u-boot.git/net, branch next

net: srand_mac(): fix -ENODEV crash with CONFIG_DM_RNG

2026-08-12T15:02:50Z

The uclass_get_device() return-value check was inverted, resulting in a synchronous abort when -ENODEV was returned. Signed-off-by: Graeme Smecher Reviewed-by: Simon Glass

net: lwip: dhcp: fix DHCP fine timer interval

2026-08-12T12:23:14Z

dhcp_fine_tmr() was called every 10ms, but lwIP expects it to be called every DHCP_FINE_TIMER_MSECS (500ms). Since the fine timer ticks are currently 50 times faster than lwIP expects, the client burns through the bounded exponential backoff sequence for the DHCPREQUEST messages in 2.44 seconds rather than 122 seconds, after which it uses a new xid and returns to sending DHCPDISCOVER messages. If there is enough latency in the server, the client could receive an ACK response within DHCP_TIMEOUT_MS (10 seconds), but reject it because it has already moved on with another xid after 2.44 seconds. We have seen this occur with our boards. When our rack of 16 boards get powered on together, they all request for an address from the network switch's DHCP server in near lock-step and we see that only a few of the boards actually obtain a lease. Fixing the timing to 500ms allowed all of the boards to obtain a lease consistently. Fixes: 98ad145db61a ("net: lwip: add DHCP support and dhcp commmand") Signed-off-by: Luca Jones

net: fix out-of-bounds write in IP fragment reassembly

2026-07-30T11:56:26Z

__net_defragment() reassembles IP fragments into the static buffer pkt_buff[CONFIG_NET_MAXDEFRAG]. The bounds check if (start + len > IP_MAXUDP) return NULL; only covers the fragment data copy. The split-hole and move-hole branches additionally write an 8-byte struct hole via "*newh = *h" at newh = thisfrag + len / 8, which can land up to sizeof(struct hole) bytes past the end of pkt_buff. A single fragment with a non-zero fragment offset and the More-Fragments flag set reaches this path, so a crafted fragment received during netboot overflows the buffer. Reject any fragment whose trailing hole descriptor would fall outside pkt_buff. Signed-off-by: Shahriyar Jalayeri Acked-by: Jerome Forissier

net: nfs: clean up bounds checks in nfs_readlink_reply()

2026-07-23T15:18:37Z

Commit d6694018eadd ("net: nfs: fix buffer overflow in nfs_readlink_reply()") added bounds checks against sizeof(nfs_path_buff) before both memcpy() calls. This is a cosmetic cleanup of that fix: - introduce a local new_len for the relative-path branch so the sum pathlen + rlen is computed once and reused for both the bounds check and the NUL terminator, rather than being open-coded twice; - emit a diagnostic when a symlink target is rejected for exceeding the buffer, matching the style of other NFS error paths. No functional change to the accept/reject decision. This same overflow was independently discovered and privately reported to the U-Boot maintainers on 2026-04-03, together with a working proof of concept, ahead of the change that became the fix cited above. This cleanup restores the local-variable form from that original report. Signed-off-by: Murtaza Munaim

net: lwip: handle chained pbufs in transmit path

2026-07-23T15:05:20Z

LwIP may pass a packet to the netif linkoutput callback as a chain of pbufs. In this case, p->len only describes the length of the first pbuf, while p->tot_len describes the length of the whole packet. The current transmit path only sends the first pbuf. This can truncate packets whose headers have already been generated for the full packet length, resulting in malformed frames on the wire. For example, the IP header may record a larger total length than the actual Ethernet frame length. Assemble chained pbufs into one aligned contiguous buffer before passing the packet to the Ethernet driver. Fixes: 98ad145db61a (net: lwip: add DHCP support and dhcp commmand) Signed-off-by: Weijie Gao Reviewed-by: Jerome Forissier

net: lwip: add tftpsrv command

2026-07-23T15:05:20Z

The legacy network stack supports tftpsrv, which listens for an incoming TFTP write request and receives the first file into memory. Despite the old command help wording, the command returns after receiving the file and does not boot it automatically. The lwIP stack already builds the lwIP TFTP application, but only wires it up for client-side tftpboot. Add a lwIP tftpsrv command and implement the server path with tftp_init_server(). Reuse the existing lwIP TFTP write callback and memory copy path so LMB checks, progress output, filesize/fileaddr updates and EFI bootdev handling stay consistent with tftpboot. Track receive timeout and write-failure state around the lwIP callbacks so a stalled or rejected receive is not reported as a successful close. Move CMD_TFTPSRV out of the legacy-only Kconfig block so it can be enabled with either network stack. Update the command help text and add usage documentation for the receive-only behavior. Add pytest coverage for tftpsrv using a generated host file and curl's TFTP upload support. Enable the command in qemu_arm64_lwip_defconfig so the test can be run with the existing lwIP QEMU build when the boardenv provides env__net_tftpsrv_file. Signed-off-by: James Hilliard [Jerome Forissier: remove trailing ':' after SPDX tag] Signed-off-by: Jerome Forissier Reviewed-by: Jerome Forissier

Merge branch 'next'

2026-07-07T00:26:12Z

Kconfig: net: restyle

2026-06-25T20:15:33Z

Restyle all Kconfigs for "net": Menu entries : no space left Menu attributes: 1 TAB Help text : 1 TAB + 2 spaces Replace '---help---' by 'help' Signed-off-by: Johan Jonker

net: cdp: reject CDP TLVs with a length below the 4-byte header

2026-06-23T11:13:16Z

cdp_receive() reads a 16-bit TLV length (tlen) from the packet and only checks that it does not exceed the remaining buffer (tlen > len). It then unconditionally does "tlen -= 4" to skip the TLV header. As tlen is a u16, a crafted TLV with a length of 0..3 underflows tlen to ~65532-65535. For a CDP_APPLIANCE_VLAN_TLV the underflowed length then drives the inner "while (tlen > 0)" loop, which walks ~64KB past the receive buffer reading *ss each step -> out-of-bounds read (crash / info-influence). A length of 0 additionally fails to advance pkt/len, hanging the parse loop. Reject any TLV whose declared length is smaller than its own 4-byte header. This is the same class of bug as the recent bootp/dhcpv6/sntp/nfs fixes (unchecked length field), in a sibling LAN parser that was missed. Verified with a standalone AddressSanitizer harness using the verbatim cdp_receive()/cdp_compute_csum() routines: a 16-byte CDP frame with an appliance-VLAN TLV of length 3 triggers a heap-buffer-overflow READ that the check eliminates. Fixes: f575ae1f7d39 ("net: Move CDP out of net.c") Cc: stable@vger.kernel.org Signed-off-by: Piyush Paliwal Reviewed-by: Jerome Forissier

net: lwip: introduce net_lwip_eth_stop() function

2026-06-23T11:13:16Z

Add a introduce net_lwip_eth_stop() function and use that to stop the network interface after each command that uses the network. This makes the behavior the same as the legacy net code and avoids potential issues with the network interface being left in an active state after a command finishes. The start/stop is reference-counted since there is at least one command (dhcp) that calls another command (tftp) to avoid starting and stopping the network interface multiple times in a single command. Signed-off-by: David Lechner Reviewed-by: Jerome Forissier