Merge tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netstable

Pull networking fixes from Jakub Kicinski:
 "Including fixes from Bluetooth, IPSec and Netfilter.

  Current release - fix to a fix:

   - netfilter: ipset: remove need to allocate memory on delete operations

  Current release - regressions:

   - macb: drop CONFIG_OF #if block, fix build

  Previous releases - always broken:

   - stream of fixes for SCTP continues

   - inet: frags: strip GSO state from fragments before reassembly

   - virtio-net: ensure that TCP packets don't overflow gso_segs

   - tcp-ao: fix use-after-free of current_key on reconnect to another
     peer

   - page_pool: remove zone/policy GFP flags when allocating XArray
     entries

   - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

   - tls: device: fix out-of-bounds write in tls_append_frag()

   - eth: bnxt:
      - ring the doorbell when SW USO exits early, avoid packets stuck
        in Tx
      - gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid
        users of older NICs seeing non-actionable warning messages

   - eth: qede: fix NULL pointer dereference in TPA fragment processing"

* tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits)
  inet: frags: strip GSO state from fragments before reassembly
  net/sched: sch_htb: limit htb_classify inner-class filter hops
  selftests/net: packetdrill: add tcp_urg_ptr_retransmit
  tcp: fix corruption of urgent data on multi-segment retransmit
  usb: atm: usbatm: fix invalid ci_range initialization
  net: fec: only stop PTP if it was initialized
  slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
  net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
  net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
  net: dsa: mxl862xx: enable assisted learning on CPU port
  net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
  net: stmmac: drop gso_enabled_types and rely on netdev features
  net: stmmac: selftests: Don't test flow control for small rx fifos
  net: stmmac: selftests: Account for the UC filter list for filtering tests
  net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
  net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
  net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
  net: stmmac: selftests: Check multiple MMC counters
  selftests: net: Fix slow configurations in big_tcp_tunnels.sh
  selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh
  ...

1 files changed, 17 insertions, 2 deletions

diff --git a/net/mctp/route.c b/net/mctp/route.c
index 1f3dccbb7aed..b19c63a5691a 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -998,14 +998,29 @@ int mctp_route_lookup(struct net *net, unsigned int dnet,
 			mtu = mtu ?: rt->mtu;
 
 		if (rt->dst_type == MCTP_ROUTE_DIRECT) {
-			mctp_eid_t saddr = mctp_dev_saddr(rt->dev);
+			mctp_eid_t saddr;
+
+			/* rt->dev may be going away concurrently: its last
+			 * reference is dropped in mctp_dev_put(), which frees
+			 * mdev->addrs that mctp_dev_saddr() reads, and
+			 * mctp_dst_from_route() takes a reference on it.  Pin
+			 * it before use, and skip a device that is already
+			 * dead rather than resurrecting it.
+			 */
+			if (!refcount_inc_not_zero(&rt->dev->refs))
+				break;
+
+			saddr = mctp_dev_saddr(rt->dev);
 
 			/* cannot do gateway-ed routes without a src  */
-			if (saddr == MCTP_ADDR_NULL && depth != 0)
+			if (saddr == MCTP_ADDR_NULL && depth != 0) {
+				mctp_dev_put(rt->dev);
 				break;
+			}
 
 			if (dst)
 				mctp_dst_from_route(dst, daddr, saddr, mtu, rt);
+			mctp_dev_put(rt->dev);
 			rc = 0;
 			break;