summaryrefslogtreecommitdiff
path: root/tools/testing/selftests/net
AgeCommit message (Collapse)Author
3 daysMerge tag 'net-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from Bluetooth, IPSec and Netfilter. Current release - fix to a fix: - netfilter: ipset: remove need to allocate memory on delete operations Current release - regressions: - macb: drop CONFIG_OF #if block, fix build Previous releases - always broken: - stream of fixes for SCTP continues - inet: frags: strip GSO state from fragments before reassembly - virtio-net: ensure that TCP packets don't overflow gso_segs - tcp-ao: fix use-after-free of current_key on reconnect to another peer - page_pool: remove zone/policy GFP flags when allocating XArray entries - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN - tls: device: fix out-of-bounds write in tls_append_frag() - eth: bnxt: - ring the doorbell when SW USO exits early, avoid packets stuck in Tx - gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid users of older NICs seeing non-actionable warning messages - eth: qede: fix NULL pointer dereference in TPA fragment processing" * tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits) inet: frags: strip GSO state from fragments before reassembly net/sched: sch_htb: limit htb_classify inner-class filter hops selftests/net: packetdrill: add tcp_urg_ptr_retransmit tcp: fix corruption of urgent data on multi-segment retransmit usb: atm: usbatm: fix invalid ci_range initialization net: fec: only stop PTP if it was initialized slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() net: bridge: mcast: fix use-after-free of a master VLAN's multicast context net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup net: dsa: mxl862xx: enable assisted learning on CPU port net: stmmac: restore NET_IP_ALIGN in the RX DMA offset net: stmmac: drop gso_enabled_types and rely on netdev features net: stmmac: selftests: Don't test flow control for small rx fifos net: stmmac: selftests: Account for the UC filter list for filtering tests net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering net: stmmac: dwmac4: Account for the primary MAC address for UC filtering net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering net: stmmac: selftests: Check multiple MMC counters selftests: net: Fix slow configurations in big_tcp_tunnels.sh selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh ...
3 daysselftests/net: packetdrill: add tcp_urg_ptr_retransmitJiayuan Chen
Drive a connection into urgent mode and force a multi-segment retransmit, checking that each retransmitted segment keeps its own urg_ptr. The test asserts the fixed behaviour: the hole is retransmitted as two independent skbs, each with its own urg_ptr (5001 and 4001) and no PSH. An unpatched kernel instead sends one super-skb whose GSO split copies urg_ptr onto the second segment and also sets PSH there, so on an unpatched kernel the mismatch shows up on the PSH bit (actual P.U ... urg 5001) before the urg_ptr: tcp_urg_ptr_retransmit.pkt:63: live packet field tcp_psh: expected: 0 (0x0) vs actual: 1 (0x1) script packet: .U 1001:2001(1000) ack 1 actual packet: P.U 1001:2001(1000) ack 1 win 1050 After the fix the retransmit carries a per-segment urg_ptr and the test passes. Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260826141145.67823-2-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
3 daysselftests: net: Fix slow configurations in big_tcp_tunnels.shAlice Mikityanska
The combination of checksum offload disabled (that causes software GSO) and a debug kernel is inherently slow. Depending on the CPU power and load, RTT may increase, limiting sk_pacing_rate, so tcp_tso_autosize caps SKBs at around 40 segments, and zero BIG TCP packets are produced. Increase sysctl net.ipv4.tcp_min_tso_segs and set a bigger initial value of CWND in these configurations to force BIG TCP. Fixes: 5cb53743e1ff ("selftests: net: Add a test for BIG TCP in UDP tunnels") Signed-off-by: Alice Mikityanska <alice@isovalent.com> Acked-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260822120308.1165200-5-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
3 daysselftests: net: Lower threshold with csum offload off in big_tcp_tunnels.shAlice Mikityanska
With checksum offload disabled, much fewer BIG TCP packets are generated due to overall loss of throughput. Use a separate threshold in these tests, which is 1/10 of the threshold set for the rest of tests. Fixes: 5cb53743e1ff ("selftests: net: Add a test for BIG TCP in UDP tunnels") Signed-off-by: Alice Mikityanska <alice@isovalent.com> Acked-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260822120308.1165200-4-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
3 daysselftests: net: Lower threshold on debug kernels for big_tcp_tunnels.shAlice Mikityanska
Debug kernels on upstream CI runners run slower and generate fewer BIG TCP packets, making the test flaky on upstream CI runners. Lower the default threshold for those kernels. Fixes: 5cb53743e1ff ("selftests: net: Add a test for BIG TCP in UDP tunnels") Signed-off-by: Alice Mikityanska <alice@isovalent.com> Acked-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260822120308.1165200-3-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
3 daysselftests: net: Wait for netserver to launchAlice Mikityanska
