u-boot.git/net, branch next

Kconfig: net: restyle

2026-06-25T20:15:33Z

Restyle all Kconfigs for "net": Menu entries : no space left Menu attributes: 1 TAB Help text : 1 TAB + 2 spaces Replace '---help---' by 'help' Signed-off-by: Johan Jonker

Merge tag 'v2026.07-rc4' into next

2026-06-08T21:28:18Z

Prepare v2026.07-rc4

net: bootp: Prevent out-of-bounds read in dhcp_message_type

2026-06-03T15:22:24Z

dhcp_message_type() scans DHCP options looking for a 0xff end-of-options marker with no check that the scan pointer stays within the received packet. A server can send a crafted OFFER with no 0xff terminator and large option length fields, advancing the pointer past bp_vend[312] into adjacent heap memory. This is the same class of bug as CVE-2024-42040, which fixed the related bootp_process_vendor() call site. Fix it by adding an end parameter to dhcp_message_type() and checking that popt is lower than end. Signed-off-by: Francois Berder Reviewed-by: Jerome Forissier

net: dhcpv6: Prevent out-of-bounds reads while parsing options

2026-06-03T15:22:24Z

dhcp6_parse_options() verifies that an option's declared data fits within the packet, but does not check that option_len is large enough for the fixed-size read each case performs. A malicious DHCP server can send an ADVERTISE with a zero-length IA_NA, STATUS_CODE, SOL_MAX_RT, or BOOTFILE_PARAM option, causing the parser to read 2-4 bytes past the option's declared data. Check option_len value before each dereference of option_ptr. Signed-off-by: Francois Berder

net: dhcpv6: Prevent buffer overflow during BOOTFILE_URL parsing

2026-06-03T15:22:24Z

The net_boot_file_name is a 1024 byte buffer. However, based on DHCPv6 RFC, bootfile-url length is specified by option_len, a 16-bit unsigned integer (valid range: 0-65535). Hence, one needs to make sure that option_len is less than the size of net_boot_file_name array before copying bootfile-url to net_boot_file_name. Signed-off-by: Francois Berder Reviewed-by: Jerome Forissier

net: sntp: Check packet length in sntp_handler

2026-06-03T15:22:24Z

Currently, the sntp_handler uses data in the UDP packet regardless of the actual packet size. A OOB read can occur if the packet is too small. Fix it by checking the packet length before extracting seconds from a SNTP packet. Signed-off-by: Francois Berder Reviewed-by: Jerome Forissier

net: SYS_RX_ETH_BUFFER defaults to 8 when CONFIG_FSL_ENETC=y

2026-06-03T14:55:55Z

drivers/net/fsl_enetc.h specifies ENETC_BD_CNT "buffer descriptors count must be a multiple of 8". This constant is set to CONFIG_SYS_RX_ETH_BUFFER which defaults to 4. All defconfigs enabling CONFIG_FSL_ENETC fortunately have it set to 8, according to ./tools/qconfig.py -l -f CONFIG_FSL_ENETC '~CONFIG_SYS_RX_ETH_BUFFER=8'. Let's make sure the default is sane by having it set to 8 when this driver is enabled. Note that originally[1] it was said EEPRO100 and 405 EMAC should be 8 or higher. 405 (PPC405?) support seems to have been dropped in commit b5e7c84f72ee ("ppc4xx: remove ASH405 board"), 11 years ago. Maybe there's something we can do for EEPRO100 though? Start all lines with a tab instead of spaces. Specify limitation for FSL_ENETC in the help text. [1] commit 53cf9435ccf9 ("- CFG_RX_ETH_BUFFER added.") Reviewed-by: Simon Glass Signed-off-by: Quentin Schulz

