--- /dev/null
+From 6a69d144661781a1e60228e26bb26985ca66723a Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Sun, 23 Feb 2025 17:22:29 +0000
+Subject: io_uring/net: fix accept multishot handling
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+Commit f6a89bf5278d6e15016a736db67043560d1b50d5 upstream.
+
+REQ_F_APOLL_MULTISHOT doesn't guarantee it's executed from the multishot
+context, so a multishot accept may get executed inline, fail
+io_req_post_cqe(), and ask the core code to kill the request with
+-ECANCELED by returning IOU_STOP_MULTISHOT even when a socket has been
+accepted and installed.
+
+Cc: stable@vger.kernel.org
+Fixes: 390ed29b5e425 ("io_uring: add IORING_ACCEPT_MULTISHOT for accept")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/51c6deb01feaa78b08565ca8f24843c017f5bc80.1740331076.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/net.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/io_uring/net.c
++++ b/io_uring/net.c
+@@ -1391,6 +1391,8 @@ retry:
+ goto retry;
+
+ io_req_set_res(req, ret, 0);
++ if (!(issue_flags & IO_URING_F_MULTISHOT))
++ return IOU_OK;
+ return IOU_STOP_MULTISHOT;
+ }
+
drm-nouveau-prime-fix-ttm_bo_delayed_delete-oops.patch
drm-sti-remove-duplicate-object-names.patch
drm-i915-gvt-fix-unterminated-string-initialization-warning.patch
+io_uring-net-fix-accept-multishot-handling.patch