--- /dev/null
+From 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Tue, 23 Jun 2026 16:22:15 +0200
+Subject: iio: imu: inv_icm42600: fix timestamp clock period by using lower value
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream.
+
+Clock period value is used for computing periods of sampling. There is
+no need for it to be higher than the maximum odr, otherwise we are
+losing precision in the computation for nothing.
+
+Switch clock period value to maximum odr period (8kHz).
+
+Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 ++--
+ drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+@@ -725,10 +725,10 @@ struct iio_dev *inv_icm42600_accel_init(
+ return ERR_PTR(-ENOMEM);
+
+ /*
+- * clock period is 32kHz (31250ns)
++ * clock period is 8kHz (125000ns)
+ * jitter is +/- 2% (20 per mille)
+ */
+- ts_chip.clock_period = 31250;
++ ts_chip.clock_period = 125000;
+ ts_chip.jitter = 20;
+ ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
+ ts = iio_priv(indio_dev);
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+@@ -736,10 +736,10 @@ struct iio_dev *inv_icm42600_gyro_init(s
+ return ERR_PTR(-ENOMEM);
+
+ /*
+- * clock period is 32kHz (31250ns)
++ * clock period is 8kHz (125000ns)
+ * jitter is +/- 2% (20 per mille)
+ */
+- ts_chip.clock_period = 31250;
++ ts_chip.clock_period = 125000;
+ ts_chip.jitter = 20;
+ ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
+ ts = iio_priv(indio_dev);
--- /dev/null
+From daec424cc57b33a28f8621eb7ac85f8bd327bd6b Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Mon, 19 Feb 2024 15:47:41 +0000
+Subject: iio: imu: inv_mpu6050: fix frequency setting when chip is off
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit daec424cc57b33a28f8621eb7ac85f8bd327bd6b upstream.
+
+Track correctly FIFO state and apply ODR change before starting
+the chip. Without the fix, you cannot change ODR more than 1 time
+when data buffering is off. This restriction on a single pending ODR
+change should only apply when the FIFO is on.
+
+Fixes: 111e1abd0045 ("iio: imu: inv_mpu6050: use the common inv_sensors timestamp module")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Link: https://lore.kernel.org/r/20240219154741.90601-1-inv.git-commit@tdk.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
+@@ -112,6 +112,7 @@ int inv_mpu6050_prepare_fifo(struct inv_
+ if (enable) {
+ /* reset timestamping */
+ inv_sensors_timestamp_reset(&st->timestamp);
++ inv_sensors_timestamp_apply_odr(&st->timestamp, 0, 0, 0);
+ /* reset FIFO */
+ d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST;
+ ret = regmap_write(st->map, st->reg->user_ctrl, d);
+@@ -187,6 +188,10 @@ static int inv_mpu6050_set_enable(struct
+ if (result)
+ goto error_power_off;
+ } else {
++ st->chip_config.gyro_fifo_enable = 0;
++ st->chip_config.accl_fifo_enable = 0;
++ st->chip_config.temp_fifo_enable = 0;
++ st->chip_config.magn_fifo_enable = 0;
+ result = inv_mpu6050_prepare_fifo(st, false);
+ if (result)
+ goto error_power_off;
--- /dev/null
+From 95444b9eeb8c5c0330563931d70c61ca3b101548 Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Fri, 24 May 2024 12:48:51 +0000
+Subject: iio: invensense: fix odr switching to same value
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit 95444b9eeb8c5c0330563931d70c61ca3b101548 upstream.
+
+ODR switching happens in 2 steps, update to store the new value and then
+apply when the ODR change flag is received in the data. When switching to
+the same ODR value, the ODR change flag is never happening, and frequency
+switching is blocked waiting for the never coming apply.
+
+Fix the issue by preventing update to happen when switching to same ODR
+value.
+
+Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Link: https://lore.kernel.org/r/20240524124851.567485-1-inv.git-commit@tdk.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
++++ b/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
+@@ -60,11 +60,15 @@ EXPORT_SYMBOL_NS_GPL(inv_sensors_timesta
+ int inv_sensors_timestamp_update_odr(struct inv_sensors_timestamp *ts,
+ uint32_t period, bool fifo)
+ {
++ uint32_t mult;
++
+ /* when FIFO is on, prevent odr change if one is already pending */
+ if (fifo && ts->new_mult != 0)
+ return -EAGAIN;
+
+- ts->new_mult = period / ts->chip.clock_period;
++ mult = period / ts->chip.clock_period;
++ if (mult != ts->mult)
++ ts->new_mult = mult;
+
+ return 0;
+ }
--- /dev/null
+From 4e43e64d0f1332fcc503babad4dc31aead7131ca Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 28 Jun 2022 12:12:48 +0000
+Subject: ipv6: fix lockdep splat in in6_dump_addrs()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 4e43e64d0f1332fcc503babad4dc31aead7131ca upstream.
+
+As reported by syzbot, we should not use rcu_dereference()
+when rcu_read_lock() is not held.
