linux/drivers/net/ppp, branch master

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-04-14T19:04:00Z

Merge in late fixes in preparation for the net-next PR. Conflicts: include/net/sch_generic.h a6bd339dbb351 ("net_sched: fix skb memory leak in deferred qdisc drops") ff2998f29f390 ("net: sched: introduce qdisc-specific drop reason tracing") https://lore.kernel.org/adz0iX85FHMz0HdO@sirena.org.uk drivers/net/ethernet/airoha/airoha_eth.c 1acdfbdb516b ("net: airoha: Fix VIP configuration for AN7583 SoC") bf3471e6e6c0 ("net: airoha: Make flow control source port mapping dependent on nbq parameter") Adjacent changes: drivers/net/ethernet/airoha/airoha_ppe.c f44218cd5e6a ("net: airoha: Reset PPE cpu port configuration in airoha_ppe_hw_init()") 7da62262ec96 ("inet: add ip_local_port_step_width sysctl to improve port usage distribution") Signed-off-by: Jakub Kicinski

pppox: remove sk_pppox() helper

2026-04-12T22:20:45Z

The sk member can be directly accessed from struct pppox_sock without relying on type casting. Remove the sk_pppox() helper and update all call sites to use po->sk directly. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260410054954.114031-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski

ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

2026-04-12T20:47:45Z

/dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns. As a result, a local unprivileged user can create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace. Require CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls. This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case. Fixes: 273ec51dd7ce ("net: ppp_generic - introduce net-namespace functionality v2") Signed-off-by: Taegu Ha Link: https://patch.msgid.link/20260409071117.4354-1-hataegu0826@gmail.com Signed-off-by: Jakub Kicinski

ppp: consolidate refcount decrements

2026-04-10T03:03:48Z

ppp_destroy_{channel,interface} are always called after refcount_dec_and_test(). To reduce boilerplate code, consolidate the decrements by moving them into the two functions. To reflect this change in semantics, rename the functions to ppp_release_*. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260407094058.257246-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski

ppp: update Kconfig help message

2026-04-03T22:35:13Z

Both links of the PPPoE section are no longer valid, and the CVS version is no longer relevant. - Replace the TLDP URL with the pppd project homepage. - Update pppd version requirement for PPPoE. - Update RP-PPPoE project homepage, and clarify that it's only needed for server mode. Signed-off-by: Qingfang Deng Reviewed-by: Julian Braha Link: https://patch.msgid.link/20260402050053.144250-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski

ppp: dead code cleanup in Kconfig

2026-04-02T01:51:59Z

There is already an 'if PPP' condition wrapping several config options e.g. PPP_MPPE and PPPOE, making the 'depends on PPP' statement for each of these a duplicate dependency (dead code). I propose leaving the outer 'if PPP...endif' and removing the individual 'depends on PPP' statement from each option. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha Reviewed-by: Qingfang Deng Link: https://patch.msgid.link/20260330213258.13982-1-julianbraha@gmail.com Signed-off-by: Jakub Kicinski

ppp: require callers of ppp_dev_name() to hold RCU

2026-03-17T23:18:48Z

ppp_dev_name() holds the RCU read lock internally to protect pch->ppp. However, as it returns netdev->name to the caller, the caller should also hold either RCU or RTNL lock to prevent the netdev from being freed. The only two references of the function is in the L2TP driver, both of which already hold RCU. So remove the internal RCU lock and document that callers must hold RCU. Signed-off-by: Qingfang Deng Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260316092824.479149-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski

ppp: remove pch->chan NULL checks from tx path

2026-03-17T09:58:04Z

Now that ppp_disconnect_channel() is called before pch->chan is set to NULL, a channel from ppp->channels list on the transmit path is guaranteed to have non-NULL pch->chan. Remove the pch->chan NULL checks from ppp_push(), ppp_mp_explode(), and ppp_fill_forward_path(), where a channel is obtained from the list. Remove the corresponding WRITE/READ_ONCE annotations as they no longer race. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260312093732.277254-2-dqfext@gmail.com Signed-off-by: Paolo Abeni

ppp: disconnect channel before nullifying pch->chan

2026-03-17T09:58:04Z

In ppp_unregister_channel(), pch->chan is set to NULL before calling ppp_disconnect_channel(), which removes the channel from ppp->channels list using list_del_rcu() + synchronize_net(). This creates an intermediate state where the channel is still connected (on the list) but already unregistered (pch->chan == NULL). Call ppp_disconnect_channel() before setting pch->chan to NULL. After the synchronize_net(), no new reader on the transmit path will hold a reference to the channel from the list. This eliminates the problematic state, and prepares for removing the pch->chan NULL checks from the transmit path in a subsequent patch. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260312093732.277254-1-dqfext@gmail.com Signed-off-by: Paolo Abeni

ppp: simplify input error handling

2026-03-10T02:07:38Z

Currently, ppp_input_error() indicates an error by allocating a 0-length skb and calling ppp_do_recv(). It takes an error code argument, which is stored in skb->cb, but not used by ppp_receive_frame(). Simplify the error handling by removing the unused parameter and the unnecessary skb allocation. Instead, call ppp_receive_error() directly from ppp_input_error() under the recv lock, and the length check in ppp_receive_frame() can be removed. Signed-off-by: Qingfang Deng Signed-off-by: Jakub Kicinski