Use wait_local_port_listen after starting netserver in big_tcp_tunnels.sh to ensure it's listening when the test starts. Fixes: 5cb53743e1ff ("selftests: net: Add a test for BIG TCP in UDP tunnels") Signed-off-by: Alice Mikityanska <alice@isovalent.com> Acked-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260822120308.1165200-2-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
3 daysselftests: net: tcp_ao: test VRF-scoped key deletionRastislav Szabo
Verify that TCP_AO_DEL_KEY can remove a TCP-AO key scoped to a VRF. Assisted-by: Codex:GPT-5 Signed-off-by: Rastislav Szabo <rastislav.szabo@isovalent.com> Reviewed-by: David Ahern <dsahern@kernel.org> Acked-by: Dmitry Safonov <dima@arista.com> Link: https://patch.msgid.link/20260822201119.272269-2-rastislav.szabo@isovalent.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
6 daysselftests/net: check fork() return value in fin_ack_latQingshuang Fu
main() never checks fork() for failure. When fork() returns -1 (EAGAIN/ENOMEM/RLIMIT_NPROC), the !child_pid test is false and the process falls into server()'s infinite accept() loop with no client ever connecting, producing empty output. The wrapper script treats an empty log as a passing test, producing a false positive. Check fork() for failure with error(), as is done for every other syscall in this file. Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260821031442.1124777-2-fffsqian@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
6 daysselftests/net: fix kill() argument order and wrapper cleanup in fin_ack_latQingshuang Fu
sig_handler() passes its arguments to kill() in the wrong order: it sends signal number child_pid to PID SIGTERM (15) instead of sending SIGTERM to the client process. The call therefore always fails and the signal is never forwarded: when only the server process receives SIGTERM, the client keeps running its infinite connect loop as an orphan process. Swap the arguments so that the server forwards SIGTERM to the client. Guard the call with child_pid > 0: the client inherits the handler and sees child_pid == 0, and a plain argument swap would make it call kill(0, SIGTERM), signaling the whole process group instead of exiting quietly. Now that the server actually terminates the client before the wrapper script's cleanup runs, kill() may fail with ESRCH for the already-exited client. The script uses set -e, so make the kill tolerant to avoid aborting the EXIT trap and leaking temporary files. Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260821031442.1124777-1-fffsqian@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
10 daysselftests: net: packetdrill: add tests for advertised MSS with PMTU exceptionsEric Dumazet
Add packetdrill tests for IPv4 and IPv6 to verify that the advertised MSS in SYN-ACK is derived from the configured interface/route MTU, and is not shrunk by learned Path MTU exceptions from previous outbound connections. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Link: https://patch.msgid.link/20260815071532.301908-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
10 daysMerge tag 'sysctl-7.03-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl Pull sysctl updates from Joel Granados: - Fix kernel-doc warnings by adjusting in file documentation - Consolidate do_proc_* function into do_proc_vec Consolidate three slightly different implementations of applying a converter on all elements of a vector. Fixes to this function now propagate to the three types. - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL (they were the same) and restrict cad_pid modifications to global root (GLOBAL_ROOT_UID) * tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] sysctl: repair some kernel-doc comments sysctl: add Returns: kernel-doc for all functions sysctl: Update API function documentation sysctl: Rename proc_doulongvec_minmax_conv to proc_doulongvec_conv sysctl: Group proc_handler declarations and document sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec sysctl: Add negp parameter to douintvec converter functions sysctl: Move default converter assignment out of do_proc_dointvec
13 daysselftest: Add tests for useful handling of LSM denials on SCM_RIGHTSJori Koolstra
Tests SCM_RIGHTS fd passing on a socket with the new socket option SO_RIGHTS_NOTRUNC turned on. To hook into the security_file_receive() call, BPF is used. The BPF program shares a hashmap with userspace that lists the inos to be blocked (of the receiver tgid). Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Link: https://patch.msgid.link/20260814172806.158954-1-jkoolstra@xs4all.nl Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysselftests: mptcp: diag: fix stack buffer overflow in get_subflow_info()Jiangshan Yi
get_subflow_info() parses the subflow address string with: char saddr[64], daddr[64]; ret = sscanf(subflow_addrs, "%[^:]:%d %[^:]:%d", saddr, &sport, daddr, &dport); The subflow_addrs buffer holds up to 1024 bytes and is taken directly from the command line ("-c" argument). The "%[^:]" conversions have no maximum field width, so if the address substring before the ':' exceeds 63 bytes, sscanf() writes past the end of the 64-byte saddr/daddr stack buffers. This overflows the stack, corrupting adjacent stack data such as the saved return address, and can crash the tool or lead to out-of-bounds writes controlled by user-supplied input. Bound both string conversions to the destination buffer size by adding an explicit maximum field width of 63 (leaving room for the terminating NUL), so at most 63 bytes are written into each 64-byte buffer: ret = sscanf(subflow_addrs, "%63[^:]:%d %63[^:]:%d", saddr, &sport, daddr, &dport); The subflow address can be passed in argument, so fixing this is helpful when the tool is manually used. Reviewed-by: Geliang Tang <geliang@kernel.org> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-11-1905a818f6cb@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysselftests: mptcp: fix const qualifier warnings in strchr usageGeliang Tang