net: guard SYS_RX_ETH_BUFFER with NET

2026-06-03T14:55:55Z

SYS_RX_ETH_BUFFER represents the number of Ethernet receive packet buffers. It therefore doesn't make sense it's reachable if NET isn't enabled. Direct users of SYS_RX_ETH_BUFFER are: - drivers/net/rtl8169.c, only compiled if CONFIG_RTL8169=y, depends on CONFIG_NETDEVICES=y, depends on CONFIG_NET=y, - drivers/net/fsl_enetc.h, via ENETC_BD_CNT, included in drivers/net/{fsl_enetc.c,fsl_enetc_mdio.c,mscc_eswitch/felix_switch.c} First two only compiled if CONFIG_FSL_ENETC=y, latter with CONFIG_MSCC_FELIX_SWITCH=y. Both symbols depends on CONFIG_NETDEVICES=y, depends on CONFIG_NET=y. - include/net-common.h via PKTBUFSRX, Indirect users via PKTBUFSRX: - arch/sandbox/include/asm/eth.h - according to ./tools/qconfig.py -l -f CONFIG_SANDBOX CONFIG_NO_NET, all sandbox defconfigs have network enabled so ignore this for now, - drivers/dma/ti/k3-udma.c - sets UDMA_RX_DESC_NUM to that if defined, else 4. PKTBUFSRX is CONFIG_SYS_RX_ETH_BUFFER which defaults to 4. According to ./tools/qconfig.py -l -f CONFIG_TI_K3_NAVSS_UDMA '~CONFIG_SYS_RX_ETH_BUFFER=4' no defconfig enabling this DMA driver sets CONFIG_SYS_RX_ETH_BUFFER to anything but the default of 4, so regardless of NET being built UDMA_RX_DESC_NUM will always be 4 with current defconfigs. - drivers/net/{airoha_eth.c,bcm6348-eth.c,bcm6368-eth.c,cortina_ni.c, dc2114x.c,eepro100.c,essedma.c,ethoc.c,ftgmac100.c,ftmac100.c, hifemac.c,mcffec.c,mpc8xx_fec.c,pic32_eth.c,sandbox.c,sni_ave.c, sni_netsec.c,ti/am65-cpsw-nuss.c,ti/cpsw.c,ti/icssg_prueth.c, tsec.c} all depends on CONFIG_NETDEVICES=y, depends on CONFIG_NET=y, - net/lwip/net-lwip.c, only compiled if CONFIG_NET_LWIP=y, depends on CONFIG_NET=y, - net/{net.c,tcp.c}, only compiled if CONFIG_NET_LEGACY=y, depends on CONFIG_NET=y, - net/net-common.c, only compiled if CONFIG_NET=y, - test/cmd/wget.c, only compiled if CONFIG_NET_LEGACY=y, depends on CONFIG_NET=y, - test/image/spl_load_net.c, only compiled if CONFIG_SPL_UT_LOAD_NET=y, depends on CONFIG_SPL_ETH=y, depends on CONFIG_SPL_NET=y, depends on CONFIG_NET_LEGACY=y, depends on CONFIG_NET=y, Indirect users via net_rx_packets[PKTBUFSRX]. This array is only externally defined in net/net-common.c which is only compiled if CONFIG_NET=y. Users of net_rx_packets are: - drivers/net/{airoha_eth.c,bcm6348-eth.c,bcm6368-eth.c,cortina_ni.c, dc2114x.c,dm9000x.c,essedma.c,ethoc.c,fsl_enetc.c,ftgmac100.c, ftmac100.c,hifemac.c,ks8851_mll.c,macb.c,mcffec.c,mpc8xx_fec.c, mscc_eswitch/jr2_switch.c,mscc_eswitch/luton_switch.c, mscc_eswitch/ocelot_switch.c,mscc_eswitch/serval_switch.c, mscc_eswitch/servalt_switch.c,pic32_eth.c,sandbox-raw.c, sandbox.c,smc911x.c,sni_ave.c,sni_netsec.c,ti/am65-cpsw-nuss.c, ti/cpsw.c,ti/icssg_prueth.c,tsec.c,xilinx_axi_mrmac.c} all depends on CONFIG_NETDEVICES=y, depends on CONFIG_NET=y, - drivers/usb/gadget/ether.c only built if CONFIG_$(PHASE_)USB_ETHER=y, depends on CONFIG_NET=y/CONFIG_SPL_NET=y, - net/lwip/net-lwip.c only compiled if CONFIG_NET_LWIP=y, depends on CONFIG_NET=y, - net/net.c, only compiled if CONFIG_NET_LEGACY=y, depends on CONFIG_NET=y, - net/net-common.c, only compiled if CONFIG_NET=y, Reviewed-by: Simon Glass Signed-off-by: Quentin Schulz

net: lwip/wget: don't print progress bar when silent

2026-05-06T09:07:22Z

When the EFI sub-system request to silence output, do not output a progress bar. Signed-off-by: Heinrich Schuchardt Reviewed-by: Jerome Forissier

net: lwip/wget: don't print content size twice

2026-05-06T09:07:22Z

If wget_info->silent is set, we should not print anything. If wget_info->silent we print the received content size. Printing the value of the Content-Length header is redundant For chunked transfer no Content-Length header is sent. The content length is returned as HTTPC_CONTENT_LEN_INVALID by the LwIP library. In this case we were incorrectly printing '4 GiB'. Signed-off-by: Heinrich Schuchardt Reviewed-by: Jerome Forissier