From 1e11f9ca88ebbbf6ca4869f40cdaaea599b1398a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 2 Jul 2026 17:49:18 +0200 Subject: [PATCH] 6.12-stable patches added patches: bonding-annotate-data-races-arcound-churn-variables.patch locking-rtmutex-fix-wake_q-logic-in-task_blocks_on_rt_mutex.patch net-bonding-update-the-slave-array-for-broadcast-mode.patch --- ...e-data-races-arcound-churn-variables.patch | 111 ++++++++++++++++++ ...e_q-logic-in-task_blocks_on_rt_mutex.patch | 60 ++++++++++ ...e-the-slave-array-for-broadcast-mode.patch | 56 +++++++++ queue-6.12/series | 3 + 4 files changed, 230 insertions(+) create mode 100644 queue-6.12/bonding-annotate-data-races-arcound-churn-variables.patch create mode 100644 queue-6.12/locking-rtmutex-fix-wake_q-logic-in-task_blocks_on_rt_mutex.patch create mode 100644 queue-6.12/net-bonding-update-the-slave-array-for-broadcast-mode.patch diff --git a/queue-6.12/bonding-annotate-data-races-arcound-churn-variables.patch b/queue-6.12/bonding-annotate-data-races-arcound-churn-variables.patch new file mode 100644 index 0000000000..8634639c31 --- /dev/null +++ b/queue-6.12/bonding-annotate-data-races-arcound-churn-variables.patch @@ -0,0 +1,111 @@ +From b47ff80f280e18ad2310f44293cc057d9b64ff11 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 3 Jun 2026 12:35:14 +0000 +Subject: bonding: annotate data-races arcound churn variables + +From: Eric Dumazet + +commit b47ff80f280e18ad2310f44293cc057d9b64ff11 upstream. + +These fields are updated asynchronously by the bonding state machine +in ad_churn_machine() while holding bond->mode_lock. + +bond_info_show_slave() and bond_fill_slave_info() read them without +bond->mode_lock being held, we need to add READ_ONCE() and +WRITE_ONCE() annotations. + +Note that AD_CHURN_MONITOR, AD_CHURN, and AD_NO_CHURN are defined +exclusively in (kernel private) include/net/bond_3ad.h header. + +They should be moved to include/uapi/linux/if_bonding.h or userspace +tools will have to hardcode their values. + +Fixes: 4916f2e2f3fc ("bonding: print churn state via netlink") +Fixes: 14c9551a32eb ("bonding: Implement port churn-machine (AD standard 43.4.17).") +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20260603123514.388226-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_3ad.c | 18 ++++++++++-------- + drivers/net/bonding/bond_netlink.c | 4 ++-- + drivers/net/bonding/bond_procfs.c | 8 ++++---- + 3 files changed, 16 insertions(+), 14 deletions(-) + +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -1348,8 +1348,8 @@ static void ad_churn_machine(struct port + { + if (port->sm_vars & AD_PORT_CHURNED) { + port->sm_vars &= ~AD_PORT_CHURNED; +- port->sm_churn_actor_state = AD_CHURN_MONITOR; +- port->sm_churn_partner_state = AD_CHURN_MONITOR; ++ WRITE_ONCE(port->sm_churn_actor_state, AD_CHURN_MONITOR); ++ WRITE_ONCE(port->sm_churn_partner_state, AD_CHURN_MONITOR); + port->sm_churn_actor_timer_counter = + __ad_timer_to_ticks(AD_ACTOR_CHURN_TIMER, 0); + port->sm_churn_partner_timer_counter = +@@ -1360,20 +1360,22 @@ static void ad_churn_machine(struct port + !(--port->sm_churn_actor_timer_counter) && + port->sm_churn_actor_state == AD_CHURN_MONITOR) { + if (port->actor_oper_port_state & LACP_STATE_SYNCHRONIZATION) { +- port->sm_churn_actor_state = AD_NO_CHURN; ++ WRITE_ONCE(port->sm_churn_actor_state, AD_NO_CHURN); + } else { +- port->churn_actor_count++; +- port->sm_churn_actor_state = AD_CHURN; ++ WRITE_ONCE(port->churn_actor_count, ++ port->churn_actor_count + 1); ++ WRITE_ONCE(port->sm_churn_actor_state, AD_CHURN); + } + } + if (port->sm_churn_partner_timer_counter && + !