From ae49895cd2649b5056b0d8e7df671d0f793b4e68 Mon Sep 17 00:00:00 2001
From: John Audia <therealgraysky@proton.me>
Date: Fri, 15 Aug 2025 15:04:26 -0400
Subject: [PATCH] kernel: bump 6.12 to 6.12.42

Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.42

Added backport to fix ipv6 breakage with the 6.12.42 release:
generic/backport-6.12/621-proc-fix-missing-pde_set_flags.patch[1]

All other patches automatically rebased.

1. https://lore.kernel.org/all/20250821105806.1453833-1-wangzijie1@honor.com

Build system: x86/64
Build-tested: flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3, x86/64-glibc
Run-tested: flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3, x86/64-glibc (Intel N150)

Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/19618
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 .../900-unaligned_access_hacks.patch          |   2 +-
 ...tft-Add-support-for-display-variants.patch |   6 +-
 ...tibility-hack-should-be-X86-specific.patch |   4 +-
 ...nicast-multicast-flooding-on-BCM5325.patch |   6 +-
 ...e-IFF_NO_QUEUE-in-virtual-interfaces.patch |   2 +-
 .../621-proc-fix-missing-pde_set_flags.patch  | 121 ++++++++++++++++++
 .../721-net-add-packet-mangeling.patch        |   4 +-
 target/linux/generic/kernel-6.12              |   4 +-
 .../650-net-pppoe-implement-GRO-support.patch |   4 +-
 .../pending-6.12/655-increase_skb_pad.patch   |   2 +-
 ...ng-with-source-address-failed-policy.patch |  14 +-
 ...les-ignore-EOPNOTSUPP-on-flowtable-d.patch |   2 +-
 ...dsa-add-out-of-band-tagging-protocol.patch |   2 +-
 13 files changed, 147 insertions(+), 26 deletions(-)
 create mode 100644 target/linux/generic/backport-6.12/621-proc-fix-missing-pde_set_flags.patch

diff --git a/target/linux/ath79/patches-6.12/900-unaligned_access_hacks.patch b/target/linux/ath79/patches-6.12/900-unaligned_access_hacks.patch
index ea51478fd0..12fbc59e98 100644
--- a/target/linux/ath79/patches-6.12/900-unaligned_access_hacks.patch
+++ b/target/linux/ath79/patches-6.12/900-unaligned_access_hacks.patch
@@ -578,7 +578,7 @@ SVN-Revision: 35130
  			goto next_ht;
 --- a/net/ipv6/ip6_offload.c
 +++ b/net/ipv6/ip6_offload.c
-@@ -269,7 +269,7 @@ INDIRECT_CALLABLE_SCOPE struct sk_buff *
+@@ -271,7 +271,7 @@ INDIRECT_CALLABLE_SCOPE struct sk_buff *
  			continue;
  
  		iph2 = (struct ipv6hdr *)(p->data + off);
diff --git a/target/linux/bcm27xx/patches-6.12/950-0196-staging-fbtft-Add-support-for-display-variants.patch b/target/linux/bcm27xx/patches-6.12/950-0196-staging-fbtft-Add-support-for-display-variants.patch
index bf6573548e..105941aa55 100644
--- a/target/linux/bcm27xx/patches-6.12/950-0196-staging-fbtft-Add-support-for-display-variants.patch
+++ b/target/linux/bcm27xx/patches-6.12/950-0196-staging-fbtft-Add-support-for-display-variants.patch
@@ -95,7 +95,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  #include <video/mipi_display.h>
  
-@@ -1131,6 +1133,7 @@ static struct fbtft_platform_data *fbtft
+@@ -1132,6 +1134,7 @@ static struct fbtft_platform_data *fbtft
   * @display: Display properties
   * @sdev: SPI device
   * @pdev: Platform device
@@ -103,7 +103,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
   *
   * Allocates, initializes and registers a framebuffer
   *
-@@ -1140,12 +1143,15 @@ static struct fbtft_platform_data *fbtft
+@@ -1141,12 +1144,15 @@ static struct fbtft_platform_data *fbtft
   */
  int fbtft_probe_common(struct fbtft_display *display,
  		       struct spi_device *sdev,
@@ -120,7 +120,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	int ret;
  
