nAdd a frame-control length gate, then validate each subtype\u0027s minimum\nframe size in an if/else-if chain that mirrors the dispatch logic. Trace\nonly after the frame is known to be well-formed.\n\nSide effects of this change:\n - The WARN_ON(len \u003c 2) is dropped. It only guarded the frame_control\n read, never the subtype fixed fields, and it does not fire on the\n frames that actually trigger the out-of-bounds read (which are \u003e\u003d 2).\n The len \u003e\u003d 2 check is kept as the guard before dereferencing\n frame_control, but without the warning: these are exported callbacks\n and a malformed frame from a driver should be dropped silently rather\n than backtraced.\n - cfg80211_tx_mlme_mgmt() previously routed every non-deauth subtype\n through disassociation handling; it now silently ignores unrecognised\n subtypes.\n\nAssisted-by: Codex:gpt-5.5\nAssisted-by: Claude:claude-opus-4.8\nSigned-off-by: Zhao Li \u003cenderaoelyther@gmail.com\u003e\nLink: https://patch.msgid.link/20260707025336.22557-1-enderaoelyther@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "d0e69d9afa59b93c30294eba89b1f15f69e91105", "tree": "79a1f92260bbbeb713df170a7fa8b79e7b3465b6", "parents": [ "4e72459683b5185568e9ffe2584a7b834f7902b5" ], "author": { "name": "Pagadala Yesu Anjaneyulu", "email": "pagadala.yesu.anjaneyulu@intel.com", "time": "Mon Jul 06 22:37:56 2026 +0300" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jul 07 09:28:55 2026 +0200" }, "message": "wifi: mac80211: ibss: wait for in-flight TX on disconnect\n\nWhile leaving an IBSS in ieee80211_ibss_disconnect() mac80211 flushes\nstations, turns the carrier off and immediately tells the driver to\nleave as well. While there may be synchronize_net() in station flush\nand in this code later, packets can still be transmitted due to\ncross-CPU race conditions after carrier off is set.\nTherefore, it\u0027s possible for a race to happen where a TX to the\ndriver occurs while or after telling it to leave the IBSS. This can\nbe confusing to drivers, and in the case of iwlwifi leads to an\nattempt to use invalid queues.\n\nMove netif_carrier_off() to occur before sta_info_flush() during\nIBSS disconnect, and add synchronize_net() if flushing didn\u0027t,\nso that the synchronize_net() always happens between turning the\ncarrier off and telling the driver, avoiding this race.\n\nSigned-off-by: Pagadala Yesu Anjaneyulu \u003cpagadala.yesu.anjaneyulu@intel.com\u003e\nReviewed-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Miri Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20260706223751.da1ce439cc93.If5cf482f87ab98ce66dd48724e24c81fed236d3f@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "4e72459683b5185568e9ffe2584a7b834f7902b5", "tree": "a2abe56679ef9590d44d7410cc6501aaf9fc08c2", "parents": [ "0c2ed186bbe14304415476d6707b747dddcd8583" ], "author": { "name": "Shahar Tzarfati", "email": "shahar.tzarfati@intel.com", "time": "Mon Jul 06 22:27:52 2026 +0300" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jul 07 09:28:36 2026 +0200" }, "message": "wifi: mac80211: recalculate rx_nss on IBSS peer capability update\n\nWhen IBSS peer capabilities change, rates_updated is set to true in\nieee80211_update_sta_info(), but rx_nss is never recalculated.\nFor peers with HT/VHT, this leaves rx_nss at 0 instead of the\ncorrect value, causing drivers to use incorrect rate scaling\nparameters.\n\nThe root cause is that the commit below moved NSS initialisation\nout of rate_control_rate_init() into explicit call sites, but\nmissing the rates_updated path in ieee80211_update_sta_info().\n\nFix this by calling ieee80211_sta_init_nss_bw_capa() before\nrate_control_rate_init() when peer capabilities are updated,\nconsistent with the other IBSS call sites added by that commit.\n\nFixes: e5ad38a9b261 (\"wifi: mac80211: clean up STA NSS handling\")\nSigned-off-by: Shahar Tzarfati \u003cshahar.tzarfati@intel.com\u003e\nReviewed-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Miri Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20260706222724.422adfd57b71.I5a47f65c5e38a221712f5203e5c8040304b382b5@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "0c2ed186bbe14304415476d6707b747dddcd8583", "tree": "43372833160bacec5a138bc39547d10e8c8295c6", "parents": [ "95fc02722edde02946d0d475221f2b2054d3d8ba" ], "author": { "name": "Cen Zhang", "email": "zzzccc427@gmail.com", "time": "Mon Jul 06 23:24:18 2026 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jul 07 09:27:42 2026 +0200" }, "message": "wifi: cfg80211: use wiphy work for socket owner autodisconnect\n\nnl80211_netlink_notify() walks the cfg80211 wireless device list when a\nNETLINK_GENERIC socket is released. If the socket owns a connection, the\nnotifier queues the embedded wdev-\u003edisconnect_wk work item.\n\nThat work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a\nNETLINK_URELEASE notifier that already observed conn_owner_nlportid can\nqueue it after that cancel returns. _cfg80211_unregister_wdev() then\nremoves the wdev from the list and waits for RCU readers, but\nsynchronize_net() does not drain work queued by such a reader.