Merge tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
"Including fixes from Netfilter, Bluetooth, IPSec and WiFi.

Previous r

Merge tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
"Including fixes from Netfilter, Bluetooth, IPSec and WiFi.

Previous releases - regressions:

- netfilter: hold reference on ct until flow is released

- bridge:
- move switchdev call outside rcu
- vlan: fix bugs caused by switchdev deletion errors

- wifi:
- mac80211: reset state when starting AP fails
- cfg80211: don't free driver-owned scan requests

- tcp: don't call skb_clone_and_charge_r() for close()d listener in
tcp_v6_do_rcv()

- mptcp: return sk_wait_data() errors from recvmsg()

- xfrm: serialize state GC with device state flush

- drop_monitor: synchronize tracepoint unregistration on error path

- bluetooth:
- eir: validate service data length before reading UUID
- hci_sync: serialize local codec list cleanup
- RFCOMM: avoid socket lock inversion in listener cleanup

- eth:
- lan743x: fix RX checksum use-after-free
- mvpp2: prevent buffer overflow in page_pool allocation

Previous releases - always broken:

- core: lock the socket in sock_gettstamp()

- neighbour: enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.

- sched: codel: bound the dropping loop per dequeue call

- wifi: mac80211: include TIM bitmap control for buffered S1G mcast
traffic

- psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()

- xfrm: fix stack OOB read in iptfs_skb_reset_frag_walk()

- bluetooth: hci_qca: do not write to the serial port after it is
closed

- dsa: mxl862xx: disable the stats poll on teardown

- eth:
- stmmac: fix TSO header length truncation
- ip_tunnel: initialize `options_len` before referencing options"

* tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (159 commits)
mptcp: fix bad accounting in __mptcp_subflow_push_pending()
mptcp: close race between scheduler and state change
mptcp: avoid unneeded actions on subflow reset
net: skbuff: do not leave stale header offsets after pskb_carve()
selftests: net: packetdrill: test exclusion of old ACK from TCP fast path
tcp: exclude old ACKs from tcp fast path
dpll: reject a reference sync pin which is not on the pin's dpll
net: mvpp2: prevent buffer overflow in page_pool allocation
net: macb: fix ordering around PTP timestamp read
selftests: drv-net: psp: test PSP and TCP ULP mutual exclusion
net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
net: stmmac: preserve real_num_tx_queues on mqprio setup failure
net: stmmac: propagate FPE preemption-class mapping errors
net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
net: ethernet: cortina: Ack RX overrun interrupt correctly
net: lock the socket in sock_gettstamp()
eth: fbnic: ring the doorbell if a burst ends in a drop
net: netsec: fix device_node reference leak on phy_np
...

show more ...

Merge branch 'net-sched-fix-action-batch-deletion-cleanup'

Xuanqiang Luo says:

====================
net/sched: fix action batch deletion cleanup

Batched RTM_DELACTION requests can leak references

Merge branch 'net-sched-fix-action-batch-deletion-cleanup'

Xuanqiang Luo says:

====================
net/sched: fix action batch deletion cleanup

Batched RTM_DELACTION requests can leak references to unprocessed actions
when deletion stops at a filter-bound action.

Patch 1 fixes the failure cleanup.

Patch 2 adds tc-testing regression coverage.

Failure reproduction (key output excerpts):

python3 tdc.py -f /root/tc-testing/batch-delete.json

not ok 1 d710 - Release tail references after first action deletion fails
Could not match regex pattern. Verify command output:
[...]
index 2 ref 2 bind 0
[...]
index 3 ref 2 bind 0

not ok 2 d711 - Release tail references after middle action deletion fails
Could not match regex pattern. Verify command output:
[...]
index 3 ref 2 bind 0

not ok 3 d713 - Delete a tail action once after a failed batch
Could not match regex pattern. Verify command output:
total acts 2
[...]
index 2 ref 1 bind 0
====================

Link: https://patch.msgid.link/20260910093413.34509-1-xuanqiang.luo@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

show more ...

selftests: tc-testing: test action batch deletion failure cleanup

Add tests for cleanup after a batched RTM_DELACTION request fails at
a gact action bound to a filter. Check that subsequent actions

selftests: tc-testing: test action batch deletion failure cleanup

Add tests for cleanup after a batched RTM_DELACTION request fails at
a gact action bound to a filter. Check that subsequent actions retain
their original reference counts and that earlier successful deletions
are preserved.

Cover failures at the first and middle entries. Verify that a remaining
unbound action can be removed with one subsequent delete.

Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Link: https://patch.msgid.link/20260910093413.34509-3-xuanqiang.luo@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

show more ...