Networking for v6.17-rc3

Hi Linus!

The following changes since commit 63467137ecc0ff6f804d53903ad87a2f0397a18b:

Merge tag 'net-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2025-08-14 07:14:30 -0700)

are available in the Git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git tags/net-6.17-rc3

for you to fetch changes up to 91a79b792204313153e1bdbbe5acbfc28903b3a5:

netfilter: nf_reject: don't leak dst refcount for loopback packets (2025-08-21 10:02:00 -0700)

----------------------------------------------------------------
Including fixes from Bluetooth.

Current release - fix to a fix:

- usb: asix_devices: fix PHY address mask in MDIO bus initialization

Current release - regressions:

- Bluetooth: fixes for the split between BIS_LINK and PA_LINK

- Revert "net: cadence: macb: sama7g5_emac: Remove USARIO CLKEN flag", breaks compatibility with some existing device tree blobs

- dsa: b53: fix reserved register access in b53_fdb_dump()

Current release - new code bugs:

- sched: dualpi2: run probability update timer in BH to avoid deadlock

- eth: libwx: fix the size in RSS hash key population

- pse-pd: pd692x0: improve power budget error paths and handling

Previous releases - regressions:

- tls: fix handling of zero-length records on the rx_list

- hsr: reject HSR frame if skb can't hold tag

- bonding: fix negotiation flapping in 802.3ad passive mode

Previous releases - always broken:

- gso: forbid IPv6 TSO with extensions on devices with only IPV6_CSUM

- sched: make cake_enqueue return NET_XMIT_CN when past buffer_limit, avoid packet drops with low buffer_limit, remove unnecessary WARN()

- sched: fix backlog accounting after modifying config of a qdisc in the middle of the hierarchy

- mptcp: improve handling of skb extension allocation failures

- eth: mlx5:
- fixes for the "HW Steering" flow management method
- fixes for QoS and device buffer management

----------------------------------------------------------------
Alex Vesker (1):
net/mlx5: HWS, Fix table creation UID

Alexandra Winter (1):
MAINTAINERS: update s390/net

Alexei Lazar (1):
net/mlx5e: Query FW for buffer ownership

Armen Ratner (1):
net/mlx5e: Preserve shared buffer capacity during headroom updates

Carolina Jubran (5):
net/mlx5: Remove default QoS group and attach vports directly to root TSAR net/mlx5e: Preserve tc-bw during parent changes
net/mlx5: Destroy vport QoS element when no configuration remains net/mlx5: Fix QoS reference leak in vport enable error path net/mlx5: Restore missing scheduling node cleanup on vport enable failure

Chandra Mohan Sundar (1):
net: libwx: Fix the size in RSS hash key population

Christoph Paasch (1):
mptcp: drop skb if MPTCP skb extension allocation fails

D. Wythe (1):
net/smc: fix UAF on smcsk after smc_listen_out()

Daniel Jurgens (1):
net/mlx5: Base ECVF devlink port attrs from 0

Eric Biggers (1):
ipv6: sr: Fix MAC comparison to be constant-time

Florian Westphal (1):
netfilter: nf_reject: don't leak dst refcount for loopback packets

Geliang Tang (3):
mptcp: remove duplicate sk_reset_timer call
mptcp: disable add_addr retransmission when timeout is 0
selftests: mptcp: disable add_addr retrans in endpoint_tests

Hangbin Liu (3):
bonding: update LACP activity flag after setting lacp_active
bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU
selftests: bonding: add test for passive LACP mode

Hariprasad Kelam (1):
Octeontx2-af: Skip overlap check for SPI field

Horatiu Vultur (1):
phy: mscc: Fix timestamping for vsc8584

Ido Schimmel (2):
mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
selftest: forwarding: router: Add a test case for IPv4 link-local source IP

