Merge tag 'net-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netHEADmaster

Pull networking fixes from Paolo Abeni:
 "Including fixes from Bluetooth, IPsec, WiFi and CAN.

  Current release - regressions:

    - eth: wwan: mhi_wwan_ctrl: send a DTR drop before it can be coalesced

  Previous releases - regressions:

    - core:
       - use a dedicated flag to track disabled napi instances
       - frags: limit the truesize of a reassembly queue
       - reject a negative TCP header offset in qdisc_pkt_len_segs_init()y

    - tcp:
       - reject unhashed sockets during established lookups
       - free ireq->ipv6_opt after an RCU grace period

    - ipv6:
       - fix fib6 walker UAF on NLM_F_REPLACE
       - raw: fix use-after-free in rawv6_send_hdrinc()

    - wifi:
       - mac80211: reinstate IEEE80211_TX_CTL_AMPDU, fix ath9k stall
       - brcmfmac: map msgbuf RX packet IDs bidirectional, fix firmware
         crash loop

    - vsock: size receive SKBs from declared payload

    - xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()

    - bluetooth: hci_sync: copy the LE accept list under hdev->lock

    - ptp: fix use-after-free in extts_fifo_show() reading tsevqs unlocked

    - can: protect the receive lists with a per-device lock

    - eth:
       - bnxt: don't keep MSI-X vectors added before FW reserves them
       - vxlan: stop rejecting dynamic FDB entries with a nexthop ID

  Previous releases - always broken:

    - sched: sch_qfq: prevent aggregate self-replacement

    - bridge: disable MRP ports before the FDB flush in del_nbp()

    - mptcp: do not use fast open on MP_JOIN subflows

    - ipv6: serialize multicast router socket ownership

    - bluetooth: hci_core: keep link-key filtering inside RCU

    - eth:
       - atl1c: drop oversized RX frames instead of panicking
       - stmmac: a bunch of XDP path fixes
       - b53: enable IGMP and MLD control packet CPU copies"

* tag 'net-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (170 commits)
  tcp: ipv6: free ireq->ipv6_opt after an RCU grace period
  mptcp: pm: kernel: use RCU to free endpoint listeners
  tcp: initialize send sequence numbers before deferring TFO
  net: bridge: disable MRP ports before the FDB flush in del_nbp()
  net: stmmac: set XDP metadata length on the page_pool RX path
  bonding: fix missing down path on speed/duplex failure after FAIL->UP
  ip6mr: Serialize multicast router socket ownership
  bonding: 3ad: don't set BOND_LINK_FAIL on a slave that is not up
  net: ethernet: ti: am65-cpsw-nuss: Enable timestamping of unicast PTP packets
  net: count last skb of each sk_backlog pass in __release_sock()
  net: 8139cp: keep Rx masked while NAPI is scheduled
  net/smc: don't spin in smc_rx_recvmsg() while a pipe holds spliced data
  net: dsa: b53: restore the NSP IMP port 2 Gbps mode
  net: ethernet: bgmac: preserve forced 2.5 Gbps link speed
  l2tp: only return sessions of the given tunnel in l2tp_session_get()
  tipc: raise the minimum bearer MTU to fit tunnel and crypto overhead
  mptcp: do not use Fast Open on MP_JOIN subflows
  tcp: ipv6: do not read ireq->pktopts from tcp_v6_send_synack()
  ipv4: Call rt_add_uncached_list() if !do_cache in ip_route_input_slow().
  ipv6: Flush rt->from in rt6_uncached_list_flush_dev().
  ...

2 files changed, 27 insertions, 14 deletions

diff --git a/Documentation/networking/can.rst b/Documentation/networking/can.rst
index 536ff411da1d..51bc70748f75 100644
--- a/Documentation/networking/can.rst
+++ b/Documentation/networking/can.rst
@@ -1040,17 +1040,21 @@ As described in :ref:`socketcan-receive-lists` the SocketCAN core uses several f
 lists to deliver received CAN frames to CAN protocol modules. These
 receive lists, their filters and the count of filter matches can be
 checked in the appropriate receive list. All entries contain the
-device and a protocol module identifier::
+CAN network device, the filter (can_id/can_mask), the number of filter
+matches, the inode number of the subscribing socket and the name of the
+receive function. A sock_inode of 0 denotes a kernel internal subscriber
+without a socket (e.g. CAN gateway or J1939). When the function name can
+not be resolved (e.g. with CONFIG_KALLSYMS=n) "(unknown)" is printed::
 
