From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 23 Jun 2026 07:03:35 +0000 (+0200)
Subject: 7.0-stable patches
X-Git-Tag: v6.18.37~43
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4666647bb185b97d3d9f6b015dd76f46ee3252ed;p=thirdparty%2Fkernel%2Fstable-queue.git

7.0-stable patches

added patches:
	net-net_failover-fix-the-deadlock-in-slave-register.patch
---

diff --git a/queue-7.0/net-net_failover-fix-the-deadlock-in-slave-register.patch b/queue-7.0/net-net_failover-fix-the-deadlock-in-slave-register.patch
new file mode 100644
index 0000000000..482d4e3f94
--- /dev/null
+++ b/queue-7.0/net-net_failover-fix-the-deadlock-in-slave-register.patch
@@ -0,0 +1,108 @@
+From b84c5632c7b31f8910167075a8128cfb9e50fcfe Mon Sep 17 00:00:00 2001
+From: Faicker Mo <faicker.mo@gmail.com>
+Date: Mon, 11 May 2026 22:05:51 +0800
+Subject: net: net_failover: Fix the deadlock in slave register
+
+From: Faicker Mo <faicker.mo@gmail.com>
+
+commit b84c5632c7b31f8910167075a8128cfb9e50fcfe upstream.
+
+There is netdev_lock_ops() before the NETDEV_REGISTER notifier
+in register_netdevice(), so use the non-locking functions
+in net_failover_slave_register().
+failover_slave_register() in failover_existing_slave_register() adds lock
+and unlock ops too.
+
+Call Trace:
+ <TASK>
+ __schedule+0x30d/0x7a0
+ schedule+0x27/0x90
+ schedule_preempt_disabled+0x15/0x30
+ __mutex_lock.constprop.0+0x538/0x9e0
+ __mutex_lock_slowpath+0x13/0x20
+ mutex_lock+0x3b/0x50
+ dev_set_mtu+0x40/0xe0
+ net_failover_slave_register+0x24/0x280
+ failover_slave_register+0x103/0x1b0
+ failover_event+0x15e/0x210
+ ? dropmon_net_event+0xac/0xe0
+ notifier_call_chain+0x5e/0xe0
+ raw_notifier_call_chain+0x16/0x30
+ call_netdevice_notifiers_info+0x52/0xa0
+ register_netdevice+0x5f4/0x7c0
+ register_netdev+0x1e/0x40
+ _mlx5e_probe+0xe2/0x370 [mlx5_core]
+ mlx5e_probe+0x59/0x70 [mlx5_core]
+ ? __pfx_mlx5e_probe+0x10/0x10 [mlx5_core]
+
+Fixes: 4c975fd70002 ("net: hold instance lock during NETDEV_REGISTER/UP")
+Signed-off-by: Faicker Mo <faicker.mo@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/net_failover.c |   12 ++++++------
+ net/core/failover.c        |    6 +++++-
+ 2 files changed, 11 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/net_failover.c
++++ b/drivers/net/net_failover.c
+@@ -502,7 +502,7 @@ static int net_failover_slave_register(s
+ 
+ 	/* Align MTU of slave with failover dev */
+ 	orig_mtu = slave_dev->mtu;
+-	err = dev_set_mtu(slave_dev, failover_dev->mtu);
++	err = netif_set_mtu(slave_dev, failover_dev->mtu);
+ 	if (err) {
+ 		netdev_err(failover_dev, "unable to change mtu of %s to %u register failed\n",
+ 			   slave_dev->name, failover_dev->mtu);
+@@ -512,11 +512,11 @@ static int net_failover_slave_register(s
+ 	dev_hold(slave_dev);
+ 
+ 	if (netif_running(failover_dev)) {
+-		err = dev_open(slave_dev, NULL);
++		err = netif_open(slave_dev, NULL);
+ 		if (err && (err != -EBUSY)) {
+ 			netdev_err(failover_dev, "Opening slave %s failed err:%d\n",
+ 				   slave_dev->name, err);
+-			goto err_dev_open;
++			goto err_netif_open;
+ 		}
+ 	}
+ 
+@@ -562,10 +562,10 @@ static int net_failover_slave_register(s
+ err_vlan_add:
+ 	dev_uc_unsync(slave_dev, failover_dev);
+ 	dev_mc_unsync(slave_dev, failover_dev);
+-	dev_close(slave_dev);
+-err_dev_open:
++	netif_close(slave_dev);
++err_netif_open:
+ 	dev_put(slave_dev);
+-	dev_set_mtu(slave_dev, orig_mtu);
++	netif_set_mtu(slave_dev, orig_mtu);
+ done:
+ 	return err;
+ }
+--- a/net/core/failover.c
++++ b/net/core/failover.c
+@@ -12,6 +12,7 @@
+ #include <uapi/linux/if_arp.h>
+ #include <linux/rtnetlink.h>
+ #include <linux/if_vlan.h>
++#include <net/netdev_lock.h>
+ #include <net/failover.h>
+ 
+ static LIST_HEAD(failover_list);
+@@ -221,8 +222,11 @@ failover_existing_slave_register(struct
+ 	for_each_netdev(net, dev) {
+ 		if (netif_is_failover(dev))
+ 			continue;
+-		if (ether_addr_equal(failover_dev->perm_addr, dev->perm_addr))
++		if (ether_addr_equal(failover_dev->perm_addr, dev->perm_addr)) {
++			netdev_lock_ops(dev);
+ 			failover_slave_register(dev);
++			netdev_unlock_ops(dev);
++		}
+ 	}
+ 	rtnl_unlock();
+ }
diff --git a/queue-7.0/series b/queue-7.0/series
index 91ed4f5420..716cb52614 100644
--- a/queue-7.0/series
+++ b/queue-7.0/series
@@ -8,3 +8,4 @@ firmware-samsung-acpm-fix-false-timeouts-and-use-after-free-in-polling.patch
 firmware-samsung-acpm-fix-missing-lkmm-barriers-in-sequence-allocator.patch
 fuse-re-lock-request-before-replacing-page-cache-folio.patch
 revert-nfsd-defer-sub-object-cleanup-in-export-put-callbacks.patch
+net-net_failover-fix-the-deadlock-in-slave-register.patch