kernel/git/next/linux-next.git/include/net, branch master

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git

2026-09-09T12:11:55+00:00

# Conflicts: # include/net/mac80211.h # net/mac80211/iface.c # net/mac80211/tx.c

Merge branch 'master' of https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git

2026-09-09T12:03:25+00:00

# Conflicts: # net/bluetooth/hci_sync.c # net/bluetooth/l2cap_core.c

Merge branch 'main' of https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git

2026-09-09T12:03:15+00:00

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git

2026-09-09T12:03:13+00:00

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/mm/linux.git

2026-09-09T11:39:26+00:00

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git

2026-09-09T11:24:56+00:00

mm: drop stale MAX_ORDER references

2026-09-09T06:30:09+00:00

The treewide rename in commit 5e0a760b4441 ("mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER") left a few spots still using the old name: - two comments in include/net/mana/mana.h and mm/page_alloc.c; - the gdb helper scripts/gdb/linux/mm.py, where self.MAX_ORDER is a local mirror of the kernel's MAX_ORDER define. Rename the leftover instances to MAX_PAGE_ORDER so the tree is consistent. No functional changes. Link: https://lore.kernel.org/20260819082052.3338603-1-xiqi2@huawei.com Signed-off-by: Qi Xi Reviewed-by: Zi Yan Cc: Jan Kiszka Cc: Johannes Weiner Cc: Kefeng Wang Cc: Kieran Bingham Cc: Konstantin Taranov Cc: Long Li Cc: Michal Hocko Cc: Nanyong Sun Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton

Bluetooth: coredump: Quiesce dump work on unregister

2026-09-08T16:18:45+00:00

hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers queue dump_rx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an active dump lets them access hdev after hci_release_dev() frees it. Shut down coredump processing during unregister. Close the producer gate under dump_q.lock before disabling both works, then free the active buffer and queued packets under hci_dev_lock. Serializing the gate with enqueue prevents controller-specific workers from adding packets after the final purge. Fixes: 9695ef876fd1 ("Bluetooth: Add support for hci devcoredump") Reported-by: syzbot+b170dbf55520ebf5969a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b170dbf55520ebf5969a Reported-by: Aby Sam Ross Link: https://lore.kernel.org/r/20260322210849.68743-1-abysamross@gmail.com Suggested-by: Aby Sam Ross Reported-by: Tristan Madani Link: https://lore.kernel.org/r/20260814231248.3096377-1-tristmd@gmail.com Reported-by: Xiang Mei Assisted-by: OpenAI Codex:gpt-5 Signed-off-by: Weiming Shi Reported-by: Xiang Mei Signed-off-by: Luiz Augusto von Dentz

wifi: mac80211: don't allow injecting frames wider than the chanctx

2026-09-08T13:39:06+00:00

Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual operational bandwidth. If the bandwidth requested is too wide, that triggers a warning in hwsim: WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)) Drop such frames entirely instead since they cannot be sent. Assisted-by: LLM Fixes: 646e76bb5daf ("mac80211: parse VHT info in injected frames") Reported-by: syzbot+435fdb053cf98bfa5778@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=435fdb053cf98bfa5778 Link: https://patch.msgid.link/20260908122838.201719-13-johannes@sipsolutions.net Signed-off-by: Johannes Berg

tcp: Do not allow buggy transitions between ehash and lhash2.

2026-09-08T00:40:26+00:00

The following state transitions have long been a playground for syzbot, and recently AI joined in, reporting a lot more bugs. * listen() + shutdown() + connect() * connect() + connect(AF_UNSPEC) + listen() All the fix attempts would add more code to the fast path, which is not worth it. Instead of playing whack-a-mole with these edge-case bugs, let's disallow these transitions. Note that unhashed_state is placed in the 4-byte hole after icsk_pmtu_cookie. $ pahole -C inet_connection_sock vmlinux struct inet_connection_sock { ... __u32 icsk_pmtu_cookie; /* 1208 4 */ unsigned char unhashed_state; /* 1212 1 */ /* XXX 3 bytes hole, try to pack */ Reported-by: Kyle Zeng Closes: https://lore.kernel.org/netdev/20260731140512.566464-1-david.lee@trailofbits.com/ Reported-by: Michal Luczaj Closes: https://lore.kernel.org/netdev/20260803-sockmap-lookup-tcp-leak-v2-0-306e025bfe66@rbox.co/ Reported-by: Hyunwoo Kim Closes: https://lore.kernel.org/netdev/20260824033331.1084971-1-imv4bel@gmail.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260904033543.2635540-2-kuniyu@google.com Signed-off-by: Jakub Kicinski