In mptcp_connect.c, strchr() returns a pointer to a character within the input string, which is declared as const char *. Assigning this return value to a non-const char * discards the const qualifier, triggering compiler warnings: make: Entering directory 'tools/testing/selftests/net/mptcp' CC mptcp_connect mptcp_connect.c: In function 'parse_cmsg_types': mptcp_connect.c:1267:22: warning: initialization discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] 1267 | char *next = strchr(type, ','); | ^~~~~~ mptcp_connect.c: In function 'parse_setsock_options': mptcp_connect.c:1295:22: warning: initialization discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] 1295 | char *next = strchr(name, ','); | ^~~~~~ make: Leaving directory 'tools/testing/selftests/net/mptcp' Fix these warnings by declaring the 'next' variable as const char *, as it is only used for read-only parsing. Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-10-1905a818f6cb@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysselftests: mptcp: pcap: drop most of the payloadMatthieu Baerts (NGI0)
Limit the size of each captured packet to 108B (IPv4 only) or 128B (a mix of v4 and v6): this should drop most of the payload that is generally not needed when debugging an issue. 8 bytes are left in this payload, to be able to inspect the beginning, just in case. Please also note that generally, this payload is usually mostly filled with 0, except at the end. This reduces the .pcap sizes, and reduce IO usage, which helps debugging issues. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-9-1905a818f6cb@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysselftests: mptcp: simult_flow: test name in pcap fileMatthieu Baerts (NGI0)
To be able to easily find out which pcap was produced by which test, the selftest name is now added to the pcap file, similar to the other tests. While at it, print the prefix name to be able to find which capture files have been produced by which test after several runs. This prefix was not printed anywhere before. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-8-1905a818f6cb@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysselftests: mptcp: connect: test name in pcap fileMatthieu Baerts (NGI0)
Even if the pcap prefix is printed in the test, it is clearer if this prefix also include the test name: mptcp_connect. With this, it is easily possible to find out which pcap was produced by which test, and easily delete the right ones. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-7-1905a818f6cb@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysselftests: mptcp: check per-event MPTCP_RST_EMPTCP countersShardul Bankar
Add named env-var expectations for each per-event MPTCP_RST_EMPTCP counter, matching the pattern used by the existing JOIN/RST checks. Each defaults to 0 and is checked silently on success; a mismatch prints a check line and fails the test. Counters absent from the running kernel are skipped silently so older kernels do not false-fail. The JOIN-related counters (MPJoinSynAckNoMPJoin, MPJoinAckNoMPJoin, MPJoinAckNoCtx, MPJoinNotEstablished, MPJoinNoIdFound) are checked in chk_join_nr() on fixed namespaces; the two remaining reset counters (MD5SigReset, DssReset) stay in chk_rst_nr(). Add a test at the end of signal_address_tests that triggers MPJoinSynAckNoMPJoin: ns1 signals an address that is already bound on the client (ns2), where a TCP-only mptcp_connect listener is started. The client's MP_JOIN routes locally to the TCP listener, which responds with a plain SYN/ACK without the MP_JOIN option, and the new counter increments on the client side. Other per-event counters (MD5SigReset, MPJoinAckNoMPJoin, MPJoinAckNoCtx, DssReset, MPJoinNotEstablished, MPJoinNoIdFound) are not currently reachable from mptcp_join.sh; the env-var hooks are in place for future tests to set expectations explicitly. Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-6-1905a818f6cb@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysselftests: net: separate ipv6_flowlabel_mgr testMarcelo Mendes Spessoto Junior
The ipv6_flowlabel_mgr used to be a component of a broader overall flow label test, defined in the ipv6_flowlabel.sh file. This wrapper script called tests defined on ipv6_flowlabel.c and ipv6_flowlabel_mgr.c files, using predefined parameters and enforcing the in_netns.sh helper to set network namespaces for each test env. However, the ipv6_flowlabel_mgr.c was drastically changed recently. These modifications led to the mgr tests becoming a self contained and independent test suite, enforcing netns creation by itself and not relying on the ipv6_flowlabel.sh wrapper for proper test execution anymore. Therefore, remove the mgr tests from the wrapper and update the Makefile to handle it as a standalone test program instead. Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn> Link: https://patch.msgid.link/20260813030708.37609-1-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-14Merge tag 'nf-next-26-08-10' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net This includes an enhancement to detect ct memleaks easier via DEBUG_NET and flowtable preparation patches for IPv4 over IPV6 and vice-versa. This also includes a fix for the nft_ct custom expectation support. 