Jakub Acs (1):
net, hsr: reject HSR frame if skb can't hold tag

Jakub Kicinski (10):
Merge branch 'mlxsw-spectrum-forward-packets-with-an-ipv4-link-local-source-ip' Merge tag 'for-net-2025-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
selftests: tls: make the new data_steal test less flaky
Merge branch 'mptcp-misc-fixes-for-v6-17-rc'
Merge branch 'mlx5-hws-fixes-2025-08-17'
Merge branch 'fixes-on-the-microchip-s-lan865x-driver'
Merge branch 'intel-wired-lan-driver-updates-2025-08-15-ice-ixgbe-igc'
tls: fix handling of zero-length records on the rx_list
selftests: tls: add tests for zero-length records
Merge branch 'mlx5-misx-fixes-2025-08-20'

Jakub Ramaseuski (1):
net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM

Jason Xing (1):
ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc

Jiande Lu (1):
Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown

Jonas Gorski (1):
net: dsa: b53: fix reserved register access in b53_fdb_dump()

Jordan Rhee (1):
gve: prevent ethtool ops after shutdown

Justin Lai (1):
rtase: Fix Rx descriptor CRC error bit definition

Kory Maincent (2):
net: pse-pd: pd692x0: Fix power budget leak in manager setup error path
net: pse-pd: pd692x0: Skip power budget configuration when undefined

Lorenzo Bianconi (1):
net: airoha: ppe: Do not invalid PPE entries in case of SW hash collision

Lubomir Rintel (1):
cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN

Luiz Augusto von Dentz (7):
Bluetooth: hci_sync: Fix scan state after PA Sync has been established
Bluetooth: ISO: Fix getname not returning broadcast fields
Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK
Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source
Bluetooth: hci_core: Fix using {cis,bis}_capable for current settings
Bluetooth: hci_core: Fix using ll_privacy_capable for current settings
Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately

MD Danish Anwar (1):
net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload.

Maciej Fijalkowski (1):
ixgbe: fix ndo_xdp_xmit() workloads

Matthieu Baerts (NGI0) (4):
mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
selftests: mptcp: pm: check flush doesn't reset limits
selftests: mptcp: connect: fix C23 extension warning
selftests: mptcp: sockopt: fix C23 extension warning

Michael Chan (1):
bnxt_en: Fix lockdep warning during rmmod

Minhong He (1):
ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add

Neeraj Sanjay Kale (1):
Bluetooth: btnxpuart: Uses threaded IRQ for host wakeup handling

Paolo Abeni (1):
Merge branch 'bonding-fix-negotiation-flapping-in-802-3ad-passive-mode'

Parthiban Veerasooran (2):
microchip: lan865x: fix missing netif_start_queue() call on device open
microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1

Pauli Virtanen (1):

      Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established

Qingfang Deng (2):
net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
ppp: fix race conditions in ppp_fill_forward_path

Ryan Wanner (1):
Revert "net: cadence: macb: sama7g5_emac: Remove USARIO CLKEN flag"

Sergey Shtylyov (1):
Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()

Suraj Gupta (1):
net: xilinx: axienet: Fix RX skb ring management in DMAengine mode

Tristram Ha (1):
net: dsa: microchip: Fix KSZ9477 HSR port setup issue

ValdikSS (1):
igc: fix disabling L1.2 PCI-E link substate on I226 on init

Victor Nogueira (1):
net/sched: sch_dualpi2: Run prob update timer in softirq to avoid deadlock

Vlad Dogaru (1):
net/mlx5: CT: Use the correct counter offset

Wang Liang (1):
net: bridge: fix soft lockup in br_multicast_query_expired()

William Liu (4):
net/sched: Fix backlog accounting in qdisc_dequeue_internal selftests/tc-testing: Check backlog stats in gso_skb case
net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate

Yang Li (2):
Bluetooth: hci_sync: Avoid adding default advertising on startup
Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF

Yao Zi (1):
net: stmmac: thead: Enable TX clock before MAC initialization

Yevgeny Kliteynik (5):
net/mlx5: HWS, fix bad parameter in CQ creation net/mlx5: HWS, fix simple rules rehash error flow net/mlx5: HWS, fix complex rules rehash error flow net/mlx5: HWS, prevent rehash from filling up the queues net/mlx5: HWS, don't rehash on every kind of insertion failure

