Changes in Kconfig

0fc8f6200d2313278fbf4539bbab74677c685531 - Merge drm/drm-fixes into drm-misc-fixes

Mon, 27 Apr 2026 10:26:49 +0200

Merge drm/drm-fixes into drm-misc-fixesGetting fixes and updates from v7.1-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/net/sctp/Kconfig

91a4855d6c03e770e42f17c798a36a3c46e63de2 - Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

Wed, 15 Apr 2026 03:36:10 +0200

Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-nextPull networking updates from Jakub Kicinski: "Core & protocols: - Support HW queue leasing, allowing containers to be granted access to HW queues for zero-copy operations and AF_XDP - Number of code moves to help the compiler with inlining. Avoid output arguments for returning drop reason where possible - Rework drop handling within qdiscs to include more metadata about the reason and dropping qdisc in the tracepoints - Remove the rtnl_lock use from IP Multicast Routing - Pack size information into the Rx Flow Steering table pointer itself. This allows making the table itself a flat array of u32s, thus making the table allocation size a power of two - Report TCP delayed ack timer information via socket diag - Add ip_local_port_step_width sysctl to allow distributing the randomly selected ports more evenly throughout the allowed space - Add support for per-route tunsrc in IPv6 segment routing - Start work of switching sockopt handling to iov_iter - Improve dynamic recvbuf sizing in MPTCP, limit burstiness and avoid buffer size drifting up - Support MSG_EOR in MPTCP - Add stp_mode attribute to the bridge driver for STP mode selection. This addresses concerns about call_usermodehelper() usage - Remove UDP-Lite support (as announced in 2023) - Remove support for building IPv6 as a module. Remove the now unnecessary function calling indirection Cross-tree stuff: - Move Michael MIC code from generic crypto into wireless, it's considered insecure but some WiFi networks still need it Netfilter: - Switch nft_fib_ipv6 module to no longer need temporary dst_entry object allocations by using fib6_lookup() + RCU. Florian W reports this gets us ~13% higher packet rate - Convert IPVS's global __ip_vs_mutex to per-net service_mutex and switch the service tables to be per-net. Convert some code that walks the service lists to use RCU instead of the service_mutex - Add more opinionated input validation to lower security exposure - Make IPVS hash tables to be per-netns and resizable Wireless: - Finished assoc frame encryption/EPPKE/802.1X-over-auth - Radar detection improvements - Add 6 GHz incumbent signal detection APIs - Multi-link support for FILS, probe response templates and client probing - New APIs and mac80211 support for NAN (Neighbor Aware Networking, aka Wi-Fi Aware) so less work must be in firmware Driver API: - Add numerical ID for devlink instances (to avoid having to create fake bus/device pairs just to have an ID). Support shared devlink instances which span multiple PFs - Add standard counters for reporting pause storm events (implement in mlx5 and fbnic) - Add configuration API for completion writeback buffering (implement in mana) - Support driver-initiated change of RSS context sizes - Support DPLL monitoring input frequency (implement in zl3073x) - Support per-port resources in devlink (implement in mlx5) Misc: - Expand the YAML spec for Netfilter Drivers - Software: - macvlan: support multicast rx for bridge ports with shared source MAC address - team: decouple receive and transmit enablement for IEEE 802.3ad LACP "independent control" - Ethernet high-speed NICs: - nVidia/Mellanox: - support high order pages in zero-copy mode (for payload coalescing) - support multiple packets in a page (for