+
+WARNING: suspicious RCU usage
+5.19.0-rc2-syzkaller #0 Not tainted
+
+net/ipv6/addrconf.c:5175 suspicious rcu_dereference_check() usage!
+
+other info that might help us debug this:
+
+rcu_scheduler_active = 2, debug_locks = 1
+1 lock held by syz-executor326/3617:
+ #0: ffffffff8d5848e8 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0xae/0xc20 net/netlink/af_netlink.c:2223
+
+stack backtrace:
+CPU: 0 PID: 3617 Comm: syz-executor326 Not tainted 5.19.0-rc2-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
+ in6_dump_addrs+0x12d1/0x1790 net/ipv6/addrconf.c:5175
+ inet6_dump_addr+0x9c1/0xb50 net/ipv6/addrconf.c:5300
+ netlink_dump+0x541/0xc20 net/netlink/af_netlink.c:2275
+ __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2380
+ netlink_dump_start include/linux/netlink.h:245 [inline]
+ rtnetlink_rcv_msg+0x73e/0xc90 net/core/rtnetlink.c:6046
+ netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
+ netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
+ netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
+ netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
+ sock_sendmsg_nosec net/socket.c:714 [inline]
+ sock_sendmsg+0xcf/0x120 net/socket.c:734
+ ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
+ ___sys_sendmsg+0xf3/0x170 net/socket.c:2546
+ __sys_sendmsg net/socket.c:2575 [inline]
+ __do_sys_sendmsg net/socket.c:2584 [inline]
+ __se_sys_sendmsg net/socket.c:2582 [inline]
+ __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Taehee Yoo <ap420073@gmail.com>
+Link: https://lore.kernel.org/r/20220628121248.858695-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/addrconf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -5178,9 +5178,9 @@ next:
+ fillargs->event = RTM_GETMULTICAST;
+
+ /* multicast address */
+- for (ifmca = rcu_dereference(idev->mc_list);
++ for (ifmca = rtnl_dereference(idev->mc_list);
+ ifmca;
+- ifmca = rcu_dereference(ifmca->next), ip_idx++) {
++ ifmca = rtnl_dereference(ifmca->next), ip_idx++) {
+ if (ip_idx < s_ip_idx)
+ continue;
+ err = inet6_fill_ifmcaddr(skb, ifmca, fillargs);
--- /dev/null
+From ae3264a25a4635531264728859dbe9c659fad554 Mon Sep 17 00:00:00 2001
+From: Yue Haibing <yuehaibing@huawei.com>
+Date: Mon, 14 Jul 2025 22:19:57 +0800
+Subject: ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
+
+From: Yue Haibing <yuehaibing@huawei.com>
+
+commit ae3264a25a4635531264728859dbe9c659fad554 upstream.
+
+pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec()
+does, the reference should be put after ip6_mc_clear_src() return.
+
+Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data")
+Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
+Link: https://patch.msgid.link/20250714141957.3301871-1-yuehaibing@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/mcast.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -806,8 +806,8 @@ static void mld_del_delrec(struct inet6_
+ } else {
+ im->mca_crcount = idev->mc_qrv;
+ }
+- in6_dev_put(pmc->idev);
+ ip6_mc_clear_src(pmc);
++ in6_dev_put(pmc->idev);
+ kfree_rcu(pmc, rcu);
+ }
+ }
--- /dev/null
+From 2e7ef287f07c74985f1bf2858bedc62bd9ebf155 Mon Sep 17 00:00:00 2001
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Date: Wed, 17 Jan 2024 09:21:02 -0800
+Subject: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+commit 2e7ef287f07c74985f1bf2858bedc62bd9ebf155 upstream.
+
+idev->mc_ifc_count can be written over without proper locking.
+
+Originally found by syzbot [1], fix this issue by encapsulating calls
+to mld_ifc_stop_work() (and mld_gq_stop_work() for good measure) with
+mutex_lock() and mutex_unlock() accordingly as these functions
+should only be called with mc_lock per their declarations.
+
+[1]
+BUG: KCSAN: data-race in ipv6_mc_down / mld_ifc_work
+
+write to 0xffff88813a80c832 of 1 bytes by task 3771 on cpu 0:
+ mld_ifc_stop_work net/ipv6/mcast.c:1080 [inline]
+ ipv6_mc_down+0x10a/0x280 net/ipv6/mcast.c:2725
+ addrconf_ifdown+0xe32/0xf10 net/ipv6/addrconf.c:3949
+ addrconf_notify+0x310/0x980
+ notifier_call_chain kernel/notifier.c:93 [inline]
+ raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461
+ __dev_notify_flags+0x205/0x3d0
+ dev_change_flags+0xab/0xd0 net/core/dev.c:8685
+ do_setlink+0x9f6/0x2430 net/core/rtnetlink.c:2916
+ rtnl_group_changelink net/core/rtnetlink.c:3458 [inline]
+ __rtnl_newlink net/core/rtnetlink.c:3717 [inline]
+ rtnl_newlink+0xbb3/0x1670 net/core/rtnetlink.c:3754
+ rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6558
+ netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2545
+ rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6576
+ netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
+ netlink_unicast+0x589/0x650 net/netlink/af_netlink.c:1368
+ netlink_sendmsg+0x66e/0x770 net/netlink/af_netlink.c:1910
+ ...
