--- /dev/null
+From b47ff80f280e18ad2310f44293cc057d9b64ff11 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 3 Jun 2026 12:35:14 +0000
+Subject: bonding: annotate data-races arcound churn variables
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit b47ff80f280e18ad2310f44293cc057d9b64ff11 upstream.
+
+These fields are updated asynchronously by the bonding state machine
+in ad_churn_machine() while holding bond->mode_lock.
+
+bond_info_show_slave() and bond_fill_slave_info() read them without
+bond->mode_lock being held, we need to add READ_ONCE() and
+WRITE_ONCE() annotations.
+
+Note that AD_CHURN_MONITOR, AD_CHURN, and AD_NO_CHURN are defined
+exclusively in (kernel private) include/net/bond_3ad.h header.
+
+They should be moved to include/uapi/linux/if_bonding.h or userspace
+tools will have to hardcode their values.
+
+Fixes: 4916f2e2f3fc ("bonding: print churn state via netlink")
+Fixes: 14c9551a32eb ("bonding: Implement port churn-machine (AD standard 43.4.17).")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260603123514.388226-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_3ad.c | 18 ++++++++++--------
+ drivers/net/bonding/bond_netlink.c | 4 ++--
+ drivers/net/bonding/bond_procfs.c | 8 ++++----
+ 3 files changed, 16 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -1348,8 +1348,8 @@ static void ad_churn_machine(struct port
+ {
+ if (port->sm_vars & AD_PORT_CHURNED) {
+ port->sm_vars &= ~AD_PORT_CHURNED;
+- port->sm_churn_actor_state = AD_CHURN_MONITOR;
+- port->sm_churn_partner_state = AD_CHURN_MONITOR;
++ WRITE_ONCE(port->sm_churn_actor_state, AD_CHURN_MONITOR);
++ WRITE_ONCE(port->sm_churn_partner_state, AD_CHURN_MONITOR);
+ port->sm_churn_actor_timer_counter =
+ __ad_timer_to_ticks(AD_ACTOR_CHURN_TIMER, 0);
+ port->sm_churn_partner_timer_counter =
+@@ -1360,20 +1360,22 @@ static void ad_churn_machine(struct port
+ !(--port->sm_churn_actor_timer_counter) &&
+ port->sm_churn_actor_state == AD_CHURN_MONITOR) {
+ if (port->actor_oper_port_state & LACP_STATE_SYNCHRONIZATION) {
+- port->sm_churn_actor_state = AD_NO_CHURN;
++ WRITE_ONCE(port->sm_churn_actor_state, AD_NO_CHURN);
+ } else {
+- port->churn_actor_count++;
+- port->sm_churn_actor_state = AD_CHURN;
++ WRITE_ONCE(port->churn_actor_count,
++ port->churn_actor_count + 1);
++ WRITE_ONCE(port->sm_churn_actor_state, AD_CHURN);
+ }
+ }
+ if (port->sm_churn_partner_timer_counter &&
+ !(--port->sm_churn_partner_timer_counter) &&
+ port->sm_churn_partner_state == AD_CHURN_MONITOR) {
+ if (port->partner_oper.port_state & LACP_STATE_SYNCHRONIZATION) {
+- port->sm_churn_partner_state = AD_NO_CHURN;
++ WRITE_ONCE(port->sm_churn_partner_state, AD_NO_CHURN);
+ } else {
+- port->churn_partner_count++;
+- port->sm_churn_partner_state = AD_CHURN;
++ WRITE_ONCE(port->churn_partner_count,
++ port->churn_partner_count + 1);
++ WRITE_ONCE(port->sm_churn_partner_state, AD_CHURN);
+ }
+ }
+ }
+--- a/drivers/net/bonding/bond_netlink.c
++++ b/drivers/net/bonding/bond_netlink.c
+@@ -82,10 +82,10 @@ static int bond_fill_slave_info(struct s
+ goto nla_put_failure_rcu;
+
+ if (nla_put_u8(skb, IFLA_BOND_SLAVE_AD_CHURN_ACTOR_STATE,
+- ad_port->sm_churn_actor_state))
++ READ_ONCE(ad_port->sm_churn_actor_state)))
+ goto nla_put_failure_rcu;
+ if (nla_put_u8(skb, IFLA_BOND_SLAVE_AD_CHURN_PARTNER_STATE,
+- ad_port->sm_churn_partner_state))
++ READ_ONCE(ad_port->sm_churn_partner_state)))
+ goto nla_put_failure_rcu;
+ }
+ rcu_read_unlock();
+--- a/drivers/net/bonding/bond_procfs.c
++++ b/drivers/net/bonding/bond_procfs.c
+@@ -220,13 +220,13 @@ static void bond_info_show_slave(struct
+ seq_printf(seq, "Aggregator ID: %d\n",
+ agg->aggregator_identifier);
+ seq_printf(seq, "Actor Churn State: %s\n",
+- bond_3ad_churn_desc(port->sm_churn_actor_state));
++ bond_3ad_churn_desc(READ_ONCE(port->sm_churn_actor_state)));
+ seq_printf(seq, "Partner Churn State: %s\n",
+- bond_3ad_churn_desc(port->sm_churn_partner_state));
++ bond_3ad_churn_desc(READ_ONCE(port->sm_churn_partner_state)));
+ seq_printf(seq, "Actor Churned Count: %d\n",
+- port->churn_actor_count);
++ READ_ONCE(port->churn_actor_count));
+ seq_printf(seq, "Partner Churned Count: %d\n",
+- port->churn_partner_count);
++ READ_ONCE(port->churn_partner_count));
+
+ if (capable(CAP_NET_ADMIN)) {
+ seq_puts(seq, "details actor lacp pdu:\n");
--- /dev/null
+From 82f9cc094975240885c93effbca7f4603f5de1bf Mon Sep 17 00:00:00 2001
+From: John Stultz <jstultz@google.com>
+Date: Thu, 14 Nov 2024 11:00:47 -0800
+Subject: locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex
+
+From: John Stultz <jstultz@google.com>
+
+commit 82f9cc094975240885c93effbca7f4603f5de1bf upstream.
