6.12-stable patches

added patches:
	bonding-do-not-set-usable_slaves-for-broadcast-mode.patch

diff --git a/queue-6.12/bonding-do-not-set-usable_slaves-for-broadcast-mode.patch b/queue-6.12/bonding-do-not-set-usable_slaves-for-broadcast-mode.patch
new file mode 100644 (file)
index 0000000..889c334
--- /dev/null
+++ b/queue-6.12/bonding-do-not-set-usable_slaves-for-broadcast-mode.patch
@@ -0,0 +1,60 @@
+From 45fc134bcfadde456639c1b1e206e6918d69a553 Mon Sep 17 00:00:00 2001
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Wed, 4 Mar 2026 15:13:53 +0800
+Subject: bonding: do not set usable_slaves for broadcast mode
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+commit 45fc134bcfadde456639c1b1e206e6918d69a553 upstream.
+
+After commit e0caeb24f538 ("net: bonding: update the slave array for broadcast mode"),
+broadcast mode will also set all_slaves and usable_slaves during
+bond_enslave(). But if we also set updelay, during enslave, the
+slave init state will be BOND_LINK_BACK. And later
+bond_update_slave_arr() will alloc usable_slaves but add nothing.
+This will cause bond_miimon_inspect() to have ignore_updelay
+always true. So the updelay will be always ignored. e.g.
+
+[    6.498368] bond0: (slave veth2): link status definitely down, disabling slave
+[    7.536371] bond0: (slave veth2): link status up, enabling it in 0 ms
+[    7.536402] bond0: (slave veth2): link status definitely up, 10000 Mbps full duplex
+
+To fix it, we can either always call bond_update_slave_arr() on every
+place when link changes. Or, let's just not set usable_slaves for
+broadcast mode.
+
+Fixes: e0caeb24f538 ("net: bonding: update the slave array for broadcast mode")
+Reported-by: Liang Li <liali@redhat.com>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://patch.msgid.link/20260304-b4-bond_updelay-v1-1-f72eb2e454d0@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c |   13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -5191,13 +5191,18 @@ static void bond_set_slave_arr(struct bo
+ {
+       struct bond_up_slave *usable, *all;
+ 
+-      usable = rtnl_dereference(bond->usable_slaves);
+-      rcu_assign_pointer(bond->usable_slaves, usable_slaves);
+-      kfree_rcu(usable, rcu);
+-
+       all = rtnl_dereference(bond->all_slaves);
+       rcu_assign_pointer(bond->all_slaves, all_slaves);
+       kfree_rcu(all, rcu);
++
++      if (BOND_MODE(bond) == BOND_MODE_BROADCAST) {
++              kfree_rcu(usable_slaves, rcu);
++              return;
++      }
++
++      usable = rtnl_dereference(bond->usable_slaves);
++      rcu_assign_pointer(bond->usable_slaves, usable_slaves);
++      kfree_rcu(usable, rcu);
+ }
+ 
+ static void bond_reset_slave_arr(struct bonding *bond)

diff --git a/queue-6.12/series b/queue-6.12/series
index a8be6ad236ed2ebf1c793e43b1e0dcc23c79a376..f66ae5ddb349adf629b99f73a4ea962054056546 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -201,3 +201,4 @@ net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch
 locking-rtmutex-fix-wake_q-logic-in-task_blocks_on_rt_mutex.patch
 net-bonding-update-the-slave-array-for-broadcast-mode.patch
 bonding-annotate-data-races-arcound-churn-variables.patch
+bonding-do-not-set-usable_slaves-for-broadcast-mode.patch