+
+write to 0xffff88813a80c832 of 1 bytes by task 22 on cpu 1:
+ mld_ifc_work+0x54c/0x7b0 net/ipv6/mcast.c:2653
+ process_one_work kernel/workqueue.c:2627 [inline]
+ process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2700
+ worker_thread+0x525/0x730 kernel/workqueue.c:2781
+ ...
+
+Fixes: 2d9a93b4902b ("mld: convert from timer to delayed work")
+Reported-by: syzbot+a9400cabb1d784e49abf@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/all/000000000000994e09060ebcdffb@google.com/
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Acked-by: Taehee Yoo <ap420073@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://lore.kernel.org/r/20240117172102.12001-1-n.zhandarovich@fintech.ru
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/mcast.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2754,8 +2754,12 @@ void ipv6_mc_down(struct inet6_dev *idev
+ synchronize_net();
+ mld_query_stop_work(idev);
+ mld_report_stop_work(idev);
++
++ mutex_lock(&idev->mc_lock);
+ mld_ifc_stop_work(idev);
+ mld_gq_stop_work(idev);
++ mutex_unlock(&idev->mc_lock);
++
+ mld_dad_stop_work(idev);
+ }
+
--- /dev/null
+From 17ef8efc00b34918b966388b2af0993811895a8c Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 9 Feb 2024 15:30:56 +0000
+Subject: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 17ef8efc00b34918b966388b2af0993811895a8c upstream.
+
+As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops
+in igmp6_event_query() and igmp6_event_report()")) I think the
+synchronize_net() call in ipv6_mc_down() is not needed.
+
+Under load, synchronize_net() can last between 200 usec and 5 ms.
+
+KASAN seems to agree as well.
+
+Fixes: f185de28d9ae ("mld: add new workqueues for process mld events")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Taehee Yoo <ap420073@gmail.com>
+Cc: Cong Wang <xiyou.wangcong@gmail.com>
+Cc: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/mcast.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2751,7 +2751,6 @@ void ipv6_mc_down(struct inet6_dev *idev
+ /* Should stop work after group drop. or we will
+ * start work again in mld_ifc_event()
+ */
+- synchronize_net();
+ mld_query_stop_work(idev);
+ mld_report_stop_work(idev);
+
--- /dev/null
+From 26394fc118d6115390bd5b3a0fb17096271da227 Mon Sep 17 00:00:00 2001
+From: Ignat Korchagin <ignat@cloudflare.com>
+Date: Fri, 11 Feb 2022 17:30:42 +0000
+Subject: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+commit 26394fc118d6115390bd5b3a0fb17096271da227 upstream.
+
+Some time ago 8965779d2c0e ("ipv6,mcast: always hold idev->lock before mca_lock")
+switched ipv6_get_lladdr() to __ipv6_get_lladdr(), which is rcu-unsafe
+version. That was OK, because idev->lock was held for these codepaths.
+
+In 88e2ca308094 ("mld: convert ifmcaddr6 to RCU") these external locks were
+removed, so we probably need to restore the original rcu-safe call.
+
+Otherwise, we occasionally get a machine crashed/stalled with the following
+in dmesg:
+
+[ 3405.966610][T230589] general protection fault, probably for non-canonical address 0xdead00000000008c: 0000 [#1] SMP NOPTI
+[ 3405.982083][T230589] CPU: 44 PID: 230589 Comm: kworker/44:3 Tainted: G O 5.15.19-cloudflare-2022.2.1 #1
+[ 3405.998061][T230589] Hardware name: SUPA-COOL-SERV
+[ 3406.009552][T230589] Workqueue: mld mld_ifc_work
+[ 3406.017224][T230589] RIP: 0010:__ipv6_get_lladdr+0x34/0x60
+[ 3406.025780][T230589] Code: 57 10 48 83 c7 08 48 89 e5 48 39 d7 74 3e 48 8d 82 38 ff ff ff eb 13 48 8b 90 d0 00 00 00 48 8d 82 38 ff ff ff 48 39 d7 74 22 <66> 83 78 32 20 77 1b 75 e4 89 ca 23 50 2c 75 dd 48 8b 50 08 48 8b
+[ 3406.055748][T230589] RSP: 0018:ffff94e4b3fc3d10 EFLAGS: 00010202
+[ 3406.065617][T230589] RAX: dead00000000005a RBX: ffff94e4b3fc3d30 RCX: 0000000000000040
+[ 3406.077477][T230589] RDX: dead000000000122 RSI: ffff94e4b3fc3d30 RDI: ffff8c3a31431008
+[ 3406.089389][T230589] RBP: ffff94e4b3fc3d10 R08: 0000000000000000 R09: 0000000000000000
+[ 3406.101445][T230589] R10: ffff8c3a31430000 R11: 000000000000000b R12: ffff8c2c37887100