  	if (sdev)
-@@ -1158,6 +1164,14 @@ int fbtft_probe_common(struct fbtft_disp
+@@ -1159,6 +1165,14 @@ int fbtft_probe_common(struct fbtft_disp
  		pdata = fbtft_properties_read(dev);
  		if (IS_ERR(pdata))
  			return PTR_ERR(pdata);
diff --git a/target/linux/bcm27xx/patches-6.12/950-0330-pps-Compatibility-hack-should-be-X86-specific.patch b/target/linux/bcm27xx/patches-6.12/950-0330-pps-Compatibility-hack-should-be-X86-specific.patch
index 2f8ab29fdd..3d05954a77 100644
--- a/target/linux/bcm27xx/patches-6.12/950-0330-pps-Compatibility-hack-should-be-X86-specific.patch
+++ b/target/linux/bcm27xx/patches-6.12/950-0330-pps-Compatibility-hack-should-be-X86-specific.patch
@@ -22,7 +22,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/pps/pps.c
 +++ b/drivers/pps/pps.c
-@@ -249,12 +249,13 @@ static long pps_cdev_ioctl(struct file *
+@@ -254,12 +254,13 @@ static long pps_cdev_ioctl(struct file *
  static long pps_cdev_compat_ioctl(struct file *file,
  		unsigned int cmd, unsigned long arg)
  {
@@ -38,7 +38,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		struct pps_fdata_compat compat;
  		struct pps_fdata fdata;
  		int err;
-@@ -289,6 +290,7 @@ static long pps_cdev_compat_ioctl(struct
+@@ -296,6 +297,7 @@ static long pps_cdev_compat_ioctl(struct
  		return copy_to_user(uarg, &compat,
  				sizeof(struct pps_fdata_compat)) ? -EFAULT : 0;
  	}
diff --git a/target/linux/generic/backport-6.12/612-12-v6.17-net-dsa-b53-fix-unicast-multicast-flooding-on-BCM5325.patch b/target/linux/generic/backport-6.12/612-12-v6.17-net-dsa-b53-fix-unicast-multicast-flooding-on-BCM5325.patch
index 9044909bc6..063622398a 100644
--- a/target/linux/generic/backport-6.12/612-12-v6.17-net-dsa-b53-fix-unicast-multicast-flooding-on-BCM5325.patch
+++ b/target/linux/generic/backport-6.12/612-12-v6.17-net-dsa-b53-fix-unicast-multicast-flooding-on-BCM5325.patch
@@ -21,7 +21,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/dsa/b53/b53_common.c
 +++ b/drivers/net/dsa/b53/b53_common.c
-@@ -560,12 +560,24 @@ static void b53_port_set_ucast_flood(str
+@@ -564,12 +564,24 @@ static void b53_port_set_ucast_flood(str
  {
  	u16 uc;
  
@@ -52,7 +52,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  }
  
  static void b53_port_set_mcast_flood(struct b53_device *dev, int port,
-@@ -573,19 +585,31 @@ static void b53_port_set_mcast_flood(str
+@@ -577,19 +589,31 @@ static void b53_port_set_mcast_flood(str
  {
  	u16 mc;
  
@@ -107,7 +107,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  /* PHY Registers */
  #define B53_PORT_MII_PAGE(i)		(0x10 + (i)) /* Port i MII Registers */
-@@ -369,6 +370,18 @@
+@@ -372,6 +373,18 @@
  #define B53_ARL_SRCH_RSTL(x)		(B53_ARL_SRCH_RSTL_0 + ((x) * 0x10))
  
  /*************************************************************************
diff --git a/target/linux/generic/backport-6.12/620-v6.15-ppp-use-IFF_NO_QUEUE-in-virtual-interfaces.patch b/target/linux/generic/backport-6.12/620-v6.15-ppp-use-IFF_NO_QUEUE-in-virtual-interfaces.patch
index 64effc5ec8..6d9ac56cf0 100644
--- a/target/linux/generic/backport-6.12/620-v6.15-ppp-use-IFF_NO_QUEUE-in-virtual-interfaces.patch
+++ b/target/linux/generic/backport-6.12/620-v6.15-ppp-use-IFF_NO_QUEUE-in-virtual-interfaces.patch
@@ -47,7 +47,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		if (error) {
 --- a/drivers/net/ppp/pptp.c
 +++ b/drivers/net/ppp/pptp.c
-@@ -465,6 +465,7 @@ static int pptp_connect(struct socket *s
+@@ -469,6 +469,7 @@ static int pptp_connect(struct socket *s
  	po->chan.mtu -= PPTP_HEADER_OVERHEAD;
  
