Commit b3e528a5811b for kernel

commit b3e528a5811bbc8246dbdb962f0812dc9b721681
Author: Jeremy Kerr <jk@codeconstruct.com.au>
Date:   Tue Nov 25 14:48:54 2025 +0800

    net: mctp: unconditionally set skb->dev on dst output

    On transmit, we are currently relying on skb->dev being set by
    mctp_local_output() when we first set up the skb destination fields.
    However, forwarded skbs do not use the local_output path, so will retain
    their incoming netdev as their ->dev on tx. This does not work when
    we're forwarding between interfaces.

    Set skb->dev unconditionally in the transmit path, to allow for proper
    forwarding.

    We keep the skb->dev initialisation in mctp_local_output(), as we use it
    for fragmentation.

    Fixes: 269936db5eb3 ("net: mctp: separate routing database from routing operations")
    Suggested-by: Vince Chang <vince_chang@aspeedtech.com>
    Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
    Link: https://patch.msgid.link/20251125-dev-forward-v1-1-54ecffcd0616@codeconstruct.com.au
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/mctp/route.c b/net/mctp/route.c
index 4d314e062ba9..2ac4011a953f 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -623,6 +623,7 @@ static int mctp_dst_output(struct mctp_dst *dst, struct sk_buff *skb)

 	skb->protocol = htons(ETH_P_MCTP);
 	skb->pkt_type = PACKET_OUTGOING;
+	skb->dev = dst->dev->dev;

 	if (skb->len > dst->mtu) {
 		kfree_skb(skb);