\n\nMake the autodisconnect work a wiphy_work instead. The callback already\nneeds the wiphy mutex, and wiphy_work runs under that mutex. This lets\nteardown cancel pending autodisconnect work while holding the mutex,\nwithout a cancel_work_sync() vs. worker locking concern.\n\nAlso cancel the wiphy work after list_del_rcu() and synchronize_net(). Any\nNETLINK_URELEASE notifier that had already reached the wdev list has then\neither queued the work and it is removed, or can no longer find the wdev.\n\nFixes: bd2522b16884 (\"cfg80211: NL80211_ATTR_SOCKET_OWNER support for CMD_CONNECT\")\nSuggested-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nAssisted-by: Codex:gpt-5.5\nSigned-off-by: Cen Zhang \u003czzzccc427@gmail.com\u003e\nLink: https://patch.msgid.link/20260706152418.779226-1-zzzccc427@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "95fc02722edde02946d0d475221f2b2054d3d8ba", "tree": "c96fb4650d75fa1f4a10becdccf94153b523c8ac", "parents": [ "f3858d5b1432098c1936e03d6e03dd0e33facf60" ], "author": { "name": "Dawei Feng", "email": "dawei.feng@seu.edu.cn", "time": "Mon Jul 06 22:35:07 2026 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jul 07 09:25:05 2026 +0200" }, "message": "wifi: mac80211: fix memory leak in ieee80211_register_hw()\n\nIf kmemdup() fails while copying supported band structures, the error\npath jumps to fail_rate. This skips rate_control_deinitialize() and\nleaks the initialized local-\u003erate_ctrl.\n\nFix this by adding a fail_band label that shares the rate-control cleanup\npath before falling through to the remaining teardown.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still present in\nv7.1-rc7.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have a\nsuitable mac80211 device/driver combination to test with, no runtime\ntesting was able to be performed.\n\nFixes: 09b4a4faf9d0 (\"mac80211: introduce capability flags for VHT EXT NSS support\")\nCc: stable@vger.kernel.org\nReviewed-by: Zilin Guan \u003czilin@seu.edu.cn\u003e\nSigned-off-by: Dawei Feng \u003cdawei.feng@seu.edu.cn\u003e\nLink: https://patch.msgid.link/20260706143507.146131-1-dawei.feng@seu.edu.cn\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "f3858d5b1432098c1936e03d6e03dd0e33facf60", "tree": "fd8cdd766405aad89d9e26784ac8de863176c87e", "parents": [ "4a360c6e18dfa9d70006c7247a6a8cc8dfe0d60f" ], "author": { "name": "Cen Zhang", "email": "zzzccc427@gmail.com", "time": "Mon Jul 06 22:08:41 2026 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jul 07 09:23:23 2026 +0200" }, "message": "wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock\n\nieee80211_do_stop() removes AP_VLAN packets from the parent AP\nps-\u003ebc_buf while holding ps-\u003ebc_buf.lock with IRQs disabled. It then\ncalls ieee80211_free_txskb() before dropping the lock.\n\nieee80211_free_txskb() is not just a passive SKB release. For SKBs with\nTX status state it can report a dropped frame through cfg80211/nl80211,\nand that path can reach netlink tap transmit. This is the same reason\nthe pending queue cleanup in ieee80211_do_stop() already unlinks SKBs\nunder the queue lock and frees them after IRQ state is restored.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nAP_VLAN management TX: AP_VLAN stop:\n1. attach ACK-status state 1. clear the running state\n2. queue a multicast SKB on 2. take ps-\u003ebc_buf.lock with IRQs\n parent ps-\u003ebc_buf disabled\n 3. unlink the AP_VLAN SKB\n 4. call ieee80211_free_txskb()\n\nUnlink matching AP_VLAN SKBs from ps-\u003ebc_buf under the existing lock,\nbut move them to a local free queue. Drop the lock and restore IRQ state\nbefore calling ieee80211_free_txskb().\n\nWARNING: kernel/softirq.c:430 at __local_bh_enable_ip\n\nFixes: 397a7a24ef8c (\"mac80211: free ps-\u003ebc_buf skbs on vlan device stop\")\nAssisted-by: Codex:gpt-5.5\nSigned-off-by: Cen Zhang \u003czzzccc427@gmail.com\u003e\nLink: https://patch.msgid.link/20260706140841.581566-1-zzzccc427@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53", "tree": "f7bf7ed29f7a271df5365a146b2da083d2ee7708", "parents": [ "cead34ac1ce10046cb745fbc33a4b21cac899753", "039892c35f9d8f5ea00d7c2ed1c25224f28b11d7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 06 18:51:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 06 18:51:36 2026 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-07-06-17-49\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc fixes from Andrew Morton:\n \"20 hotfixes. 17 are for MM. 12 are cc:stable and the remaining 8\n address post-7.1 issues or aren\u0027t considered suitable for backporting.