+[ 3406.113553][T230589] R13: ffff8c3a39537000 R14: 00000000000005dc R15: ffff8c3a31431000
+[ 3406.125730][T230589] FS: 0000000000000000(0000) GS:ffff8c3b9fc80000(0000) knlGS:0000000000000000
+[ 3406.138992][T230589] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 3406.149895][T230589] CR2: 00007f0dfea1db60 CR3: 000000387b5f2000 CR4: 0000000000350ee0
+[ 3406.162421][T230589] Call Trace:
+[ 3406.170235][T230589] <TASK>
+[ 3406.177736][T230589] mld_newpack+0xfe/0x1a0
+[ 3406.186686][T230589] add_grhead+0x87/0xa0
+[ 3406.195498][T230589] add_grec+0x485/0x4e0
+[ 3406.204310][T230589] ? newidle_balance+0x126/0x3f0
+[ 3406.214024][T230589] mld_ifc_work+0x15d/0x450
+[ 3406.223279][T230589] process_one_work+0x1e6/0x380
+[ 3406.232982][T230589] worker_thread+0x50/0x3a0
+[ 3406.242371][T230589] ? rescuer_thread+0x360/0x360
+[ 3406.252175][T230589] kthread+0x127/0x150
+[ 3406.261197][T230589] ? set_kthread_struct+0x40/0x40
+[ 3406.271287][T230589] ret_from_fork+0x22/0x30
+[ 3406.280812][T230589] </TASK>
+[ 3406.288937][T230589] Modules linked in: ... [last unloaded: kheaders]
+[ 3406.476714][T230589] ---[ end trace 3525a7655f2f3b9e ]---
+
+Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU")
+Reported-by: David Pinilla Caparros <dpini@cloudflare.com>
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/addrconf.h | 2 --
+ net/ipv6/addrconf.c | 4 ++--
+ net/ipv6/mcast.c | 2 +-
+ 3 files changed, 3 insertions(+), 5 deletions(-)
+
+--- a/include/net/addrconf.h
++++ b/include/net/addrconf.h
+@@ -117,8 +117,6 @@ struct inet6_ifaddr *ipv6_get_ifaddr(str
+ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dev,
+ const struct in6_addr *daddr, unsigned int srcprefs,
+ struct in6_addr *saddr);
+-int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
+- u32 banned_flags);
+ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
+ u32 banned_flags);
+ bool inet_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2,
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1851,8 +1851,8 @@ out:
+ }
+ EXPORT_SYMBOL(ipv6_dev_get_saddr);
+
+-int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
+- u32 banned_flags)
++static int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
++ u32 banned_flags)
+ {
+ struct inet6_ifaddr *ifp;
+ int err = -EADDRNOTAVAIL;
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -1776,7 +1776,7 @@ static struct sk_buff *mld_newpack(struc
+ skb_reserve(skb, hlen);
+ skb_tailroom_reserve(skb, mtu, tlen);
+
+- if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
++ if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
+ /* <draft-ietf-magma-mld-source-05.txt>:
+ * use unspecified address as the source address
+ * when a valid link-local address is not available.
--- /dev/null
+From 4b4b84468aa27d0a18be8cb727f246aa35a3406d Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Sun, 4 Apr 2021 13:38:23 +0000
+Subject: mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+commit 4b4b84468aa27d0a18be8cb727f246aa35a3406d upstream.
+
+struct ip6_sf_socklist and ipv6_mc_socklist are per-socket MLD data.
+These data are protected by rtnl lock, socket lock, and RCU.
+So, when these are used, it verifies whether rtnl lock is acquired or not.
+
+ip6_mc_msfget() is called by do_ipv6_getsockopt().
+But caller doesn't acquire rtnl lock.
+So, when these data are used in the ip6_mc_msfget() lockdep warns about it.
+But accessing these is actually safe because socket lock was acquired by
+do_ipv6_getsockopt().
+
+So, it changes lockdep annotation from rtnl lock to socket lock.
+(rtnl_dereference -> sock_dereference)
+
+Locking graph for mld data is like below:
+
+When writing mld data:
+do_ipv6_setsockopt()
+ rtnl_lock
+ lock_sock
+ (mld functions)
+ idev->mc_lock(if per-interface mld data is modified)
+
+When reading mld data:
+do_ipv6_getsockopt()
+ lock_sock
+ ip6_mc_msfget()
+
+Splat looks like:
+=============================
+WARNING: suspicious RCU usage
+5.12.0-rc4+ #503 Not tainted
+-----------------------------
+net/ipv6/mcast.c:610 suspicious rcu_dereference_protected() usage!