1) Add DEBUG_NET_WARN_ON_ONCE to nf_ct_set() to spot ct memleaks. 2) Pass struct net_device_path_ctx to dev_fill_forward_path() to make it easier to pass more parameters to this function. From Lorenzo Bianconi. 3) Add ether_type field to net_device_path context structucture. 4) Rename tun.l3_proto field to tun.inner_proto. 5) Rename ctx.tun.proto to ctx.tun.inner_proto. 6) Store ether_type in flowtable context. 7) Move IPv4 and IPv6 xmit path to a helper function. 8) Move encapsulation header parser out of the flowtable lookup function. 9) Rework nft_ct custom expectation support to address a possible reallocation of ct extension area while expectation list also contains expectations. Move datapath to a ct helper to fix it. 10) Ensure timeout is always lowered for the non-closing RST case in the TCP connection tracking. 11) Bail out when inserting already dead expectation, this should not ever happen, hence report it via DEBUG_NET. 12) Comestic updates for improving the conntrack selftest dump and flush userspace program, from Qingshuang Fu. * tag 'nf-next-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo netfilter: nf_conntrack_expect: bail out on insert dead expectations netfilter: conntrack: always lower timeout for non-closing RST packets netfilter: nft_ct: move custom expectation support to helper netfilter: flowtable: detach layer 2 encapsulation parser from lookup netfilter: flowtable: move ipv4 and ipv6 xmit path to function netfilter: flowtable: store ethertype in flowtable context netfilter: flowtable: rename ctx.tun.proto to ctx.tun.inner_proto netfilter: flowtable: rename tun.l3_proto to tun.inner_proto net: netfilter: add ether_type to net_device_path_ctx and use it net: pass net_device_path_ctx to dev_fill_forward_path() netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct() ==================== Link: https://patch.msgid.link/20260810194015.932627-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-13selftests/net/openvswitch: add SCTP flow key support and testMinxi Hou
The ovskey flow-string parser has no OVS_KEY_ATTR_SCTP entry, so a flow string containing sctp(src=.../dst=...) parses without error but silently drops the L4 key. The resulting flow carries only ipv4(proto=132), and the kernel rejects it: match_validate() in flow_netlink.c requires OVS_KEY_ATTR_SCTP when the IP protocol is IPPROTO_SCTP and returns -EINVAL for the missing key. Register OVS_KEY_ATTR_SCTP in the parse table and add a matching selftest that verifies SCTP flow key matching (sctp src/dst port). One listener serves the whole test. socat's fork option handles each association in a child, so the flow rules are the only thing that changes between the three phases and the listener is never restarted underneath them. -t 1 bounds how long a forked child lingers after its association closes, and the existing kill -TERM of the captured pid on teardown removes the listener itself. Also enable CONFIG_IP_SCTP in the selftest kernel config. The config checker strips underscores before comparing keys, so the entry sorts before CONFIG_IPV6 rather than after it. Signed-off-by: Minxi Hou <houminxi@gmail.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260811181645.1918420-1-houminxi@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-13Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc8). No conflicts. Adjacent changes: drivers/net/ethernet/wangxun/ngbe/ngbe_main.c 5f3a13e0bb5e ("net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling") d661abdc30c2 ("net: ngbe: correct misleading interrupt comment") drivers/net/ipvlan/ipvlan_main.c e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev") 00a40d809207 ("ipvlan: Support per-netns netdev unregistration.") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-13selftests: net: verify RTA_DEL_REASON on route deletionYuyang Huang
Extend rtnetlink.py to check the reason reported in RTM_DELROUTE: - expired: route with a 2s lifetime collected by the fib6 GC (gc_interval lowered like fib_tests.sh fib6_gc_test does); - ra-withdrawn: a single RA advertises a default route (router lifetime), an on-link prefix route (RFC 4861 prefix information option) and a route information option route (RFC 4191), then a second RA withdraws all three with zero lifetimes; the RAs are crafted over a raw ICMPv6 socket so the test does not depend on an external RA tool; - absence: a userspace deletion request records no cause and must not carry the attribute at all. Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com> Link: https://patch.msgid.link/20260808005642.26901-11-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-11selftests: net: adopt harness for flow label mgrMarcelo Mendes Spessoto Junior