\n\n Two patches from SJ addresses a couple of quite old DAMON issues. And\n two patches from Yichong Chen fixes tools/virtio build issues. The\n remaining patches are singletons\"\n\n* tag \u0027mm-hotfixes-stable-2026-07-06-17-49\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n tools/include: include stdint.h for SIZE_MAX in overflow.h\n tools/virtio: add missing compat definitions for vhost_net_test\n mm: do file ownership checks with the proper mount idmap\n samples/damon/mtier: fail early if address range parameters are invalid\n mm: a second pagecache maintainer\n mm/damon: add a kernel-doc comment for damon_ctx-\u003ernd_state\n mm/damon: add a kernel-doc comment for damon_ctx-\u003eprobes\n mailmap: add entries for Radu Rendec\n selftests/mm: hmm-tests: include linux/mman.h to access MADV_COLLAPSE\n selftests/mm: pagemap_ioctl: use the correct page size for transact_test()\n fs/proc: fix KPF_KSM reported for all anonymous pages\n mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access\n mm/damon/ops-common: handle extreme intervals in damon_hot_score()\n MAINTAINERS: add Lance as an rmap reviewer\n mm/compaction: handle free_pages_prepare() properly in compaction_free()\n mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error\n mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()\n mm: shrinker: fix NULL pointer dereference in debugfs\n mm: shrinker: fix shrinker_info teardown race with expansion\n selftests/mm: fix ksft_process_madv.sh test category\n" }, { "commit": "cead34ac1ce10046cb745fbc33a4b21cac899753", "tree": "b0370b911ec176ed14a8d40755a7a7a9b5209ca0", "parents": [ "8cdeaa50eae8dad34885515f62559ee83e7e8dda" ], "author": { "name": "Nick Desaulniers", "email": "ndesaulniers@google.com", "time": "Thu May 28 14:38:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 06 15:49:29 2026 -0700" }, "message": "MAINTAINERS: update ndesaulniers\n\nI\u0027m coming back. I will return. I will possess your body, and I\u0027ll\nmake LKML burn.\n\nSigned-off-by: Nick Desaulniers \u003cndesaulniers@google.com\u003e\nAcked-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nAcked-by: Will Deacon \u003cwill@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6e1930ece855a4c256f1c7e6632d634cfb9888b5", "tree": "482480492e304d7ad24720a3d934a1f213cdcf4c", "parents": [ "dd068ef044128db655f48323a4acfd5907e04903" ], "author": { "name": "Stig Hornang", "email": "stig@hornang.me", "time": "Fri Jun 12 16:38:18 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:58 2026 -0400" }, "message": "Bluetooth: L2CAP: fix tx ident leak for commands without a response\n\nCommit 6c3ea155e5ee (\"Bluetooth: L2CAP: Fix not tracking outstanding\nTX ident\") changed ident allocation to use an IDA, releasing idents in\nl2cap_put_ident() when the matching response command is received.\n\nBut identifiers allocated for commands that have no response defined\nare never released. In particular L2CAP_LE_CREDITS is sent repeatedly for\nthe lifetime of an LE CoC channel, so a peer streaming data to the\nhost exhausts the 1-255 ident range after 254 credit packets. From\nthen on l2cap_get_ident() fails:\n\n kernel: Bluetooth: Unable to allocate ident: -28\n\nand every subsequent L2CAP_LE_CREDITS packet is sent with ident 0,\nwhich is invalid (Core Spec, Vol 3, Part A, Section 4: \"Signaling\nidentifier 0x00 is an invalid identifier and shall never be used in\nany command\"). Remote stacks that validate the ident drop these\ncommands, never receive new credits, and the channel stalls\npermanently. With default socket buffers this happens after roughly 0.5 MB\nof received data (the exact amount depends on the socket receive buffer):\n\n \u003c ACL Data TX: Handle 2048 flags 0x00 dlen 12\n LE L2CAP: LE Flow Control Credit (0x16) ident 0 len 4\n Source CID: 64\n Credits: 1\n\nRelease the ident immediately after sending L2CAP_LE_CREDITS since no\nresponse will ever release it. Use a local variable instead of\nchan-\u003eident so that an ident that an EXT_FLOWCTL channel may be waiting on\n(e.g. a pending reconfigure) is not overwritten by a credit packet.\n\nAlso add the missing L2CAP_LE_CONN_RSP case to l2cap_put_ident() so\nidents allocated for outgoing L2CAP_LE_CONN_REQ commands are released\nwhen the response arrives.\n\nFixes: 6c3ea155e5ee (\"Bluetooth: L2CAP: Fix not tracking outstanding TX ident\")\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221629\nAssisted-by: Claude:claude-opus-4.8\nAssisted-by: Fable:5\nSigned-off-by: Stig Hornang \u003cstig@hornang.me\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "dd068ef044128db655f48323a4acfd5907e04903", "tree": "f3d8cbb8895c1f38a1e0af5f40837acc8d438332", "parents": [ "fd076d8deeab6f9f18ef13400f89e1f550df665b" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Wed Jul 01 09:06:14 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:58 2026 -0400" }, "message": "Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()\n\nbpa10x_setup() sends the vendor command 0xfc0e and passes the response\nto bt_dev_info() and hci_set_fw_info() as a \"%s\" string starting at\nskb-\u003edata + 1, without checking the length:\n\n\tbt_dev_info(hdev, \"%s\", (char *)(skb-\u003edata + 1));\n\thci_set_fw_info(hdev, \"%s\", skb-\u003edata + 1);\n\nA device that returns a one-byte response (status only) leaves\nskb-\u003edata + 1 past the end of the data, and the %s walk reads adjacent\nslab memory until it meets a NUL. The same happens when the payload is\nnot NUL-terminated within skb-\u003elen. The out-of-bounds bytes end up in\nthe kernel log and the firmware-info debugfs file.\n\nPrint the revision string with a bounded \"%.*s\" limited to skb-\u003elen - 1\ninstead. This keeps the string readable for well-behaved devices while\nnever reading past the received data, and does not fail setup, so a\ndevice returning a short or unterminated response keeps working.