Pull networking fixes from Jakub Kicinski:
 "Including fixes from Bluetooth, IPSec and Netfilter.

  Current release - fix to a fix:

   - netfilter: ipset: remove need to allocate memory on delete operations

  Current release - regressions:

   - macb: drop CONFIG_OF #if block, fix build

  Previous releases - always broken:

   - stream of fixes for SCTP continues

   - inet: frags: strip GSO state from fragments before reassembly

   - virtio-net: ensure that TCP packets don't overflow gso_segs

   - tcp-ao: fix use-after-free of current_key on reconnect to another
     peer

   - page_pool: remove zone/policy GFP flags when allocating XArray
     entries

   - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

   - tls: device: fix out-of-bounds write in tls_append_frag()

   - eth: bnxt:
      - ring the doorbell when SW USO exits early, avoid packets stuck
        in Tx
      - gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid
        users of older NICs seeing non-actionable warning messages

   - eth: qede: fix NULL pointer dereference in TPA fragment processing"

* tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits)
  inet: frags: strip GSO state from fragments before reassembly
  net/sched: sch_htb: limit htb_classify inner-class filter hops
  selftests/net: packetdrill: add tcp_urg_ptr_retransmit
  tcp: fix corruption of urgent data on multi-segment retransmit
  usb: atm: usbatm: fix invalid ci_range initialization
  net: fec: only stop PTP if it was initialized
  slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
  net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
  net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
  net: dsa: mxl862xx: enable assisted learning on CPU port
  net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
  net: stmmac: drop gso_enabled_types and rely on netdev features
  net: stmmac: selftests: Don't test flow control for small rx fifos
  net: stmmac: selftests: Account for the UC filter list for filtering tests
  net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
  net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
  net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
  net: stmmac: selftests: Check multiple MMC counters
  selftests: net: Fix slow configurations in big_tcp_tunnels.sh
  selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh
  ...

Pull devicetree fixes from Rob Herring:

 - Fix possible out-of-bounds access in of_alias_scan()

 - Fix refcount leak in of_irq_get_affinity()

 - Add Qualcomm SPMI PMIC haptics input which is already referenced

* tag 'devicetree-fixes-for-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
  of: fix out-of-bounds read in of_alias_scan() stem parser
  of/irq: Fix device node refcount leak in of_irq_get_affinity()
  dt-bindings: input: Add Qualcomm SPMI PMIC haptics

syzbot reported a shift-out-of-bounds in __vcc_connect():

  UBSAN: shift-out-of-bounds in net/atm/common.c:382:32
  shift exponent -1 is negative
  CPU: 0 UID: 0 PID: 5987 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
  Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
  Call Trace:
   <TASK>
   dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
   ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
   __ubsan_handle_shift_out_of_bounds+0x36d/0x400 lib/ubsan.c:494
   __vcc_connect+0x14b4/0x19c0 net/atm/common.c:382
   vcc_connect+0x328/0x8f0 net/atm/common.c:498
   pvc_bind+0x272/0x380 net/atm/pvc.c:52
   __sys_bind+0x2e3/0x410 net/socket.c:1976
   __x64_sys_bind+0x7a/0x90 net/socket.c:1979
   ...

ATM device ci_range fields (vpi_bits and vci_bits) represent the
number of bits supported for VPI and VCI addressing on the device.
net/atm/common.c directly uses these fields as bit shift counts:
  vpi >> dev->ci_range.vpi_bits
  vci >> dev->ci_range.vci_bits
  1 << vcc->dev->ci_range.vpi_bits
  1 << vcc->dev->ci_range.vci_bits

usbatm_atm_init() sets ci_range.vpi_bits and ci_range.vci_bits to
ATM_CI_MAX (-1), which is defined in <uapi/linux/atmdev.h> as a
sentinel value for userspace ATM_SETCIRANGE requests, not a valid bit
count. Shifting by -1 is undefined behavior and triggers UBSAN
warnings.

ATM UNI cell headers allow up to 8 bits for VPI (0..255) and 16 bits
for VCI (0..65535). Initialize vpi_bits to 8 and vci_bits to 16, as
done by solos-pci.

