kernel/git/next/linux-next.git/net/ipv4, branch master

Merge branch 'main' of https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git

2026-07-09T14:47:47+00:00

# Conflicts: # MAINTAINERS # tools/testing/selftests/net/lib.sh

ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()

2026-07-08T12:41:01+00:00

When a timer is deleted and not re-armed in igmp_mod_timer(), or stopped in igmp_stop_timer(), the code currently decrements the reference counter of the multicast list entry @im using refcount_dec(&im->refcnt). However, both functions can be called from the RCU reader path: - igmp_mod_timer() via igmp_heard_query() -> for_each_pmc_rcu() - igmp_stop_timer() via igmp_rcv() -> igmp_heard_report() If the group im was concurrently removed from the list by ip_mc_dec_group(), its reference count might have already been decremented to 1. In this case, timer_delete() succeeds, and refcount_dec() decrements the refcount from 1 to 0. Since refcount_dec() does not free the object when it hits 0 (unlike ip_ma_put()), the im structure is leaked. Fix this by using ip_ma_put(im) instead of refcount_dec(&im->refcnt), and deferring the put until after the spinlock is released. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260705181756.963063-4-edumazet@google.com Signed-off-by: Paolo Abeni

ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()

2026-07-08T12:41:01+00:00

A race condition exists between device teardown (inetdev_destroy) and incoming IGMP query processing (igmp_rcv), leading to a Use-After-Free in the IGMP timer callback. During device destruction, inetdev_destroy() drops the primary reference to in_device, which can drop its refcount to 0. The actual freeing of in_device memory is deferred via RCU (using call_rcu()). Concurrently, igmp_rcv() runs under RCU read lock and obtains the in_device pointer. Because the memory is RCU-protected, CPU-0 can safely dereference in_device even if its refcount has hit 0. However, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it attempts to acquire a reference using in_dev_hold(). This increments the refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning. Since the in_device memory is still scheduled to be freed after the RCU grace period (as the free callback does not check the refcount again), the device is freed while the timer is still armed. When the timer expires, it accesses the freed memory, causing a kernel panic. Fix this by using refcount_inc_not_zero() (via a new helper in_dev_hold_safe()) to prevent acquiring a reference if the device is already being destroyed. If the refcount is 0, we do not arm the timer. A similar issue in IPv6 MLD is fixed in a subsequent patch. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Zero Day Initiative Signed-off-by: Eric Dumazet Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260705181756.963063-2-edumazet@google.com Signed-off-by: Paolo Abeni

ipv4: igmp: remove multicast group from hash table on device destruction

2026-07-07T10:15:39+00:00

When a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through the multicast list and calls ip_ma_put() on each membership, scheduling them for RCU reclamation. However, they are not unlinked from the device's multicast hash table (mc_hash). Since the device remains published in dev->ip_ptr until after ip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash can still locate and access the multicast group after its refcount is decremented. If the RCU callback runs and frees the group while a reader is accessing it, a use-after-free occurs. Fix this by unlinking the multicast group from mc_hash using ip_mc_hash_remove() before scheduling it for reclamation. BUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0 Read of size 4 at addr ffff888009bf1408 by task mausezahn/2276 Call Trace: dump_stack_lvl+0x67/0x90 print_report+0x175/0x7c0 kasan_report+0x147/0x180 ip_check_mc_rcu+0x149/0x3f0 udp_v4_early_demux+0x36d/0x12d0 ip_rcv_finish_core+0xb8b/0x1390 ip_rcv_finish+0x54/0x120 NF_HOOK+0x213/0x2b0 __netif_receive_skb+0x126/0x340 process_backlog+0x4f2/0xf00 __napi_poll+0x92/0x2c0 net_rx_action+0x583/0xc60 handle_softirqs+0x236/0x7f0 do_softirq+0x57/0x80 Allocated by task 2239: kasan_save_track+0x3e/0x80 __kasan_kmalloc+0x72/0x90 ____ip_mc_inc_group+0x31a/0xa40 __ip_mc_join_group+0x334/0x3f0 do_ip_setsockopt+0x16fa/0x2010 ip_setsockopt+0x3f/0x90 do_sock_setsockopt+0x1ad/0x300 Freed by task 0: kasan_save_track+0x3e/0x80 kasan_save_free_info+0x40/0x50 __kasan_slab_free+0x3a/0x60 __rcu_free_sheaf_prepare+0xd4/0x220 rcu_free_sheaf+0x36/0x190 rcu_core+0x8d9/0x12f0 handle_softirqs+0x236/0x7f0 Fixes: e9897071350b ("igmp: hash a hash table to speedup ip_check_mc_rcu()") Cc: stable@vger.kernel.org Signed-off-by: Yuyang Huang Reviewed-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260701235014.73505-1-yuyanghuang@google.com Signed-off-by: Paolo Abeni

ipv4: fib: Define fib_table_hash_lock under CONFIG_IP_MULTIPLE_TABLES.

