Merge tag 'net-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from Bluetooth, IPsec, WiFi and CAN.

  Current release - regressions:

    - eth: wwan: mhi_wwan_ctrl: send a DTR drop before it can be coalesced

  Previous releases - regressions:

    - core:
       - use a dedicated flag to track disabled napi instances
       - frags: limit the truesize of a reassembly queue
       - reject a negative TCP header offset in qdisc_pkt_len_segs_init()y

    - tcp:
       - reject unhashed sockets during established lookups
       - free ireq->ipv6_opt after an RCU grace period

    - ipv6:
       - fix fib6 walker UAF on NLM_F_REPLACE
       - raw: fix use-after-free in rawv6_send_hdrinc()

    - wifi:
       - mac80211: reinstate IEEE80211_TX_CTL_AMPDU, fix ath9k stall
       - brcmfmac: map msgbuf RX packet IDs bidirectional, fix firmware
         crash loop

    - vsock: size receive SKBs from declared payload

    - xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()

    - bluetooth: hci_sync: copy the LE accept list under hdev->lock

    - ptp: fix use-after-free in extts_fifo_show() reading tsevqs unlocked

    - can: protect the receive lists with a per-device lock

    - eth:
       - bnxt: don't keep MSI-X vectors added before FW reserves them
       - vxlan: stop rejecting dynamic FDB entries with a nexthop ID

  Previous releases - always broken:

    - sched: sch_qfq: prevent aggregate self-replacement

    - bridge: disable MRP ports before the FDB flush in del_nbp()

    - mptcp: do not use fast open on MP_JOIN subflows

    - ipv6: serialize multicast router socket ownership

    - bluetooth: hci_core: keep link-key filtering inside RCU

    - eth:
       - atl1c: drop oversized RX frames instead of panicking
       - stmmac: a bunch of XDP path fixes
       - b53: enable IGMP and MLD control packet CPU copies"

* tag 'net-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (170 commits)
  tcp: ipv6: free ireq->ipv6_opt after an RCU grace period
  mptcp: pm: kernel: use RCU to free endpoint listeners
  tcp: initialize send sequence numbers before deferring TFO
  net: bridge: disable MRP ports before the FDB flush in del_nbp()
  net: stmmac: set XDP metadata length on the page_pool RX path
  bonding: fix missing down path on speed/duplex failure after FAIL->UP
  ip6mr: Serialize multicast router socket ownership
  bonding: 3ad: don't set BOND_LINK_FAIL on a slave that is not up
  net: ethernet: ti: am65-cpsw-nuss: Enable timestamping of unicast PTP packets
  net: count last skb of each sk_backlog pass in __release_sock()
  net: 8139cp: keep Rx masked while NAPI is scheduled
  net/smc: don't spin in smc_rx_recvmsg() while a pipe holds spliced data
  net: dsa: b53: restore the NSP IMP port 2 Gbps mode
  net: ethernet: bgmac: preserve forced 2.5 Gbps link speed
  l2tp: only return sessions of the given tunnel in l2tp_session_get()
  tipc: raise the minimum bearer MTU to fit tunnel and crypto overhead
  mptcp: do not use Fast Open on MP_JOIN subflows
  tcp: ipv6: do not read ireq->pktopts from tcp_v6_send_synack()
  ipv4: Call rt_add_uncached_list() if !do_cache in ip_route_input_slow().
  ipv6: Flush rt->from in rt6_uncached_list_flush_dev().
  ...