  	po->chan.hdrlen = 2 + sizeof(struct pptp_gre_header);
diff --git a/target/linux/generic/backport-6.12/621-proc-fix-missing-pde_set_flags.patch b/target/linux/generic/backport-6.12/621-proc-fix-missing-pde_set_flags.patch
new file mode 100644
index 0000000000..ba026b9c3a
--- /dev/null
+++ b/target/linux/generic/backport-6.12/621-proc-fix-missing-pde_set_flags.patch
@@ -0,0 +1,121 @@
+From: wangzijie <wangzijie1@honor.com>
+To: <akpm@linux-foundation.org>, <brauner@kernel.org>,
+	<viro@zeniv.linux.org.uk>, <adobriyan@gmail.com>,
+	<rick.p.edgecombe@intel.com>, <ast@kernel.org>,
+	<k.shutemov@gmail.com>, <jirislaby@kernel.org>,
+	<linux-fsdevel@vger.kernel.org>
+Cc: <polynomial-c@gmx.de>, <gregkh@linuxfoundation.org>,
+	<stable@vger.kernel.org>, <regressions@lists.linux.dev>,
+	wangzijie <wangzijie1@honor.com>
+Subject: [PATCH v3] proc: fix missing pde_set_flags() for net proc files
+Date: Thu, 21 Aug 2025 18:58:06 +0800	[thread overview]
+Message-ID: <20250821105806.1453833-1-wangzijie1@honor.com> (raw)
+
+To avoid potential UAF issues during module removal races, we use pde_set_flags()
+to save proc_ops flags in PDE itself before proc_register(), and then use
+pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*.
+
+However, the pde_set_flags() call was missing when creating net related proc files.
+This omission caused incorrect behavior which FMODE_LSEEK was being cleared
+inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1].
+
+Fix this by ensuring pde_set_flags() is called when register proc entry, and add
+NULL check for proc_ops in pde_set_flags().
+
+[1]: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/
+
+Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al")
+Cc: stable@vger.kernel.org
+Reported-by: Lars Wendler <polynomial-c@gmx.de>
+Signed-off-by: wangzijie <wangzijie1@honor.com>
+---
+v3:
+- followed by Christian's suggestion to stash pde->proc_ops in a local const variable
+v2:
+- followed by Jiri's suggestion to refractor code and reformat commit message
+---
+ fs/proc/generic.c | 38 +++++++++++++++++++++-----------------
+ 1 file changed, 21 insertions(+), 17 deletions(-)
+
+--- a/fs/proc/generic.c
++++ b/fs/proc/generic.c
+@@ -362,6 +362,25 @@ static const struct inode_operations pro
+ 	.setattr	= proc_notify_change,
+ };
+ 
++static void pde_set_flags(struct proc_dir_entry *pde)
++{
++	const struct proc_ops *proc_ops = pde->proc_ops;
++
++	if (!proc_ops)
++		return;
++
++	if (proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
++		pde->flags |= PROC_ENTRY_PERMANENT;
++	if (proc_ops->proc_read_iter)
++		pde->flags |= PROC_ENTRY_proc_read_iter;
++#ifdef CONFIG_COMPAT
++	if (proc_ops->proc_compat_ioctl)
++		pde->flags |= PROC_ENTRY_proc_compat_ioctl;
++#endif
++	if (proc_ops->proc_lseek)
++		pde->flags |= PROC_ENTRY_proc_lseek;
++}
++
+ /* returns the registered entry, or frees dp and returns NULL on failure */
+ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
+ 		struct proc_dir_entry *dp)
+@@ -369,6 +388,8 @@ struct proc_dir_entry *proc_register(str
+ 	if (proc_alloc_inum(&dp->low_ino))
+ 		goto out_free_entry;
+ 
++	pde_set_flags(dp);
++
+ 	write_lock(&proc_subdir_lock);
+ 	dp->parent = dir;
+ 	if (pde_subdir_insert(dir, dp) == false) {
+@@ -557,20 +578,6 @@ struct proc_dir_entry *proc_create_reg(c
+ 	return p;
+ }
+ 
+-static void pde_set_flags(struct proc_dir_entry *pde)
+-{
+-	if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
+-		pde->flags |= PROC_ENTRY_PERMANENT;
+-	if (pde->proc_ops->proc_read_iter)
+-		pde->flags |= PROC_ENTRY_proc_read_iter;
+-#ifdef CONFIG_COMPAT
+-	if (pde->proc_ops->proc_compat_ioctl)
+-		pde->flags |= PROC_ENTRY_proc_compat_ioctl;
+-#endif
+-	if (pde->proc_ops->proc_lseek)
+-		pde->flags |= PROC_ENTRY_proc_lseek;
+-}
+-
+ struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
+ 		struct proc_dir_entry *parent,
+ 		const struct proc_ops *proc_ops, void *data)
+@@ -581,7 +588,6 @@ struct proc_dir_entry *proc_create_data(
+ 	if (!p)
+ 		return NULL;
+ 	p->proc_ops = proc_ops;
+-	pde_set_flags(p);
+ 	return proc_register(parent, p);
+ }
+ EXPORT_SYMBOL(proc_create_data);
+@@ -632,7 +638,6 @@ struct proc_dir_entry *proc_create_seq_p
+ 	p->proc_ops = &proc_seq_ops;
+ 	p->seq_ops = ops;
+ 	p->state_size = state_size;
+-	pde_set_flags(p);
+ 	return proc_register(parent, p);
+ }
+ EXPORT_SYMBOL(proc_create_seq_private);
+@@ -663,7 +668,6 @@ struct proc_dir_entry *proc_create_singl
+ 		return NULL;
+ 	p->proc_ops = &proc_single_ops;
+ 	p->single_show = show;
+-	pde_set_flags(p);
+ 	return proc_register(parent, p);
+ }
+ EXPORT_SYMBOL(proc_create_single_data);
diff --git a/target/linux/generic/hack-6.12/721-net-add-packet-mangeling.patch b/target/linux/generic/hack-6.12/721-net-add-packet-mangeling.patch
index 5ad34a4517..9430070457 100644
--- a/target/linux/generic/hack-6.12/721-net-add-packet-mangeling.patch
+++ b/target/linux/generic/hack-6.12/721-net-add-packet-mangeling.patch
@@ -52,7 +52,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   */
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -3213,6 +3213,10 @@ static inline int pskb_trim(struct sk_bu
+@@ -3236,6 +3236,10 @@ static inline int pskb_trim(struct sk_bu
  	return (len < skb->len) ? __pskb_trim(skb, len) : 0;
  }
  