Yuichiro Tsuji (1):
net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization

 Documentation/networking/mptcp-sysctl.rst          |   2 +
 MAINTAINERS                                        |   2 +-
 drivers/bluetooth/btmtk.c                          |   7 +-
 drivers/bluetooth/btnxpuart.c                      |   8 +-
 drivers/net/bonding/bond_3ad.c                     |  67 +++--
 drivers/net/bonding/bond_options.c                 |   1 +
 drivers/net/dsa/b53/b53_common.c                   |   2 +-
 drivers/net/dsa/microchip/ksz_common.c             |   6 +
 drivers/net/ethernet/airoha/airoha_ppe.c           |   4 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   2 +-
 drivers/net/ethernet/cadence/macb_main.c           |   3 +-
 drivers/net/ethernet/google/gve/gve_main.c         |   2 +
 drivers/net/ethernet/intel/igc/igc_main.c          |  14 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c      |  34 +--
 drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c       |   4 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c |   4 +-
 drivers/net/ethernet/mediatek/mtk_ppe_offload.c    |   2 +
 drivers/net/ethernet/mellanox/mlx5/core/en/dcbnl.h |   1 -
 .../ethernet/mellanox/mlx5/core/en/port_buffer.c   |  18 +-
 .../ethernet/mellanox/mlx5/core/en/tc/ct_fs_hmfs.c |   2 +
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c |  12 +-
 .../ethernet/mellanox/mlx5/core/esw/devlink_port.c |   4 +-
 drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c  | 183 ++++++------
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.h  |   5 -
 .../net/ethernet/mellanox/mlx5/core/mlx5_core.h    |   2 +
 drivers/net/ethernet/mellanox/mlx5/core/port.c     |  20 ++
 .../ethernet/mellanox/mlx5/core/steering/hws/bwc.c |  81 ++++--
 .../mellanox/mlx5/core/steering/hws/bwc_complex.c  |  41 ++-
 .../ethernet/mellanox/mlx5/core/steering/hws/cmd.c |   1 +
 .../ethernet/mellanox/mlx5/core/steering/hws/cmd.h |   1 +
 .../mellanox/mlx5/core/steering/hws/fs_hws.c       |   1 +
 .../mellanox/mlx5/core/steering/hws/matcher.c      |   5 +-
 .../mellanox/mlx5/core/steering/hws/mlx5hws.h      |   1 +
 .../mellanox/mlx5/core/steering/hws/send.c         |   1 -
 .../mellanox/mlx5/core/steering/hws/table.c        |  13 +-
 .../mellanox/mlx5/core/steering/hws/table.h        |   3 +-
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c     |   2 +
 drivers/net/ethernet/mellanox/mlxsw/trap.h         |   1 +
 drivers/net/ethernet/microchip/lan865x/lan865x.c   |  21 ++
 drivers/net/ethernet/realtek/rtase/rtase.h         |   2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac-thead.c  |   9 +-
 drivers/net/ethernet/ti/icssg/icssg_prueth.c       |  72 +++--
 drivers/net/ethernet/wangxun/libwx/wx_vf_lib.c     |   2 +-
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c  |   8 +-
 drivers/net/phy/mscc/mscc.h                        |  12 +
 drivers/net/phy/mscc/mscc_main.c                   |  12 +
