Commit 6730fe495c35 for kernel

commit 6730fe495c35f174a424ab58cf5fdf99ce4746e9
Author: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
Date:   Wed Nov 11 11:11:47 2026 +0800

    amt: use ipv6_hdr() in amt_mldv1_leave_handler()

    In amt_mldv1_leave_handler(), which handles IPv6 MLDv1 Done
    (ICMPV6_MGM_REDUCTION) messages, the source address is mistakenly
    extracted via ip_hdr(skb)->saddr into host.ip4 instead of copying the
    IPv6 source address from ipv6_hdr(skb)->saddr into host.ip6 as
    amt_mldv1_report_handler() does.

    Because amt_lookup_group() compares the full union amt_addr for v6
    groups, looking up the group with a 32-bit IPv4 header slice fails to
    match the group entry created by amt_mldv1_report_handler(). As a
    result, amt_del_group() is not called when an MLDv1 listener leaves,
    and the AMT relay continues forwarding multicast traffic until the
    group timer expires.

    Use ipv6_hdr(skb) and copy ip6h->saddr into host.ip6 so that MLDv1
    Done messages properly match and delete the corresponding IPv6 group.

    This issue was found via LLM-assisted code review, confirmed by
    reproducing the stale group forwarding in a User-Mode Linux (ARCH=um)
    environment, and verified in UML by testing that AMT relay multicast
    forwarding stops immediately after receiving an MLDv1 Done message.

    Fixes: b75f7095d4d4 ("amt: add mld report message handler")
    Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
    Link: https://patch.msgid.link/20261111031147.105834-1-sunwenbo@cmss.chinamobile.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index e7fa09e36803..8b9fc3d11ece 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -2147,13 +2147,12 @@ static void amt_mldv1_leave_handler(struct amt_dev *amt, struct sk_buff *skb,
 				    struct amt_tunnel_list *tunnel)
 {
 	struct mld_msg *mld = (struct mld_msg *)icmp6_hdr(skb);
-	struct iphdr *iph = ip_hdr(skb);
+	struct ipv6hdr *ip6h = ipv6_hdr(skb);
 	struct amt_group_node *gnode;
 	union amt_addr group, host;

 	memcpy(&group.ip6, &mld->mld_mca, sizeof(struct in6_addr));
-	memset(&host, 0, sizeof(union amt_addr));
-	host.ip4 = iph->saddr;
+	memcpy(&host.ip6, &ip6h->saddr, sizeof(struct in6_addr));

 	gnode = amt_lookup_group(tunnel, &group, &host, true);
 	if (gnode) {