Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Cross-merge networking fixes after downstream PR.

Conflicts:

net/sched/act_ct.c
  26488172b029 ("net/sched: Fix UAF when resolving a clash")
  3abbd7ed8b76 ("act_ct: prepare for stolen verdict coming from conntrack and nat engine")

No adjacent changes.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --cc MAINTAINERS
Simple merge

diff --cc drivers/net/ethernet/broadcom/bnxt/bnxt.c
Simple merge

diff --cc drivers/net/ethernet/broadcom/bnxt/bnxt.h
Simple merge

diff --cc drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
Simple merge

diff --cc drivers/net/ethernet/marvell/octeontx2/af/rvu.c
Simple merge

diff --cc include/linux/sched.h
Simple merge

diff --cc kernel/bpf/helpers.c
Simple merge

diff --cc net/core/datagram.c
Simple merge

diff --cc net/ipv4/tcp_input.c
Simple merge

diff --cc net/ipv4/tcp_timer.c
Simple merge

diff --cc net/ipv4/udp.c
Simple merge

diff --cc net/netfilter/nf_tables_api.c
Simple merge

diff --cc net/sched/act_ct.c
index a6b7c51,6fa3cca..113b907
--- 1/net/sched/act_ct.c
--- 2/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@@ -1078,9 -1075,16 +1078,17 @@@ do_nat
                /* This will take care of sending queued events
                 * even if the connection is already confirmed.
                 */
 -              if (nf_conntrack_confirm(skb) != NF_ACCEPT)
 -                      goto drop;
 +              err = nf_conntrack_confirm(skb);
 +              if (err != NF_ACCEPT)
 +                      goto nf_error;
+ 
+               /* The ct may be dropped if a clash has been resolved,
+                * so it's necessary to retrieve it from skb again to
+                * prevent UAF.
+                */
+               ct = nf_ct_get(skb, &ctinfo);
+               if (!ct)
+                       skip_add = true;
        }
  
        if (!skip_add)

diff --cc tools/testing/selftests/bpf/config
Simple merge