wireguard-linux/Documentation/netlink, branch stable

net: devmem: document that bind-tx is unprivileged by design

2026-09-23T01:40:15Z

Unlike bind-rx, which configures shared NIC RX queues to steer incoming traffic into the caller's dmabuf and requires CAP_NET_ADMIN (uns-admin-perm), bind-tx only DMA-maps the caller's dmabuf so the caller can transmit from it on their own sockets without affecting other traffic or device configuration. Add a comment in netdev.yaml and above netdev_nl_bind_tx_doit() to make it explicit that NETDEV_CMD_BIND_TX is unprivileged by design. Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20260921195545.493253-1-almasrymina@google.com Signed-off-by: Jakub Kicinski

neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.

2026-09-12T00:25:13Z

NDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses .validation_type, so no validation is applied: # ynl --family rt-neigh --do setneightbl \ --json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 0}}' # ynl --family rt-neigh --dump getneightbl --output-json | \ jq '.[] | select(.name == "arp_cache" and has("config")) | .parms["interval-probe-time-ms"]' 0 Moreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is silently cast to u32, so a larger value can bypass the min check: e.g. 4294967296 == 0x100000000 # ynl --family rt-neigh --do setneightbl \ --json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 4294967296}}' # ynl --family rt-neigh --dump getneightbl --output-json | \ jq '.[] | select(.name == "arp_cache" and has("config")) | .parms["interval-probe-time-ms"]' 0 msecs_to_jiffies() returns MAX_JIFFY_OFFSET if the value is larger than INT_MAX. Also, INT_MAX ms overflows int NEIGH_VAR() when HZ > 1000 (Alpha, MIPS), and passing a negative integer to queue_delayed_work(unsigned long delay) causes sign extension, which wraps around the expiry time to the past, resulting in it being handled as 0 delay in the timer wheel. Let's use NLA_POLICY_FULL_RANGE() and limit the max to 1 day. The same max check is applied to sysctl as well. Note that this controls the probe interval for NTF_MANAGED entries, so the max of 1 day is unlikely to break any deployments. Fixes: 211da42eaa45 ("net, neigh: introduce interval_probe_time_ms for periodic probe") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260909233143.2401847-3-kuniyu@google.com Signed-off-by: Jakub Kicinski

net: reject oversized tx_queue_len at netlink parse time

2026-09-04T23:30:49Z

rtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len without going through netif_change_tx_queue_len(), so a device created with "ip link add ... txqueuelen 500000" bypasses the S16_MAX cap and still triggers the oversized ring allocations in pfifo_fast, tun and tap. The veth peer nest (rtnl_nla_parse_ifinfomsg()) and the RTM_NEWLINK-on-existing-device path reach the same sinks. Enforce the cap in ifla_policy instead: IFLA_TXQLEN becomes NLA_POLICY_FULL_RANGE(NLA_U32, &txqlen_range) with txqlen_range = { .min = 0, .max = S16_MAX }. All netlink consumers parse against this policy - rtnl_setlink(), rtnl_newlink() (create and change), and the veth peer nest - so every netlink path is capped at parse time and rejects the attribute with -ERANGE plus a proper "integer out of range" extack message before any device state is modified (the RTM_SETLINK half-application wart is gone with it). Document the bound in the rt-link.yaml netlink spec. Conditions to recreate the bug: - CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y. - Unprivileged user in a fresh user+net namespace (unshare -Urn): ip link add v0 txqueuelen 500000 type veth peer name v1 -> on the fixed kernel this is rejected with -ERANGE ("integer out of range" extack) instead of installing an oversized tx_queue_len that later inflates pfifo_fast/tun/tap ring allocations. - ip link set v0 txqueuelen 500000 is likewise rejected at parse time. Fixes: 38f7b870d4a6 ("[RTNETLINK]: Link creation API") Reported-by: Vega Tested-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/QDISC-2899.v2.20260901233641@mojatatu.com.2 Signed-off-by: Jakub Kicinski

netlink: specs: add missing mask attributes for conntrack dump

2026-08-28T22:34:51Z

'mark-mask' and 'status-mask' are defined and supported by the conntrack dump, but missing from the list of arguments. While at it, the order of the arguments should follow the order of their definition in the enum ctattr_type. That appears to be a common convention for other spec files. Fixes: 23fc9311a526 ("netlink: specs: add conntrack dump and stats dump support") Cc: stable@vger.kernel.org Signed-off-by: Ilya Maximets Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20260826220444.4054714-3-i.maximets@ovn.org Signed-off-by: Jakub Kicinski

netlink: specs: fix the conntrack filter type

2026-08-28T22:34:51Z

The CTA_FILTER doesn't contain nested tuple attributes, instead it contains bit masks that specify which tuple attributes to filter on. The values for filtering are taken from the top-level CTA_TUPLE_ORIG and CTA_TUPLE_REPLY, which are also missing in the attribute list for the dump request. The bits themselves somehow are not in the public headers, so not defining them in the spec either for now. Once they are public in uAPI, they can be added here with enum-as-flags. Fixes: 23fc9311a526 ("netlink: specs: add conntrack dump and stats dump support") Cc: stable@vger.kernel.org Signed-off-by: Ilya Maximets Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20260826220444.4054714-2-i.maximets@ovn.org Signed-off-by: Jakub Kicinski