(--port->sm_churn_partner_timer_counter) && + port->sm_churn_partner_state == AD_CHURN_MONITOR) { + if (port->partner_oper.port_state & LACP_STATE_SYNCHRONIZATION) { +- port->sm_churn_partner_state = AD_NO_CHURN; ++ WRITE_ONCE(port->sm_churn_partner_state, AD_NO_CHURN); + } else { +- port->churn_partner_count++; +- port->sm_churn_partner_state = AD_CHURN; ++ WRITE_ONCE(port->churn_partner_count, ++ port->churn_partner_count + 1); ++ WRITE_ONCE(port->sm_churn_partner_state, AD_CHURN); + } + } + } +--- a/drivers/net/bonding/bond_netlink.c ++++ b/drivers/net/bonding/bond_netlink.c +@@ -82,10 +82,10 @@ static int bond_fill_slave_info(struct s + goto nla_put_failure_rcu; + + if (nla_put_u8(skb, IFLA_BOND_SLAVE_AD_CHURN_ACTOR_STATE, +- ad_port->sm_churn_actor_state)) ++ READ_ONCE(ad_port->sm_churn_actor_state))) + goto nla_put_failure_rcu; + if (nla_put_u8(skb, IFLA_BOND_SLAVE_AD_CHURN_PARTNER_STATE, +- ad_port->sm_churn_partner_state)) ++ READ_ONCE(ad_port->sm_churn_partner_state))) + goto nla_put_failure_rcu; + } + rcu_read_unlock(); +--- a/drivers/net/bonding/bond_procfs.c ++++ b/drivers/net/bonding/bond_procfs.c +@@ -220,13 +220,13 @@ static void bond_info_show_slave(struct + seq_printf(seq, "Aggregator ID: %d\n", + agg->aggregator_identifier); + seq_printf(seq, "Actor Churn State: %s\n", +- bond_3ad_churn_desc(port->sm_churn_actor_state)); ++ bond_3ad_churn_desc(READ_ONCE(port->sm_churn_actor_state))); + seq_printf(seq, "Partner Churn State: %s\n", +- bond_3ad_churn_desc(port->sm_churn_partner_state)); ++ bond_3ad_churn_desc(READ_ONCE(port->sm_churn_partner_state))); + seq_printf(seq, "Actor Churned Count: %d\n", +- port->churn_actor_count); ++ READ_ONCE(port->churn_actor_count)); + seq_printf(seq, "Partner Churned Count: %d\n", +- port->churn_partner_count); ++ READ_ONCE(port->churn_partner_count)); + + if (capable(CAP_NET_ADMIN)) { + seq_puts(seq, "details actor lacp pdu:\n"); diff --git a/queue-6.12/locking-rtmutex-fix-wake_q-logic-in-task_blocks_on_rt_mutex.patch b/queue-6.12/locking-rtmutex-fix-wake_q-logic-in-task_blocks_on_rt_mutex.patch new file mode 100644 index 0000000000..fa145b0389 --- /dev/null +++ b/queue-6.12/locking-rtmutex-fix-wake_q-logic-in-task_blocks_on_rt_mutex.patch @@ -0,0 +1,60 @@ +From 82f9cc094975240885c93effbca7f4603f5de1bf Mon Sep 17 00:00:00 2001 +From: John Stultz +Date: Thu, 14 Nov 2024 11:00:47 -0800 +Subject: locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex + +From: John Stultz + +commit 82f9cc094975240885c93effbca7f4603f5de1bf upstream. + +Anders had bisected a crash using PREEMPT_RT with linux-next and +isolated it down to commit 894d1b3db41c ("locking/mutex: Remove +wakeups from under mutex::wait_lock"), where it seemed the +wake_q structure was somehow getting corrupted causing a null +pointer traversal. + +I was able to easily repoduce this with PREEMPT_RT and managed +to isolate down that through various call stacks we were +actually calling wake_up_q() twice on the same wake_q. + +I found that in the problematic commit, I had added the +wake_up_q() call in task_blocks_on_rt_mutex() around +__ww_mutex_add_waiter(), following a similar pattern in +__mutex_lock_common(). + +However, its just wrong. We haven't dropped the lock->wait_lock, +so its contrary to the point of the original patch. And it +didn't match the __mutex_lock_common() logic of re-initializing +the wake_q after calling it midway in the stack. + +Looking at it now, the wake_up_q() call is incorrect and should +just be removed. So drop the erronious logic I had added. + +Fixes: 894d1b3db41c ("locking/mutex: Remove wakeups from under mutex::wait_lock") +Closes: https://lore.kernel.org/lkml/6afb936f-17c7-43fa-90e0-b9e780866097@app.fastmail.com/ +Reported-by: Anders Roxell +Reported-by: Arnd Bergmann +Signed-off-by: John Stultz +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Juri Lelli +Tested-by: Anders Roxell +Tested-by: K Prateek Nayak +Link: https://lore.kernel.org/r/20241114190051.552665-1-jstultz@google.