systems with 64kB pages) - Broadcom 25-400GE (bnxt): - implement XDP RSS hash metadata extraction - add software fallback for UDP GSO, lowering the IOMMU cost - Broadcom 800GE (bnge): - add link status and configuration handling - add various HW and SW statistics - Marvell/Cavium: - NPC HW block support for cn20k - Huawei (hinic3): - add mailbox / control queue - add rx VLAN offload - add driver info and link management - Ethernet NICs: - Marvell/Aquantia: - support reading SFP module info on some AQC100 cards - Realtek PCI (r8169): - add support for RTL8125cp - Realtek USB (r8152): - support for the RTL8157 5Gbit chip - add 2500baseT EEE status/configuration support - Ethernet NICs embedded and off-the-shelf IP: - Synopsys (stmmac): - cleanup and reorganize SerDes handling and PCS support - cleanup descriptor handling and per-platform data - cleanup and consolidate MDIO defines and handling - shrink driver memory use for internal structures - improve Tx IRQ coalescing - improve TCP segmentation handling - add support for Spacemit K3 - Cadence (macb): - support PHYs that have inband autoneg disabled with GEM - support IEEE 802.3az EEE - rework usrio capabilities and handling - AMD (xgbe): - improve power management for S0i3 - improve TX resilience for link-down handling - Virtual: - Google cloud vNIC: - support larger ring sizes in DQO-QPL mode - improve HW-GRO handling - support UDP GSO for DQO format - PCIe NTB: - support queue count configuration - Ethernet PHYs: - automatically disable PHY autonomous EEE if MAC is in charge - Broadcom: - add BCM84891/BCM84892 support - Micrel: - support for LAN9645X internal PHY - Realtek: - add RTL8224 pair order support - support PHY LEDs on RTL8211F-VD - support spread spectrum clocking (SSC) - Maxlinear: - add PHY-level statistics via ethtool - Ethernet switches: - Maxlinear (mxl862xx): - support for bridge offloading - support for VLANs - support driver statistics - Bluetooth: - large number of fixes and new device IDs - Mediatek: - support MT6639 (MT7927) - support MT7902 SDIO - WiFi: - Intel (iwlwifi): - UNII-9 and continuing UHR work - MediaTek (mt76): - mt7996/mt7925 MLO fixes/improvements - mt7996 NPU support (HW eth/wifi traffic offload) - Qualcomm (ath12k): - monitor mode support on IPQ5332 - basic hwmon temperature reporting - support IPQ5424 - Realtek: - add USB RX aggregation to improve performance - add USB TX flow control by tracking in-flight URBs - Cellular: - IPA v5.2 support"* tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1561 commits) net: pse-pd: fix kernel-doc function name for pse_control_find_by_id() wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit wireguard: allowedips: remove redundant space tools: ynl: add sample for wireguard wireguard: allowedips: Use kfree_rcu() instead of call_rcu() MAINTAINERS: Add netkit selftest files selftests/net: Add additional test coverage in nk_qlease selftests/net: Split netdevsim tests from HW tests in nk_qlease tools/ynl: Make YnlFamily closeable as a context manager net: airoha: Add missing PPE configurations in airoha_ppe_hw_init() net: airoha: Fix VIP configuration for AN7583 SoC net: caif: clear client service pointer on teardown net: strparser: fix skb_head leak in strp_abort_strp() net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() selftests/bpf: add test for xdp_master_redirect with bond not up net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master net: airoha: Remove PCE_MC_EN_MASK bit in REG_FE_PCE_CFG configuration sctp: disable BH before calling udp_tunnel_xmit_skb() sctp: fix missing encap_port propagation for GSO fragments net: airoha: Rely on net_device pointer in ETS callbacks ... List of files: /linux/net/sctp/Kconfig