The kselftest_harness.h file contains modern helpers to build tests for kselftest. Dropping the custom test helpers in ipv6_flowlabel_mgr in favor of the harness makes tests more legible and conforms to the structure of the latest selftests. It also enforces the TAP standard. Another change made to the structure of the ipv6_flowlabel_mgr test file was the removal of parse_opts. The supported opts were already unused: the binary is listed in TEST_GEN_FILES, and is driven solely by ipv6_flowlabel.sh via "./ipv6_flowlabel_mgr", which never passed -l or -v. Dropping the -l gate means the two checks it previously guarded (each with a 13-second sleep, ~26 seconds total) are now unconditionally enabled on every run instead of never running at all. The TH_LOG calls and code comments now cover the information that the removed, custom -v flag used to print. Finally, FIXTURE_SETUP(flowlabel) ensures each test gets its own isolated network namespace. The previously added setup() helper was dropped to conform to the netns setup pattern used in icmp_rfc4884.c. disable_flowlabel_consistency() was moved next to reflect_flag, the only test that calls it, and now uses SKIP() instead of an ad hoc [INFO] message when the sysctl cannot be disabled. Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com> Link: https://patch.msgid.link/20260807220942.421382-6-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11selftests: net: test IPV6_FL_F_REFLECTMarcelo Mendes Spessoto Junior
According to the source code, flowlabel_consistency must be deactivated for the IPV6_FL_F_REFLECT flag to work. Since ipv6_flowlabel_mgr now runs in its own network namespace, do this directly from the test binary. Attempt to disable net.ipv6.flowlabel_consistency and skip the reflect test if that fails. A disabled flowlabel_consistency does not affect the remaining features being tested on the file, and failing to disable is not fatal and skips the reflect test only. The previously defined tcp_listen and tcp_connect helpers were reused, since the connection flow required for REFLECT validation is very similar to REMOTE. Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com> Link: https://patch.msgid.link/20260807220942.421382-5-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11selftests: net: create own netns in ipv6_flowlabel_mgrMarcelo Mendes Spessoto Junior
Have ipv6_flowlabel_mgr create and configure its own network namespace (unshare(CLONE_NEWNET) + bring up lo), the same way ipv6_fragmentation.c and icmp_rfc4884.c already do, instead of relying on the in_netns.sh wrapper script. The setup can then be reused across tests through fixtures and provide isolated network environments for each test in the case of a future adoption of kselftest_harness. It also avoids the leak of modifications to the netns in case the user runs the test file directly, outside the wrapper and without the in_netns.sh file. Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com> Link: https://patch.msgid.link/20260807220942.421382-4-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11selftests: net: test IPV6_FL_F_REMOTEMarcelo Mendes Spessoto Junior
This flag retrieves the flow label seen by the socket at connection setup via a getsockopt query. Therefore, the validation of this flag requires a brief connection setup (source code for flow label shows it must be TCP). The simple TCP connection logic was wrapped inside two simple helpers, because there are other uncovered features of flow label mgr that could benefit from it (such as IPV6_FL_F_REFLECT). Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com> Link: https://patch.msgid.link/20260807220942.421382-3-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11selftests: net: test IPV6_FL_A_RENEWMarcelo Mendes Spessoto Junior
RENEW was the only flow label action without selftests coverage. Assert renew returns no error on correct usage and fails for labels that do not exist. This test is based on the previously implemented EXCL share test, which demonstrates that a new flow label with the same value can be created after the linger period. Renew is used here to show that a flow label can last longer and block a new flow label creation after the previous linger time. This test, however, demands sleep during execution, and should be placed as a conditional test under the -l option. The addition of the expect_fail_errno helper is necessary to assert the corresponding error when a function can fail in multiple ways. Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com> Link: https://patch.msgid.link/20260807220942.421382-2-marcelomspessoto@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11selftests: tls: cover splice after a failed decryptChuck Lever
Nothing in this file splices a socket whose last decrypt failed, so the check that fails tls_sw_splice_read() on a broken connection can be removed without a test noticing. Such a splice hands the application plaintext that recvmsg() and read_sock() already refuse to return. Extend the bad_auth pattern. Corrupt an authenticated record, confirm recvmsg() reports EBADMSG, then splice the same socket and require EBADMSG again. A synchronous decrypt fails again on the still-queued record, so only an async decrypt reaches EBADMSG through the recorded-failure check alone. bad_auth builds the same corrupted record, so its construction moves into a helper the two tests share. Signed-off-by: Chuck Lever <cel@kernel.org> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Link: https://patch.msgid.link/20260806-tls-splice-crypto-fix-v1-2-a2624005a286@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-11selftests: net: reuseport_bpf_numa: consider cpuless numa nodeFeng Tang
reuseport_bpf_numa case failed when testing on a platform with CXL memory: #./reuseport_bpf_numa ---- IPv4 UDP ---- send node 0, receive socket 0 ./reuseport_bpf_numa: failed to pin to node: Invalid argument The root cause is that the platform has 2 numa nodes: node 0 has both cpu and memory, while node 1 is a CXL node which only has memory, and caused numa_run_on_node() to fail. Add sanity check to skip cpuless numa node for the numa binding test. Signed-off-by: Feng Tang <feng.tang@linux.alibaba.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260807002436.43991-1-feng.tang@linux.alibaba.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-10selftests: drv-net: let ethtool stats settle before readingJakub Kicinski