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/rtmutex.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/kernel/locking/rtmutex.c ++++ b/kernel/locking/rtmutex.c +@@ -1248,10 +1248,7 @@ static int __sched task_blocks_on_rt_mut + + /* Check whether the waiter should back out immediately */ + rtm = container_of(lock, struct rt_mutex, rtmutex); +- preempt_disable(); + res = __ww_mutex_add_waiter(waiter, rtm, ww_ctx, wake_q); +- wake_up_q(wake_q); +- preempt_enable(); + if (res) { + raw_spin_lock(&task->pi_lock); + rt_mutex_dequeue(lock, waiter); diff --git a/queue-6.12/net-bonding-update-the-slave-array-for-broadcast-mode.patch b/queue-6.12/net-bonding-update-the-slave-array-for-broadcast-mode.patch new file mode 100644 index 0000000000..ac214b1ed9 --- /dev/null +++ b/queue-6.12/net-bonding-update-the-slave-array-for-broadcast-mode.patch @@ -0,0 +1,56 @@ +From e0caeb24f538c3c9c94f471882ceeb43d9dc2739 Mon Sep 17 00:00:00 2001 +From: Tonghao Zhang +Date: Thu, 16 Oct 2025 20:51:36 +0800 +Subject: net: bonding: update the slave array for broadcast mode + +From: Tonghao Zhang + +commit e0caeb24f538c3c9c94f471882ceeb43d9dc2739 upstream. + +This patch fixes ce7a381697cb ("net: bonding: add broadcast_neighbor option for 802.3ad"). +Before this commit, on the broadcast mode, all devices were traversed using the +bond_for_each_slave_rcu. This patch supports traversing devices by using all_slaves. +Therefore, we need to update the slave array when enslave or release slave. + +Fixes: ce7a381697cb ("net: bonding: add broadcast_neighbor option for 802.3ad") +Cc: Simon Horman +Cc: Jonathan Corbet +Cc: Andrew Lunn +Cc: +Reported-by: Jiri Slaby +Tested-by: Jiri Slaby +Link: https://lore.kernel.org/all/a97e6e1e-81bc-4a79-8352-9e4794b0d2ca@kernel.org/ +Signed-off-by: Tonghao Zhang +Reviewed-by: Hangbin Liu +Reviewed-by: Nikolay Aleksandrov +Acked-by: Jay Vosburgh +Link: https://patch.msgid.link/20251016125136.16568-1-tonghao@bamaicloud.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2390,7 +2390,9 @@ skip_mac_set: + bpf_prog_inc(bond->xdp_prog); + } + +- if (bond_mode_can_use_xmit_hash(bond)) ++ /* broadcast mode uses the all_slaves to loop through slaves. */ ++ if (bond_mode_can_use_xmit_hash(bond) || ++ BOND_MODE(bond) == BOND_MODE_BROADCAST) + bond_update_slave_arr(bond, NULL); + + bond_xdp_set_features(bond_dev); +@@ -2533,7 +2535,8 @@ static int __bond_release_one(struct net + + bond_upper_dev_unlink(bond, slave); + +- if (bond_mode_can_use_xmit_hash(bond)) ++ if (bond_mode_can_use_xmit_hash(bond) || ++ BOND_MODE(bond) == BOND_MODE_BROADCAST) + bond_update_slave_arr(bond, slave); + + slave_info(bond_dev, slave_dev, "Releasing %s interface\n", diff --git a/queue-6.12/series b/queue-6.12/series index 6bd18a8ace..a8be6ad236 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -198,3 +198,6 @@ crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch crypto-qat-remove-unused-character-device-and-ioctls.patch net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch +locking-rtmutex-fix-wake_q-logic-in-task_blocks_on_rt_mutex.patch +net-bonding-update-the-slave-array-for-broadcast-mode.patch +bonding-annotate-data-races-arcound-churn-variables.patch -- 2.47.3