+
+other info that might help us debug this:
+
+rcu_scheduler_active = 2, debug_locks = 1
+1 lock held by mcast-listener-/923:
+ #0: ffff888007958a70 (sk_lock-AF_INET6){+.+.}-{0:0}, at:
+ipv6_get_msfilter+0xaf/0x190
+
+stack backtrace:
+CPU: 1 PID: 923 Comm: mcast-listener- Not tainted 5.12.0-rc4+ #503
+Call Trace:
+ dump_stack+0xa4/0xe5
+ ip6_mc_msfget+0x553/0x6c0
+ ? ipv6_sock_mc_join_ssm+0x10/0x10
+ ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0
+ ? mark_held_locks+0xb7/0x120
+ ? lockdep_hardirqs_on_prepare+0x27c/0x3e0
+ ? __local_bh_enable_ip+0xa5/0xf0
+ ? lock_sock_nested+0x82/0xf0
+ ipv6_get_msfilter+0xc3/0x190
+ ? compat_ipv6_get_msfilter+0x300/0x300
+ ? lock_downgrade+0x690/0x690
+ do_ipv6_getsockopt.isra.6.constprop.13+0x1809/0x29e0
+ ? do_ipv6_mcast_group_source+0x150/0x150
+ ? register_lock_class+0x1750/0x1750
+ ? kvm_sched_clock_read+0x14/0x30
+ ? sched_clock+0x5/0x10
+ ? sched_clock_cpu+0x18/0x170
+ ? find_held_lock+0x3a/0x1c0
+ ? lock_downgrade+0x690/0x690
+ ? ipv6_getsockopt+0xdb/0x1b0
+ ipv6_getsockopt+0xdb/0x1b0
+[ ... ]
+
+Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU")
+Reported-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/mcast.c | 48 +++++++++++++++++++++++-------------------------
+ net/tipc/udp_media.c | 2 ++
+ 2 files changed, 25 insertions(+), 25 deletions(-)
+
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -114,10 +114,13 @@ int sysctl_mld_qrv __read_mostly = MLD_Q
+ #define mc_dereference(e, idev) \
+ rcu_dereference_protected(e, lockdep_is_held(&(idev)->mc_lock))
+
+-#define for_each_pmc_rtnl(np, pmc) \
+- for (pmc = rtnl_dereference((np)->ipv6_mc_list); \
++#define sock_dereference(e, sk) \
++ rcu_dereference_protected(e, lockdep_sock_is_held(sk))
++
++#define for_each_pmc_socklock(np, sk, pmc) \
++ for (pmc = sock_dereference((np)->ipv6_mc_list, sk); \
+ pmc; \
+- pmc = rtnl_dereference(pmc->next))
++ pmc = sock_dereference(pmc->next, sk))
+
+ #define for_each_pmc_rcu(np, pmc) \
+ for (pmc = rcu_dereference((np)->ipv6_mc_list); \
+@@ -183,7 +186,7 @@ static int __ipv6_sock_mc_join(struct so
+ if (!ipv6_addr_is_multicast(addr))
+ return -EINVAL;
+
+- for_each_pmc_rtnl(np, mc_lst) {
++ for_each_pmc_socklock(np, sk, mc_lst) {
+ if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
+ ipv6_addr_equal(&mc_lst->addr, addr))
+ return -EADDRINUSE;
+@@ -261,7 +264,7 @@ int ipv6_sock_mc_drop(struct sock *sk, i
+ return -EINVAL;
+
+ for (lnk = &np->ipv6_mc_list;
+- (mc_lst = rtnl_dereference(*lnk)) != NULL;
++ (mc_lst = sock_dereference(*lnk, sk)) != NULL;
+ lnk = &mc_lst->next) {
+ if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
+ ipv6_addr_equal(&mc_lst->addr, addr)) {
+@@ -326,7 +329,7 @@ void __ipv6_sock_mc_close(struct sock *s
+
+ ASSERT_RTNL();
+
+- while ((mc_lst = rtnl_dereference(np->ipv6_mc_list)) != NULL) {
++ while ((mc_lst = sock_dereference(np->ipv6_mc_list, sk)) != NULL) {
+ struct net_device *dev;
+
+ np->ipv6_mc_list = mc_lst->next;
+@@ -353,8 +356,11 @@ void ipv6_sock_mc_close(struct sock *sk)
+
+ if (!rcu_access_pointer(np->ipv6_mc_list))
+ return;
++
+ rtnl_lock();
++ lock_sock(sk);
+ __ipv6_sock_mc_close(sk);
++ release_sock(sk);
+ rtnl_unlock();
+ }
+
+@@ -384,7 +390,7 @@ int ip6_mc_source(int add, int omode, st
+ err = -EADDRNOTAVAIL;
+
+ mutex_lock(&idev->mc_lock);
+- for_each_pmc_rtnl(inet6, pmc) {
++ for_each_pmc_socklock(inet6, sk, pmc) {
+ if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface)
+ continue;
+ if (ipv6_addr_equal(&pmc->addr, group))
+@@ -407,7 +413,7 @@ int ip6_mc_source(int add, int omode, st
+ pmc->sfmode = omode;
+ }
+
+- psl = rtnl_dereference(pmc->sflist);
