--- /dev/null
+From stable+bounces-191695-greg=kroah.com@vger.kernel.org Thu Oct 30 08:00:22 2025
+From: Rajani Kantha <681739313@139.com>
+Date: Thu, 30 Oct 2025 14:59:59 +0800
+Subject: bonding: check xdp prog when set bond mode
+To: razor@blackwall.org, toke@redhat.com, liuhangbin@gmail.com, kuba@kernel.org, joamaki@gmail.com, wangliang74@huawei.com, stable@vger.kernel.org
+Message-ID: <20251030065959.8773-3-681739313@139.com>
+
+From: Wang Liang <wangliang74@huawei.com>
+
+[ Upstream commit 094ee6017ea09c11d6af187935a949df32803ce0 ]
+
+Following operations can trigger a warning[1]:
+
+ ip netns add ns1
+ ip netns exec ns1 ip link add bond0 type bond mode balance-rr
+ ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp
+ ip netns exec ns1 ip link set bond0 type bond mode broadcast
+ ip netns del ns1
+
+When delete the namespace, dev_xdp_uninstall() is called to remove xdp
+program on bond dev, and bond_xdp_set() will check the bond mode. If bond
+mode is changed after attaching xdp program, the warning may occur.
+
+Some bond modes (broadcast, etc.) do not support native xdp. Set bond mode
+with xdp program attached is not good. Add check for xdp program when set
+bond mode.
+
+ [1]
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 11 at net/core/dev.c:9912 unregister_netdevice_many_notify+0x8d9/0x930
+ Modules linked in:
+ CPU: 0 UID: 0 PID: 11 Comm: kworker/u4:0 Not tainted 6.14.0-rc4 #107
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
+ Workqueue: netns cleanup_net
+ RIP: 0010:unregister_netdevice_many_notify+0x8d9/0x930
+ Code: 00 00 48 c7 c6 6f e3 a2 82 48 c7 c7 d0 b3 96 82 e8 9c 10 3e ...
+ RSP: 0018:ffffc90000063d80 EFLAGS: 00000282
+ RAX: 00000000ffffffa1 RBX: ffff888004959000 RCX: 00000000ffffdfff
+ RDX: 0000000000000000 RSI: 00000000ffffffea RDI: ffffc90000063b48
+ RBP: ffffc90000063e28 R08: ffffffff82d39b28 R09: 0000000000009ffb
+ R10: 0000000000000175 R11: ffffffff82d09b40 R12: ffff8880049598e8
+ R13: 0000000000000001 R14: dead000000000100 R15: ffffc90000045000
+ FS: 0000000000000000(0000) GS:ffff888007a00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 000000000d406b60 CR3: 000000000483e000 CR4: 00000000000006f0
+ Call Trace:
+ <TASK>
+ ? __warn+0x83/0x130
+ ? unregister_netdevice_many_notify+0x8d9/0x930
+ ? report_bug+0x18e/0x1a0
+ ? handle_bug+0x54/0x90
+ ? exc_invalid_op+0x18/0x70
+ ? asm_exc_invalid_op+0x1a/0x20
+ ? unregister_netdevice_many_notify+0x8d9/0x930
+ ? bond_net_exit_batch_rtnl+0x5c/0x90
+ cleanup_net+0x237/0x3d0
+ process_one_work+0x163/0x390
+ worker_thread+0x293/0x3b0
+ ? __pfx_worker_thread+0x10/0x10
+ kthread+0xec/0x1e0
+ ? __pfx_kthread+0x10/0x10
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x2f/0x50
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+ ---[ end trace 0000000000000000 ]---
+
+Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver")
+Signed-off-by: Wang Liang <wangliang74@huawei.com>
+Acked-by: Jussi Maki <joamaki@gmail.com>
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://patch.msgid.link/20250321044852.1086551-1-wangliang74@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Rajani Kantha <681739313@139.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c | 8 ++++----
+ drivers/net/bonding/bond_options.c | 3 +++
+ include/net/bonding.h | 1 +
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -322,9 +322,9 @@ static bool bond_sk_check(struct bonding
+ }
+ }
+
+-static bool bond_xdp_check(struct bonding *bond)
++bool bond_xdp_check(struct bonding *bond, int mode)
+ {
+- switch (BOND_MODE(bond)) {