Some devices refresh the statistics exposed via ethtool only periodically, every stats-block-usecs (as reported by ethtool -c). ethtool_std_stats and ethtool_rmon sample the counters immediately after generating traffic, so on such devices they can read stale values and fail with a delta short of the packets just sent. Add a hw_stats_settle() helper which sleeps for 1.25x the configured stats-block-usecs (defaulting to 20ms when the device reports no, or a zero, period). Use it for ethtool std stats and RMON. The 1.25x/20msec heuristic matches what the Python tests do. Reviewed-by: Petr Machata <petrm@nvidia.com> Link: https://patch.msgid.link/20260808163653.2460381-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-10selftests/net: fin_ack_lat: fix latency threshold typoBrian Grech
The commit message for af8c8a450bf4 ("selftests: net: Add FIN_ACK processing order related latency spike test") states: "if the latency is larger than 1 second (spike), print a message". However the code uses a threshold of 100000 us (100 ms), not 1000000 us (1 s). The lower threshold causes false positives on slower hardware where normal connection latency occasionally exceeds 100 ms but never approaches the 1 s spike that indicates the actual FIN/ACK race bug. Fix the threshold to match the documented intent. Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Brian Grech <bgrech@redhat.com> Link: https://patch.msgid.link/20260806151645.4172900-1-bgrech@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-10selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typoQingshuang Fu
Remove unused 'rplnlh' in conntrack_data_insert(), and remove unused 'rplnlh' and 'nest' variables in conntrack_count_zone() and conntrack_flush_zone(). These variables were declared but never used since their introduction. Also fix typo: rename misspelled conntracK_count_zone() to conntrack_count_zone(). Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-08-06Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc7). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06tls: rx: restore msg_iter before TLS 1.3 optimistic retryJérémy Jean
tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD. Revert the iterator by the number of bytes consumed by the optimistic mapping before retrying without zero-copy. Add a selftest which sends a TLS 1.3 control record with TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not overwrite later iovecs beyond the returned length. Fixes: ce61327ce989 ("tls: rx: support optimistic decrypt to user buffer with TLS 1.3") Cc: stable@vger.kernel.org Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> Link: https://patch.msgid.link/20260804125528.2139928-1-Jeremy.Jean@oss.cyber.gouv.fr Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06selftests: tls: add a test for splicing onto a full plaintext recordchanyoung
Splicing onto a plaintext sk_msg ring that is already full used to wrap the ring and make the kernel oops in the scatterwalk once the record was pushed. Only the copy path leaves the ring full without pushing it, so splice until the ring is one fragment short, add the last fragment with a one-byte MSG_MORE send, and splice once more before pushing the record. CONFIG_MAX_SKB_FRAGS is 17..45, so that last fragment follows between 16 and 44 splices; sweep that range to trigger the bug on any build. Signed-off-by: chanyoung <ppoo1220@gmail.com> Link: https://patch.msgid.link/20260804052837.49015-3-ppoo1220@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06selftests: mptcp: join: mark tests with data corruption as failedGang Yan
check_transfer() compares the input and output files byte-by-byte using `cmp -l "$in" "$out" | while read ...`. Because the while-loop body runs in a subshell (the script sets neither lastpipe nor pipefail), the fail_test call inside it -- which sets the global ret/last_test_failed -- and the `return 1` both act on the subshell, not on check_transfer(). check_transfer() thus always falls through to `return 0`, and any data corruption affecting only the payload (leaving the subflow/PM counters untouched) is silently reported as PASS. Fixes: 8117dac3e7c3 ("selftests: mptcp: add invert check in check_transfer") Cc: stable@vger.kernel.org Signed-off-by: Gang Yan <yangang@kylinos.cn> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260803-net-mptcp-misc-fixes-7-2-rc6-v2-5-b8f496d71664@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06openvswitch: remove support for legacy tunnel typesIlya Maximets