++ psl = sock_dereference(pmc->sflist, sk);
+ if (!add) {
+ if (!psl)
+ goto done; /* err = -EADDRNOTAVAIL */
+@@ -514,7 +520,7 @@ int ip6_mc_msfilter(struct sock *sk, str
+ goto done;
+ }
+
+- for_each_pmc_rtnl(inet6, pmc) {
++ for_each_pmc_socklock(inet6, sk, pmc) {
+ if (pmc->ifindex != gsf->gf_interface)
+ continue;
+ if (ipv6_addr_equal(&pmc->addr, group))
+@@ -555,7 +561,7 @@ int ip6_mc_msfilter(struct sock *sk, str
+ }
+
+ mutex_lock(&idev->mc_lock);
+- psl = rtnl_dereference(pmc->sflist);
++ psl = sock_dereference(pmc->sflist, sk);
+ if (psl) {
+ ip6_mc_del_src(idev, group, pmc->sfmode,
+ psl->sl_count, psl->sl_addr, 0);
+@@ -577,40 +583,32 @@ done:
+ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
+ struct sockaddr_storage *p)
+ {
+- int err, i, count, copycount;
++ struct ipv6_pinfo *inet6 = inet6_sk(sk);
+ const struct in6_addr *group;
+ struct ipv6_mc_socklist *pmc;
+- struct inet6_dev *idev;
+- struct ipv6_pinfo *inet6 = inet6_sk(sk);
+ struct ip6_sf_socklist *psl;
+- struct net *net = sock_net(sk);
++ int i, count, copycount;
+
+ group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
+
+ if (!ipv6_addr_is_multicast(group))
+ return -EINVAL;
+
+- idev = ip6_mc_find_dev_rtnl(net, group, gsf->gf_interface);
+- if (!idev)
+- return -ENODEV;
+-
+- err = -EADDRNOTAVAIL;
+ /* changes to the ipv6_mc_list require the socket lock and
+- * rtnl lock. We have the socket lock and rcu read lock,
+- * so reading the list is safe.
++ * rtnl lock. We have the socket lock, so reading the list is safe.
+ */
+
+- for_each_pmc_rtnl(inet6, pmc) {
++ for_each_pmc_socklock(inet6, sk, pmc) {
+ if (pmc->ifindex != gsf->gf_interface)
+ continue;
+ if (ipv6_addr_equal(group, &pmc->addr))
+ break;
+ }
+ if (!pmc) /* must have a prior join */
+- return err;
++ return -EADDRNOTAVAIL;
+
+ gsf->gf_fmode = pmc->sfmode;
+- psl = rtnl_dereference(pmc->sflist);
++ psl = sock_dereference(pmc->sflist, sk);
+ count = psl ? psl->sl_count : 0;
+
+ copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
+@@ -2620,7 +2618,7 @@ static int ip6_mc_leave_src(struct sock
+ struct ip6_sf_socklist *psl;
+ int err;
+
+- psl = rtnl_dereference(iml->sflist);
++ psl = sock_dereference(iml->sflist, sk);
+
+ if (idev)
+ mutex_lock(&idev->mc_lock);
+--- a/net/tipc/udp_media.c
++++ b/net/tipc/udp_media.c
+@@ -411,8 +411,10 @@ static int enable_mcast(struct udp_beare
+ err = ip_mc_join_group(sk, &mreqn);
+ #if IS_ENABLED(CONFIG_IPV6)
+ } else {
++ lock_sock(sk);
+ err = ipv6_stub->ipv6_sock_mc_join(sk, ub->ifindex,
+ &remote->ipv6);
++ release_sock(sk);
+ #endif
+ }
+ return err;
--- /dev/null
+From aa8caa767e319bad34a82bfce7da1ed2b9c0ed6f Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Fri, 16 Apr 2021 14:16:06 +0000
+Subject: mld: fix suspicious RCU usage in __ipv6_dev_mc_dec()
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+commit aa8caa767e319bad34a82bfce7da1ed2b9c0ed6f upstream.
+
+__ipv6_dev_mc_dec() internally uses sleepable functions so that caller
+must not acquire atomic locks. But caller, which is addrconf_verify_rtnl()
+acquires rcu_read_lock_bh().
+So this warning occurs in the __ipv6_dev_mc_dec().
+
+Test commands:
+ ip netns add A
+ ip link add veth0 type veth peer name veth1
+ ip link set veth1 netns A
+ ip link set veth0 up
+ ip netns exec A ip link set veth1 up
+ ip a a 2001:db8::1/64 dev veth0 valid_lft 2 preferred_lft 1
+
+Splat looks like:
+============================
+WARNING: suspicious RCU usage
+5.12.0-rc6+ #515 Not tainted
+-----------------------------
+kernel/sched/core.c:8294 Illegal context switch in RCU-bh read-side
+critical section!
