Commit c84ff04def25 for kernel

commit c84ff04def255edb51e57c9f969efdfade0da16a
Merge: ff6e798c2eac 6851161feb01
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Fri May 29 12:57:22 2026 -0700

    Merge tag 'ipsec-2026-05-29' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

    Steffen Klassert says:

    ====================
    pull request (net): ipsec 2026-05-29

    1) xfrm: route MIGRATE notifications to caller's netns
       Thread the caller's netns through km_migrate() so that
       MIGRATE notifications go to the issuing netns, fixing both the
       init_net listener leak and MOBIKE notifications inside
       non-init netns. From Maoyi Xie.

    2) xfrm: ipcomp: Free destination pages on acomp errors
       Move the out_free_req label up so that allocated destination
       pages are released on decompression errors, not only on success.
       From Herbert Xu.

    3) xfrm: Check for underflow in xfrm_state_mtu
       Reject configurations that cause xfrm_state_mtu() to underflow,
       preventing a negative TFCPAD value from becoming a memset size
       that triggers an out-of-bounds write of several terabytes.
       From David Ahern.

    4) xfrm: ah: use skb_to_full_sk in async output callbacks
       Convert the possibly-incomplete skb->sk to a full socket pointer
       in async AH callbacks so that a request_sock or timewait_sock
       never reaches xfrm_output_resume() downstream consumers.
       From Michael Bommarito.

    5) Add and revert: esp: fix page frag reference leak on skb_to_sgvec failure
       The patch does not fix te issue completely.

    6) xfrm: esp: restore combined single-frag length gate
       Check the aligned post-trailer combined length against a page limit
       in the fast path, preventing skb_page_frag_refill() from falling
       back to a page too small for the destination scatterlist.
       From Jingguo Tan.

    7) xfrm: iptfs: reset runtime state when cloning SAs
       Reinitialise the clone's mode_data runtime objects before
       publishing it, preventing queued skbs from being freed with
       list state copied from the original SA when migration fails.
       From Shaomin Chen.

    8) xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
       Flush policy tables and drain the workqueue in a .pre_exit handler
       so that cleanup_net() pays one RCU grace period per batch instead
       of one per namespace, fixing stalls at high CLONE_NEWNET rates.
       From Usama Arif.

    9) xfrm: input: hold netns during deferred transport reinjection
       Take a netns reference when queueing deferred transport reinjection
       work and drop it after the callback completes, keeping the skb->cb
       net pointer valid until the deferred work runs.
       From Zhengchuan Liang.

    * tag 'ipsec-2026-05-29' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
      Revert "esp: fix page frag reference leak on skb_to_sgvec failure"
      xfrm: input: hold netns during deferred transport reinjection
      xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
      xfrm: iptfs: reset runtime state when cloning SAs
      xfrm: esp: restore combined single-frag length gate
      esp: fix page frag reference leak on skb_to_sgvec failure
      xfrm: ah: use skb_to_full_sk in async output callbacks
      xfrm: Check for underflow in xfrm_state_mtu
      xfrm: ipcomp: Free destination pages on acomp errors
      xfrm: route MIGRATE notifications to caller's netns
    ====================

    Link: https://patch.msgid.link/20260529092648.3878973-1-steffen.klassert@secunet.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>