7.1-stable patches

added patches:
	net-sched-dualpi2-fix-gso-backlog-accounting.patch

diff --git a/queue-7.1/net-sched-dualpi2-fix-gso-backlog-accounting.patch b/queue-7.1/net-sched-dualpi2-fix-gso-backlog-accounting.patch
new file mode 100644 (file)
index 0000000..6cee4d4
--- /dev/null
+++ b/queue-7.1/net-sched-dualpi2-fix-gso-backlog-accounting.patch
@@ -0,0 +1,68 @@
+From 05ed733b65ab977dd931e7f7ac0f62fdb81205c2 Mon Sep 17 00:00:00 2001
+From: Xingquan Liu <b1n@b1n.io>
+Date: Fri, 19 Jun 2026 11:13:47 -0400
+Subject: net/sched: dualpi2: fix GSO backlog accounting
+
+From: Xingquan Liu <b1n@b1n.io>
+
+commit 05ed733b65ab977dd931e7f7ac0f62fdb81205c2 upstream.
+
+When DualPI2 splits a GSO skb into N segments, it propagates N
+additional packets to its parent before returning NET_XMIT_SUCCESS.
+The parent then accounts for the original skb once more, leaving its
+qlen one larger than the number of packets actually queued.
+
+With QFQ as the parent, after all real packets are dequeued, QFQ still
+has a non-zero qlen while its in-service aggregate has no active
+classes. qfq_choose_next_agg() returns NULL and qfq_dequeue() passes
+the result to qfq_peek_skb(), causing a NULL pointer dereference.
+
+Follow the same pattern used by tbf_segment() and taprio: count only
+successfully queued segments, propagate the difference between the
+original skb and those segments, and return NET_XMIT_SUCCESS whenever
+at least one segment was queued.
+
+Fixes: 8f9516daedd6 ("sched: Add enqueue/dequeue of dualpi2 qdisc")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xingquan Liu <b1n@b1n.io>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Reviewed-by: Victor Nogueira <victor@mojatatu.com>
+Link: https://patch.msgid.link/20260619151447.223640-1-b1n@b1n.io
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_dualpi2.c |   11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/net/sched/sch_dualpi2.c
++++ b/net/sched/sch_dualpi2.c
+@@ -461,7 +461,7 @@ static int dualpi2_qdisc_enqueue(struct
+               if (IS_ERR_OR_NULL(nskb))
+                       return qdisc_drop(skb, sch, to_free);
+ 
+-              cnt = 1;
++              cnt = 0;
+               byte_len = 0;
+               orig_len = qdisc_pkt_len(skb);
+               skb_list_walk_safe(nskb, nskb, next) {
+@@ -488,16 +488,15 @@ static int dualpi2_qdisc_enqueue(struct
+                               byte_len += nskb->len;
+                       }
+               }
+-              if (cnt > 1) {
++              if (cnt > 0) {
+                       /* The caller will add the original skb stats to its
+                        * backlog, compensate this if any nskb is enqueued.
+                        */
+-                      --cnt;
+-                      byte_len -= orig_len;
++                      qdisc_tree_reduce_backlog(sch, 1 - cnt,
++                                                orig_len - byte_len);
+               }
+-              qdisc_tree_reduce_backlog(sch, -cnt, -byte_len);
+               consume_skb(skb);
+-              return err;
++              return cnt > 0 ? NET_XMIT_SUCCESS : err;
+       }
+       return dualpi2_enqueue_skb(skb, sch, to_free);
+ }

diff --git a/queue-7.1/series b/queue-7.1/series
index 2b10839b9cb7627a6b9dff4597625e9905e71d30..f9cab6a5a11f8eac402bcc56c553256c1825d548 100644 (file)
--- a/queue-7.1/series
+++ b/queue-7.1/series
@@ -1,3 +1,4 @@
 rust-str-use-the-kernel-vertical-imports-style.patch
 rust-str-clean-unused-import-for-rust-1.98.patch
 userfaultfd-gate-must_wait-writability-check-on-pte_.patch
+net-sched-dualpi2-fix-gso-backlog-accounting.patch