Changes in exception_cache.sh

adf50c47a47f0f0f0b79dd58ffade9919cddebea - Merge tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Thu, 03 Sep 2026 19:18:12 +0200

Merge tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netPull networking fixes from Paolo Abeni: "Including fixes from bluetooth. Previous releases - regressions: - page_pool: keep frag_offset aligned for odd-sized requests - sched: fix u32 duplicate handle when node ID pool is exhausted - udp: create exceptions before socket matching - igmp: convert struct ip_sf_list to RCU - ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit - rds: acquire the fastpath locks in rds_conn_shutdown() - tipc: - protect node reset trace dump with node lock - fix NULL deref in tipc_named_node_up() on empty publication list - bluetooth: - L2CAP: fix out-of-bounds write in l2cap_ecred_connect - hci_core: fix race condition during device registration - eth: - mlx5e: prevent stale XSK buffer release on refill retries - bridge: don't truncate the port group walk on teardown Previous releases - always broken: - gro: fix nesting of TCP GSO SKBs in skb_gro_receive_list() - sched: fix skb sizing and action leak on reoffload delete - tcp: fix use-after-free in do_tcp_getsockopt() - af_packet: don't cast tpacket_hdr.tp_len to int in tpacket_parse_header() - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration - iptunnel: fix stale transport header during tunnel decapsulation - eth: - vxlan: fix use-after-free in vxlan_mdb_remote_src_del() - bonding: fix uninitialized transport header access in alb_determine_nd()"* tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits) net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list() net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset net: airoha: enable RX_DONE interrupt for RX queue 31 net/rds: don't let rds_conn_shutdown() consume a concurrent drop net/rds: acquire the fastpath locks in rds_conn_shutdown() net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown net/rds: clear cp_flags bits individually in rds_conn_path_reset() net/rds: use clear_bit_unlock() in release_refill() net/rds: use wq_has_sleeper() in release_in_xmit() net: usb: qmi_wwan: add Compal EXM-G1x support net: macb: exclude software FCS from TX byte statistics net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). net: bridge: mcast: don't truncate the port group walk on teardown bonding: do not clear curr_active_slave prematurely when releasing all slaves net: qrtr: Send HELLO message on endpoint register octeontx2-af: Fix limiting SRIOV VF count logic bonding: alb: fix uninitialized transport header access in alb_determine_nd() s390/ctcm: Prevent XID null dereference net: psp: do not inherit the Rx association on clone ... List of files: /linux/tools/testing/selftests/net/exception_cache.sh

f88bbbbe96d6d2ba4cca8af0c47907ed27de2863 - Merge branch 'mitigate-a-side-channel-in-routing-exception-caches'

Tue, 01 Sep 2026 04:56:33 +0200

Merge branch 'mitigate-a-side-channel-in-routing-exception-caches'Ido Schimmel says:====================Mitigate a side channel in routing exception cachesWhen an ICMP error that quotes a UDP packet is locally delivered, thekernel only creates a routing exception if the quoted packet matchesa socket. This allows an off-path attacker to conduct a side-channelattack on the routing exception caches in order to discover theephemeral ports used by connected UDP sockets.Previous mitigations tried to make it harder for attackers to find hashcollisions in these caches and make the eviction of exceptions lesspredictable. Amit Klein and Noam Caspi demonstrated that both of thesemitigations can be bypassed.This patchset tries to mitigate such attacks by always creating anexception, even before trying to find a matching socket. The exceptionis created by the same helpers that are used when the quoted packet didnot originate from a socket, so that guesses (right or wrong) from anoff-path attacker always result in an exception being created or updatedin the cache that the attacker can observe.Note that this mitigation does not make it easier for attackers to fillthese caches, since they can already create exceptions with little to novalidation. For example, by sending an ICMP error that quotes an ICMPEcho Reply or one that quotes a UDP source port that matches a wildcardsocket.In the good case (matched socket) this comes at the cost of an extraroute lookup, as the exception is created before the one performed bythe socket path. When the two lookups resolve to different nexthops,an exception is created in the cache of each.Patch #1 fixes a pre-existing bug in the handling of ICMPv6 RedirectMessage packets. Discovered while writing the selftest.Patch #2 creates an exception from the IPv4 UDP code even before socketmatching. Other socket types do not need this: raw sockets have noports, and for TCP the ICMP error is discarded unless the quotedsequence number is in window.Patch #3 does the same for IPv6.Patch #4 adds a selftest.v1: https://lore.kernel.org/netdev/20260826143735.1819315-1-idosch@nvidia.com/====================Link: https://patch.msgid.link/20260828192344.2596928-1-idosch@nvidia.comSigned-off-by: Jakub Kicinski List of files: /linux/tools/testing/selftests/net/exception_cache.sh

c923c14942b164cfc2c1efa4e6324214f2fc248a - selftests: net: Add exception cache tests

Fri, 28 Aug 2026 21:23:44 +0200

selftests: net: Add exception cache testsAdd a test for the IPv4 and IPv6 exception caches, covering theexceptions that are created in response to ICMP errors quoting a UDPpacket.The topology consists of a host (h1) that reaches a remote host (h2)via a router (r1), with a second router (r2) attached to the segmentshared by h1 and r1. UDP packets are injected using a packet socket, sothat an ICMP error quoting them is only matched to a socket when one wasopened separately with the same source port. PMTU errors are provoked bylowering the MTU of the far end of the path and redirects by pointingr1's route towards h2 back over the segment it received the packet from.The following is tested for both address families and for both PMTU andredirect exceptions:* An error that is not matched to a socket creates an exception that carries the new MTU or gateway.* An error that is matched to a socket creates the same exception.The PMTU tests further verify that a lower PMTU replaces the one storedin the exception whereas a higher one does not, and that a socket whichdisabled PMTU discovery using IP{,V6}_PMTUDISC_OMIT gets the sameexception as the other cases.Without "ipv4: udp: Create exceptions before socket matching" and "ipv6:udp: Create exceptions before socket matching", the tests that do notopen a socket fail: # ./exception_cache.sh TEST: IPv4: PMTU: exception without a matching socket [FAIL] No socket: exception does not carry an MTU of 1400 TEST: IPv6: PMTU: exception without a matching socket [FAIL] No socket: exception does not carry an MTU of 1400 TEST: IPv4: PMTU: exception with a matching socket [ OK ] TEST: IPv6: PMTU: exception with a matching socket [ OK ] TEST: IPv4: PMTU: exception with a socket ignoring it [FAIL] PMTU discovery disabled: exception does not carry an MTU of 1400 TEST: IPv6: PMTU: exception with a socket ignoring it [FAIL] PMTU discovery disabled: exception does not carry an MTU of 1400 TEST: IPv4: Redirect: exception without a matching socket [FAIL] No socket: exception does not carry the new gateway TEST: IPv6: Redirect: exception without a matching socket [FAIL] No socket: exception does not carry the new gateway TEST: IPv4: Redirect: exception with a matching socket [ OK ] TEST: IPv6: Redirect: exception with a matching socket [ OK ]Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20260828192344.2596928-5-idosch@nvidia.comSigned-off-by: Jakub Kicinski List of files: /linux/tools/testing/selftests/net/exception_cache.sh