++ switch (mode) {
+ case BOND_MODE_ROUNDROBIN:
+ case BOND_MODE_ACTIVEBACKUP:
+ return true;
+@@ -1930,7 +1930,7 @@ void bond_xdp_set_features(struct net_de
+
+ ASSERT_RTNL();
+
+- if (!bond_xdp_check(bond) || !bond_has_slaves(bond)) {
++ if (!bond_xdp_check(bond, BOND_MODE(bond)) || !bond_has_slaves(bond)) {
+ xdp_clear_features_flag(bond_dev);
+ return;
+ }
+@@ -5699,7 +5699,7 @@ static int bond_xdp_set(struct net_devic
+
+ ASSERT_RTNL();
+
+- if (!bond_xdp_check(bond)) {
++ if (!bond_xdp_check(bond, BOND_MODE(bond))) {
+ BOND_NL_ERR(dev, extack,
+ "No native XDP support for the current bonding mode");
+ return -EOPNOTSUPP;
+--- a/drivers/net/bonding/bond_options.c
++++ b/drivers/net/bonding/bond_options.c
+@@ -868,6 +868,9 @@ static bool bond_set_xfrm_features(struc
+ static int bond_option_mode_set(struct bonding *bond,
+ const struct bond_opt_value *newval)
+ {
++ if (bond->xdp_prog && !bond_xdp_check(bond, newval->value))
++ return -EOPNOTSUPP;
++
+ if (!bond_mode_uses_arp(newval->value)) {
+ if (bond->params.arp_interval) {
+ netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n",
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -695,6 +695,7 @@ void bond_debug_register(struct bonding
+ void bond_debug_unregister(struct bonding *bond);
+ void bond_debug_reregister(struct bonding *bond);
+ const char *bond_mode_name(int mode);
++bool bond_xdp_check(struct bonding *bond, int mode);
+ void bond_setup(struct net_device *bond_dev);
+ unsigned int bond_get_num_tx_queues(void);
+ int bond_netlink_init(void);
--- /dev/null
+From stable+bounces-191694-greg=kroah.com@vger.kernel.org Thu Oct 30 08:00:19 2025
+From: Rajani Kantha <681739313@139.com>
+Date: Thu, 30 Oct 2025 14:59:58 +0800
+Subject: bonding: return detailed error when loading native XDP fails
+To: razor@blackwall.org, toke@redhat.com, liuhangbin@gmail.com, kuba@kernel.org, joamaki@gmail.com, wangliang74@huawei.com, stable@vger.kernel.org
+Message-ID: <20251030065959.8773-2-681739313@139.com>
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 22ccb684c1cae37411450e6e86a379cd3c29cb8f ]
+
+Bonding only supports native XDP for specific modes, which can lead to
+confusion for users regarding why XDP loads successfully at times and
+fails at others. This patch enhances error handling by returning detailed
+error messages, providing users with clearer insights into the specific
+reasons for the failure when loading native XDP.
+
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://patch.msgid.link/20241021031211.814-2-liuhangbin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Rajani Kantha <681739313@139.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -5699,8 +5699,11 @@ static int bond_xdp_set(struct net_devic
+
+ ASSERT_RTNL();
+
+- if (!bond_xdp_check(bond))
++ if (!bond_xdp_check(bond)) {
++ BOND_NL_ERR(dev, extack,
++ "No native XDP support for the current bonding mode");
+ return -EOPNOTSUPP;
++ }
+
+ old_prog = bond->xdp_prog;
+ bond->xdp_prog = prog;
--- /dev/null
+From stable+bounces-191787-greg=kroah.com@vger.kernel.org Fri Oct 31 07:20:50 2025
+From: Rajani Kantha <681739313@139.com>
+Date: Fri, 31 Oct 2025 14:17:10 +0800
+Subject: f2fs: fix to avoid panic once fallocation fails for pinfile
+To: chao@kernel.org, jaegeuk@kernel.org, stable@vger.kernel.org
+Message-ID: <20251031061710.2854-1-681739313@139.com>
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 48ea8b200414ac69ea96f4c231f5c7ef1fbeffef ]
+
+syzbot reports a f2fs bug as below:
+
+------------[ cut here ]------------
+kernel BUG at fs/f2fs/segment.c:2746!
+CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted 6.13.0-rc2-syzkaller-00018-g7cb1b4663150 #0
+RIP: 0010:get_new_segment fs/f2fs/segment.c:2746 [inline]
+RIP: 0010:new_curseg+0x1f52/0x1f70 fs/f2fs/segment.c:2876
+Call Trace:
+ <TASK>
+ __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3210
+ f2fs_allocate_new_section fs/f2fs/segment.c:3224 [inline]
+ f2fs_allocate_pinning_section+0xfa/0x4e0 fs/f2fs/segment.c:3238
+ f2fs_expand_inode_data+0x696/0xca0 fs/f2fs/file.c:1830
+ f2fs_fallocate+0x537/0xa10 fs/f2fs/file.c:1940
+ vfs_fallocate+0x569/0x6e0 fs/open.c:327
+ do_vfs_ioctl+0x258c/0x2e40 fs/ioctl.c:885
+ __do_sys_ioctl fs/ioctl.c:904 [inline]
+ __se_sys_ioctl+0x80/0x170 fs/ioctl.c:892
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Concurrent pinfile allocation may run out of free section, result in
+panic in get_new_segment(), let's expand pin_sem lock coverage to
+include f2fs_gc(), so that we can make sure to reclaim enough free
+space for following allocation.
+
+In addition, do below changes to enhance error path handling:
+- call f2fs_bug_on() only in non-pinfile allocation path in
+get_new_segment().
+- call reset_curseg_fields() to reset all fields of curseg in
+new_curseg()
+
+Fixes: f5a53edcf01e ("f2fs: support aligned pinned file")
+Reported-by: syzbot+15669ec8c35ddf6c3d43@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/linux-f2fs-devel/675cd64e.050a0220.37aaf.00bb.GAE@google.com
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Rajani Kantha <681739313@139.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/file.c | 8 +++++---
+ fs/f2fs/segment.c | 20 ++++++++++----------
+ 2 files changed, 15 insertions(+), 13 deletions(-)
+
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1836,18 +1836,20 @@ static int f2fs_expand_inode_data(struct
+
+ map.m_len = sec_blks;
+ next_alloc:
++ f2fs_down_write(&sbi->pin_sem);
++
+ if (has_not_enough_free_secs(sbi, 0, f2fs_sb_has_blkzoned(sbi) ?
+ ZONED_PIN_SEC_REQUIRED_COUNT :
+ GET_SEC_FROM_SEG(sbi, overprovision_segments(sbi)))) {
+ f2fs_down_write(&sbi->gc_lock);
+ stat_inc_gc_call_count(sbi, FOREGROUND);
+ err = f2fs_gc(sbi, &gc_control);
+- if (err && err != -ENODATA)
++ if (err && err != -ENODATA) {
++ f2fs_up_write(&sbi->pin_sem);
+ goto out_err;
++ }
+ }
+
+- f2fs_down_write(&sbi->pin_sem);
+-
+ err = f2fs_allocate_pinning_section(sbi);
+ if (err) {
+ f2fs_up_write(&sbi->pin_sem);
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -2749,7 +2749,7 @@ find_other_zone:
+ MAIN_SECS(sbi));
+ if (secno >= MAIN_SECS(sbi)) {
+ ret = -ENOSPC;
+- f2fs_bug_on(sbi, 1);
++ f2fs_bug_on(sbi, !pinning);
+ goto out_unlock;
+ }
+ }
+@@ -2795,7 +2795,7 @@ got_it:
+ out_unlock:
+ spin_unlock(&free_i->segmap_lock);
+
+- if (ret == -ENOSPC)
++ if (ret == -ENOSPC && !pinning)
+ f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_NO_SEGMENT);
+ return ret;
+ }
+@@ -2868,6 +2868,13 @@ static unsigned int __get_next_segno(str
+ return curseg->segno;
+ }
+
++static void reset_curseg_fields(struct curseg_info *curseg)
++{
++ curseg->inited = false;
++ curseg->segno = NULL_SEGNO;
++ curseg->next_segno = 0;
++}
++
+ /*
+ * Allocate a current working segment.
+ * This function always allocates a free segment in LFS manner.
