[PATCH net 0/3 repost2] net/sched: fix short-skb metadata and namespace boundaries

This series fixes three independent boundary problems in net/sched.

1/3 act_ife: encode a configured zero metadata value.  ife_check_meta_u32()
reserves an 8-byte TLV for a configured zero value, but the encoder
returned without writing it, leaking stale skb headroom bytes.

2/3 act_ife: require a full Ethernet header on egress.  An undersized
linear head can make the encoder read past the end of the skb data.

3/3 sch_teql: reject qdiscs from another network namespace.  The global
TEQL master lives in the initial netns; a qdisc created in another netns
could still mutate the master's MTU and flags.

Origins:

1/3: reported by shaos [off-list ref] with a reproducer, which was
reproduced and verified in our test environment.
2/3: found by Sashiko (nipa and gemini) while reviewing Victor Nogueira's
parent act_ife patchset; independently reported by shaos
[off-list ref] with a reproducer, which was verified in our test
environment.
3/3: reported by shaos [off-list ref] with a reproducer, which was
reproduced and verified in our test environment.

The three patches are independent.  They target net and carry a stable
nomination.  They are sent together because they share the short-skb and
namespace-boundary review context.

Jamal Hadi Salim (3):
  net/sched: act_ife: encode a configured zero metadata value
  net/sched: act_ife: require a full Ethernet header on egress
  net/sched: sch_teql: reject qdiscs from another network namespace

 net/sched/act_ife.c  | 13 +++++++------
 net/sched/sch_teql.c |  9 +++++++--
 2 files changed, 14 insertions(+), 8 deletions(-)

Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
---

repost2: the repost1 posting is withdrawn.  3/3 carried hunk context for
teql_qdisc_init() from before 8b2043279dae ("sch_teql: fix slaves_lock
IRQ deadlock"), so it did not apply to the current tree.  This posting is
rebased onto the current net tip; 1/3 and 2/3 are unchanged, and 3/3
takes the new lock context and is otherwise the same fix.

The series is now built and tested against the current net tip.