linux-stable.git/drivers/net/ppp, branch master

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-08-18T17:42:41+00:00

Merge in late fixes in preparation for the net-next PR.

Conflicts:

drivers/dpll/dpll_core.c
drivers/dpll/dpll_netlink.c
  33f016b23a219 ("dpll: fix NULL deref in dpll_device_ops() during teardown race")
  b1d0c412088e3 ("dpll: add STATE_CONNECTED_OVERRIDE pin capability")
https://lore.kernel.org/aoR9YYY2P5--3x0N@sirena.org.uk
https://lore.kernel.org/aoR9VmKllVGwmQn_@sirena.org.uk

No adjacent changes.

Signed-off-by: Jakub Kicinski

pppox: drain queued packets on channel handoff

2026-08-17T21:00:30+00:00

PPPIOCGCHAN both returns the channel index and marks a PPPOX socket as
bound to generic PPP, despite its getter semantic. Packets received
before that transition are queued on sk_receive_queue, but a bound
socket is no longer readable. Such packets therefore remain queued until
the socket is destroyed.

After marking a socket bound, wait for receive paths that observed the
old state to finish queueing packets, and then drain the queue into
generic PPP.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Qingfang Deng 
Link: https://patch.msgid.link/20260811035314.302878-1-qingfang.deng@linux.dev
Signed-off-by: Jakub Kicinski

pptp: drop packets received before connect

2026-08-13T00:17:53+00:00

pptp_bind() publishes the socket by its local call ID before it is
connected, so GRE packets can reach pptp_rcv_core() while
PPPOX_CONNECTED is clear.

Such packets are queued on sk_receive_queue, but PPTP provides no recvmsg
operation and never drains the queue after connect. The packets therefore
remain there until socket destruction.

Drop such packets immediately instead. Since PPTP no longer queues packets
on sk_receive_queue, remove the corresponding destructor purge.

Signed-off-by: Qingfang Deng 
Link: https://patch.msgid.link/20260811074948.345834-1-qingfang.deng@linux.dev
Signed-off-by: Jakub Kicinski

ppp: annotate lockless queue empty check

2026-08-13T00:14:20+00:00

ppp_poll() checks whether pf->rq contains a packet without holding the
queue lock. skb_peek() requires appropriate locking or a private queue,
neither of which applies because ppp_input() can enqueue concurrently.

Only queue emptiness is needed, so use skb_queue_empty_lockless()
instead.

Cc: stable+noautosel@kernel.org # race annotation
Signed-off-by: Qingfang Deng 
Reviewed-by: Breno Leitao

pppoe: remove redundant xmit wrapper

2026-08-06T01:34:20+00:00

Merge __pppoe_xmit() into pppoe_xmit(), its only caller.

Signed-off-by: Qingfang Deng 
Link: https://patch.msgid.link/20260804094336.109364-1-qingfang.deng@linux.dev
Signed-off-by: Jakub Kicinski

ppp: use netdev_from_priv()

2026-08-03T23:23:48+00:00

Use the new netdev_from_priv() helper to access the net device from
struct ppp.

Signed-off-by: Qingfang Deng 
Reviewed-by: Breno Leitao 
Link: https://patch.msgid.link/20260730100654.745-1-qingfang.deng@linux.dev
Signed-off-by: Jakub Kicinski

ppp: convert chan_sem to a mutex

2026-07-29T02:13:51+00:00

chan_sem's read-side lock is taken under another mutex, so there is no
benefit in keeping it as an rwsem. Replace the rwsem with a mutex.

Signed-off-by: Qingfang Deng 
Link: https://patch.msgid.link/20260727032802.4090-1-qingfang.deng@linux.dev
Signed-off-by: Jakub Kicinski

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-07-23T21:07:40+00:00

Cross-merge networking fixes after downstream PR (net-7.2-rc5).

Conflicts:

drivers/net/amt.c
  3656a79f94c47 ("amt: re-read skb header pointers after every pull")
  586c4dcf28eb6 ("amt: no longer rely on RTNL in amt_fill_info()")
https://lore.kernel.org/amIaJr3aOQNS_Fvl@sirena.org.uk

Adjacent changes:

drivers/net/geneve.c
  8efb8f8bbb35 ("geneve: require CAP_NET_ADMIN in the device netns for changelink")
  0ba269933f73 ("geneve: convert config to RCU-protected pointer")

Signed-off-by: Jakub Kicinski

pppoe: reload header pointer after dev_hard_header()

2026-07-23T14:01:53+00:00

pppoe_sendmsg() saves a pointer to the PPPoE header before calling
dev_hard_header(). Device header callbacks are allowed to reallocate the
skb head, invalidating pointers into it.

This can happen when a send is blocked in copy_from_user() while the first
non-Ethernet port is added to an empty team device. The team's delegated
GRE header callback then expands the skb head. PPPoE subsequently writes
six bytes through the stale pointer into the freed head.

Reload the PPPoE header through the skb's network-header offset after
device header creation. pskb_expand_head() updates that offset when it
relocates the head.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Asim Viladi Oglu Manizada 
Reviewed-by: Vadim Fedorenko 
Reviewed-by: Eric Dumazet 
Link: https://patch.msgid.link/20260722093814.3017176-1-manizada@pm.me
Signed-off-by: Jakub Kicinski

ppp: annotate data races in ppp_generic

2026-07-23T14:01:37+00:00

Several fields in struct ppp can be read or updated concurrently
from multiple CPUs without synchronization, causing data races:

1. ppp->mru is read concurrently in ppp_receive_nonmp_frame() while
   being updated via PPPIOCSMRU ioctl. Protect ppp->mru updates in
   PPPIOCSMRU with ppp_recv_lock(ppp).

2. PPPIOCGFLAGS reads ppp->flags, ppp->xstate, and ppp->rstate
   unlocked. Wrap the read in ppp_lock(ppp) to get a consistent
   snapshot.

3. ppp->debug is updated via PPPIOCSDEBUG and read concurrently on
   fast paths. Annotate reads with READ_ONCE() and writes with
   WRITE_ONCE().

4. ppp->last_xmit and ppp->last_recv are updated on TX/RX data paths
   and read via PPPIOCGIDLE32 / PPPIOCGIDLE64 ioctls. Annotate with
   WRITE_ONCE() / READ_ONCE() and use max() to handle jiffies
   subtraction.

5. ppp->npmode[] is updated via PPPIOCSNPMODE and read on TX/RX
   paths. Annotate with WRITE_ONCE() / READ_ONCE().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet 
Reviewed-by: Qingfang Deng 
Link: https://patch.msgid.link/20260722101605.2868548-1-edumazet@google.com
Signed-off-by: Jakub Kicinski