+@@ -2886,7 +2893,7 @@ static int new_curseg(struct f2fs_sb_inf
+ ret = get_new_segment(sbi, &segno, new_sec, pinning);
+ if (ret) {
+ if (ret == -ENOSPC)
+- curseg->segno = NULL_SEGNO;
++ reset_curseg_fields(curseg);
+ return ret;
+ }
+
+@@ -3640,13 +3647,6 @@ static void f2fs_randomize_chunk(struct
+ get_random_u32_inclusive(1, sbi->max_fragment_hole);
+ }
+
+-static void reset_curseg_fields(struct curseg_info *curseg)
+-{
+- curseg->inited = false;
+- curseg->segno = NULL_SEGNO;
+- curseg->next_segno = 0;
+-}
+-
+ int f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct page *page,
+ block_t old_blkaddr, block_t *new_blkaddr,
+ struct f2fs_summary *sum, int type,
--- /dev/null
+From stable+bounces-190029-greg=kroah.com@vger.kernel.org Mon Oct 27 16:35:57 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 11:34:51 -0400
+Subject: mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
+To: stable@vger.kernel.org
+Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Geliang Tang <geliang@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251027153451.554067-1-sashal@kernel.org>
+
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+
+[ Upstream commit e84cb860ac3ce67ec6ecc364433fd5b412c448bc ]
+
+The special C-flag case expects the ADD_ADDR to be received when
+switching to 'fully-established'. But for various reasons, the ADD_ADDR
+could be sent after the "4th ACK", and the special case doesn't work.
+
+On NIPA, the new test validating this special case for the C-flag failed
+a few times, e.g.
+
+ 102 default limits, server deny join id 0
+ syn rx [FAIL] got 0 JOIN[s] syn rx expected 2
+
+ Server ns stats
+ (...)
+ MPTcpExtAddAddrTx 1
+ MPTcpExtEchoAdd 1
+
+ Client ns stats
+ (...)
+ MPTcpExtAddAddr 1
+ MPTcpExtEchoAddTx 1
+
+ synack rx [FAIL] got 0 JOIN[s] synack rx expected 2
+ ack rx [FAIL] got 0 JOIN[s] ack rx expected 2
+ join Rx [FAIL] see above
+ syn tx [FAIL] got 0 JOIN[s] syn tx expected 2
+ join Tx [FAIL] see above
+
+I had a suspicion about what the issue could be: the ADD_ADDR might have
+been received after the switch to the 'fully-established' state. The
+issue was not easy to reproduce. The packet capture shown that the
+ADD_ADDR can indeed be sent with a delay, and the client would not try
+to establish subflows to it as expected.
+
+A simple fix is not to mark the endpoints as 'used' in the C-flag case,
+when looking at creating subflows to the remote initial IP address and
+port. In this case, there is no need to try.
+
+Note: newly added fullmesh endpoints will still continue to be used as
+expected, thanks to the conditions behind mptcp_pm_add_addr_c_flag_case.
+
+Fixes: 4b1ff850e0c1 ("mptcp: pm: in-kernel: usable client side with C-flag")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-1-8207030cb0e8@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ applied to pm_netlink.c instead of pm_kernel.c ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/pm_netlink.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/mptcp/pm_netlink.c
++++ b/net/mptcp/pm_netlink.c
+@@ -618,6 +618,10 @@ static void mptcp_pm_create_subflow_or_s
+ }
+
+ subflow:
++ /* No need to try establishing subflows to remote id0 if not allowed */
++ if (mptcp_pm_add_addr_c_flag_case(msk))
++ goto exit;
++
+ /* check if should create a new subflow */
+ while (msk->pm.local_addr_used < local_addr_max &&
+ msk->pm.subflows < subflows_max) {
+@@ -649,6 +653,8 @@ subflow:
+ __mptcp_subflow_connect(sk, &local, &addrs[i]);
+ spin_lock_bh(&msk->pm.lock);
+ }
++
++exit:
+ mptcp_pm_nl_check_work_pending(msk);
+ }
+
--- /dev/null
+From stable+bounces-189997-greg=kroah.com@vger.kernel.org Mon Oct 27 15:31:19 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 10:22:11 -0400
+Subject: selftests: mptcp: disable add_addr retrans in endpoint_tests
+To: stable@vger.kernel.org
+Cc: Geliang Tang <tanggeliang@kylinos.cn>, Matthieu Baerts <matttbe@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251027142212.514463-1-sashal@kernel.org>
+
+From: Geliang Tang <tanggeliang@kylinos.cn>
+
+[ Upstream commit f92199f551e617fae028c5c5905ddd63e3616e18 ]
+
+To prevent test instability in the "delete re-add signal" test caused by
+ADD_ADDR retransmissions, disable retransmissions for this test by setting
+net.mptcp.add_addr_timeout to 0.
