Pull networking fixes from Jakub Kicinski:
 "Including fixes from Bluetooth, IPSec and Netfilter.

  Current release - fix to a fix:

   - netfilter: ipset: remove need to allocate memory on delete operations

  Current release - regressions:

   - macb: drop CONFIG_OF #if block, fix build

  Previous releases - always broken:

   - stream of fixes for SCTP continues

   - inet: frags: strip GSO state from fragments before reassembly

   - virtio-net: ensure that TCP packets don't overflow gso_segs

   - tcp-ao: fix use-after-free of current_key on reconnect to another
     peer

   - page_pool: remove zone/policy GFP flags when allocating XArray
     entries

   - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

   - tls: device: fix out-of-bounds write in tls_append_frag()

   - eth: bnxt:
      - ring the doorbell when SW USO exits early, avoid packets stuck
        in Tx
      - gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid
        users of older NICs seeing non-actionable warning messages

   - eth: qede: fix NULL pointer dereference in TPA fragment processing"

* tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits)
  inet: frags: strip GSO state from fragments before reassembly
  net/sched: sch_htb: limit htb_classify inner-class filter hops
  selftests/net: packetdrill: add tcp_urg_ptr_retransmit
  tcp: fix corruption of urgent data on multi-segment retransmit
  usb: atm: usbatm: fix invalid ci_range initialization
  net: fec: only stop PTP if it was initialized
  slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
  net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
  net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
  net: dsa: mxl862xx: enable assisted learning on CPU port
  net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
  net: stmmac: drop gso_enabled_types and rely on netdev features
  net: stmmac: selftests: Don't test flow control for small rx fifos
  net: stmmac: selftests: Account for the UC filter list for filtering tests
  net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
  net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
  net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
  net: stmmac: selftests: Check multiple MMC counters
  selftests: net: Fix slow configurations in big_tcp_tunnels.sh
  selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh
  ...

Drive a connection into urgent mode and force a multi-segment retransmit,
checking that each retransmitted segment keeps its own urg_ptr.

The test asserts the fixed behaviour: the hole is retransmitted as two
independent skbs, each with its own urg_ptr (5001 and 4001) and no PSH.
An unpatched kernel instead sends one super-skb whose GSO split copies
urg_ptr onto the second segment and also sets PSH there, so on an unpatched
kernel the mismatch shows up on the PSH bit (actual P.U ... urg 5001) before
the urg_ptr:

	tcp_urg_ptr_retransmit.pkt:63: live packet field tcp_psh:
		expected: 0 (0x0) vs actual: 1 (0x1)
	script packet:  .U 1001:2001(1000) ack 1
	actual packet:  P.U 1001:2001(1000) ack 1 win 1050

After the fix the retransmit carries a per-segment urg_ptr and the test
passes.

Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260826141145.67823-2-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Add packetdrill tests for IPv4 and IPv6 to verify that the advertised
MSS in SYN-ACK is derived from the configured interface/route MTU,
and is not shrunk by learned Path MTU exceptions from previous
outbound connections.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260815071532.301908-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Pull sysctl updates from Joel Granados:

 - Fix kernel-doc warnings by adjusting in file documentation

 - Consolidate do_proc_* function into do_proc_vec

   Consolidate three slightly different implementations of applying a
   converter on all elements of a vector. Fixes to this function now
   propagate to the three types.

 - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL (they were the same)
   and restrict cad_pid modifications to global root (GLOBAL_ROOT_UID)

* tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:
  sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL
  sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
  sysctl: repair some kernel-doc comments
  sysctl: add Returns: kernel-doc for all functions
  sysctl: Update API function documentation
  sysctl: Rename proc_doulongvec_minmax_conv to proc_doulongvec_conv
  sysctl: Group proc_handler declarations and document
  sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec
  sysctl: Add negp parameter to douintvec converter functions
  sysctl: Move default converter assignment out of do_proc_dointvec

CONFIG_SYSCTL used to make sense as a separate hidden bool before commit
61a47c1ad3a4 ("sysctl: Remove the sysctl system call"); it was selected
by both CONFIG_SYSCTL_SYSCALL and CONFIG_PROC_SYSCTL.