e531a081065d274a14f54441a38e1849453d06ec - Merge branch 'convert-config_ipv6-to-built-in-and-remove-stubs'

Sun, 29 Mar 2026 20:21:29 +0200

Merge branch 'convert-config_ipv6-to-built-in-and-remove-stubs'Fernando Fernandez Mancera says:====================Convert CONFIG_IPV6 to built-in and remove stubsHistorically, the Linux kernel has supported compiling the IPv6 stack asa loadable module. While this made sense in the early days of IPv6adoption, modern deployments and distributions overwhelmingly eitherbuild IPv6 directly into the kernel (CONFIG_IPV6=y) or disable itentirely (CONFIG_IPV6=n). The modular IPv6 use-case offers image sizeand memory savings for specific setups, this benefit is outweighed bythe architectural burden it imposes on the subsystems on implementationand maintenance.In addition, most of the distributions are already using CONFIG_IPV6=yby default [1], including openWRT [2] and Android gki_defconfig [3]. Sothis won't have an impact on them. The most impacted architecture wouldprobably be arm64 as their default config is still using CONFIG_IPV6=m.To allow core networking, BPF, Netfilter, and various device drivers tosafely interact with a potentially unloaded IPv6 module, the kernelrelies on indirect call structures like ipv6_stub, ipv6_bpf_stub, andnf_ipv6_ops, along with dynamic RCU registrations for things like ICMPv6senders.This patch series addresses this by changing CONFIG_IPV6 from a tristateto a boolean, enforcing that IPv6 is either built-in or disabled. Thisallows us to completely rip out the stub infrastructures and safelyreplace them with direct function calls.The bloat-o-meter report the following results for m68k, arm64, x86_64defconfig.m68k (keep on mind that CONFIG_IPV6 is disabled now):add/remove: 65/938 grow/shrink: 36/254 up/down: 3022/-49692 (-46670)arm64:add/remove: 1251/265 grow/shrink: 81/46 up/down: 448740/-71519 (377221)x86_64:add/remove: 62/98 grow/shrink: 10/39 up/down: 2497/-4357 (-1860)Considering that each new kernel release increases sizes by 30-40KiB onaverage, this size increase isn't a huge jump for the distributions thatare still using CONFIG_IPV6=m. For the ones that are already usingCONFIG_IPV6=y, the size is reduced actually.All the patches has been independently build tested. With allmodconfigand allmodconfig + CONFIG_IPV6=n. In addition, net selftest has been runagainst them on virtme-ng.The series applied as a whole as been tested with allyesconfig and alsoallyesconfig + CONFIG_IPV6=n but not all patches has been independentlytested this way.[1] https://github.com/nyrahul/linux-kernel-configs[2] https://github.com/openwrt/openwrt/commit/832e7b817221d288df76b763ca12c585365db5d8[3] https://android.googlesource.com/kernel/common/+/refs/heads/android-mainline/arch/arm64/configs/gki_defconfig====================Link: https://patch.msgid.link/20260325120928.15848-1-fmancera@suse.deSigned-off-by: Jakub Kicinski List of files: /linux/net/sctp/Kconfig

309b905deee595619cc38719f48d63d57b8bff3d - ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs

Wed, 25 Mar 2026 13:08:42 +0100

ipv6: convert CONFIG_IPV6 to built-in only and clean up KconfigsMaintaining a modular IPv6 stack offers image size savings for specificsetups, this benefit is outweighed by the architectural burden itimposes on the subsystems on implementation and maintenance. Therefore,drop it.Change CONFIG_IPV6 from tristate to bool. Remove all Kconfigdependencies across the tree that explicitly checked for IPV6=m. Inaddition, remove MODULE_DESCRIPTION(), MODULE_ALIAS(), MODULE_AUTHOR()and MODULE_LICENSE().This is also replacing module_init() by device_initcall(). It is notpossible to use fs_initcall() as IPv4 does because that creates a racecondition on IPv6 addrconf.Finally, modify the default configs from CONFIG_IPV6=m to CONFIG_IPV6=yexcept for m68k as according to the bloat-o-meter the image isincreasing by 330KB~ and that isn't acceptable. Instead, disable IPv6 onthis architecture by default. This is aligned with m68k RAM requirementsand recommendations [1].[1] http://www.linux-m68k.org/faq/ram.htmlSigned-off-by: Fernando Fernandez Mancera Tested-by: Ricardo B. Marlière Acked-by: Krzysztof Kozlowski # arm64Link: https://patch.msgid.link/20260325120928.15848-2-fmancera@suse.deSigned-off-by: Jakub Kicinski List of files: /linux/net/sctp/Kconfig

a4a508df2aa34f8650afde54ea804321c618f45f - Merge tag 'v6.18' into next

Sat, 13 Dec 2025 10:18:20 +0100

Merge tag 'v6.18' into nextSync up with the mainline to bring in the latest APIs. List of files: /linux/net/sctp/Kconfig

cb9f145f638d7afa633632a9290d6ad06caeb8ee - Merge remote-tracking branch 'drm/drm-next' into msm-next-robclark