+
+other info that might help us debug this:
+
+rcu_scheduler_active = 2, debug_locks = 1
+4 locks held by kworker/4:0/1997:
+ #0: ffff88810bd72d48 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at:
+process_one_work+0x761/0x1440
+ #1: ffff888105c8fe00 ((addr_chk_work).work){+.+.}-{0:0}, at:
+process_one_work+0x795/0x1440
+ #2: ffffffffb9279fb0 (rtnl_mutex){+.+.}-{3:3}, at:
+addrconf_verify_work+0xa/0x20
+ #3: ffffffffb8e30860 (rcu_read_lock_bh){....}-{1:2}, at:
+addrconf_verify_rtnl+0x23/0xc60
+
+stack backtrace:
+CPU: 4 PID: 1997 Comm: kworker/4:0 Not tainted 5.12.0-rc6+ #515
+Workqueue: ipv6_addrconf addrconf_verify_work
+Call Trace:
+ dump_stack+0xa4/0xe5
+ ___might_sleep+0x27d/0x2b0
+ __mutex_lock+0xc8/0x13f0
+ ? lock_downgrade+0x690/0x690
+ ? __ipv6_dev_mc_dec+0x49/0x2a0
+ ? mark_held_locks+0xb7/0x120
+ ? mutex_lock_io_nested+0x1270/0x1270
+ ? lockdep_hardirqs_on_prepare+0x12c/0x3e0
+ ? _raw_spin_unlock_irqrestore+0x47/0x50
+ ? trace_hardirqs_on+0x41/0x120
+ ? __wake_up_common_lock+0xc9/0x100
+ ? __wake_up_common+0x620/0x620
+ ? memset+0x1f/0x40
+ ? netlink_broadcast_filtered+0x2c4/0xa70
+ ? __ipv6_dev_mc_dec+0x49/0x2a0
+ __ipv6_dev_mc_dec+0x49/0x2a0
+ ? netlink_broadcast_filtered+0x2f6/0xa70
+ addrconf_leave_solict.part.64+0xad/0xf0
+ ? addrconf_join_solict.part.63+0xf0/0xf0
+ ? nlmsg_notify+0x63/0x1b0
+ __ipv6_ifa_notify+0x22c/0x9c0
+ ? inet6_fill_ifaddr+0xbe0/0xbe0
+ ? lockdep_hardirqs_on_prepare+0x12c/0x3e0
+ ? __local_bh_enable_ip+0xa5/0xf0
+ ? ipv6_del_addr+0x347/0x870
+ ipv6_del_addr+0x3b1/0x870
+ ? addrconf_ifdown+0xfe0/0xfe0
+ ? rcu_read_lock_any_held.part.27+0x20/0x20
+ addrconf_verify_rtnl+0x8a9/0xc60
+ addrconf_verify_work+0xf/0x20
+ process_one_work+0x84c/0x1440
+
+In order to avoid this problem, it uses rcu_read_unlock_bh() for
+a short time. RCU is used for avoiding freeing
+ifp(struct *inet6_ifaddr) while ifp is being used. But this will
+not be released even if rcu_read_unlock_bh() is used.
+Because before rcu_read_unlock_bh(), it uses in6_ifa_hold(ifp).
+So this is safe.
+
+Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data")
+Suggested-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/addrconf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -4550,7 +4550,9 @@ restart:
+ age >= ifp->valid_lft) {
+ spin_unlock(&ifp->lock);
+ in6_ifa_hold(ifp);
++ rcu_read_unlock_bh();
+ ipv6_del_addr(ifp);
++ rcu_read_lock_bh();
+ goto restart;
+ } else if (ifp->prefered_lft == INFINITY_LIFE_TIME) {
+ spin_unlock(&ifp->lock);
--- /dev/null
+From 8b8701d0b4925807a6d4dc4699cb80a1e16218ad Mon Sep 17 00:00:00 2001
+From: Kristian Evensen <kristian.evensen@gmail.com>
+Date: Wed, 9 Jun 2021 16:32:49 +0200
+Subject: net: ethernet: rmnet: Always subtract MAP header
+
+From: Kristian Evensen <kristian.evensen@gmail.com>
+
+commit 8b8701d0b4925807a6d4dc4699cb80a1e16218ad upstream.
+
+Commit e1d9a90a9bfd ("net: ethernet: rmnet: Support for ingress MAPv5
+checksum offload") broke ingress handling for devices where
+RMNET_FLAGS_INGRESS_MAP_CKSUMV5 or RMNET_FLAGS_INGRESS_MAP_CKSUMV4 are
+not set. Unless either of these flags are set, the MAP header is not
+removed. This commit restores the original logic by ensuring that the
+MAP header is removed for all MAP packets.
+
+Fixes: e1d9a90a9bfd ("net: ethernet: rmnet: Support for ingress MAPv5 checksum offload")
+Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+@@ -88,11 +88,12 @@ __rmnet_map_ingress_handler(struct sk_bu
+ goto free_skb;
+ skb_pull(skb, sizeof(*map_header));
+ rmnet_set_skb_proto(skb);
+- } else if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4) {
++ } else {
+ /* Subtract MAP header */
+ skb_pull(skb, sizeof(*map_header));
+ rmnet_set_skb_proto(skb);
+- if (!rmnet_map_checksum_downlink_packet(skb, len + pad))
++ if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4 &&
++ !rmnet_map_checksum_downlink_packet(skb, len + pad))
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+ }
+
--- /dev/null
+From 3e7d18b9dca388940a19cae30bfc1f76dccd8c28 Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Fri, 22 Jul 2022 17:06:35 +0000
+Subject: net: mld: fix reference count leak in mld_{query | report}_work()
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+commit 3e7d18b9dca388940a19cae30bfc1f76dccd8c28 upstream.