@@ -63,7 +63,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /**
   *	pskb_trim_unique - remove end from a paged unique (not cloned) buffer
   *	@skb: buffer to alter
-@@ -3378,16 +3382,6 @@ static inline struct sk_buff *dev_alloc_
+@@ -3401,16 +3405,6 @@ static inline struct sk_buff *dev_alloc_
  }
  
  
diff --git a/target/linux/generic/kernel-6.12 b/target/linux/generic/kernel-6.12
index 11f05faf1c..51f0379fc1 100644
--- a/target/linux/generic/kernel-6.12
+++ b/target/linux/generic/kernel-6.12
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.12 = .41
-LINUX_KERNEL_HASH-6.12.41 = 6b19a3ae99423de2416964d67251d745910277af258b4c4c63e88fd87dbf0e27
+LINUX_VERSION-6.12 = .42
+LINUX_KERNEL_HASH-6.12.42 = 4804528a29cd20309a0b41c30e5aeffc35fa21ee3358f4a706d4586d003bc1fb
diff --git a/target/linux/generic/pending-6.12/650-net-pppoe-implement-GRO-support.patch b/target/linux/generic/pending-6.12/650-net-pppoe-implement-GRO-support.patch
index d7260296bd..11d0f03fba 100644
--- a/target/linux/generic/pending-6.12/650-net-pppoe-implement-GRO-support.patch
+++ b/target/linux/generic/pending-6.12/650-net-pppoe-implement-GRO-support.patch
@@ -230,7 +230,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
 --- a/net/ipv6/ip6_offload.c
 +++ b/net/ipv6/ip6_offload.c
-@@ -304,6 +304,7 @@ out:
+@@ -306,6 +306,7 @@ out:
  
  	return pp;
  }
@@ -238,7 +238,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  static struct sk_buff *sit_ip6ip6_gro_receive(struct list_head *head,
  					      struct sk_buff *skb)
-@@ -386,6 +387,7 @@ INDIRECT_CALLABLE_SCOPE int ipv6_gro_com
+@@ -388,6 +389,7 @@ INDIRECT_CALLABLE_SCOPE int ipv6_gro_com
  out:
  	return err;
  }
diff --git a/target/linux/generic/pending-6.12/655-increase_skb_pad.patch b/target/linux/generic/pending-6.12/655-increase_skb_pad.patch
index 6fa3358218..57857272f0 100644
--- a/target/linux/generic/pending-6.12/655-increase_skb_pad.patch
+++ b/target/linux/generic/pending-6.12/655-increase_skb_pad.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -3180,7 +3180,7 @@ static inline int pskb_network_may_pull(
+@@ -3203,7 +3203,7 @@ static inline int pskb_network_may_pull(
   * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
   */
  #ifndef NET_SKB_PAD
diff --git a/target/linux/generic/pending-6.12/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch b/target/linux/generic/pending-6.12/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
index d10f39cf22..f0cdd65766 100644
--- a/target/linux/generic/pending-6.12/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
+++ b/target/linux/generic/pending-6.12/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@@ -185,7 +185,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		cfg->fc_flags |= RTF_REJECT;
  