Fixes: c59bba75fa50 ("[PATCH] USB ATM: new usbatm core")
Reported-by: syzbot+6665d3db5fef15914802@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6665d3db5fef15914802
Suggested-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/all/20260824024620.23485-1-kartikey406@gmail.com/T/ [v1]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Link: https://patch.msgid.link/20260826133258.8306-1-kartikey406@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

fec_ptp_init() is only called when fep->bufdesc_ex is available.
However, fec_probe() unconditionally calls fec_ptp_stop() on the
failed_init path, and fec_drv_remove() unconditionally calls
fec_ptp_stop() during device removal.

Check fep->bufdesc_ex before calling fec_ptp_stop() in both paths
to avoid stopping PTP when it was not initialized.

Fixes: 32cba57ba74b ("net: fec: introduce fec_ptp_stop and use in probe fail path")
Reviewed-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260826103428.32807-1-phucduc.bui@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read
in slip_receive_buf() when racing against tty hangup.

tty_ldisc_hangup() calls ld->ops->hangup() while holding only
a read lock on tty->ldisc_sem (via tty_ldisc_ref()).
Because slip_hangup() simply called slip_close(), it ran concurrently
with reader functions such as slip_receive_buf().

slip_close() unregisters and frees the net device and its private
struct slip, causing concurrent reader threads in slip_receive_buf()
to dereference freed memory.

Line discipline close() is already guaranteed to be called under
the write lock of tty->ldisc_sem during hangup processing
(in tty_ldisc_reinit() or tty_ldisc_kill()).

Remove slip_hangup() so teardown is serialized cleanly by slip_close().

Fixes: 5342b77c4123 ("slip: Clean up create and destroy")
Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
Closes: https://lore.kernel.org/netdev/20260825150655.1450271-1-jjy600901@snu.ac.kr/
Cc: Qingfang Deng <qingfang.deng@linux.dev>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260826105238.3323436-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Pull spi fixes from Mark Brown:
 "A couple of fixes that came in during the merge window: Geert fixed an
  uninitialised data bug in the amlogic-spisg driver which could crash
  and in the Loongson driver Li Jun hooked up the existing suspend
  operations more fully to fix hibernation"

* tag 'spi-fix-v7.3-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: loongson: pm: add .freeze .poweroff .thaw .restore
  spi: amlogic-spisg: Make sure clk_init_data is fully initialized

Pull regulator fix from Mark Brown:
 "One fix here, for a race condition on startup in the tps65185 driver
  which is seen on actual boards - we need a delay after waking the chip
  before it is ready to talk to the host"

* tag 'regulator-fix-v7.3-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: tps65185: wait for the IC to wake before the first I2C access

The MxL862xx driver enables FDB isolation but does not enable assisted
learning on the CPU port. Consequently, MAC addresses learned through a
physical switch port are not updated in hardware when the corresponding
station moves to a foreign bridge port, such as a Wi-Fi interface.

The stale hardware FDB entry continues directing return traffic toward
the original physical port. Traffic entering that same port is then
filtered instead of being forwarded to the CPU and software bridge. This
causes downstream unicast traffic, including DHCP OFFER and ACK packets,
to disappear after a client roams to a local wireless interface. The
client eventually considers the connection unusable and disconnects.

Enable assisted CPU-port learning so DSA installs foreign bridge FDB
entries on the CPU port. This keeps the hardware FDB synchronized with
the software bridge and allows return traffic to reach locally attached
Wi-Fi clients after roaming.

Tested on a BPI R4 PRO with a MxL862xx switch and a BE14000 WiFi interface.
- Without patch, wired uplink on lan6 port (mxl path)
  Wifi clients connect but roam away not getting DHCP offers
- Without patch, wired uplink on wan port (no mxl path)
  Wifi clients connect and roam successfully
- With this patch, uplink on lan6 (mxl path)
  Wifi clients connect and roam successfully

Fixes: 340bdf984613 ("net: dsa: mxl862xx: implement bridge offloading")
Signed-off-by: Edoardo Pinci <epinci@outlook.com>
Link: https://patch.msgid.link/DU0P251MB069949C6DEB4D1D51F31FE87C4A02@DU0P251MB0699.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Since the RX path was converted to zero-copy, the page pool page is handed
to the stack directly as the skb head, and the offset the DMA engine writes
at is what determines the alignment of the packet headers.