+
+Anders had bisected a crash using PREEMPT_RT with linux-next and
+isolated it down to commit 894d1b3db41c ("locking/mutex: Remove
+wakeups from under mutex::wait_lock"), where it seemed the
+wake_q structure was somehow getting corrupted causing a null
+pointer traversal.
+
+I was able to easily repoduce this with PREEMPT_RT and managed
+to isolate down that through various call stacks we were
+actually calling wake_up_q() twice on the same wake_q.
+
+I found that in the problematic commit, I had added the
+wake_up_q() call in task_blocks_on_rt_mutex() around
+__ww_mutex_add_waiter(), following a similar pattern in
+__mutex_lock_common().
+
+However, its just wrong. We haven't dropped the lock->wait_lock,
+so its contrary to the point of the original patch. And it
+didn't match the __mutex_lock_common() logic of re-initializing
+the wake_q after calling it midway in the stack.
+
+Looking at it now, the wake_up_q() call is incorrect and should
+just be removed. So drop the erronious logic I had added.
+
+Fixes: 894d1b3db41c ("locking/mutex: Remove wakeups from under mutex::wait_lock")
+Closes: https://lore.kernel.org/lkml/6afb936f-17c7-43fa-90e0-b9e780866097@app.fastmail.com/
+Reported-by: Anders Roxell <anders.roxell@linaro.org>
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: John Stultz <jstultz@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Juri Lelli <juri.lelli@redhat.com>
+Tested-by: Anders Roxell <anders.roxell@linaro.org>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Link: https://lore.kernel.org/r/20241114190051.552665-1-jstultz@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/rtmutex.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/kernel/locking/rtmutex.c
++++ b/kernel/locking/rtmutex.c
+@@ -1248,10 +1248,7 @@ static int __sched task_blocks_on_rt_mut
+
+ /* Check whether the waiter should back out immediately */
+ rtm = container_of(lock, struct rt_mutex, rtmutex);
+- preempt_disable();
+ res = __ww_mutex_add_waiter(waiter, rtm, ww_ctx, wake_q);
+- wake_up_q(wake_q);
+- preempt_enable();
+ if (res) {
+ raw_spin_lock(&task->pi_lock);
+ rt_mutex_dequeue(lock, waiter);
--- /dev/null
+From e0caeb24f538c3c9c94f471882ceeb43d9dc2739 Mon Sep 17 00:00:00 2001
+From: Tonghao Zhang <tonghao@bamaicloud.com>
+Date: Thu, 16 Oct 2025 20:51:36 +0800
+Subject: net: bonding: update the slave array for broadcast mode
+
+From: Tonghao Zhang <tonghao@bamaicloud.com>
+
+commit e0caeb24f538c3c9c94f471882ceeb43d9dc2739 upstream.
+
+This patch fixes ce7a381697cb ("net: bonding: add broadcast_neighbor option for 802.3ad").
+Before this commit, on the broadcast mode, all devices were traversed using the
+bond_for_each_slave_rcu. This patch supports traversing devices by using all_slaves.
+Therefore, we need to update the slave array when enslave or release slave.
+
+Fixes: ce7a381697cb ("net: bonding: add broadcast_neighbor option for 802.3ad")
+Cc: Simon Horman <horms@kernel.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Andrew Lunn <andrew+netdev@lunn.ch>
+Cc: <stable@vger.kernel.org>
+Reported-by: Jiri Slaby <jirislaby@kernel.org>
+Tested-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://lore.kernel.org/all/a97e6e1e-81bc-4a79-8352-9e4794b0d2ca@kernel.org/
+Signed-off-by: Tonghao Zhang <tonghao@bamaicloud.com>
+Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Acked-by: Jay Vosburgh <jv@jvosburgh.net>
+Link: https://patch.msgid.link/20251016125136.16568-1-tonghao@bamaicloud.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2390,7 +2390,9 @@ skip_mac_set:
+ bpf_prog_inc(bond->xdp_prog);
+ }
+
+- if (bond_mode_can_use_xmit_hash(bond))
++ /* broadcast mode uses the all_slaves to loop through slaves. */
++ if (bond_mode_can_use_xmit_hash(bond) ||
++ BOND_MODE(bond) == BOND_MODE_BROADCAST)
+ bond_update_slave_arr(bond, NULL);
+
+ bond_xdp_set_features(bond_dev);
+@@ -2533,7 +2535,8 @@ static int __bond_release_one(struct net
+
+ bond_upper_dev_unlink(bond, slave);
+
+- if (bond_mode_can_use_xmit_hash(bond))
++ if (bond_mode_can_use_xmit_hash(bond) ||
++ BOND_MODE(bond) == BOND_MODE_BROADCAST)
+ bond_update_slave_arr(bond, slave);
+
+ slave_info(bond_dev, slave_dev, "Releasing %s interface\n",
crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch
crypto-qat-remove-unused-character-device-and-ioctls.patch
net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch
+locking-rtmutex-fix-wake_q-logic-in-task_blocks_on_rt_mutex.patch
+net-bonding-update-the-slave-array-for-broadcast-mode.patch
+bonding-annotate-data-races-arcound-churn-variables.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
