From 6fb06d5ab4a268ba6608c658692524278ea3e5c1 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 31 Oct 2025 13:27:46 +0100 Subject: [PATCH] 6.12-stable patches added patches: bonding-check-xdp-prog-when-set-bond-mode.patch bonding-return-detailed-error-when-loading-native-xdp-fails.patch f2fs-fix-to-avoid-panic-once-fallocation-fails-for-pinfile.patch mptcp-pm-in-kernel-c-flag-handle-late-add_addr.patch selftests-mptcp-disable-add_addr-retrans-in-endpoint_tests.patch selftests-mptcp-join-mark-delete-re-add-signal-as-skipped-if-not-supported.patch wifi-cfg80211-add-missing-lock-in-cfg80211_check_and_end_cac.patch --- ...ng-check-xdp-prog-when-set-bond-mode.patch | 137 +++++++++++++++++ ...-error-when-loading-native-xdp-fails.patch | 43 ++++++ ...c-once-fallocation-fails-for-pinfile.patch | 139 ++++++++++++++++++ ...n-kernel-c-flag-handle-late-add_addr.patch | 86 +++++++++++ ...e-add_addr-retrans-in-endpoint_tests.patch | 39 +++++ ...d-signal-as-skipped-if-not-supported.patch | 40 +++++ queue-6.12/series | 7 + ...g-lock-in-cfg80211_check_and_end_cac.patch | 96 ++++++++++++ 8 files changed, 587 insertions(+) create mode 100644 queue-6.12/bonding-check-xdp-prog-when-set-bond-mode.patch create mode 100644 queue-6.12/bonding-return-detailed-error-when-loading-native-xdp-fails.patch create mode 100644 queue-6.12/f2fs-fix-to-avoid-panic-once-fallocation-fails-for-pinfile.patch create mode 100644 queue-6.12/mptcp-pm-in-kernel-c-flag-handle-late-add_addr.patch create mode 100644 queue-6.12/selftests-mptcp-disable-add_addr-retrans-in-endpoint_tests.patch create mode 100644 queue-6.12/selftests-mptcp-join-mark-delete-re-add-signal-as-skipped-if-not-supported.patch create mode 100644 queue-6.12/wifi-cfg80211-add-missing-lock-in-cfg80211_check_and_end_cac.patch diff --git a/queue-6.12/bonding-check-xdp-prog-when-set-bond-mode.patch b/queue-6.12/bonding-check-xdp-prog-when-set-bond-mode.patch new file mode 100644 index 0000000000..34d18ddc91 --- /dev/null +++ b/queue-6.12/bonding-check-xdp-prog-when-set-bond-mode.patch @@ -0,0 +1,137 @@ +From stable+bounces-191695-greg=kroah.com@vger.kernel.org Thu Oct 30 08:00:22 2025 +From: Rajani Kantha <681739313@139.com> +Date: Thu, 30 Oct 2025 14:59:59 +0800 +Subject: bonding: check xdp prog when set bond mode +To: razor@blackwall.org, toke@redhat.com, liuhangbin@gmail.com, kuba@kernel.org, joamaki@gmail.com, wangliang74@huawei.com, stable@vger.kernel.org +Message-ID: <20251030065959.8773-3-681739313@139.com> + +From: Wang Liang + +[ Upstream commit 094ee6017ea09c11d6af187935a949df32803ce0 ] + +Following operations can trigger a warning[1]: + + ip netns add ns1 + ip netns exec ns1 ip link add bond0 type bond mode balance-rr + ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp + ip netns exec ns1 ip link set bond0 type bond mode broadcast + ip netns del ns1 + +When delete the namespace, dev_xdp_uninstall() is called to remove xdp +program on bond dev, and bond_xdp_set() will check the bond mode. If bond +mode is changed after attaching xdp program, the warning may occur. + +Some bond modes (broadcast, etc.) do not support native xdp. Set bond mode +with xdp program attached is not good. Add check for xdp program when set +bond mode. + + [1] + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 11 at net/core/dev.c:9912 unregister_netdevice_many_notify+0x8d9/0x930 + Modules linked in: + CPU: 0 UID: 0 PID: 11 Comm: