| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250710124526.32220-1-pabeni@redhat.com>
Date: Thu, 10 Jul 2025 14:45:26 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: torvalds@...ux-foundation.org
Cc: kuba@...nel.org,
davem@...emloft.net,
netdev@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: [GIT PULL] Networking for v6.16-rc6
Hi Linus!
A slightly larger number of regressions than usual, but I'm not aware of
any other pending ones.
The following changes since commit 17bbde2e1716e2ee4b997d476b48ae85c5a47671:
Merge tag 'net-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2025-07-03 09:18:55 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git net-6.16-rc6
for you to fetch changes up to dd831ac8221e691e9e918585b1003c7071df0379:
net/sched: sch_qfq: Fix null-deref in agg_dequeue (2025-07-10 11:08:35 +0200)
----------------------------------------------------------------
Including fixes from Bluetooth.
Current release - regressions:
- tcp: refine sk_rcvbuf increase for ooo packets
- bluetooth: fix attempting to send HCI_Disconnect to BIS handle
- rxrpc: fix over large frame size warning
- eth: bcmgenet: initialize u64 stats seq counter
Previous releases - regressions:
- tcp: correct signedness in skb remaining space calculation
- sched: abort __tc_modify_qdisc if parent class does not exist
- vsock: fix transport_{g2h,h2g} TOCTOU
- rxrpc: fix bug due to prealloc collision
- tipc: fix use-after-free in tipc_conn_close().
- bluetooth: fix not marking Broadcast Sink BIS as connected
- phy: qca808x: fix WoL issue by utilizing at8031_set_wol()
- eth: am65-cpsw-nuss: fix skb size by accounting for skb_shared_info
Previous releases - always broken:
- netlink: fix wraparounds of sk->sk_rmem_alloc.
- atm: fix infinite recursive call of clip_push().
- eth: stmmac: fix interrupt handling for level-triggered mode in DWC_XGMAC2
- eth: rtsn: fix a null pointer dereference in rtsn_probe()
Signed-off-by: Paolo Abeni <pabeni@...hat.com>
----------------------------------------------------------------
Alok Tiwari (1):
net: thunderx: avoid direct MTU assignment after WRITE_ONCE()
Chen-Yu Tsai (1):
dt-bindings: net: sun8i-emac: Rename A523 EMAC0 to GMAC0
Chintan Vankar (1):
net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info
Christophe JAILLET (1):
net: airoha: Fix an error handling path in airoha_probe()
David Howells (3):
rxrpc: Fix over large frame size warning
rxrpc: Fix bug due to prealloc collision
rxrpc: Fix oops due to non-existence of prealloc backlog struct
Eric Dumazet (2):
tcp: refine sk_rcvbuf increase for ooo packets
selftests/net: packetdrill: add tcp_ooo-before-and-after-accept.pkt
EricChan (1):
net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
Haoxiang Li (1):
net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe()
Jakub Kicinski (8):
Merge branch 'fix-qca808x-wol-issue'
Merge tag 'for-net-2025-07-03' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Merge branch 'allwinner-a523-rename-emac0-to-gmac0'
Merge branch 'vsock-fix-transport_-h2g-g2h-dgram-local-toctou-issues'
Merge branch 'net-phy-smsc-robustness-fixes-for-lan87xx-lan9500'
Merge branch 'atm-clip-fix-infinite-recursion-potential-null-ptr-deref-and-memleak'
Merge branch 'tcp-better-memory-control-for-not-yet-accepted-sockets'
Merge branch 'rxrpc-miscellaneous-fixes'
Jason Xing (1):
bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL
Jiayuan Chen (1):
tcp: Correct signedness in skb remaining space calculation
Kuniyuki Iwashima (5):
netlink: Fix wraparounds of sk->sk_rmem_alloc.
tipc: Fix use-after-free in tipc_conn_close().
atm: clip: Fix potential null-ptr-deref in to_atmarpd().
atm: clip: Fix memory leak of struct clip_vcc.
atm: clip: Fix infinite recursive call of clip_push().
Louis Peens (1):
MAINTAINERS: remove myself as netronome maintainer
Luiz Augusto von Dentz (4):
Bluetooth: hci_sync: Fix not disabling advertising instance
Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state
Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
Luo Jie (2):
net: phy: qcom: move the WoL function to shared library
net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol()
Michal Luczaj (3):
vsock: Fix transport_{g2h,h2g} TOCTOU
vsock: Fix transport_* TOCTOU
vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
Oleksij Rempel (3):
net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
net: phy: smsc: Force predictable MDI-X state on LAN87xx
net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
Ryo Takakura (1):
net: bcmgenet: Initialize u64 stats seq counter
Stefano Garzarella (1):
vsock: fix `vsock_proto` declaration
Victor Nogueira (2):
selftests/tc-testing: Create test case for UAF scenario with DRR/NETEM/BLACKHOLE chain
net/sched: Abort __tc_modify_qdisc if parent class does not exist
Xiang Mei (1):
net/sched: sch_qfq: Fix null-deref in agg_dequeue
Yue Haibing (1):
atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
.../bindings/net/allwinner,sun8i-a83t-emac.yaml | 2 +-
MAINTAINERS | 4 +-
drivers/net/ethernet/airoha/airoha_eth.c | 1 +
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 ++-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 6 ++
drivers/net/ethernet/cavium/thunder/nicvf_main.c | 12 +---
drivers/net/ethernet/renesas/rtsn.c | 5 ++
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 24 +++----
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 4 +-
drivers/net/phy/qcom/at803x.c | 27 --------
drivers/net/phy/qcom/qca808x.c | 2 +-
drivers/net/phy/qcom/qcom-phy-lib.c | 25 +++++++
drivers/net/phy/qcom/qcom.h | 5 ++
drivers/net/phy/smsc.c | 57 +++++++++++++--
include/net/af_vsock.h | 2 +-
include/net/bluetooth/hci_core.h | 3 +-
include/net/pkt_sched.h | 25 ++++++-
net/atm/clip.c | 64 ++++++++++++-----
net/bluetooth/hci_event.c | 3 +
net/bluetooth/hci_sync.c | 4 +-
net/ipv4/tcp.c | 2 +-
net/ipv4/tcp_input.c | 4 +-
net/netlink/af_netlink.c | 81 +++++++++++++---------
net/rxrpc/ar-internal.h | 15 ++--
net/rxrpc/call_accept.c | 4 ++
net/rxrpc/output.c | 5 +-
net/sched/sch_api.c | 33 +++++----
net/sched/sch_hfsc.c | 16 -----
net/sched/sch_qfq.c | 2 +-
net/tipc/topsrv.c | 2 +
net/vmw_vsock/af_vsock.c | 57 ++++++++++++---
.../tcp_ooo-before-and-after-accept.pkt | 53 ++++++++++++++
.../tc-testing/tc-tests/infra/qdiscs.json | 37 ++++++++++
33 files changed, 421 insertions(+), 175 deletions(-)
create mode 100644 tools/testing/selftests/net/packetdrill/tcp_ooo-before-and-after-accept.pkt
Powered by blists - more mailing lists