Before the conversion the payload was copied into an skb obtained from
napi_alloc_skb(), which reserves NET_SKB_PAD + NET_IP_ALIGN. The
conversion moved the headroom into stmmac_rx_offset() but did not carry
over NET_IP_ALIGN, so on architectures where NET_IP_ALIGN is 2 the IP
header now lands misaligned:

  64 (NET_SKB_PAD) + 14 (ethernet) + 20 (IP) = 98

Same for the XDP branch:

  256 (XDP_PACKET_HEADROOM) + 14 (ethernet) + 20 (IP) = 290

On ARM32 this is fatal, because ldm and ldrd trap on unaligned addresses
even when CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is set.

Any received echo request panics the machine, e.g:

  Unhandled fault: alignment exception (0x001) at 0x81873062
  Internal error: : 1 [#1] SMP ARM
  Hardware name: Altera SOCFPGA Arria10
  PC is at icmp_echo+0x38/0xa8
  LR is at icmp_rcv+0x22c/0x370
  Call trace:
   icmp_echo from icmp_rcv+0x22c/0x370
   icmp_rcv from ip_protocol_deliver_rcu+0x2c/0x224
   ip_protocol_deliver_rcu from ip_local_deliver+0xc8/0x1a0
   ip_local_deliver from ip_sublist_rcv_finish+0x3c/0x50
   ip_sublist_rcv_finish from ip_list_rcv_finish+0x110/0x118
   ip_list_rcv_finish from ip_list_rcv+0xc8/0xdc
   ip_list_rcv from __netif_receive_skb_list_core+0x170/0x1c0
   ...
   napi_complete_done from stmmac_napi_poll_rx+0xcb0/0x1030
  Code: e24dd068 e59020a0 e28dc010 e0822001 (e8920003)
  Kernel panic - not syncing: Fatal exception in interrupt

The faulting instruction is the ldm of *icmp_hdr(skb) in icmp_echo().

Fix by adding NET_IP_ALIGN back to the RX offset, which restores the
alignment the stack used to get.

Note that commit a955318fe67e ("stmmac: align RX buffers") made a similar
change in 2021 and was reverted by commit 12d125b4574b ("stmmac: Revert
"stmmac: align RX buffers"") because it caused packet corruption. That
patch raised the offset from 0 without adjusting the buffer size
accounting, so the DMA engine could arguably write past the end of the RX
buffers, though this was never root caused.
Commit df542f669307 ("net: stmmac: Switch to zero-copy in non-XDP RX
path") since derives the page pool allocation from stmmac_rx_offset(), so
the extra bytes are accounted for.

Fixes: df542f669307 ("net: stmmac: Switch to zero-copy in non-XDP RX path")
Cc: Daniel Baldin <DBaldin@dspace.de>
Signed-off-by: Pascal Kneuper <PKneuper@dspace.de>
Link: https://patch.msgid.link/20260824125014.47862-1-PKneuper@dspace.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Pull backlight updates from Lee Jones:
 "New Support & Features:
   - Silergy SY7758: Add driver for the 6-channel high-efficiency LED
     driver

  Improvements & Fixes
   - Awinic AW99706: Fix device tree property names to match the
     binding, consistently validate all property values, and honor the
     core blank state in `update_status()`
   - Kinetic KTD2801: Add missing dependency on `GPIOLIB` in Kconfig
   - Qualcomm WLED: Remove redundant `dev_err()` calls

  Cleanups & Refactoring
   - Core: Use `sysfs_emit()` instead of `sprintf()` in sysfs show
     callbacks
   - Maintainers: Update Junjie Cao's email address for the Awinic
     AW99706 driver

  Device Tree Binding Updates
   - Marvell 88PM860X: Add missing bracket in the example
   - Silergy SY7758: Document the 6-channel high-efficiency LED driver"

* tag 'backlight-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
  backlight: Use sysfs_emit() instead of sprintf()
  backlight: qcom-wled: Remove redundant dev_err()
  backlight: ktd2801: Fix unmet dependency on GPIOLIB
  backlight: aw99706: Honor the core blank state in update_status()
  backlight: aw99706: Validate all DT property values consistently
  backlight: aw99706: Fix DT property names to match binding
  dt-bindings: backlight: 88pm860x: Add missing bracket
  MAINTAINERS: Update my email address for the AW99706 backlight driver
  backlight: Add SY7758 6-channel High Efficiency LED Driver support
  dt-bindings: leds: backlight: Document the SY7758 6-channel High Efficiency LED Driver