+
+Suggested-by: Matthieu Baerts <matttbe@kernel.org>
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-6-521fe9957892@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: c3496c052ac3 ("selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -3824,6 +3824,7 @@ endpoint_tests()
+ # remove and re-add
+ if reset_with_events "delete re-add signal" &&
+ mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
++ ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=0
+ pm_nl_set_limits $ns1 0 3
+ pm_nl_set_limits $ns2 3 3
+ pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal
--- /dev/null
+From stable+bounces-189998-greg=kroah.com@vger.kernel.org Mon Oct 27 15:22:21 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 10:22:12 -0400
+Subject: selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported
+To: stable@vger.kernel.org
+Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Geliang Tang <geliang@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251027142212.514463-2-sashal@kernel.org>
+
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+
+[ Upstream commit c3496c052ac36ea98ec4f8e95ae6285a425a2457 ]
+
+The call to 'continue_if' was missing: it properly marks a subtest as
+'skipped' if the attached condition is not valid.
+
+Without that, the test is wrongly marked as passed on older kernels.
+
+Fixes: b5e2fb832f48 ("selftests: mptcp: add explicit test case for remove/readd")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-4-8207030cb0e8@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -3823,7 +3823,7 @@ endpoint_tests()
+
+ # remove and re-add
+ if reset_with_events "delete re-add signal" &&
+- mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
++ continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
+ ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=0
+ pm_nl_set_limits $ns1 0 3
+ pm_nl_set_limits $ns2 3 3
sched_ext-make-qmap-dump-operation-non-destructive.patch
arch-add-the-macro-compile_offsets-to-all-the-asm-of.patch
docs-kdoc-handle-the-obsolescensce-of-docutils.errorstring.patch
+selftests-mptcp-disable-add_addr-retrans-in-endpoint_tests.patch
+selftests-mptcp-join-mark-delete-re-add-signal-as-skipped-if-not-supported.patch
+mptcp-pm-in-kernel-c-flag-handle-late-add_addr.patch
+f2fs-fix-to-avoid-panic-once-fallocation-fails-for-pinfile.patch
+wifi-cfg80211-add-missing-lock-in-cfg80211_check_and_end_cac.patch
+bonding-return-detailed-error-when-loading-native-xdp-fails.patch
+bonding-check-xdp-prog-when-set-bond-mode.patch
--- /dev/null
+From stable+bounces-191772-greg=kroah.com@vger.kernel.org Fri Oct 31 02:51:23 2025
+From: alvalan9@foxmail.com
+Date: Fri, 31 Oct 2025 09:50:24 +0800
+Subject: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
+To: gregkh@linuxfoundation.org, stable@vger.kernel.org
+Cc: Alexander Wetzel <Alexander@wetzel-home.de>, Johannes Berg <johannes.berg@intel.com>, Alva Lan <alvalan9@foxmail.com>
+Message-ID: <tencent_D8063C5ABD1AA68F4E4974EB631C0A18AC07@qq.com>
+
+From: Alexander Wetzel <Alexander@wetzel-home.de>
+
+[ Upstream commit 2c5dee15239f3f3e31aa5c8808f18996c039e2c1 ]
+
+Callers of wdev_chandef() must hold the wiphy mutex.
+
+But the worker cfg80211_propagate_cac_done_wk() never takes the lock.