kworker/u4:0 Not tainted 6.14.0-rc4 #107 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 + Workqueue: netns cleanup_net + RIP: 0010:unregister_netdevice_many_notify+0x8d9/0x930 + Code: 00 00 48 c7 c6 6f e3 a2 82 48 c7 c7 d0 b3 96 82 e8 9c 10 3e ... + RSP: 0018:ffffc90000063d80 EFLAGS: 00000282 + RAX: 00000000ffffffa1 RBX: ffff888004959000 RCX: 00000000ffffdfff + RDX: 0000000000000000 RSI: 00000000ffffffea RDI: ffffc90000063b48 + RBP: ffffc90000063e28 R08: ffffffff82d39b28 R09: 0000000000009ffb + R10: 0000000000000175 R11: ffffffff82d09b40 R12: ffff8880049598e8 + R13: 0000000000000001 R14: dead000000000100 R15: ffffc90000045000 + FS: 0000000000000000(0000) GS:ffff888007a00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 000000000d406b60 CR3: 000000000483e000 CR4: 00000000000006f0 + Call Trace: + + ? __warn+0x83/0x130 + ? unregister_netdevice_many_notify+0x8d9/0x930 + ? report_bug+0x18e/0x1a0 + ? handle_bug+0x54/0x90 + ? exc_invalid_op+0x18/0x70 + ? asm_exc_invalid_op+0x1a/0x20 + ? unregister_netdevice_many_notify+0x8d9/0x930 + ? bond_net_exit_batch_rtnl+0x5c/0x90 + cleanup_net+0x237/0x3d0 + process_one_work+0x163/0x390 + worker_thread+0x293/0x3b0 + ? __pfx_worker_thread+0x10/0x10 + kthread+0xec/0x1e0 + ? __pfx_kthread+0x10/0x10 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x2f/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1a/0x30 + + ---[ end trace 0000000000000000 ]--- + +Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver") +Signed-off-by: Wang Liang +Acked-by: Jussi Maki +Reviewed-by: Nikolay Aleksandrov +Reviewed-by: Toke Høiland-Jørgensen +Link: https://patch.msgid.link/20250321044852.1086551-1-wangliang74@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Rajani Kantha <681739313@139.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 8 ++++---- + drivers/net/bonding/bond_options.c | 3 +++ + include/net/bonding.h | 1 + + 3 files changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -322,9 +322,9 @@ static bool bond_sk_check(struct bonding + } + } + +-static bool bond_xdp_check(struct bonding *bond) ++bool bond_xdp_check(struct bonding *bond, int mode) + { +- switch (BOND_MODE(bond)) { ++ switch (mode) { + case BOND_MODE_ROUNDROBIN: + case BOND_MODE_ACTIVEBACKUP: + return true; +@@ -1930,7 +1930,7 @@ void bond_xdp_set_features(struct net_de + + ASSERT_RTNL(); + +- if (!bond_xdp_check(bond) || !bond_has_slaves(bond)) { ++ if (!bond_xdp_check(bond, BOND_MODE(bond)) || !bond_has_slaves(bond)) { + xdp_clear_features_flag(bond_dev); + return; + } +@@ -5699,7 +5699,7 @@ static int bond_xdp_set(struct net_devic + + ASSERT_RTNL(); + +- if (!bond_xdp_check(bond)) { ++ if (!bond_xdp_check(bond, BOND_MODE(bond))) { + BOND_NL_ERR(dev, extack, + "No native XDP support for the current bonding mode"); + return -EOPNOTSUPP; +--- a/drivers/net/bonding/bond_options.c ++++ b/drivers/net/bonding/bond_options.c +@@ -868,6 +868,9 @@ static bool bond_set_xfrm_features(struc + static int bond_option_mode_set(struct bonding *bond, + const struct bond_opt_value *newval) + { ++ if (bond->xdp_prog && !bond_xdp_check(bond, newval->value)) ++ return -EOPNOTSUPP; ++ + if (!bond_mode_uses_arp(newval->value)) { + if (bond->params.arp_interval) { + netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n", +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -695,6 +695,7 @@ void bond_debug_register(struct bonding + void bond_debug_unregister(struct