From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 7 Jul 2026 15:27:25 +0000 (+0200)
Subject: 7.1-stable patches
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=acb81f27e61a9a45a3c90017423fe019cb80582a;p=thirdparty%2Fkernel%2Fstable-queue.git

7.1-stable patches

added patches:
	net-sched-dualpi2-fix-gso-backlog-accounting.patch
---

diff --git a/queue-7.1/net-sched-dualpi2-fix-gso-backlog-accounting.patch b/queue-7.1/net-sched-dualpi2-fix-gso-backlog-accounting.patch
new file mode 100644
index 0000000000..6cee4d4122
--- /dev/null
+++ b/queue-7.1/net-sched-dualpi2-fix-gso-backlog-accounting.patch
@@ -0,0 +1,68 @@
+From 05ed733b65ab977dd931e7f7ac0f62fdb81205c2 Mon Sep 17 00:00:00 2001
+From: Xingquan Liu <b1n@b1n.io>
+Date: Fri, 19 Jun 2026 11:13:47 -0400
+Subject: net/sched: dualpi2: fix GSO backlog accounting
+
+From: Xingquan Liu <b1n@b1n.io>
+
+commit 05ed733b65ab977dd931e7f7ac0f62fdb81205c2 upstream.
+
+When DualPI2 splits a GSO skb into N segments, it propagates N
+additional packets to its parent before returning NET_XMIT_SUCCESS.
+The parent then accounts for the original skb once more, leaving its
+qlen one larger than the number of packets actually queued.
+
+With QFQ as the parent, after all real packets are dequeued, QFQ still
+has a non-zero qlen while its in-service aggregate has no active
+classes. qfq_choose_next_agg() returns NULL and qfq_dequeue() passes
+the result to qfq_peek_skb(), causing a NULL pointer dereference.
+
+Follow the same pattern used by tbf_segment() and taprio: count only
+successfully queued segments, propagate the difference between the
+original skb and those segments, and return NET_XMIT_SUCCESS whenever
+at least one segment was queued.
+
+Fixes: 8f9516daedd6 ("sched: Add enqueue/dequeue of dualpi2 qdisc")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xingquan Liu <b1n@b1n.io>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Reviewed-by: Victor Nogueira <victor@mojatatu.com>
+Link: https://patch.msgid.link/20260619151447.223640-1-b1n@b1n.io
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_dualpi2.c |   11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/net/sched/sch_dualpi2.c
++++ b/net/sched/sch_dualpi2.c
+@@ -461,7 +461,7 @@ static int dualpi2_qdisc_enqueue(struct
+ 		if (IS_ERR_OR_NULL(nskb))
+ 			return qdisc_drop(skb, sch, to_free);
+ 
+-		cnt = 1;
++		cnt = 0;
+ 		byte_len = 0;
+ 		orig_len = qdisc_pkt_len(skb);
+ 		skb_list_walk_safe(nskb, nskb, next) {
+@@ -488,16 +488,15 @@ static int dualpi2_qdisc_enqueue(struct
+ 				byte_len += nskb->len;
+ 			}
+ 		}
+-		if (cnt > 1) {
++		if (cnt > 0) {
+ 			/* The caller will add the original skb stats to its
+ 			 * backlog, compensate this if any nskb is enqueued.
+ 			 */
+-			--cnt;
+-			byte_len -= orig_len;
++			qdisc_tree_reduce_backlog(sch, 1 - cnt,
++						  orig_len - byte_len);
+ 		}
+-		qdisc_tree_reduce_backlog(sch, -cnt, -byte_len);
+ 		consume_skb(skb);
+-		return err;
++		return cnt > 0 ? NET_XMIT_SUCCESS : err;
+ 	}
+ 	return dualpi2_enqueue_skb(skb, sch, to_free);
+ }
diff --git a/queue-7.1/series b/queue-7.1/series
index 2b10839b9c..f9cab6a5a1 100644
--- a/queue-7.1/series
+++ b/queue-7.1/series
@@ -1,3 +1,4 @@
 rust-str-use-the-kernel-vertical-imports-style.patch
 rust-str-clean-unused-import-for-rust-1.98.patch
 userfaultfd-gate-must_wait-writability-check-on-pte_.patch
+net-sched-dualpi2-fix-gso-backlog-accounting.patch