 drivers/net/phy/mscc/mscc_ptp.c                    |  49 +++-
 drivers/net/ppp/ppp_generic.c                      |  17 +-
 drivers/net/pse-pd/pd692x0.c                       |  63 ++++-
 drivers/net/usb/asix_devices.c                     |   2 +-
 drivers/net/usb/cdc_ncm.c                          |   7 +
 include/net/bluetooth/bluetooth.h                  |   4 +-
 include/net/bluetooth/hci_core.h                   |  44 ++-
 include/net/bond_3ad.h                             |   1 +
 include/net/sch_generic.h                          |  11 +-
 net/bluetooth/hci_conn.c                           |  17 +-
 net/bluetooth/hci_event.c                          |  15 +-
 net/bluetooth/hci_sync.c                           |  25 +-
 net/bluetooth/iso.c                                |  16 +-
 net/bluetooth/mgmt.c                               |  12 +-
 net/bridge/br_multicast.c                          |  16 ++
 net/bridge/br_private.h                            |   2 +
 net/core/dev.c                                     |  12 +
 net/hsr/hsr_slave.c                                |   8 +-
 net/ipv4/netfilter/nf_reject_ipv4.c                |   6 +-
 net/ipv6/netfilter/nf_reject_ipv6.c                |   5 +-
 net/ipv6/seg6_hmac.c                               |   6 +-
 net/mptcp/options.c                                |   6 +-
 net/mptcp/pm.c                                     |  18 +-
 net/mptcp/pm_kernel.c                              |   1 -
 net/sched/sch_cake.c                               |  14 +-
 net/sched/sch_codel.c                              |  12 +-
 net/sched/sch_dualpi2.c                            |   5 +-
 net/sched/sch_fq.c                                 |  12 +-
 net/sched/sch_fq_codel.c                           |  12 +-
 net/sched/sch_fq_pie.c                             |  12 +-
 net/sched/sch_hhf.c                                |  12 +-
 net/sched/sch_htb.c                                |   2 +-
 net/sched/sch_pie.c                                |  12 +-
 net/smc/af_smc.c                                   |   3 +-
 net/tls/tls_sw.c                                   |   7 +-
 .../testing/selftests/drivers/net/bonding/Makefile |   3 +-
 .../drivers/net/bonding/bond_passive_lacp.sh       | 105 +++++++
 tools/testing/selftests/drivers/net/bonding/config |   1 +
 tools/testing/selftests/net/forwarding/router.sh   |  29 ++
 tools/testing/selftests/net/mptcp/mptcp_connect.c  |   5 +-
 tools/testing/selftests/net/mptcp/mptcp_inq.c      |   5 +-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    |   1 +
 tools/testing/selftests/net/mptcp/mptcp_sockopt.c  |   5 +-
 tools/testing/selftests/net/mptcp/pm_netlink.sh    |   1 +
 tools/testing/selftests/net/tls.c                  | 312 ++++++++++++++++++++-
 .../tc-testing/tc-tests/infra/qdiscs.json          | 198 +++++++++++++
 92 files changed, 1434 insertions(+), 397 deletions(-)
 create mode 100755 tools/testing/selftests/drivers/net/bonding/bond_passive_lacp.sh