Sat, 01 Nov 2025 13:47:30 +0100

Merge remote-tracking branch 'drm/drm-next' into msm-next-robclarkBack-merge drm-next to get caught up.Signed-off-by: Rob Clark List of files: /linux/net/sctp/Kconfig

82ee50252dc891e3f3b32d923bb4f656d300b772 - Merge drm/drm-next into drm-xe-next

Tue, 14 Oct 2025 11:31:49 +0200

Merge drm/drm-next into drm-xe-nextBackmerging to bring in 6.18-rc1.Signed-off-by: Thomas Hellström List of files: /linux/net/sctp/Kconfig

2acee98fcc61052d63fab4539fcb6ee677555645 - Merge drm/drm-next into drm-intel-next

Tue, 14 Oct 2025 09:37:11 +0200

Merge drm/drm-next into drm-intel-nextSync to v6.18-rc1.Signed-off-by: Jani Nikula List of files: /linux/net/sctp/Kconfig

9b966ae42235a88eaea714be09ff3d698535bdfe - Merge drm/drm-next into drm-misc-next

Mon, 13 Oct 2025 09:19:19 +0200

Merge drm/drm-next into drm-misc-nextUpdating drm-misc-next to the state of v6.18-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/net/sctp/Kconfig

f088104d837a991c65e51fa30bb4196169b3244d - Merge drm/drm-next into drm-intel-gt-next

Tue, 16 Sep 2025 12:53:20 +0200

Merge drm/drm-next into drm-intel-gt-nextBackmerge in order to get the commit: 048832a3f400 ("drm/i915: Refactor shmem_pwrite() to use kiocb and write_iter")To drm-intel-gt-next as there are followup fixes to be applied.Signed-off-by: Joonas Lahtinen List of files: /linux/net/sctp/Kconfig

2ace52718376fdb56aca863da2eebe70d7e2ddb1 - Merge branch 'objtool/core'

Fri, 21 Nov 2025 11:21:20 +0100

Merge branch 'objtool/core'Bring in the UDB and objtool data annotations to avoid conflicts while further extending the bug exceptions.Signed-off-by: Peter Zijlstra List of files: /linux/net/sctp/Kconfig

f39b6c468c52745dbca9a842d91c8373fda208ab - Merge tag 'v6.18-rc6' into for-linus

Tue, 18 Nov 2025 08:16:55 +0100

Merge tag 'v6.18-rc6' into for-linusSync up with the mainline to bring in definition ofINPUT_PROP_HAPTIC_TOUCHPAD. List of files: /linux/net/sctp/Kconfig

4f38da1f027ea2c9f01bb71daa7a299c191b6940 - spi: Merge up v6.18-rc1

Mon, 13 Oct 2025 14:32:13 +0200

spi: Merge up v6.18-rc1Ensure my CI has a sensible baseline. List of files: /linux/net/sctp/Kconfig

ec2e0fb07d789976c601bec19ecced7a501c3705 - Merge tag 'asoc-fix-v6.18-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Thu, 16 Oct 2025 20:14:24 +0200

Merge tag 'asoc-fix-v6.18-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v6.18A moderately large collection of driver specific fixes, plus a few newquirks and device IDs. The NAU8821 changes are a little large but morein mechanical ways than in ways that are complex. List of files: /linux/net/sctp/Kconfig

48a710760e10a4f36e11233a21860796ba204b1e - Merge drm/drm-fixes into drm-misc-fixes