+
+mld_{query | report}_work() processes queued events.
+If there are too many events in the queue, it re-queue a work.
+And then, it returns without in6_dev_put().
+But if queuing is failed, it should call in6_dev_put(), but it doesn't.
+So, a reference count leak would occur.
+
+THREAD0 THREAD1
+mld_report_work()
+ spin_lock_bh()
+ if (!mod_delayed_work())
+ in6_dev_hold();
+ spin_unlock_bh()
+ spin_lock_bh()
+ schedule_delayed_work()
+ spin_unlock_bh()
+
+Script to reproduce(by Hangbin Liu):
+ ip netns add ns1
+ ip netns add ns2
+ ip netns exec ns1 sysctl -w net.ipv6.conf.all.force_mld_version=1
+ ip netns exec ns2 sysctl -w net.ipv6.conf.all.force_mld_version=1
+
+ ip -n ns1 link add veth0 type veth peer name veth0 netns ns2
+ ip -n ns1 link set veth0 up
+ ip -n ns2 link set veth0 up
+
+ for i in `seq 50`; do
+ for j in `seq 100`; do
+ ip -n ns1 addr add 2021:${i}::${j}/64 dev veth0
+ ip -n ns2 addr add 2022:${i}::${j}/64 dev veth0
+ done
+ done
+ modprobe -r veth
+ ip -a netns del
+
+splat looks like:
+ unregister_netdevice: waiting for veth0 to become free. Usage count = 2
+ leaked reference.
+ ipv6_add_dev+0x324/0xec0
+ addrconf_notify+0x481/0xd10
+ raw_notifier_call_chain+0xe3/0x120
+ call_netdevice_notifiers+0x106/0x160
+ register_netdevice+0x114c/0x16b0
+ veth_newlink+0x48b/0xa50 [veth]
+ rtnl_newlink+0x11a2/0x1a40
+ rtnetlink_rcv_msg+0x63f/0xc00
+ netlink_rcv_skb+0x1df/0x3e0
+ netlink_unicast+0x5de/0x850
+ netlink_sendmsg+0x6c9/0xa90
+ ____sys_sendmsg+0x76a/0x780
+ __sys_sendmsg+0x27c/0x340
+ do_syscall_64+0x43/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Tested-by: Hangbin Liu <liuhangbin@gmail.com>
+Fixes: f185de28d9ae ("mld: add new workqueues for process mld events")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/mcast.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -1545,7 +1545,6 @@ static void mld_query_work(struct work_s
+
+ if (++cnt >= MLD_MAX_QUEUE) {
+ rework = true;
+- schedule_delayed_work(&idev->mc_query_work, 0);
+ break;
+ }
+ }
+@@ -1556,8 +1555,10 @@ static void mld_query_work(struct work_s
+ __mld_query_work(skb);
+ mutex_unlock(&idev->mc_lock);
+
+- if (!rework)
+- in6_dev_put(idev);
++ if (rework && queue_delayed_work(mld_wq, &idev->mc_query_work, 0))
++ return;
++
++ in6_dev_put(idev);
+ }
+
+ /* called with rcu_read_lock() */
+@@ -1652,7 +1653,6 @@ static void mld_report_work(struct work_
+
+ if (++cnt >= MLD_MAX_QUEUE) {
+ rework = true;
+- schedule_delayed_work(&idev->mc_report_work, 0);
+ break;
+ }
+ }
+@@ -1663,8 +1663,10 @@ static void mld_report_work(struct work_
+ __mld_report_work(skb);
+ mutex_unlock(&idev->mc_lock);
+
+- if (!rework)
+- in6_dev_put(idev);
++ if (rework && queue_delayed_work(mld_wq, &idev->mc_report_work, 0))
++ return;
++
++ in6_dev_put(idev);
+ }
+
+ static bool is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch
kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch
bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch
+iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch
+iio-invensense-fix-odr-switching-to-same-value.patch
+iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch
+mld-change-lockdep-annotation-for-ip6_sf_socklist-and-ipv6_mc_socklist.patch
+ipv6-mcast-delay-put-pmc-idev-in-mld_del_delrec.patch
+net-ethernet-rmnet-always-subtract-map-header.patch
+ipv6-mcast-use-rcu-safe-version-of-ipv6_get_lladdr.patch
+ipv6-fix-lockdep-splat-in-in6_dump_addrs.patch
+net-mld-fix-reference-count-leak-in-mld_-query-report-_work.patch
+ipv6-mcast-fix-data-race-in-ipv6_mc_down-mld_ifc_work.patch
+ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv6_mc_down.patch
+mld-fix-suspicious-rcu-usage-in-__ipv6_dev_mc_dec.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