FWIW I'm hitting the splat below from random code paths (futex, epoll, bpf) when running your tree within Meta. Takes some time to hit, IDK what exactly triggers it. Could be a driver tho I can hit it on two different generations of servers.

[ 2121.610162] BUG: sleeping function called from invalid context at mm/vmalloc.c:3409
[ 2121.625698] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3382, name: x
[ 2121.642639] preempt_count: 1, expected: 0
[ 2121.651190] RCU nest depth: 0, expected: 0
[ 2121.660177] INFO: lockdep is turned off.
[ 2121.668619] Preemption disabled at:
[ 2121.668625] [<ffffffff84565d0f>] schedule+0x15f/0x360
[ 2121.686927] CPU: 9 UID: 34126 PID: 3382 Comm: x Kdump: loaded Tainted: G S               N  6.17.0-rc2-00079-g1c656b1efde6 #136 PREEMPT(none) 
[ 2121.686938] Tainted: [S]=CPU_OUT_OF_SPEC, [N]=TEST
[ 2121.686944] Call Trace:
[ 2121.686947]  <TASK>
[ 2121.686950]  dump_stack_lvl+0xe3/0x160
[ 2121.686962]  ? show_regs_print_info+0x10/0x10
[ 2121.686969]  ? thaw_kernel_threads+0x1c0/0x1c0
[ 2121.686985]  ? schedule+0x15f/0x360
[ 2121.686992]  __might_resched+0x474/0x5f0
[ 2121.687001]  ? schedule+0x15f/0x360
[ 2121.687006]  ? __might_sleep+0xe0/0xe0
[ 2121.687012]  ? rcu_force_quiescent_state+0x250/0x250
[ 2121.687020]  ? _raw_spin_unlock_irqrestore+0xa5/0x100
[ 2121.687026]  ? _raw_spin_unlock+0x40/0x40
[ 2121.687041]  vfree+0x41/0x2f0
[ 2121.687052]  __mmdrop+0x25f/0x490
[ 2121.687062]  finish_task_switch+0x31c/0x7a0
[ 2121.687076]  __schedule+0x158a/0x26b0
[ 2121.687098]  ? is_mmconf_reserved+0x390/0x390
[ 2121.687109]  ? schedule+0x92/0x360
[ 2121.687112]  ? rcu_is_watching+0x1b/0x90
[ 2121.687122]  ? rcu_is_watching+0x1b/0x90
[ 2121.687131]  ? _raw_spin_unlock+0x40/0x40
[ 2121.687141]  schedule+0x166/0x360
[ 2121.687148]  schedule_hrtimeout_range_clock+0x110/0x290
[ 2121.687154]  ? ktime_get+0x2b/0x120
[ 2121.687162]  ? schedule_timeout_idle+0xb0/0xb0
[ 2121.687170]  ? hrtimer_dummy_timeout+0x10/0x10
[ 2121.687184]  ? ktime_get+0x64/0x120
[ 2121.687190]  ? do_epoll_wait+0x75e/0xcc0
[ 2121.687197]  do_epoll_wait+0xabe/0xcc0
[ 2121.687205]  ? do_epoll_wait+0x75e/0xcc0
[ 2121.687227]  ? ep_destroy_wakeup_source+0xd0/0xd0
[ 2121.687234]  ? do_epoll_wait+0xcc0/0xcc0
[ 2121.687246]  ? nsecs_to_jiffies+0x20/0x20
[ 2121.687251]  ? kmem_cache_free+0x18c/0x410
[ 2121.687259]  ? entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 2121.687268]  __x64_sys_epoll_wait+0x179/0x1c0
[ 2121.687276]  ? ep_try_send_events+0xb50/0xb50
[ 2121.687284]  ? rcu_is_watching+0x1b/0x90
[ 2121.687294]  ? entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 2121.687300]  ? entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 2121.687305]  do_syscall_64+0x86/0x2d0
[ 2121.687309]  ? trace_irq_enable+0x60/0x180
[ 2121.687319]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 2121.687324] RIP: 0033:0x7f46cc32c482
[ 2121.687343] Code: 89 55 f8 48 89 75 f0 89 7d fc 89 4d ec e8 c6 a7 f6 ff 41 89 c0 44 8b 55 ec 8b 55 f8 48 8b 75 f0 8b 7d fc b8 e8 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 44 89 c7 89 45 fc e8 fb a7 f6 ff 8b 45 fc
[ 2121.687347] RSP: 002b:00007f46507cc2a0 EFLAGS: 00000293 ORIG_RAX: 00000000000000e8
[ 2121.687355] RAX: ffffffffffffffda RBX: 00007f467a5bb800 RCX: 00007f46cc32c482
[ 2121.687359] RDX: 0000000000000020 RSI: 00007f467a5bb800 RDI: 000000000000017f
[ 2121.687363] RBP: 00007f46507cc2c0 R08: 0000000000000000 R09: 7fffffffffffffff
[ 2121.687366] R10: 0000000000001b47 R11: 0000000000000293 R12: 0000000000000000
[ 2121.687369] R13: 00007f4668c30000 R14: 00007f4668c30000 R15: 00000000021d3a00

Looks like it's this FWIW, so it's known
https://lore.kernel.org/all/[email protected]/