+Which triggers the warning below with the mesh_peer_connected_dfs
+test from hostapd and not (yet) released mac80211 code changes:
+
+WARNING: CPU: 0 PID: 495 at net/wireless/chan.c:1552 wdev_chandef+0x60/0x165
+Modules linked in:
+CPU: 0 UID: 0 PID: 495 Comm: kworker/u4:2 Not tainted 6.14.0-rc5-wt-g03960e6f9d47 #33 13c287eeabfe1efea01c0bcc863723ab082e17cf
+Workqueue: cfg80211 cfg80211_propagate_cac_done_wk
+Stack:
+ 00000000 00000001 ffffff00 6093267c
+ 00000000 6002ec30 6d577c50 60037608
+ 00000000 67e8d108 6063717b 00000000
+Call Trace:
+ [<6002ec30>] ? _printk+0x0/0x98
+ [<6003c2b3>] show_stack+0x10e/0x11a
+ [<6002ec30>] ? _printk+0x0/0x98
+ [<60037608>] dump_stack_lvl+0x71/0xb8
+ [<6063717b>] ? wdev_chandef+0x60/0x165
+ [<6003766d>] dump_stack+0x1e/0x20
+ [<6005d1b7>] __warn+0x101/0x20f
+ [<6005d3a8>] warn_slowpath_fmt+0xe3/0x15d
+ [<600b0c5c>] ? mark_lock.part.0+0x0/0x4ec
+ [<60751191>] ? __this_cpu_preempt_check+0x0/0x16
+ [<600b11a2>] ? mark_held_locks+0x5a/0x6e
+ [<6005d2c5>] ? warn_slowpath_fmt+0x0/0x15d
+ [<60052e53>] ? unblock_signals+0x3a/0xe7
+ [<60052f2d>] ? um_set_signals+0x2d/0x43
+ [<60751191>] ? __this_cpu_preempt_check+0x0/0x16
+ [<607508b2>] ? lock_is_held_type+0x207/0x21f
+ [<6063717b>] wdev_chandef+0x60/0x165
+ [<605f89b4>] regulatory_propagate_dfs_state+0x247/0x43f
+ [<60052f00>] ? um_set_signals+0x0/0x43
+ [<605e6bfd>] cfg80211_propagate_cac_done_wk+0x3a/0x4a
+ [<6007e460>] process_scheduled_works+0x3bc/0x60e
+ [<6007d0ec>] ? move_linked_works+0x4d/0x81
+ [<6007d120>] ? assign_work+0x0/0xaa
+ [<6007f81f>] worker_thread+0x220/0x2dc
+ [<600786ef>] ? set_pf_worker+0x0/0x57
+ [<60087c96>] ? to_kthread+0x0/0x43
+ [<6008ab3c>] kthread+0x2d3/0x2e2
+ [<6007f5ff>] ? worker_thread+0x0/0x2dc
+ [<6006c05b>] ? calculate_sigpending+0x0/0x56
+ [<6003b37d>] new_thread_handler+0x4a/0x64
+irq event stamp: 614611
+hardirqs last enabled at (614621): [<00000000600bc96b>] __up_console_sem+0x82/0xaf
+hardirqs last disabled at (614630): [<00000000600bc92c>] __up_console_sem+0x43/0xaf
+softirqs last enabled at (614268): [<00000000606c55c6>] __ieee80211_wake_queue+0x933/0x985
+softirqs last disabled at (614266): [<00000000606c52d6>] __ieee80211_wake_queue+0x643/0x985
+
+Fixes: 26ec17a1dc5e ("cfg80211: Fix radar event during another phy CAC")
+Signed-off-by: Alexander Wetzel <Alexander@wetzel-home.de>
+Link: https://patch.msgid.link/20250717162547.94582-1-Alexander@wetzel-home.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+[ The author recommends that when porting to older kernels, we should use wiphy_lock()
+and wiphy_unlock() instead of guard(). This tip is mentioned in the link:
+https://patch.msgid.link/20250717162547.94582-1-Alexander@wetzel-home.de. ]
+Signed-off-by: Alva Lan <alvalan9@foxmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/reg.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -4234,6 +4234,8 @@ static void cfg80211_check_and_end_cac(s
+ struct wireless_dev *wdev;
+ unsigned int link_id;
+
++ wiphy_lock(&rdev->wiphy);
++
+ /* If we finished CAC or received radar, we should end any
+ * CAC running on the same channels.
+ * the check !cfg80211_chandef_dfs_usable contain 2 options:
+@@ -4258,6 +4260,8 @@ static void cfg80211_check_and_end_cac(s
+ rdev_end_cac(rdev, wdev->netdev, link_id);
+ }
+ }
++
++ wiphy_unlock(&rdev->wiphy);
+ }
+
+ void regulatory_propagate_dfs_state(struct wiphy *wiphy,
projects / thirdparty / kernel / stable-queue.git / commitdiff