Tue, 14 Oct 2025 10:59:58 +0200

Merge drm/drm-fixes into drm-misc-fixesUpdating drm-misc-fixes to the state of v6.18-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/net/sctp/Kconfig

07fdad3a93756b872da7b53647715c48d0f4a2d0 - Merge tag 'net-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

Fri, 03 Oct 2025 00:17:01 +0200

Merge tag 'net-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-nextPull networking updates from Paolo Abeni: "Core & protocols: - Improve drop account scalability on NUMA hosts for RAW and UDP sockets and the backlog, almost doubling the Pps capacity under DoS - Optimize the UDP RX performance under stress, reducing contention, revisiting the binary layout of the involved data structs and implementing NUMA-aware locking. This improves UDP RX performance by an additional 50%, even more under extreme conditions - Add support for PSP encryption of TCP connections; this mechanism has some similarities with IPsec and TLS, but offers superior HW offloads capabilities - Ongoing work to support Accurate ECN for TCP. AccECN allows more than one congestion notification signal per RTT and is a building block for Low Latency, Low Loss, and Scalable Throughput (L4S) - Reorganize the TCP socket binary layout for data locality, reducing the number of touched cachelines in the fastpath - Refactor skb deferral free to better scale on large multi-NUMA hosts, this improves TCP and UDP RX performances significantly on such HW - Increase the default socket memory buffer limits from 256K to 4M to better fit modern link speeds - Improve handling of setups with a large number of nexthop, making dump operating scaling linearly and avoiding unneeded synchronize_rcu() on delete - Improve bridge handling of VLAN FDB, storing a single entry per bridge instead of one entry per port; this makes the dump order of magnitude faster on large switches - Restore IP ID correctly for encapsulated packets at GSO segmentation time, allowing GRO to merge packets in more scenarios - Improve netfilter matching performance on large sets - Improve MPTCP receive path performance by leveraging recently introduced core infrastructure (skb deferral free) and adopting recent TCP autotuning changes - Allow bridges to redirect to a backup port when the bridge port is administratively down - Introduce MPTCP 'laminar' endpoint that con be used only once per connection and simplify common MPTCP setups - Add RCU safety to dst->dev, closing a lot of possible races - A significant crypto library API for SCTP, MPTCP and IPv6 SR, reducing code duplication - Supports pulling data from an skb frag into the linear area of an XDP buffer Things we sprinkled into general kernel code: - Generate netlink documentation from YAML using an integrated YAML parser Driver API: - Support using IPv6 Flow Label in Rx hash computation and RSS queue selection - Introduce API for fetching the DMA device for a given queue, allowing TCP zerocopy RX on more H/W setups - Make XDP helpers compatible with unreadable memory, allowing more easily building DevMem-enabled drivers with a unified XDP/skbs datapath - Add a new dedicated ethtool callback enabling drivers to provide the number of RX rings directly, improving efficiency and clarity in RX ring queries and RSS configuration - Introduce a burst period for the health reporter, allowing better handling of multiple errors due to the same root cause - Support for DPLL phase offset exponential moving average, controlling the average smoothing factor Device drivers: - Add a new Huawei driver for 3rd gen NIC (hinic3) - Add a new SpacemiT driver for K1 ethernet MAC - Add a generic abstraction for shared memory communication devices (dibps) - Ethernet high-speed NICs: - nVidia/Mellanox: - Use multiple per-queue doorbell, to avoid