kernel/git/next/linux-next.git/drivers/net/ppp, branch master

ppp: ppp_synctty: simplify tty disc_data access

2026-09-01T00:36:56+00:00

Apply the same simplification as the preceding ppp_async change. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+b503105c2410c3433459@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=b503105c2410c3433459 Signed-off-by: Qingfang Deng Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260828073245.126804-2-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski

ppp: ppp_async: simplify tty disc_data access

2026-09-01T00:36:56+00:00

tty_ldisc_hangup() invokes the hangup callback while holding only a read lock on tty->ldisc_sem, so it can run concurrently with other line discipline callbacks. This currently forces async PPP to maintain separate lifetime protection around tty->disc_data. Line discipline close is called under the write lock during hangup processing. Remove the hangup callback and rely on close for teardown, as done for SLIP by commit 23c53269f2ba ("slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()"). This serializes teardown with all other line discipline operations. disc_data_lock, refcount and completion are redundant with that serialization. Remove them and access tty->disc_data directly. This also eliminates a lockdep warning reported by syzbot. The warning does not indicate a real deadlock because the write side runs only in process context with hardirqs disabled. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+8e808eb853386f575d86@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000002fbad30611e25849@google.com/ Signed-off-by: Qingfang Deng Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260828073245.126804-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-08-18T17:42:41+00:00

Merge in late fixes in preparation for the net-next PR. Conflicts: drivers/dpll/dpll_core.c drivers/dpll/dpll_netlink.c 33f016b23a219 ("dpll: fix NULL deref in dpll_device_ops() during teardown race") b1d0c412088e3 ("dpll: add STATE_CONNECTED_OVERRIDE pin capability") https://lore.kernel.org/aoR9YYY2P5--3x0N@sirena.org.uk https://lore.kernel.org/aoR9VmKllVGwmQn_@sirena.org.uk No adjacent changes. Signed-off-by: Jakub Kicinski

pppox: drain queued packets on channel handoff

2026-08-17T21:00:30+00:00

PPPIOCGCHAN both returns the channel index and marks a PPPOX socket as bound to generic PPP, despite its getter semantic. Packets received before that transition are queued on sk_receive_queue, but a bound socket is no longer readable. Such packets therefore remain queued until the socket is destroyed. After marking a socket bound, wait for receive paths that observed the old state to finish queueing packets, and then drain the queue into generic PPP. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260811035314.302878-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski

pptp: drop packets received before connect

2026-08-13T00:17:53+00:00

pptp_bind() publishes the socket by its local call ID before it is connected, so GRE packets can reach pptp_rcv_core() while PPPOX_CONNECTED is clear. Such packets are queued on sk_receive_queue, but PPTP provides no recvmsg operation and never drains the queue after connect. The packets therefore remain there until socket destruction. Drop such packets immediately instead. Since PPTP no longer queues packets on sk_receive_queue, remove the corresponding destructor purge. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260811074948.345834-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski

ppp: annotate lockless queue empty check

2026-08-13T00:14:20+00:00

ppp_poll() checks whether pf->rq contains a packet without holding the queue lock. skb_peek() requires appropriate locking or a private queue, neither of which applies because ppp_input() can enqueue concurrently. Only queue emptiness is needed, so use skb_queue_empty_lockless() instead. Cc: stable+noautosel@kernel.org # race annotation Signed-off-by: Qingfang Deng Reviewed-by: Breno Leitao

pppoe: remove redundant xmit wrapper

2026-08-06T01:34:20+00:00

Merge __pppoe_xmit() into pppoe_xmit(), its only caller. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260804094336.109364-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski

ppp: use netdev_from_priv()

2026-08-03T23:23:48+00:00

Use the new netdev_from_priv() helper to access the net device from struct ppp. Signed-off-by: Qingfang Deng Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260730100654.745-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski

ppp: convert chan_sem to a mutex

2026-07-29T02:13:51+00:00

chan_sem's read-side lock is taken under another mutex, so there is no benefit in keeping it as an rwsem. Replace the rwsem with a mutex. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260727032802.4090-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-07-23T21:07:40+00:00

Cross-merge networking fixes after downstream PR (net-7.2-rc5). Conflicts: drivers/net/amt.c 3656a79f94c47 ("amt: re-read skb header pointers after every pull") 586c4dcf28eb6 ("amt: no longer rely on RTNL in amt_fill_info()") https://lore.kernel.org/amIaJr3aOQNS_Fvl@sirena.org.uk Adjacent changes: drivers/net/geneve.c 8efb8f8bbb35 ("geneve: require CAP_NET_ADMIN in the device netns for changelink") 0ba269933f73 ("geneve: convert config to RCU-protected pointer") Signed-off-by: Jakub Kicinski