\n\nFixes: ddd68ec8f484 (\"Bluetooth: bpa10x: Read revision information in setup stage\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "fd076d8deeab6f9f18ef13400f89e1f550df665b", "tree": "4563465f3beee6c6a4ffb9840fd06af985cf9109", "parents": [ "e054c1a6ae7310d2815778fddb87da616e11c255" ], "author": { "name": "Pauli Virtanen", "email": "pav@iki.fi", "time": "Wed Jul 01 18:46:39 2026 +0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:58 2026 -0400" }, "message": "Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length\n\nslen contains ISO_SDU_Length (12 bits), RFU (2 bits),\nPacket_Status_Flags (2 bits).\n\nExclude the RFU bits from hci_iso_data_len. Also add masks to the pack\nmacro.\n\nFixes: 4de0fc599eb9 (\"Bluetooth: Add definitions for CIS connections\")\nSigned-off-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "e054c1a6ae7310d2815778fddb87da616e11c255", "tree": "a1022a7c225e2fc631f02820a1ba8635fd173bf4", "parents": [ "9c36951474d8e1127f4946f39cb874a200f34e9f" ], "author": { "name": "Pauli Virtanen", "email": "pav@iki.fi", "time": "Wed Jul 01 18:46:38 2026 +0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:58 2026 -0400" }, "message": "Bluetooth: ISO: fix malformed ISO_END/CONT handling\n\nCore specification (Part C vol 4 sec 5.4.5) does not exclude empty\nISO_CONT, ISO_END packets. We currently reject them if they are last.\n\nIf controller sends malformed sequence\n\n ISO_START -\u003e rx_len \u003d 4, ISO_CONT skb-\u003elen 4, ISO_START\n\nthat ends payload in ISO_CONT, we leak conn-\u003erx_skb. If controller sends\ntoo long ISO_END, we panic on skb_put. If controller sends too short\nISO_END we accept it.\n\nFix by marking unfinished ISO_START via conn-\u003erx_skb !\u003d NULL. Check\nskb-\u003elen properly before skb_put. Combine the ISO_CONT/END code paths\nas they require the same initial checks. Reject too short ISO_END\npackets.\n\nFixes: 84c24fb151fc (\"Bluetooth: ISO: drop ISO_END frames received without prior ISO_START\")\nFixes: ccf74f2390d6 (\"Bluetooth: Add BTPROTO_ISO socket type\")\nSigned-off-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "9c36951474d8e1127f4946f39cb874a200f34e9f", "tree": "a3537e2ae299f5890b32cd2081eef01d02214291", "parents": [ "6fef032af0092ed5ccb767239a9ac1bc38c08a40" ], "author": { "name": "Kiran K", "email": "kiran.k@intel.com", "time": "Tue Jun 30 22:29:19 2026 +0530" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:58 2026 -0400" }, "message": "Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()\n\nThe FLR branch in btintel_pcie_reset_work() open-coded the entire\nre-init sequence: btintel_pcie_release_hdev() (hci_unregister_dev +\nhci_free_dev), pci_try_reset_function(), enable_interrupts /\nconfig_msix / enable_bt / reset_ia / start_rx, then\nbtintel_pcie_setup_hdev() (hci_alloc_dev_priv + hci_register_dev).\nEvery probe() init step had to be kept in sync with this second\ncopy in the reset path, and any failure mid-sequence left state to\nunwind by hand.\n\nThe PLDR path already delegates teardown and re-init to the PCI\ncore via device_reprobe(): .remove() destroys data through devres\nand unregisters hdev, then .probe() rebuilds everything from\nscratch. Apply the same model to FLR.\n\nIntroduce btintel_pcie_perform_flr() mirroring perform_pldr(). It\nruns pci_try_reset_function() (required to avoid the device_lock\nABBA against btintel_pcie_remove(), which calls\ndisable_work_sync(\u0026reset_work) while holding device_lock) followed\nby device_reprobe(). On success, data is destroyed and a fresh\nprobe re-INIT_WORKs coredump_work with disable count 0, so\nenable_work() must not be called; on failure, data is still alive\nand the caller balances the earlier disable_work_sync(). The\ncontract is documented on the helper and reiterated at the\nreset_work() call site.\n\nreset_work() shrinks to interrupt/worker drain, dispatch on\nreset_type, and the single asymmetry between the two paths. The\nout_enable label, the manual unregister/register pair, and the\nforward declaration of btintel_pcie_setup_hdev() are dropped.\n\nNo intended functional change; FLR and PLDR now share one\nteardown contract.\n\nFixes: 256ab9520d15 (\"Bluetooth: btintel_pcie: Support Function level reset\")\nAssisted-by: GitHub-Copilot:claude-4.7-opus\nSigned-off-by: Kiran K \u003ckiran.k@intel.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "6fef032af0092ed5ccb767239a9ac1bc38c08a40", "tree": "fc3fa8802f21c6c136b29a4c43a46b11bcd35a24", "parents": [ "4bd0b274054f2679f28b70222b607bb0afc3ab9a" ], "author": { "name": "Siwei Zhang", "email": "oss@fourdim.xyz", "time": "Mon Jun 29 09:49:58 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:58 2026 -0400" }, "message": "Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)-\u003echan after\nrelease_sock(parent). Once the parent lock is dropped the newly\nenqueued child socket sk is reachable via the accept queue, so another\ntask can accept and free it before the callback dereferences sk,\nresulting in a use-after-free.\n\nRework the -\u003enew_connection() op so the core, rather than the callback,\nowns the child channel\u0027s lifetime. The op now receives a pre-allocated\nnew_chan and returns an errno instead of allocating and returning a\nchannel. l2cap_new_connection() allocates the child channel and links\nit into the conn list via __l2cap_chan_add() before invoking the\ncallback, so the conn-list reference keeps the channel alive once\nrelease_sock(parent) exposes the socket to other tasks.