MMIO contention issues - support adjacent functions, allowing them to delegate their SR-IOV VFs to sibling PFs - support RSS for IPSec offload - support exposing raw cycle counters in PTP and mlx5 - support for disabling host PFs. - Intel (100G, ice, idpf): - ice: support for SRIOV VFs over an Active-Active link aggregate - ice: support for firmware logging via debugfs - ice: support for Earliest TxTime First (ETF) hardware offload - idpf: support basic XDP functionalities and XSk - Broadcom (bnxt): - support Hyper-V VF ID - dynamic SRIOV resource allocations for RoCE - Meta (fbnic): - support queue API, zero-copy Rx and Tx - support basic XDP functionalities - devlink health support for FW crashes and OTP mem corruptions - expand hardware stats coverage to FEC, PHY, and Pause - Wangxun: - support ethtool coalesce options - support for multiple RSS contexts - Ethernet virtual: - Macsec: - replace custom netlink attribute checks with policy-level checks - Bonding: - support aggregator selection based on port priority - Microsoft vNIC: - use page pool fragments for RX buffers instead of full pages to improve memory efficiency - Ethernet NICs consumer, and embedded: - Qualcomm: support Ethernet function for IPQ9574 SoC - Airoha: implement wlan offloading via NPU - Freescale - enetc: add NETC timer PTP driver and add PTP support - fec: enable the Jumbo frame support for i.MX8QM - Renesas (R-Car S4): - support HW offloading for layer 2 switching - support for RZ/{T2H, N2H} SoCs - Cadence (macb): support TAPRIO traffic scheduling - TI: - support for Gigabit ICSS ethernet SoC (icssm-prueth) - Synopsys (stmmac): a lot of cleanups - Ethernet PHYs: - Support 10g-qxgmi phy-mode for AQR412C, Felix DSA and Lynx PCS driver - Support bcm63268 GPHY power control - Support for Micrel lan8842 PHY and PTP - Support for Aquantia AQR412 and AQR115 - CAN: - a large CAN-XL preparation work - reorganize raw_sock and uniqframe struct to minimize memory usage - rcar_canfd: update the CAN-FD handling - WiFi: - extended Neighbor Awareness Networking (NAN) support - S1G channel representation cleanup - improve S1G support - WiFi drivers: - Intel (iwlwifi): - major refactor and cleanup - Broadcom (brcm80211): - support for AP isolation - RealTek (rtw88/89) rtw88/89: - preparation work for RTL8922DE support - MediaTek (mt76): - HW restart improvements - MLO support - Qualcomm/Atheros (ath10k): - GTK rekey fixes - Bluetooth drivers: - btusb: support for several new IDs for MT7925 - btintel: support for BlazarIW core - btintel_pcie: support for _suspend() / _resume() - btintel_pcie: support for Scorpious, Panther Lake-H484 IDs"* tag 'net-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1536 commits) net: stmmac: Add support for Allwinner A523 GMAC200 dt-bindings: net: sun8i-emac: Add A523 GMAC200 compatible Revert "Documentation: net: add flow control guide and document ethtool API" octeontx2-pf: fix bitmap leak octeontx2-vf: fix bitmap leak net/mlx5e: Use extack in set rxfh callback net/mlx5e: Introduce mlx5e_rss_params for RSS configuration net/mlx5e: Introduce mlx5e_rss_init_params net/mlx5e: Remove unused mdev param from RSS indir init net/mlx5: Improve QoS error messages with actual depth values net/mlx5e: Prevent entering switchdev mode with inconsistent netns net/mlx5: HWS, Generalize complex matchers net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs selftests/net: add tcp_port_share to .gitignore Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" net: add NUMA awareness to skb_attempt_defer_free() net: use llist for sd->defer_list net: make softnet_data.defer_count an atomic selftests: drv-net: psp: add tests for destroying devices selftests: drv-net: psp: add test for auto-adjusting TCP MSS ... List of files: /linux/net/sctp/Kconfig