     foo@bar:~$ cat /proc/net/can/rcvlist_all
 
     receive list 'rx_all':
-      (vcan3: no entry)
-      (vcan2: no entry)
-      (vcan1: no entry)
-      device   can_id   can_mask  function  userdata   matches  ident
-       vcan0     000    00000000  f88e6370  f6c6f400         0  raw
       (any: no entry)
+      device   can_id   can_mask   matches  sock_inode  function
+       vcan0     000    00000000         0       63586  raw_rcv [can_raw]
+      (vcan1: no entry)
+      (vcan2: no entry)
+      (vcan3: no entry)
 
 In this example an application requests any CAN traffic from vcan0::
 
diff --git a/Documentation/networking/xfrm/xfrm_migrate_state.rst b/Documentation/networking/xfrm/xfrm_migrate_state.rst
index 9d53cb22b007..ca2c9e5aaf33 100644
--- a/Documentation/networking/xfrm/xfrm_migrate_state.rst
+++ b/Documentation/networking/xfrm/xfrm_migrate_state.rst
@@ -27,15 +27,20 @@ SA Identification
 =================
 
 The struct is defined in ``include/uapi/linux/xfrm.h``. The SA is looked
-up using ``xfrm_state_lookup()`` with ``id.spi``,
-``id.daddr``, ``id.proto``, ``id.family``, and
-``old_mark.v & old_mark.m`` as the mark key::
+up using ``xfrm_state_lookup_exact()`` with ``id.spi``, ``id.daddr``,
+``id.proto``, ``id.family``, and an exact match against ``old_mark.v``
+and ``old_mark.m``. Unlike the data path, which uses a masked
+comparison, this requires the SA's mark and mask to equal ``old_mark``
+exactly, so a broad-mask SA is never matched when a more specific one
+was intended. If no such SA exists, ``-ESRCH`` is returned.
+
+The layout is::
 
     struct xfrm_user_migrate_state {
         struct xfrm_usersa_id  id;       /* spi, daddr, proto, family */
         xfrm_address_t         new_daddr;
         xfrm_address_t         new_saddr;
-        struct xfrm_mark       old_mark; /* SA lookup: key = v & m */
+        struct xfrm_mark       old_mark; /* SA lookup key (exact v/m match) */
         struct xfrm_selector   new_sel;  /* new selector (see Flags) */
         __u32                  new_reqid;
         __u32                  flags;    /* XFRM_MIGRATE_STATE_* */
@@ -72,8 +77,8 @@ inherits the value from the existing SA (omit-to-inherit).
      - Description
    * - ``XFRMA_MARK``
      - Mark on the migrated SA (``struct xfrm_mark``). Absent inherits
-       ``old_mark``. To use no mark on the new SA, send ``XFRMA_MARK``
-       with ``{0, 0}``.
+       the mark of the existing SA. To use no mark on the new SA, send
+       ``XFRMA_MARK`` with ``{0, 0}``.
    * - ``XFRMA_ENCAP``
      - UDP encapsulation template; only ``UDP_ENCAP_ESPINUDP`` is supported.
        Set ``encap_type=0`` to remove encap.
@@ -259,8 +264,12 @@ Attributes in the notification
 Error Handling
 ==============
 
-If the target SA tuple (new daddr, SPI, proto, new family) is already
-occupied, the operation returns ``-EEXIST`` before the migration begins.
+If the target SA tuple (new daddr, SPI, proto, new family, mark) is
+already occupied, the operation returns ``-EEXIST`` before the migration
+begins. "Occupied" includes wildcard shadowing: an existing SA with a
+broader mask (e.g. mark 0/0) claims every mark value, so it blocks
+migrating to any more specific mark at the same tuple, not just an
+exact mark/mask duplicate.
 The old SA remains intact and the operation is safe to retry after
 resolving the conflict.