\n\nChannel configuration that was duplicated in l2cap_sock_init() and the\nvarious new_connection callbacks is consolidated into\nl2cap_chan_set_defaults(), which now inherits from the parent channel\nwhen one is supplied.\n\nFixes: 8ffb929098a5 (\"Bluetooth: Remove parent socket usage from l2cap_core.c\")\nCc: stable@kernel.org\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Siwei Zhang \u003coss@fourdim.xyz\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "4bd0b274054f2679f28b70222b607bb0afc3ab9a", "tree": "43b213723e5bc2d06b5a6d2127a30382d03e0e12", "parents": [ "bb067a99a0356196c0b89a95721985485ebce5a5" ], "author": { "name": "Yousef Alhouseen", "email": "alhouseenyousef@gmail.com", "time": "Sun Jun 28 02:23:05 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:57 2026 -0400" }, "message": "Bluetooth: fix UAF in bt_accept_dequeue()\n\nbt_accept_get() takes a temporary reference before dropping the accept\nqueue lock. bt_accept_dequeue() currently drops that reference before\nbt_accept_unlink(), leaving only the queue reference.\n\nbt_accept_unlink() drops the queue reference. The subsequent\nsock_hold() therefore accesses freed memory if it was the final\nreference, as observed by KASAN during listening L2CAP socket cleanup.\n\nRetain the temporary queue-walk reference through unlink and hand it to\nthe caller on success. Drop it explicitly on the closed and\nnot-yet-connected paths.\n\nFixes: ab1513597c6c (\"Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()\")\nReported-by: syzbot+674ff7e4d7fdfd572afc@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d674ff7e4d7fdfd572afc\nCc: stable@vger.kernel.org\nSigned-off-by: Yousef Alhouseen \u003calhouseenyousef@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "bb067a99a0356196c0b89a95721985485ebce5a5", "tree": "c2e1b5c7836e3503179c93c09d823e268554c830", "parents": [ "0f8a5dcc66648b6e1458a9f3ba4c5a0463a228fc" ], "author": { "name": "Yousef Alhouseen", "email": "alhouseenyousef@gmail.com", "time": "Sun Jun 28 02:50:58 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:57 2026 -0400" }, "message": "Bluetooth: bnep: pin L2CAP connection during netdev registration\n\nbnep_add_connection() reads the L2CAP connection without holding the\nchannel lock, then passes its HCI device to register_netdev(). Controller\nteardown can clear and release that connection concurrently, leaving the\nnetwork device registration path to dereference a freed parent device.\n\nTake a reference to the L2CAP connection while holding the channel lock.\nRetain it until register_netdev() has taken the parent device reference.\n\nFixes: 65f53e9802db (\"Bluetooth: Access BNEP session addresses through L2CAP channel\")\nReported-by: syzbot+fed5dce4553262f3b35c@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dfed5dce4553262f3b35c\nCc: stable@vger.kernel.org\nSigned-off-by: Yousef Alhouseen \u003calhouseenyousef@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "0f8a5dcc66648b6e1458a9f3ba4c5a0463a228fc", "tree": "7cdb08e7421b2dc65dcd7077231258a1908e5206", "parents": [ "384a4b2fef9ffe5e270ee5558975c0504881c5fb" ], "author": { "name": "Sungwoo Kim", "email": "iam@sung-woo.kim", "time": "Wed Jun 24 17:33:04 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:57 2026 -0400" }, "message": "Bluetooth: sco: Fix a race condition in sco_sock_timeout()\n\nsco_sock_timeout() runs asynchronously and lock_sock(sk). If the socket\nis closing while the timer is running, it holds the same lock\n(lock_sock(sk)) twice, leading to a deadlock.\n\nCPU 0 CPU 1\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nsco_sock_close()\n sco_sock_timeout()\nlock_sock(sk) // \u003c-- LOCK\n __sco_sock_close()\n sco_chan_del()\n sco_conn_put()\n\t sco_conn_free()\n\t disable_delayed_work_sync()\n\t lock(sk) // \u003c-- SAME LOCK\n\nFix this by moving disable_delayed_work_sync() outside of lock_sock(sk),\nensuring that no lock_sock(sk) is held before sco_sock_timeout().\n\nLockdep splat:\n\nWARNING: possible circular locking dependency detected\n6.13.0-rc4 #7 Not tainted\n\nsyz-executor292/9514 is trying to acquire lock:\nffff8881115d5070 ((work_completion)(\u0026(\u0026conn-\u003etimeout_work)-\u003ework)){+.+.}-{0:0}, at: rcu_lock_acquire sect/v6.13-rc4/./include/linux/rcupdate.h:337 [inline]\nffff8881115d5070 ((work_completion)(\u0026(\u0026conn-\u003etimeout_work)-\u003ework)){+.+.}-{0:0}, at: rcu_read_lock sect/v6.13-rc4/./include/linux/rcupdate.h:849 [inline]\nffff8881115d5070 ((work_completion)(\u0026(\u0026conn-\u003etimeout_work)-\u003ework)){+.+.}-{0:0}, at: start_flush_work sect/v6.13-rc4/kernel/workqueue.c:4137 [inline]\nffff8881115d5070 ((work_completion)(\u0026(\u0026conn-\u003etimeout_work)-\u003ework)){+.+.