ovs-vswitchd doesn't use OVS_VPORT_TYPE_GRE/VXLAN/GENEVE with the Linux kernel module since adding support for standard tunnel devices with COLLECT_METADATA back in 2017. The code to use them was only activated as a fallback for old kernels, so not used in practice. And it is now fully removed in the upcoming OVS 4.0 release. Modern way to use tunnels with OVS is to create standard tunnel ports with RTM_NEWLINK + COLLECT_METADATA and add them as OVS_VPORT_TYPE_NETDEV. Device reference management and the netlink options parsing for these legacy port types is complicated and was a CVE magnet in the previous release cycles. Existence of these modules also makes locking analysis for geneve module and other core tunnel devices unnecessarily more complicated, especially in light of migration to per-netns locking. Since there are no actual users for these port types for a very long time, let's just remove the support entirely. There is no practical reason to run OVS from 2017 on a recent kernel. While it's technically a uAPI change in some sense, from the user's perspective this removal looks indistinguishable from the kernel built with CONFIG_OPENVSWITCH_GENEVE/VXLAN/GRE disabled. And it seems like removal of unused drivers/modules is not a rare event these days. A comment is added to the uAPI header noting that standard RTM_NEWLINK with COLLECT_METADATA followed by OVS_VPORT_CMD_NEW with the simple OVS_VPORT_TYPE_NETDEV should be used instead. Modules responsible for these tunnel ports are removed as well as selftests covering this functionality. Further cleanups will follow. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-2-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-05sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTLOleg Nesterov
CONFIG_SYSCTL used to make sense as a separate hidden bool before commit 61a47c1ad3a4 ("sysctl: Remove the sysctl system call"); it was selected by both CONFIG_SYSCTL_SYSCALL and CONFIG_PROC_SYSCTL. Today CONFIG_PROC_SYSCTL is the only selector, so the two are always equal. Kill the hidden bool, rename the PROC_SYSCTL prompt to SYSCTL, and s/CONFIG_PROC_SYSCTL/CONFIG_SYSCTL/ tree-wide. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Joel Granados <joel.granados@kernel.org>
2026-08-03selftests: net: getsockopt_iter: cover rawv6 and tlsBreno Leitao
Add fixtures for the newly converted getsockopt leaves: - rawv6: IPV6_HDRINCL / IPV6_CHECKSUM int paths + a SOL_RAW unknown-optname case that reaches do_rawv6_getsockopt(). - tls: TLS_TX_ZEROCOPY_RO, the TLS_TX crypto_info round-trip at the base and full cipher sizes, the NULL-optval and short buffer EINVAL paths, and an unknown optname. It skips when the kernel lacks TLS or AES-GCM. Each fixture pins the returned-length / errno semantics across exact, oversized and short buffers and an unknown optname. The semantics are unchanged by the sockopt_t conversion, so the tests pass both before and after the leaf conversions. ieee802154 and phonet are not covered: their CONFIG options are absent from the net selftest target config, so the cases would only ever skip. Acked-by: Rémi Denis-Courmont <remi@remlab.net> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Joe Damato <joe@dama.to> Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260729-getsockopt_phase4-v4-7-c44576757c17@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30selftests: net: add coverage for fdb nexthop dst_portJack Ma
Add coverage for the new per-nexthop VXLAN destination port (NHA_DST_PORT). In fib_nexthops.sh, new ipv4_fdb_port_fcnal() and ipv6_fdb_port_fcnal() tests check that a dst_port is accepted on an fdb nexthop that has a gateway and echoed back on dump, that it is rejected without a gateway and rejected when zero, that a group may hold legs that differ only in UDP port, and that a portless fdb nexthop omits the attribute. The tests SKIP when iproute2 lacks the "dst_port" keyword. In test_vxlan_nh.sh, basic_tx_common() gains a second fdb nexthop group whose nexthop carries a destination port that differs from the VXLAN device default, plus a flower filter keyed on that port, to confirm the per-nexthop port is used on the wire. The test now requires an iproute2 with dst_port support. Signed-off-by: Jack Ma <jack4it@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260724-b4-vxlan-fdb-port-v5-3-cd1c6aeee058@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc6). No conflicts. Adjacent changes: net/ipv4/route.c dbc3791e3b24 ("net: do not send ICMP/NDISC Redirects when peer allocation fails") 7804eaa057fe ("ipv4: snapshot dst.dev in ip_rt_send_redirect() and ip_rt_get_source()") drivers/net/tun.c 23dad2d088df ("tun: no longer rely on RTNL in tun_fill_info()") c3da92af07ea ("Revert "tun/tap: add ptr_ring consume helper with netdev queue wakeup"") drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c 3bd438a58e91 ("octeontx2-af: Block VFs from clobbering special CGX PKIND state") 5ba5611ef946 ("octeontx2-af: reserve 4 PKINDs for skip-size custom use") drivers/net/wireless/ath/ath12k/core.h drivers/net/wireless/ath/ath12k/mac.c drivers/net/wireless/ath/ath12k/peer.c 469d7e6077c1 ("wifi: ath12k: resolve PENDING ML peer ID from MLO_PEER_MAP HTT event") 378e659029d5 ("wifi: ath12k: introduce host_alloc_ml_id hardware parameter") c42b27336eef ("wifi: ath12k: fix survey indexing across bands") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-29selftests/net: test PACKET_IGNORE_OUTGOINGJoe Damato
Test that setsockopt PACKET_IGNORE_OUTGOING: - works with valid values (0 and 1), - rejects values outside of that range, and When enabled for a loopback sniffer, it only produces 1 copy of the packet (rx) instead of two copies (tx and rx). Use sll_pkttype to check the direction of the packet to ensure the correct packet is sniffed. Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260728160935.4128982-6-joe@dama.to Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-29selftests/net: psock_snd: Verify sll_pkttypeJoe Damato
Extend do_rx() to take an expected packet type. Existing callers pass -1 to skip the check. Signed-off-by: Joe Damato <joe@dama.to> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260728160935.4128982-5-joe@dama.to Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-29selftests/net: psock_snd: unify on recvmsg()Joe Damato