  	if (rtm->rtm_type == RTN_LOCAL)
-@@ -6349,6 +6380,8 @@ static int ip6_route_dev_notify(struct n
+@@ -6357,6 +6388,8 @@ static int ip6_route_dev_notify(struct n
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
  		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
@@ -194,7 +194,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
  		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
  #endif
-@@ -6360,6 +6393,7 @@ static int ip6_route_dev_notify(struct n
+@@ -6368,6 +6401,7 @@ static int ip6_route_dev_notify(struct n
  		in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
@@ -202,7 +202,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
  #endif
  	}
-@@ -6555,6 +6589,8 @@ static int __net_init ip6_route_net_init
+@@ -6563,6 +6597,8 @@ static int __net_init ip6_route_net_init
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	net->ipv6.fib6_has_custom_rules = false;
@@ -211,7 +211,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
  					       sizeof(*net->ipv6.ip6_prohibit_entry),
  					       GFP_KERNEL);
-@@ -6565,11 +6601,21 @@ static int __net_init ip6_route_net_init
+@@ -6573,11 +6609,21 @@ static int __net_init ip6_route_net_init
  			 ip6_template_metrics, true);
  	INIT_LIST_HEAD(&net->ipv6.ip6_prohibit_entry->dst.rt_uncached);
  
@@ -234,7 +234,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
  	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
  			 ip6_template_metrics, true);
-@@ -6596,6 +6642,8 @@ out:
+@@ -6604,6 +6650,8 @@ out:
  	return ret;
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
@@ -243,7 +243,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  out_ip6_prohibit_entry:
  	kfree(net->ipv6.ip6_prohibit_entry);
  out_ip6_null_entry:
-@@ -6615,6 +6663,7 @@ static void __net_exit ip6_route_net_exi
+@@ -6623,6 +6671,7 @@ static void __net_exit ip6_route_net_exi
  	kfree(net->ipv6.ip6_null_entry);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	kfree(net->ipv6.ip6_prohibit_entry);
@@ -251,7 +251,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	kfree(net->ipv6.ip6_blk_hole_entry);
  #endif
  	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
-@@ -6698,6 +6747,9 @@ void __init ip6_route_init_special_entri
+@@ -6706,6 +6755,9 @@ void __init ip6_route_init_special_entri
  	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
  	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
diff --git a/target/linux/generic/pending-6.12/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch b/target/linux/generic/pending-6.12/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
index ceb191e5c5..2ab483d6c4 100644
--- a/target/linux/generic/pending-6.12/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
+++ b/target/linux/generic/pending-6.12/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/netfilter/nf_tables_api.c
 +++ b/net/netfilter/nf_tables_api.c
-@@ -8658,7 +8658,7 @@ static int nft_register_flowtable_net_ho
+@@ -8638,7 +8638,7 @@ static int nft_register_flowtable_net_ho
  		err = flowtable->data.type->setup(&flowtable->data,
  						  hook->ops.dev,
  						  FLOW_BLOCK_BIND);
diff --git a/target/linux/ipq40xx/patches-6.12/701-net-dsa-add-out-of-band-tagging-protocol.patch b/target/linux/ipq40xx/patches-6.12/701-net-dsa-add-out-of-band-tagging-protocol.patch
index 79a4f74fcf..b9be19232d 100644
--- a/target/linux/ipq40xx/patches-6.12/701-net-dsa-add-out-of-band-tagging-protocol.patch
+++ b/target/linux/ipq40xx/patches-6.12/701-net-dsa-add-out-of-band-tagging-protocol.patch
@@ -93,7 +93,7 @@ Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
 +#endif
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -4769,6 +4769,9 @@ enum skb_ext_id {
+@@ -4792,6 +4792,9 @@ enum skb_ext_id {
  #if IS_ENABLED(CONFIG_MCTP_FLOWS)
  	SKB_EXT_MCTP,
  #endif
-- 
2.30.2