}-{0:0}, at: __flush_work+0xd1/0xc40 sect/v6.13-rc4/kernel/workqueue.c:4195\n\nbut task is already holding lock:\nffff88807db3a258 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: lock_sock sect/v6.13-rc4/./include/net/sock.h:1623 [inline]\nffff88807db3a258 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_sock_close+0x25/0x100 sect/v6.13-rc4/net/bluetooth/sco.c:524\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #1 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:\n lock_acquire+0x1c4/0x520 sect/v6.13-rc4/kernel/locking/lockdep.c:5849\n lock_sock_nested+0x48/0x130 sect/v6.13-rc4/net/core/sock.c:3622\n lock_sock sect/v6.13-rc4/./include/net/sock.h:1623 [inline]\n sco_sock_timeout+0xbe/0x270 sect/v6.13-rc4/net/bluetooth/sco.c:158\n process_one_work sect/v6.13-rc4/kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa99/0x18f0 sect/v6.13-rc4/kernel/workqueue.c:3310\n worker_thread+0x8a9/0xd80 sect/v6.13-rc4/kernel/workqueue.c:3391\n kthread+0x2c6/0x360 sect/v6.13-rc4/kernel/kthread.c:389\n ret_from_fork+0x4e/0x80 sect/v6.13-rc4/arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 sect/v6.13-rc4/arch/x86/entry/entry_64.S:244\n\n-\u003e #0 ((work_completion)(\u0026(\u0026conn-\u003etimeout_work)-\u003ework)){+.+.}-{0:0}:\n check_prev_add sect/v6.13-rc4/kernel/locking/lockdep.c:3161 [inline]\n check_prevs_add sect/v6.13-rc4/kernel/locking/lockdep.c:3280 [inline]\n validate_chain+0x1888/0x5760 sect/v6.13-rc4/kernel/locking/lockdep.c:3904\n __lock_acquire+0x13b4/0x2120 sect/v6.13-rc4/kernel/locking/lockdep.c:5226\n lock_acquire+0x1c4/0x520 sect/v6.13-rc4/kernel/locking/lockdep.c:5849\n touch_work_lockdep_map sect/v6.13-rc4/kernel/workqueue.c:3909 [inline]\n start_flush_work sect/v6.13-rc4/kernel/workqueue.c:4163 [inline]\n __flush_work+0x70f/0xc40 sect/v6.13-rc4/kernel/workqueue.c:4195\n __cancel_work_sync sect/v6.13-rc4/kernel/workqueue.c:4351 [inline]\n disable_delayed_work_sync+0xbb/0xf0 sect/v6.13-rc4/kernel/workqueue.c:4514\n sco_conn_free sect/v6.13-rc4/net/bluetooth/sco.c:95 [inline]\n kref_put sect/v6.13-rc4/./include/linux/kref.h:65 [inline]\n sco_conn_put+0x18f/0x270 sect/v6.13-rc4/net/bluetooth/sco.c:107\n sco_chan_del+0xe2/0x210 sect/v6.13-rc4/net/bluetooth/sco.c:236\n sco_sock_close+0x8f/0x100 sect/v6.13-rc4/net/bluetooth/sco.c:526\n sco_sock_release+0x62/0x2d0 sect/v6.13-rc4/net/bluetooth/sco.c:1300\n __sock_release+0xe1/0x2d0 sect/v6.13-rc4/net/socket.c:640\n sock_close+0x1c/0x30 sect/v6.13-rc4/net/socket.c:1408\n __fput+0x2bd/0xa80 sect/v6.13-rc4/fs/file_table.c:450\n __fput_sync+0x15e/0x1c0 sect/v6.13-rc4/fs/file_table.c:535\n __do_sys_close sect/v6.13-rc4/fs/open.c:1554 [inline]\n __se_sys_close sect/v6.13-rc4/fs/open.c:1539 [inline]\n __x64_sys_close+0x93/0x120 sect/v6.13-rc4/fs/open.c:1539\n do_syscall_x64 sect/v6.13-rc4/arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xee/0x210 sect/v6.13-rc4/arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFixes: e6720779ae61 (\"Bluetooth: SCO: Use kref to track lifetime of sco_conn\")\nAcked-by: Dave Tian \u003cdaveti@purdue.edu\u003e\nSigned-off-by: Sungwoo Kim \u003ciam@sung-woo.kim\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "384a4b2fef9ffe5e270ee5558975c0504881c5fb", "tree": "04a7b168b48003b4bcff93abea3a2fc637133da2", "parents": [ "518aa9505fa10ea5662349e5d2efd8c9e32a820b" ], "author": { "name": "Cen Zhang", "email": "zzzccc427@gmail.com", "time": "Wed Jun 24 00:13:28 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:57 2026 -0400" }, "message": "Bluetooth: MGMT: Fix adv monitor add failure cleanup\n\nhci_add_adv_monitor() publishes a new adv_monitor in\nhdev-\u003eadv_monitors_idr before the powered MSFT setup step. The MSFT\noffload add path can then fail either locally before the controller add\ncommand completes, or in the MSFT add callback. In the current queued\nmanagement add flow, hci_cmd_sync_work() still invokes\nmgmt_add_adv_patterns_monitor_complete() with the original pending command\nafter msft_add_monitor_pattern() returns.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMSFT add handling MGMT completion\n1. insert monitor and handle 1. receive sync error\n2. send MSFT add command 2. call add-monitor completion\n3. callback sees bad response 3. load cmd-\u003euser_data\n4. callback frees monitor 4. read monitor-\u003ehandle\n\nLocal MSFT setup failures have the other half of the same ownership bug:\nthey return an error after the IDR insertion, but no later code removes the\nfailed monitor from the IDR.\n\nKeep ownership with the pending management command until its completion.\nFor normal management adds, the MSFT add callback now records successful\ncontroller state and returns errors to its caller. The management\ncompletion frees the monitor on non-success after copying the response\nhandle, while resume/reregister callback-error cleanup remains in the\nMSFT callback. The success path keeps the existing bookkeeping.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x19f/0x330\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n kasan_report+0xe0/0x110\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? 