From: Greg Kroah-Hartman Date: Tue, 7 Jul 2026 15:27:15 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=01a0960238ce2831221bdade95dc2753cde8ccdc;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: net-sched-dualpi2-fix-gso-backlog-accounting.patch --- diff --git a/queue-6.18/net-sched-dualpi2-fix-gso-backlog-accounting.patch b/queue-6.18/net-sched-dualpi2-fix-gso-backlog-accounting.patch new file mode 100644 index 0000000000..02056220c3 --- /dev/null +++ b/queue-6.18/net-sched-dualpi2-fix-gso-backlog-accounting.patch @@ -0,0 +1,68 @@ +From 05ed733b65ab977dd931e7f7ac0f62fdb81205c2 Mon Sep 17 00:00:00 2001 +From: Xingquan Liu +Date: Fri, 19 Jun 2026 11:13:47 -0400 +Subject: net/sched: dualpi2: fix GSO backlog accounting + +From: Xingquan Liu + +commit 05ed733b65ab977dd931e7f7ac0f62fdb81205c2 upstream. + +When DualPI2 splits a GSO skb into N segments, it propagates N +additional packets to its parent before returning NET_XMIT_SUCCESS. +The parent then accounts for the original skb once more, leaving its +qlen one larger than the number of packets actually queued. + +With QFQ as the parent, after all real packets are dequeued, QFQ still +has a non-zero qlen while its in-service aggregate has no active +classes. qfq_choose_next_agg() returns NULL and qfq_dequeue() passes +the result to qfq_peek_skb(), causing a NULL pointer dereference. + +Follow the same pattern used by tbf_segment() and taprio: count only +successfully queued segments, propagate the difference between the +original skb and those segments, and return NET_XMIT_SUCCESS whenever +at least one segment was queued. + +Fixes: 8f9516daedd6 ("sched: Add enqueue/dequeue of dualpi2 qdisc") +Cc: stable@vger.kernel.org +Signed-off-by: Xingquan Liu +Acked-by: Jamal Hadi Salim +Reviewed-by: Victor Nogueira +Link: https://patch.msgid.link/20260619151447.223640-1-b1n@b1n.io +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_dualpi2.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/net/sched/sch_dualpi2.c ++++ b/net/sched/sch_dualpi2.c +@@ -463,7 +463,7 @@ static int dualpi2_qdisc_enqueue(struct + if (IS_ERR_OR_NULL(nskb)) + return qdisc_drop(skb, sch, to_free); + +- cnt = 1; ++ cnt = 0; + byte_len = 0; + orig_len = qdisc_pkt_len(skb); + skb_list_walk_safe(nskb, nskb, next) { +@@ -489,16 +489,15 @@ static int dualpi2_qdisc_enqueue(struct + byte_len += nskb->len; + } + } +- if (cnt > 1) { ++ if (cnt > 0) { + /* The caller will add the original skb stats to its + * backlog, compensate this if any nskb is enqueued. + */ +- --cnt; +- byte_len -= orig_len; ++ qdisc_tree_reduce_backlog(sch, 1 - cnt, ++ orig_len - byte_len); + } +- qdisc_tree_reduce_backlog(sch, -cnt, -byte_len); + consume_skb(skb); +- return err; ++ return cnt > 0 ? NET_XMIT_SUCCESS : err; + } + return dualpi2_enqueue_skb(skb, sch, to_free); + } diff --git a/queue-6.18/series b/queue-6.18/series index 3a532f89c6..9805dd4626 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -18,3 +18,4 @@ f2fs-optimize-trace_f2fs_write_checkpoint-with-enums.patch f2fs-detect-more-inconsistent-cases-in-sanity_check_node_footer.patch f2fs-fix-to-do-sanity-check-on-f2fs_get_node_folio_ra.patch fbdev-fbcon-fix-out-of-bounds-read-in-err_out-of-fbcon_do_set_font.patch +net-sched-dualpi2-fix-gso-backlog-accounting.patch