2026-07-07T08:51:06+00:00

When CONFIG_IP_MULTIPLE_TABLES is disabled, fib_new_table() is fib_get_table(), and no new table is created. Let's move net->ipv4.fib_table_hash_lock under CONFIG_IP_MULTIPLE_TABLES. While at it, netns_ipv4_sysctl.rst is updated. Suggested-by: Ido Schimmel Signed-off-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260702044437.591864-2-kuniyu@google.com Signed-off-by: Paolo Abeni

Merge tag 'nf-next-26-07-02' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

2026-07-03T20:00:24+00:00

Florian Westphal says: ==================== netfilter: updates for net-next The following patchset contains Netfilter updates for *net-next*. 1) Update nfnetlink_hook to dump the individual NAT type chains instead of the nat base chains to userspace. From Phil Sutter. 2) Replace strlcpy/strlcat() with snprintf() in x_tables, from Ian Bridges. 3) Start replacing u_int8_t and u_int16t with u8 and u16 in netfilter. From Carlos Grillet. 4) Replace strcpy() with strscpy() in netfilter, from David Laight. 5) Remove redundant NULL check before kvfree(). 6) Add parameter validation to xt_tcpmss. Ensure mss_min <= mss_max and invert <= 1. From Feng Wu. 7) Add checkentry for xt_dscp 'tos' match. Implement tos_mt_check() to reject invalid invert values. Also from Feng Wu. 8) Stop hashing nf_conntrack_helper by tuple. Switch to hashing by name and L4 protocol. 9) Remove tuples from conntrack helper definitions and port usage from broadcast helpers. Add netlink policy validation to prevent protocol number truncation. 10) Remove obsolete netfilter conntrack module parameters. 11) Bound num_counters in ebtables: do_replace() by MAX_EBT_ENTRIES to prevent oversized vmalloc_array() allocations. From Jiayuan Chen. 12) Make expectations created via nft_ct rules work with NAT. netfilter pull request nf-next-26-07-02 * tag 'nf-next-26-07-02' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nft_ct: support expectation creation for natted flows netfilter: ebtables: bound num_counters like nentries in do_replace() netfilter: conntrack: remove obsolete module parameters netfilter: conntrack: get rid of tuple in helper definitions netfilter: nf_conntrack_helper: do not hash by tuple netfilter: xt_dscp: add checkentry for tos match netfilter: xt_tcpmss: add checkentry for parameter validation netfilter: remove redundant null check before kvfree() netfilter: avoid strcpy usage netfilter: replace u_int8_t and u_int16t with u8 and u16 netfilter: x_tables: replace strlcat() with snprintf() netfilter: nfnetlink_hook: Dump nat type chains ==================== Link: https://patch.msgid.link/20260702105003.13550-1-fw@strlen.de Signed-off-by: Paolo Abeni

net: ipv4: report multicast group user count

2026-07-03T06:50:43+00:00

RTM_GETMULTICAST has been part of the rtnetlink ABI for a long time and already reports IPv4 multicast group membership through IFA_MULTICAST and IFA_CACHEINFO. It does not report how many consumers hold each membership, so userspace still has to parse /proc/net/igmp to get the Users column. Add IFA_MC_USERS as a u32 attribute carrying ip_mc_list::users in RTM_GETMULTICAST replies and entry-lifecycle notifications. This gives iproute2 enough information to migrate the IPv4 part of "ip maddr show" from procfs parsing to rtnetlink. Signed-off-by: Yuyang Huang Reviewed-by: Vadim Fedorenko Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260630110207.37841-2-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni

ipv4: fib: fix route re-dump in inet_dump_fib() on multi-batch dump

2026-07-03T06:43:53+00:00

inet_dump_fib() saves its progress in cb->args[1] as a positional index within the current hash chain. Between batches, a concurrent fib_new_table() can insert a new table at the chain head, shifting all existing entries. On resume the saved index lands on a different table, causing already-dumped tables to be re-dumped and the originally suspended table to restart from the beginning. Fix by storing tb->tb_id in cb->args[1] instead of a positional index, mirroring the fix applied to inet6_dump_fib() in commit 9facb861dc6b ("ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump"). Signed-off-by: Pengfei Zhang Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260630084220.2711025-1-zhangfeionline@gmail.com Signed-off-by: Paolo Abeni

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-07-03T05:46:27+00:00

Cross-merge networking fixes after downstream PR (net-7.2-rc2). No conflicts. Adjacent changes: MAINTAINERS: 56114690ff3c ("MAINTAINERS: Update Marvell octeontx2 driver maintainers") eb56577ae9a5 ("ehea: remove the ehea driver") net/core/netpoll.c: 45f1458a8501 ("netpoll: fix a use-after-free on shutdown path") 84c0ff1efb62 ("netpoll: do not warn when the best-effort pool refill fails") Signed-off-by: Paolo Abeni

ipv4: raw: convert do_raw_getsockopt to sockopt_t

2026-07-02T10:29:06+00:00

Continue converting the proto-layer getsockopt callbacks to the sockopt_t interface, switching do_raw_getsockopt() and its raw_geticmpfilter() helper to take a sockopt_t. The thin raw_getsockopt() wrapper keeps its __user signature for now: it builds a user-backed sockopt_t with sockopt_init_user(), calls the helper, and writes the returned length back to optlen. The helper uses copy_to_iter() instead of copy_to_user(). No functional change. Signed-off-by: Breno Leitao Acked-by: Stanislav Fomichev Acked-by: Willem de Bruijn Link: https://patch.msgid.link/20260630-getsockopt_phase2-v2-3-193335f3d4d1@debian.org Signed-off-by: Paolo Abeni