0xffffffffc00d00da\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? hci_cmd_sync_work+0x1ab/0x210 [bluetooth]\n hci_cmd_sync_work+0x1c0/0x210 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n process_one_work+0x4fd/0xbc0\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __list_add_valid_or_report+0x37/0xf0\n ? __pfx_hci_cmd_sync_work+0x10/0x10 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x2d8/0x570\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1ad/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x3c9/0x540\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x2e9/0x730\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 471 on cpu 3 at 285.205389s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n __kasan_kmalloc+0xaa/0xb0\n add_adv_patterns_monitor_rssi+0xd5/0x230 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n __sys_sendto+0x2bc/0x2d0\n __x64_sys_sendto+0x76/0x90\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 454 on cpu 2 at 285.217112s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x5f/0x80\n kfree+0x313/0x590\n msft_add_monitor_sync+0x54a/0x570 [bluetooth]\n hci_add_adv_monitor+0x133/0x180 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30\n\nFixes: a2a4dedf88ab (\"Bluetooth: advmon offload MSFT add monitor\")\nAssisted-by: Codex:gpt-5.5\nSigned-off-by: Cen Zhang \u003czzzccc427@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "518aa9505fa10ea5662349e5d2efd8c9e32a820b", "tree": "dbf6d0121e59cd2502dea3fcd3971a4302275c5c", "parents": [ "352a59dc1f4a41314b6f827c17e16af7ca88271a" ], "author": { "name": "Cen Zhang", "email": "zzzccc427@gmail.com", "time": "Wed Jun 24 00:12:59 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:57 2026 -0400" }, "message": "Bluetooth: 6lowpan: hold L2CAP conn across debugfs control\n\nget_l2cap_conn() looks up an LE hci_conn under hdev protection, but\nthen drops that protection before reading hcon-\u003el2cap_data and before\nlowpan_control_write() later dereferences conn-\u003ehcon. A disconnect or\ndevice close can tear down the same L2CAP connection in that window.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\n6LoWPAN control write: HCI disconnect/device close:\n 1. get_l2cap_conn() finds hcon 1. hci_disconn_cfm() dispatches\n and hcon-\u003el2cap_data. the L2CAP disconnect callback.\n 2. get_l2cap_conn() drops hdev 2. l2cap_conn_del() clears\n protection and returns conn. hcon-\u003el2cap_data and drops the\n L2CAP connection reference.\n 3. lowpan_control_write() reads 3. hci_conn_del() removes and drops\n conn-\u003ehcon. the HCI connection.\n\nTake a reference to the L2CAP connection with\nl2cap_conn_hold_unless_zero() while hdev is still locked, and drop that\nreference after the debugfs command\u0027s last use of conn. This mirrors the\nexisting L2CAP ACL receive-side handoff and keeps the connection\ndereferenceable after leaving hdev protection. Export the existing helper\nso the bluetooth_6lowpan module can use the same lifetime primitive.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in lowpan_control_write+0x374/0x520\nThe buggy address belongs to the object at ffff888111b9d000 which belongs\nto the cache kmalloc-1k of size 1024\nThe buggy address is located 0 bytes inside of freed 1024-byte region\n[ffff888111b9d000, ffff888111b9d400)\nRead of size 8\nCall trace:\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n lowpan_control_write+0x374/0x520 (net/bluetooth/6lowpan.c:1131)\n srso_alias_return_thunk+0x5/0xfbef5\n __virt_addr_valid+0x19f/0x330\n kasan_report+0xe0/0x110\n __debugfs_file_get+0xf7/0x400\n full_proxy_write+0x9e/0xd0\n vfs_write+0x1b0/0x810\n ksys_write+0xd2/0x170\n dnotify_flush+0x32/0x220\n do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nAllocated by task stack:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n __kasan_kmalloc+0xaa/0xb0\n l2cap_conn_add+0x45/0x520\n l2cap_chan_connect+0xac6/0xd90\n l2cap_sock_connect+0x216/0x350\n __sys_connect+0x101/0x130\n __x64_sys_connect+0x40/0x50\n do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nFreed by task stack:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x5f/0x80\n kfree+0x313/0x590\n hci_conn_hash_flush+0xc0/0x140\n hci_dev_close_sync+0x41a/0xb00\n hci_dev_close+0x12f/0x160\n hci_sock_ioctl+0x157/0x570\n sock_do_ioctl+0xf7/0x210\n sock_ioctl+0x32f/0x490\n __x64_sys_ioctl+0xc7/0x110\n do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n kasan_record_aux_stack+0xa7/0xc0\n insert_work+0x32/0x100\n __queue_work+0x262/0xa60\n queue_work_on+0xad/0xb0\n l2cap_connect_cfm+0x4ef/0x670\n hci_le_remote_feat_complete_evt+0x247/0x430\n hci_event_packet+0x360/0x6f0\n hci_rx_work+0x2ae/0x7a0\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30\n\nFixes: 6b8d4a6a0314 (\"Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one\")\nAssisted-by: Codex:gpt-5.5\nSigned-off-by: Cen Zhang \u003czzzccc427@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "352a59dc1f4a41314b6f827c17e16af7ca88271a", "tree": "556f5bcbe8f064569c7a5e874d33e9d77ceda4d0", "parents": [ "12917f591cea1af36087dba5b9ec888652f0b42a" ], "author": { "name": "Cen Zhang", "email": "zzzccc427@gmail.com", "time": "Wed Jun 24 00:12:29 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:57 2026 -0400" }, "message": "Bluetooth: 6lowpan: avoid untracked enable work\n\nlowpan_enable_set() allocates a temporary work item and schedules\ndo_enable_set() on system_wq, then returns to debugfs. The debugfs active\noperation has ended at that point, but the worker still executes module\ntext and manipulates enable_6lowpan and listen_chan.\n\nbt_6lowpan_exit() removes the debugfs files and immediately closes and\nputs listen_chan. It has no pointer to the queued work item, so it cannot\ncancel or flush it before tearing down the state that the worker uses.