Merge tag 'nfsd-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2026-08-20T19:39:56Z

Pull nfsd updates from Chuck Lever: - CB_NOTIFY support for NFSD's NFSv4.1 directory delegations The server used to recall a delegation as soon as the directory changed. NFSD now watches delegated directories through fsnotify and reports adds, removes, renames, and directory attribute changes, carrying the filehandle and attributes of the affected entry, so clients can keep their caches. Some of the NOTIFY4 flags come from RFC 8881bis (Jeff Layton) - Continued netlink work A new server-stats-get operation reports what /proc/net/rpc/nfsd publishes, plus NFSv4 callback counts, and SUNRPC now keeps its per-procedure call counts per network namespace, so a container sees its own numbers. nfsstat reads all of this over netlink, with a procfs fallback for older kernels (Jeff Layton) - Remove SUNRPC service thread pool mode selection Per node is the right choice on any host we run today, so the auto, global, and percpu modes have been removed. A single-node host still gets one pool. A multi-NUMA host now gets a pool per node. sunrpc.pool_mode accepts the old names but no longer selects anything. - Bug fixes, clean-ups, and small optimizations: - async COPY offload rework (Jeff Layton) - more use-after-free fixes in the NFSv4 state revocation paths - percpu counter contention removed from the reply cache and IO accounting - a long list of hardening fixes (Chris Mason) Sincere thanks to all contributors, reviewers, testers, and bug reporters who participated in the v7.3 NFSD development cycle. * tag 'nfsd-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (182 commits) nfsd: export NFSv4 callback op stats via netlink nfsd: count NFSv4 callback operations per netns sunrpc: remove unused svc_version vs_count field nfsd: implement server-stats-get netlink handler sunrpc: use per-net counts in svc_seq_show() sunrpc: add per-netns per-procedure call counts to svc_stat NFSD: Document reply_cache_stats ABI NFSD: Eliminate percpu counter contention in IO byte accounting NFSD: Eliminate percpu counter contention in reply cache statistics NFSD: Eliminate percpu counter contention in DRC memory accounting NFSD: Fix off-by-one in DRC bucket pruning limit NFSD: Relocate NFSv4 "supported attributes" to new header NFSD: Relocate nfsd4_set_netaddr() NFSD: Relocate nfsd_user_namespace() NFSD: Move struct readdir_cd NFSD: Move the export.h include from nfsd.h to auth.c NFSD: Remove '#include "nfsd.h"' from fs/nfsd/cache.h NFSD: include "netns.h" NFSD: Explicitly include "stats.h" NFSD: Make "stats.h" self-contained ...

netlink: specs: rt-route: add the route deletion reason

2026-08-13T10:30:27Z

Add the del-reason attribute and its enum to the route attribute set, and to the getroute reply, which the route notifications reuse. The attribute is absent from the newroute and delroute request lists. RTA_DEL_REASON is above strict_start_type in rtm_ipv6_policy, so encoding it in a request is rejected with -EINVAL. Signed-off-by: Yuyang Huang Link: https://patch.msgid.link/20260808005642.26901-10-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni

netlink: specs: rt-route: split out the request attribute list

2026-08-13T10:30:27Z

The newroute and delroute requests alias the same attribute list as the getroute reply, but requests and replies do not carry the same attributes. Give the requests their own list. The two lists are identical today, so the generated code does not change. Signed-off-by: Yuyang Huang Link: https://patch.msgid.link/20260808005642.26901-9-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni

netlink: specs: rt-route: add route notifications

2026-08-13T10:30:27Z

Declare the RTM_NEWROUTE and RTM_DELROUTE notifications and the route multicast groups, so that generated clients can subscribe to route changes. Both notifications reuse the getroute reply attributes. Signed-off-by: Yuyang Huang Link: https://patch.msgid.link/20260808005642.26901-8-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni

nfsd: export NFSv4 callback op stats via netlink

2026-08-10T13:54:35Z

Add a proc4cb-ops nested attribute to the server-stats netlink dump, reusing the existing server-proc-entry (op/count) layout. The dump gains a callback section that emits one entry per callback opcode (OP_CB_GETATTR..OP_CB_OFFLOAD) from the per-netns callback counters, paged across messages like the other per-operation sections. This lets nfsstat report NFSv4 backchannel operation counts over netlink, including CB_GETATTR which corresponds to the procfs wdeleg_getattr line. Assisted-by: LLM Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260717-exportd-netlink-v7-6-b7ce17b83b60@kernel.org Signed-off-by: Chuck Lever