6.18-stable patches

added patches:
	net-sched-dualpi2-fix-gso-backlog-accounting.patch

diff --git a/queue-6.18/net-sched-dualpi2-fix-gso-backlog-accounting.patch b/queue-6.18/net-sched-dualpi2-fix-gso-backlog-accounting.patch
new file mode 100644 (file)
index 0000000..0205622
--- /dev/null
+++ b/queue-6.18/net-sched-dualpi2-fix-gso-backlog-accounting.patch
@@ -0,0 +1,68 @@
+From 05ed733b65ab977dd931e7f7ac0f62fdb81205c2 Mon Sep 17 00:00:00 2001
+From: Xingquan Liu <b1n@b1n.io>
+Date: Fri, 19 Jun 2026 11:13:47 -0400
+Subject: net/sched: dualpi2: fix GSO backlog accounting
+
+From: Xingquan Liu <b1n@b1n.io>
+
+commit 05ed733b65ab977dd931e7f7ac0f62fdb81205c2 upstream.
+
+When DualPI2 splits a GSO skb into N segments, it propagates N
+additional packets to its parent before returning NET_XMIT_SUCCESS.
+The parent then accounts for the original skb once more, leaving its
+qlen one larger than the number of packets actually queued.
+
+With QFQ as the parent, after all real packets are dequeued, QFQ still
+has a non-zero qlen while its in-service aggregate has no active
+classes. qfq_choose_next_agg() returns NULL and qfq_dequeue() passes
+the result to qfq_peek_skb(), causing a NULL pointer dereference.
+
+Follow the same pattern used by tbf_segment() and taprio: count only
+successfully queued segments, propagate the difference between the
+original skb and those segments, and return NET_XMIT_SUCCESS whenever
+at least one segment was queued.
+
+Fixes: 8f9516daedd6 ("sched: Add enqueue/dequeue of dualpi2 qdisc")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xingquan Liu <b1n@b1n.io>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Reviewed-by: Victor Nogueira <victor@mojatatu.com>
+Link: https://patch.msgid.link/20260619151447.223640-1-b1n@b1n.io
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_dualpi2.c |   11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/net/sched/sch_dualpi2.c
++++ b/net/sched/sch_dualpi2.c
+@@ -463,7 +463,7 @@ static int dualpi2_qdisc_enqueue(struct
+               if (IS_ERR_OR_NULL(nskb))
+                       return qdisc_drop(skb, sch, to_free);
+ 
+-              cnt = 1;
++              cnt = 0;
+               byte_len = 0;
+               orig_len = qdisc_pkt_len(skb);
+               skb_list_walk_safe(nskb, nskb, next) {
+@@ -489,16 +489,15 @@ static int dualpi2_qdisc_enqueue(struct
+                               byte_len += nskb->len;
+                       }
+               }
+-              if (cnt > 1) {
++              if (cnt > 0) {
+                       /* The caller will add the original skb stats to its
+                        * backlog, compensate this if any nskb is enqueued.
+                        */
+-                      --cnt;
+-                      byte_len -= orig_len;
++                      qdisc_tree_reduce_backlog(sch, 1 - cnt,
++                                                orig_len - byte_len);
+               }
+-              qdisc_tree_reduce_backlog(sch, -cnt, -byte_len);
+               consume_skb(skb);
+-              return err;
++              return cnt > 0 ? NET_XMIT_SUCCESS : err;
+       }
+       return dualpi2_enqueue_skb(skb, sch, to_free);
+ }

diff --git a/queue-6.18/series b/queue-6.18/series
index 3a532f89c6c478b80a523cc3efb747dedca968a8..9805dd462662e47e922ff8a81dc09a908ca66cb0 100644 (file)
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -18,3 +18,4 @@ f2fs-optimize-trace_f2fs_write_checkpoint-with-enums.patch
 f2fs-detect-more-inconsistent-cases-in-sanity_check_node_footer.patch
 f2fs-fix-to-do-sanity-check-on-f2fs_get_node_folio_ra.patch
 fbdev-fbcon-fix-out-of-bounds-read-in-err_out-of-fbcon_do_set_font.patch
+net-sched-dualpi2-fix-gso-backlog-accounting.patch