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\ndebugfs enable write module exit\n1. lowpan_enable_set() allocates 1. bt_6lowpan_exit() removes\n set_enable work the debugfs file\n2. schedule_work() queues 2. bt_6lowpan_exit() closes\n do_enable_set() and puts listen_chan\n3. the write operation returns 3. module teardown can continue\n4. do_enable_set() later runs\n against stale state\n\nRun the enable state transition synchronously in lowpan_enable_set()\ninstead. The simple debugfs setter can sleep, and this file already handles\nthe 6LoWPAN control write synchronously under the same set_lock. Once the\nsetter returns, debugfs removal covers the whole operation and exit can no\nlonger race with an untracked work item.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in do_enable_set+0x113/0x2e0\nWorkqueue: events do_enable_set [bluetooth_6lowpan]\nThe buggy address belongs to the object at ffff888109cb8000\n\nFixes: 90305829635d (\"Bluetooth: 6lowpan: Converting rwlocks to use RCU\")\nAssisted-by: Codex:gpt-5.5\nSigned-off-by: Cen Zhang \u003czzzccc427@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "12917f591cea1af36087dba5b9ec888652f0b42a", "tree": "a2d2aa6bf047257b9d495e904419cb05e04468ba", "parents": [ "badff6c3bed8923a1257a853f137d447976eec30" ], "author": { "name": "Siwei Zhang", "email": "oss@fourdim.xyz", "time": "Mon Jun 15 11:33:05 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:57 2026 -0400" }, "message": "Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()\n\nhci_abort_conn() read hci_skb_event(hdev-\u003esent_cmd) when a connection\nwas pending, but hdev-\u003esent_cmd can be NULL while req_status is still\nHCI_REQ_PEND, leading to a NULL pointer dereference and a general\nprotection fault from the hci_rx_work() receive path.\n\nInstead of inspecting hdev-\u003esent_cmd, track the in-flight create\nconnection command with a new per-connection HCI_CONN_CREATE flag and\nroute all cancellation through hci_cancel_connect_sync(), which\ndispatches to a dedicated per-type cancel function. The create command\nis in exactly one of two states: still queued, or in flight. The cancel\nfunction holds cmd_sync_work_lock across the whole decision: the worker\ntakes this lock to dequeue every entry, so while it is held a queued\ncommand cannot start running and an in-flight command cannot complete\nand let the next command become pending. This keeps the flag test and\nhci_cmd_sync_cancel() atomic with respect to the worker, so a queued\ncommand is simply dequeued, and an in-flight command owned by this\nconnection is cancelled without the risk of cancelling an unrelated\ncommand that became pending in the meantime. CIS uses the same flag\nmechanism via HCI_CONN_CREATE_CIS but cannot be dequeued per-connection.\n\nhci_acl_create_conn_sync() and hci_le_create_conn_sync() clear\nHCI_CONN_CREATE after the create command completes, but the command\nstatus handler can free conn via hci_conn_del() (for example when the\ncontroller rejects the connection) while the worker is still blocked on\nthe connection complete event. Hold a reference on conn across the\ncreate command so the flag can be cleared without a use-after-free.\n\nFixes: a13f316e90fd (\"Bluetooth: hci_conn: Consolidate code for aborting connections\")\nCc: stable@vger.kernel.org\nSuggested-by: XIAO WU \u003cxiaowu.417@qq.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Siwei Zhang \u003coss@fourdim.xyz\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "badff6c3bed8923a1257a853f137d447976eec30", "tree": "875b640ffeeadbb4cdd687a13ee248a81dbaea45", "parents": [ "687617555cedfb74c9e3cb85d759b908dcb17856" ], "author": { "name": "Maoyi Xie", "email": "maoyixie.tju@gmail.com", "time": "Wed Jun 17 16:36:52 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Jul 06 10:46:57 2026 -0400" }, "message": "Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()\n\nDuring the v3 firmware download the controller sends a v3_data_req with a\n32 bit offset and a 16 bit len. nxp_recv_fw_req_v3() checks only the lower\nbound of the offset and then sends firmware from that offset.\n\n nxpdev-\u003efw_dnld_v3_offset \u003d offset - nxpdev-\u003efw_v3_offset_correction;\n serdev_device_write_buf(nxpdev-\u003eserdev, nxpdev-\u003efw-\u003edata +\n nxpdev-\u003efw_dnld_v3_offset, len);\n\nNothing checks that fw_dnld_v3_offset + len stays within nxpdev-\u003efw-\u003esize,\nso a controller that asks for an offset or length past the firmware image\nmakes the driver read past the end of nxpdev-\u003efw-\u003edata and send that\nmemory back over UART.\n\nnxp_recv_fw_req_v1() already bounds the same write. Add the equivalent\ncheck to the v3 path, reject the request when it falls outside the firmware\nimage, and zero len on the error path so the fw_v3_prev_sent bookkeeping at\nfree_skb stays consistent.\n\nFixes: 689ca16e5232 (\"Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets\")\nSuggested-by: Neeraj Sanjay Kale \u003cneeraj.sanjaykale@nxp.com\u003e\nReviewed-by: Neeraj Sanjay Kale \u003cneeraj.sanjaykale@nxp.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Maoyi Xie \u003cmaoyixie.tju@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" } ], "next": "687617555cedfb74c9e3cb85d759b908dcb17856" }