Today CONFIG_PROC_SYSCTL is the only selector, so the two are always
equal. Kill the hidden bool, rename the PROC_SYSCTL prompt to SYSCTL,
and s/CONFIG_PROC_SYSCTL/CONFIG_SYSCTL/ tree-wide.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Joel Granados <joel.granados@kernel.org>

Add packetdrill coverage for the RFC 9293 reset checks on request
sockets in SYN-RECEIVED.  Verify that an exact RST removes the request,
a non-exact in-window RST sends a challenge ACK without removing it,
and an out-of-window RST is silently discarded.

Also cover an RST|ACK with an unacceptable ACK number to ensure RST
sequence validation runs before ACK-field validation.

Signed-off-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260717081443.809393-3-yangyx22@mails.tsinghua.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

These tests check syncookie mode is able to reconstruct some
client options when TCP TS are used:

- wscale option.
- sackOK.
- MSS (in a limited way, especially for IPv4).
- ECN : not enabled.

Note that IPv4 and IPv6 have different msstab[] values:

IPv4 msstab[4] = { 536, 1300, 1440, 1460 }
IPv6 msstab[4] = { 1280 - 60, 1480 - 60, 1500 - 60, 9000 - 60 }

IPv4 is currently capping SND_MSS to 1460, even on a 9K MTU network.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Link: https://patch.msgid.link/20260430021444.2929534-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

RFC 5961 Section 5.2 / RFC 793 Section 3.9 require a challenge ACK
whenever an incoming SEG.ACK falls outside
[SND.UNA - MAX.SND.WND, SND.NXT].  There is currently no packetdrill
coverage for either edge.

Add tcp_rfc5961_ack-out-of-window.pkt, which in a single passive-open
connection exercises:

  - Upper edge (SEG.ACK > SND.NXT): peer ACKs data that was never
    sent before the server has transmitted anything.
  - Lower edge (SEG.ACK < SND.UNA - MAX.SND.WND): after the server
    has sent 2000 bytes (the peer-advertised rwnd forces two 1000-byte
    segments, both acknowledged), peer sends an ACK that is older
    than the acceptable window.

Both cases must elicit a challenge ACK
<SEQ = SND.NXT, ACK = RCV.NXT, CTL = ACK>.  The per-socket RFC 5961
Section 7 rate limit is disabled for the duration of the test so that
both challenge ACKs can fire back-to-back.

Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260422123605.320000-3-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

RFC 5961 Section 5.2 validates an incoming segment's ACK value
against the range [SND.UNA - MAX.SND.WND, SND.NXT] and states:

  "All incoming segments whose ACK value doesn't satisfy the above
   condition MUST be discarded and an ACK sent back."

Commit 354e4aa391ed ("tcp: RFC 5961 5.2 Blind Data Injection Attack
Mitigation") opted Linux into this mitigation and implements the
challenge ACK on the lower side (SEG.ACK < SND.UNA - MAX.SND.WND),
but the symmetric upper side (SEG.ACK > SND.NXT) still takes the
pre-RFC-5961 path and silently returns
SKB_DROP_REASON_TCP_ACK_UNSENT_DATA, even though RFC 793 Section 3.9
(now RFC 9293 Section 3.10.7.4) has always required:

  "If the ACK acknowledges something not yet sent (SEG.ACK > SND.NXT)
   then send an ACK, drop the segment, and return."

Complete the mitigation by sending a challenge ACK on that branch,
reusing the existing tcp_send_challenge_ack() path which already
enforces the per-socket RFC 5961 Section 7 rate limit via
__tcp_oow_rate_limited().  FLAG_NO_CHALLENGE_ACK is honoured for
symmetry with the lower-edge case.

Update the existing tcp_ts_recent_invalid_ack.pkt selftest, which
drives this exact path, to consume the new challenge ACK.

Fixes: 354e4aa391ed ("tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260422123605.320000-2-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

The test depends on accepting a packet that is larger than the
advertised window and that does not trigger an immediate ACK.

Previously, the test might still pass even if kernel behavior changed
unexpectedly. Add assertions verifying that the large packet was
accepted and no ACK was sent.

Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Simon Baatz <gmbnomis@gmail.com>
Link: https://patch.msgid.link/20260316-improve_tcp_neg_usable_wnd_test-v1-1-f16d5e365107@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>