Don't maintain two RX paths in do_rx(). Unify on recvmsg() and pass aux data only when needed. No functional change. Signed-off-by: Joe Damato <joe@dama.to> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260728160935.4128982-4-joe@dama.to Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-29selftests/net: psock: Generalize stats checkJoe Damato
Generalize stats check code so that callers can specify the expected packets. Signed-off-by: Joe Damato <joe@dama.to> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260728160935.4128982-3-joe@dama.to Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-29selftests/net: psock: Generalize psock bindJoe Damato
Generalize packet socket binding so that types other than ETH_P_IP can be used. Signed-off-by: Joe Damato <joe@dama.to> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260728160935.4128982-2-joe@dama.to Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27selftests: net: Add a missing config optionAlice Mikityanska
Commit 5cb53743e1ff ("selftests: net: Add a test for BIG TCP in UDP tunnels") used iptables match comment, which was missed from the CI kernel config. Add the missing config option. Signed-off-by: Alice Mikityanska <alice@isovalent.com> Reviewed-by: Matthieu Baerts <matttbe@kernel.org> Link: https://patch.msgid.link/20260723140241.132120-1-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27selftests: net: hsr: add PRP RedBox testXin Xie
Add a kselftest that builds a PRP RedBox (interlink) with a SAN behind the interlink and a peer DANP, and checks bidirectional unicast across the interlink, preservation of the SAN source MAC on the PRP network, and that the proxy-announce supervision frame carries the RedBox-MAC TLV (Type 30) terminated by an EOT marker. It reuses the hsr_common.sh / lib.sh helpers and skips cleanly on a kernel or iproute2 without PRP interlink support. The background ping is killed by its exact PID: ip netns exec does not isolate the PID namespace, so a pattern-based pkill could hit unrelated processes on the host. Signed-off-by: Xin Xie <xiexinet@gmail.com> Link: https://patch.msgid.link/20260717201457.54-5-xiexinet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24Merge tag 'nf-26-07-23' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following batch contains Netfilter/IPVS fixes for net. This batch includes a mix of IPVS follow ups related to Sashiko reports, as well as crash fixes for connection tracking expectation, helpers, ipset and nf_tables mostly for old bugs. This also includes a fix for the flowtable tunnel selftest. 1) Use s32 instead of s16 to calculate the remaining payload containing SIP messages, otherwise underflow is possible allowing out-of-bound memory access beyond the skb->data area. From Xiang Mei. 2) Fix the counter check in the flowtable selftest for tunnels, from Lorenzo Bianconi. 3) Add and use nf_ct_expect_related_pair() to add the RTP and RTCP expectations under the expectation lock, this is required by the SIP and H.323 NAT helpers. This fixes a possible reinsertion of an expectation with the DEAD flag set on while looping to find consecutive ports. 4) Fix ipset UaF during table resize by blocking comment updates on kernel-side adds. From David Lee. 5) Do not propagate the IP_VS_CONN_F_ONE_PACKET flag when using IPVS state synchronization, otherwise reaching stale freed from ip_vs_conn struct is possible, Zhiling Zou. 6) Adjust the hn1 hash node when the forwarding method changes between MASQ and non-MASQ for an already hashed connection. This can leave stale hash nodes pointing to a freed struct ip_vs_conn and trigger UaF while reading /proc/net/ip_vs_conn. From Julian Anastasov. 7) nft_object rhltable needs to be per table, just like chain rhltable, otherwise UaF from object lookup path while netns is being released. There is also the nlevent path that can reach stale objects. Placing this rhltable under the table hierarchy fixes this issue. 8) Reject invalid combined usage of hashlimit tables with and without XT_HASHLIMIT_RATE_MATCH flag mode, otherwise access to uninitialized .burst field of dsthash_ent is possible. 9) Fix checksum validations in IPVS performed from LOCAL_IN, from Julian Anastasov. 10) Fix incorrect packet offset to layer 4 protocol in IPVS, uncovered by Sashiko, from Julian Anastasov. 11) Skip the mangling of ICMP replies for non-first fragments, also reported by Sashiko. Also from Julian. 12) Clear ip_vs_conn flags under the spinlock to fix a possible data race. From Julian Anastasov. 13) Fix incorrect calculation of the payload bitmask in the nf_tables hardware offload support, leading to UBSAN splat. From Xiang Mei. * tag 'nf-26-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_payload: fix mask build for partial field offload ipvs: clear the nfct flag under lock ipvs: do not mangle ICMP replies for non-first fragments ipvs: fix places with wrong packet offsets ipvs: fix the checksum validations netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH netfilter: nf_tables: make nft_object rhltable per table ipvs: adjust double hashing when fwd method changes ipvs: do not propagate one-packet flag to synced conns netfilter: ipset: do not update comments from kernel-side hash adds netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() ==================== Link: https://patch.msgid.link/20260723163910.274695-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-30 16:43:46 +0000