c3199adbe4ffffc7b6536715e0290d1919a45cd9 - Merge branch 'sctp-convert-to-use-crypto-lib-and-upgrade-cookie-auth'

Wed, 20 Aug 2025 04:36:29 +0200

Merge branch 'sctp-convert-to-use-crypto-lib-and-upgrade-cookie-auth'Eric Biggers says:====================sctp: Convert to use crypto lib, and upgrade cookie authThis series converts SCTP chunk and cookie authentication to use thecrypto library API instead of crypto_shash. This is much simpler (thediffstat should speak for itself), and also faster too. In addition,this series upgrades the cookie authentication to use HMAC-SHA256.I've tested that kernels with this series applied can continue tocommunicate using SCTP with older ones, in either direction, using anychoice of None, HMAC-SHA1, or HMAC-SHA256 chunk authentication.====================Link: https://patch.msgid.link/20250818205426.30222-1-ebiggers@kernel.orgSigned-off-by: Jakub Kicinski List of files: /linux/net/sctp/Kconfig

2f3dd6ec901f29aef5fff3d7a63b1371d67c1760 - sctp: Convert cookie authentication to use HMAC-SHA256

Mon, 18 Aug 2025 22:54:25 +0200

sctp: Convert cookie authentication to use HMAC-SHA256Convert SCTP cookies to use HMAC-SHA256, instead of the previous choiceof the legacy algorithms HMAC-MD5 and HMAC-SHA1. Simplify and optimizethe code by using the HMAC-SHA256 library instead of crypto_shash, andby preparing the HMAC key when it is generated instead of per-operation.This doesn't break compatibility, since the cookie format is animplementation detail, not part of the SCTP protocol itself.Note that the cookie size doesn't change either. The HMAC field wasalready 32 bytes, even though previously at most 20 bytes were actuallycompared. 32 bytes exactly fits an untruncated HMAC-SHA256 value. So,although we could safely truncate the MAC to something slightly shorter,for now just keep the cookie size the same.I also considered SipHash, but that would generate only 8-byte MACs. An8-byte MAC *might* suffice here. However, there's quite a lot ofinformation in the SCTP cookies: more than in TCP SYN cookies. Soabsent an analysis that occasional forgeries of all that information isokay in SCTP, I errored on the side of caution.Remove HMAC-MD5 and HMAC-SHA1 as options, since the new HMAC-SHA256option is just better. It's faster as well as more secure. Forexample, benchmarking on x86_64, cookie authentication is now nearly 3xas fast as the previous default choice and implementation of HMAC-MD5.Also just make the kernel always support cookie authentication if SCTPis supported at all, rather than making it optional in the build. (Itwas sort of optional before, but it didn't really work properly. E.g.,a kernel with CONFIG_SCTP_COOKIE_HMAC_MD5=n still supported HMAC-MD5cookie authentication if CONFIG_CRYPTO_HMAC and CONFIG_CRYPTO_MD5happened to be enabled in the kconfig for other reasons.)Acked-by: Xin Long Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20250818205426.30222-5-ebiggers@kernel.orgSigned-off-by: Jakub Kicinski List of files: /linux/net/sctp/Kconfig

bf40785fa437c1752117df2edb3220e9c37d98a6 - sctp: Use HMAC-SHA1 and HMAC-SHA256 library for chunk authentication

Mon, 18 Aug 2025 22:54:24 +0200

sctp: Use HMAC-SHA1 and HMAC-SHA256 library for chunk authenticationFor SCTP chunk authentication, use the HMAC-SHA1 and HMAC-SHA256 libraryfunctions instead of crypto_shash. This is simpler and faster. There'sno longer any need to pre-allocate 'crypto_shash' objects; the SCTP codenow simply calls into the HMAC code directly.As part of this, make SCTP always support both HMAC-SHA1 andHMAC-SHA256. Previously, it only guaranteed support for HMAC-SHA1.However, HMAC-SHA256 tended to be supported too anyway, as it wassupported if CONFIG_CRYPTO_SHA256 was enabled elsewhere in the kconfig.Acked-by: Xin Long Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20250818205426.30222-4-ebiggers@kernel.orgSigned-off-by: Jakub Kicinski List of files: /linux/net/sctp/Kconfig

ab93e0dd72c37d378dd936f031ffb83ff2bd87ce - Merge branch 'next' into for-linus

Wed, 06 Aug 2025 19:08:54 +0200

Merge branch 'next' into for-linusPrepare input updates for 6.17 merge window. List of files: /linux/net/sctp/Kconfig