From: Jakub Kicinski <kuba@kernel.org>
Date: Thu, 2 Apr 2026 17:57:09 +0000 (-0700)
Subject: Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b6e39e48469e37057fce27a1b87cf6d3e456aa42;p=thirdparty%2Fkernel%2Flinux.git

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Cross-merge networking fixes after downstream PR (net-7.0-rc8).

Conflicts:

net/ipv6/seg6_iptunnel.c
  c3812651b522f ("seg6: separate dst_cache for input and output paths in seg6 lwtunnel")
  78723a62b969a ("seg6: add per-route tunnel source address")
https://lore.kernel.org/adZhwtOYfo-0ImSa@sirena.org.uk

net/ipv4/icmp.c
  fde29fd934932 ("ipv4: icmp: fix null-ptr-deref in icmp_build_probe()")
  d98adfbdd5c01 ("ipv4: drop ipv6_stub usage and use direct function calls")
https://lore.kernel.org/adO3dccqnr6j-BL9@sirena.org.uk

Adjacent changes:

drivers/net/ethernet/stmicro/stmmac/chain_mode.c
  51f4e090b9f8 ("net: stmmac: fix integer underflow in chain mode")
  6b4286e05508 ("net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()")

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

b6e39e48469e37057fce27a1b87cf6d3e456aa42
diff --cc net/ipv6/seg6_iptunnel.c
index e76cc0cc481ec,d6a0f7df90807..97b50d9b13658
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@@ -48,8 -48,8 +48,9 @@@ static size_t seg6_lwt_headroom(struct 
  }
  
  struct seg6_lwt {
- 	struct dst_cache cache;
+ 	struct dst_cache cache_input;
+ 	struct dst_cache cache_output;
 +	struct in6_addr tunsrc;
  	struct seg6_iptunnel_encap tuninfo[];
  };
  
@@@ -726,18 -712,6 +731,18 @@@ static int seg6_build_state(struct net 
  
  	memcpy(&slwt->tuninfo, tuninfo, tuninfo_len);
  
 +	if (tb[SEG6_IPTUNNEL_SRC]) {
 +		slwt->tunsrc = nla_get_in6_addr(tb[SEG6_IPTUNNEL_SRC]);
 +
 +		if (ipv6_addr_any(&slwt->tunsrc) ||
 +		    ipv6_addr_is_multicast(&slwt->tunsrc) ||
 +		    ipv6_addr_loopback(&slwt->tunsrc)) {
 +			NL_SET_ERR_MSG(extack, "invalid tunsrc address");
 +			err = -EINVAL;
- 			goto free_dst_cache;
++			goto err_destroy_output;
 +		}
 +	}
 +
  	newts->type = LWTUNNEL_ENCAP_SEG6;
  	newts->flags |= LWTUNNEL_STATE_INPUT_REDIRECT;
  
@@@ -750,9 -724,9 +755,11 @@@
  
  	return 0;
  
- free_dst_cache:
- 	dst_cache_destroy(&slwt->cache);
- free_lwt_state:
++err_destroy_output:
++	dst_cache_destroy(&slwt->cache_output);
+ err_destroy_input:
+ 	dst_cache_destroy(&slwt->cache_input);
+ err_free_newts:
  	kfree(newts);
  	return err;
  }