bonding *bond); + void bond_debug_reregister(struct bonding *bond); + const char *bond_mode_name(int mode); ++bool bond_xdp_check(struct bonding *bond, int mode); + void bond_setup(struct net_device *bond_dev); + unsigned int bond_get_num_tx_queues(void); + int bond_netlink_init(void); diff --git a/queue-6.12/bonding-return-detailed-error-when-loading-native-xdp-fails.patch b/queue-6.12/bonding-return-detailed-error-when-loading-native-xdp-fails.patch new file mode 100644 index 0000000000..1be99c8ad6 --- /dev/null +++ b/queue-6.12/bonding-return-detailed-error-when-loading-native-xdp-fails.patch @@ -0,0 +1,43 @@ +From stable+bounces-191694-greg=kroah.com@vger.kernel.org Thu Oct 30 08:00:19 2025 +From: Rajani Kantha <681739313@139.com> +Date: Thu, 30 Oct 2025 14:59:58 +0800 +Subject: bonding: return detailed error when loading native XDP fails +To: razor@blackwall.org, toke@redhat.com, liuhangbin@gmail.com, kuba@kernel.org, joamaki@gmail.com, wangliang74@huawei.com, stable@vger.kernel.org +Message-ID: <20251030065959.8773-2-681739313@139.com> + +From: Hangbin Liu + +[ Upstream commit 22ccb684c1cae37411450e6e86a379cd3c29cb8f ] + +Bonding only supports native XDP for specific modes, which can lead to +confusion for users regarding why XDP loads successfully at times and +fails at others. This patch enhances error handling by returning detailed +error messages, providing users with clearer insights into the specific +reasons for the failure when loading native XDP. + +Reviewed-by: Nikolay Aleksandrov +Reviewed-by: Toke Høiland-Jørgensen +Signed-off-by: Hangbin Liu +Link: https://patch.msgid.link/20241021031211.814-2-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Rajani Kantha <681739313@139.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -5699,8 +5699,11 @@ static int bond_xdp_set(struct net_devic + + ASSERT_RTNL(); + +- if (!bond_xdp_check(bond)) ++ if (!bond_xdp_check(bond)) { ++ BOND_NL_ERR(dev, extack, ++ "No native XDP support for the current bonding mode"); + return -EOPNOTSUPP; ++ } + + old_prog = bond->xdp_prog; + bond->xdp_prog = prog; diff --git a/queue-6.12/f2fs-fix-to-avoid-panic-once-fallocation-fails-for-pinfile.patch b/queue-6.12/f2fs-fix-to-avoid-panic-once-fallocation-fails-for-pinfile.patch new file mode 100644 index 0000000000..53add9c71d --- /dev/null +++ b/queue-6.12/f2fs-fix-to-avoid-panic-once-fallocation-fails-for-pinfile.patch @@ -0,0 +1,139 @@ +From stable+bounces-191787-greg=kroah.com@vger.kernel.org Fri Oct 31 07:20:50 2025 +From: Rajani Kantha <681739313@139.com> +Date: Fri, 31 Oct 2025 14:17:10 +0800 +Subject: f2fs: fix to avoid panic once fallocation fails for pinfile +To: chao@kernel.org, jaegeuk@kernel.org, stable@vger.kernel.org +Message-ID: <20251031061710.2854-1-681739313@139.com> + +From: Chao Yu + +[ Upstream commit 48ea8b200414ac69ea96f4c231f5c7ef1fbeffef ] + +syzbot reports a f2fs bug as below: + +------------[ cut here ]------------ +kernel BUG at fs/f2fs/segment.c:2746! +CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted 6.13.0-rc2-syzkaller-00018-g7cb1b4663150 #0 +RIP: 0010:get_new_segment fs/f2fs/segment.c:2746 [inline] +RIP: 0010:new_curseg+0x1f52/0x1f70 fs/f2fs/segment.c:2876 +Call Trace: + + __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3210 + f2fs_allocate_new_section fs/f2fs/segment.c:3224 [inline] + f2fs_allocate_pinning_section+0xfa/0x4e0 fs/f2fs/segment.c:3238 + f2fs_expand_inode_data+0x696/0xca0 fs/f2fs/file.c:1830 + f2fs_fallocate+0x537/0xa10 fs/f2fs/file.c:1940 + vfs_fallocate+0x569/0x6e0 fs/open.c:327 + do_vfs_ioctl+0x258c/0x2e40 fs/ioctl.c:885 + __do_sys_ioctl fs/ioctl.c:904 [inline] + __se_sys_ioctl+0x80/0x170 fs/ioctl.c:892 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Concurrent pinfile allocation may run out of free section, result in +panic in get_new_segment(), let's expand pin_sem lock coverage to +include f2fs_gc(), so that we can make sure to reclaim enough free +space for following allocation. + +In addition, do below changes to enhance error path handling: +- call f2fs_bug_on() only in non-pinfile allocation path in +get_new_segment(). +- call reset_curseg_fields() to reset all fields of curseg in +new_curseg() + +Fixes: f5a53edcf01e ("f2fs: support aligned pinned file") +Reported-by: syzbot+15669ec8c35ddf6c3d43@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-f2fs-devel/675cd64e.050a0220.37aaf.00bb.GAE@google.com +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Rajani Kantha <681739313@139.com> +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/file.c | 8 +++++--- + fs/f2fs/segment.c | 20 ++++++++++---------- + 2 files changed, 15 insertions(+), 13 deletions(-) + +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1836,18 +1836,20 @@ static int f2fs_expand_inode_data(struct + + map.m_len = sec_blks; + next_alloc: ++ f2fs_down_write(&sbi->pin_sem); ++ + if (has_not_enough_free_secs(sbi, 0, f2fs_sb_has_blkzoned(sbi) ? + ZONED_PIN_SEC_REQUIRED_COUNT : + GET_SEC_FROM_SEG(sbi, overprovision_segments(sbi)))) { + f2fs_down_write(&sbi->gc_lock); + stat_inc_gc_call_count(sbi, FOREGROUND); + err = f2fs_gc(sbi, &gc_control); +- if (err && err != -ENODATA) ++ if (err && err != -ENODATA) { ++ f2fs_up_write(&sbi->pin_sem); + goto out_err; ++ } + } + +- f2fs_down_write(&sbi->pin_sem); +- + err = f2fs_allocate_pinning_section(sbi); + if (err) { + f2fs_up_write(&sbi->pin_sem); +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -2749,7 +2749,7 @@ find_other_zone: + MAIN_SECS(sbi)); + if (secno >= MAIN_SECS(sbi)) { + ret = -ENOSPC; +- f2fs_bug_on(sbi, 1); ++ f2fs_bug_on(sbi, !pinning); + goto out_unlock; + } + } +@@ -2795,7 +2795,7 @@ got_it: + out_unlock: + spin_unlock(&free_i->segmap_lock); + +- if (ret == -ENOSPC) ++ if (ret == -ENOSPC && !pinning) + f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_NO_SEGMENT); + return ret; + } +@@ -2868,6 +2868,13 @@ static unsigned int __get_next_segno(str + return curseg->segno; + } + ++static void reset_curseg_fields(struct curseg_info *curseg) ++{ ++ curseg->inited = false; ++ curseg->segno = NULL_SEGNO; ++ curseg->next_segno = 0; ++} ++ + /* + * Allocate a current working segment. + * This function always allocates a free segment in LFS manner. +@@ -2886,7 +2893,7 @@ static int new_curseg(struct f2fs_sb_inf + ret = get_new_segment(sbi, &segno, new_sec, pinning); + if (ret) { + if (ret == -ENOSPC) +- curseg->segno = NULL_SEGNO; ++ reset_curseg_fields(curseg); + return ret; + } + +@@ -3640,13 +3647,6 @@ static void f2fs_randomize_chunk(struct + get_random_u32_inclusive(1, sbi->max_fragment_hole); + } + +-static void reset_curseg_fields(struct curseg_info *curseg) +-{ +- curseg->inited = false; +- curseg->segno = NULL_SEGNO; +- curseg->next_segno = 0; +-} +- + int f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct page *page, + block_t old_blkaddr, block_t *new_blkaddr, + struct f2fs_summary *sum, int type, diff --git a/queue-6.12/mptcp-pm-in-kernel-c-flag-handle-late-add_addr.patch b/queue-6.12/mptcp-pm-in-kernel-c-flag-handle-late-add_addr.patch new file mode 100644 index 0000000000..1b81bc3dd6 --- /dev/null +++ b/queue-6.12/mptcp-pm-in-kernel-c-flag-handle-late-add_addr.patch @@ -0,0 +1,86 @@ +From stable+bounces-190029-greg=kroah.com@vger.kernel.org Mon Oct 27 16:35:57 2025 +From: Sasha Levin +Date: Mon, 27 Oct 2025 11:34:51 -0400 +Subject: mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR +To: stable@vger.kernel.org +Cc: "Matthieu Baerts (NGI0)" , Geliang Tang , Jakub Kicinski , Sasha Levin +Message-ID: <20251027153451.554067-1-sashal@kernel.org> + +From: "Matthieu Baerts (NGI0)" + +[ Upstream commit e84cb860ac3ce67ec6ecc364433fd5b412c448bc ] + +The special C-flag case expects the ADD_ADDR to be received when +switching to 'fully-established'. But for various reasons, the ADD_ADDR +could be sent after the "4th ACK", and the special case doesn't work. + +On NIPA, the new test validating this special case for the C-flag failed +a few times, e.g. + + 102 default limits, server deny join id 0 + syn rx [FAIL] got 0 JOIN[s] syn rx expected 2 + + Server ns stats + (...) + MPTcpExtAddAddrTx 1 + MPTcpExtEchoAdd 1 + + Client ns stats + (...) + MPTcpExtAddAddr 1 + MPTcpExtEchoAddTx 1 + + synack rx [FAIL] got 0 JOIN[s] synack rx expected 2 + ack rx [FAIL] got 0 JOIN[s] ack rx expected 2 + join Rx [FAIL] see above + syn tx [FAIL] got 0 JOIN[s] syn tx expected 2 + join Tx [FAIL] see above + +I had a suspicion about what the issue could be: the ADD_ADDR might have +been received after the switch to the 'fully-established' state. The +issue was not easy to reproduce. The packet capture shown that the +ADD_ADDR can indeed be sent with a delay, and the client would not try +to establish subflows to it as expected. + +A simple fix is not to mark the endpoints as 'used' in the C-flag case, +when looking at creating subflows to the remote initial IP address and +port. In this case, there is no need to try. + +Note: newly added fullmesh endpoints will still continue to be used as +expected, thanks to the conditions behind mptcp_pm_add_addr_c_flag_case. + +Fixes: 4b1ff850e0c1 ("mptcp: pm: in-kernel: usable client side with C-flag") +Cc: stable@vger.kernel.org +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-1-8207030cb0e8@kernel.org +Signed-off-by: Jakub Kicinski +[ applied to pm_netlink.c instead of pm_kernel.c ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_netlink.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -618,6 +618,10 @@ static void mptcp_pm_create_subflow_or_s + } + + subflow: ++ /* No need to try establishing subflows to remote id0 if not allowed */ ++ if (mptcp_pm_add_addr_c_flag_case(msk)) ++ goto exit; ++ + /* check if should create a new subflow */ + while (msk->pm.local_addr_used < local_addr_max && + msk->pm.subflows < subflows_max) { +@@ -649,6 +653,8 @@ subflow: + __mptcp_subflow_connect(sk, &local, &addrs[i]); + spin_lock_bh(&msk->pm.lock); + } ++ ++exit: + mptcp_pm_nl_check_work_pending(msk); + } + diff --git a/queue-6.12/selftests-mptcp-disable-add_addr-retrans-in-endpoint_tests.patch b/queue-6.12/selftests-mptcp-disable-add_addr-retrans-in-endpoint_tests.patch new file mode 100644 index 0000000000..344ab2be2e --- /dev/null +++ b/queue-6.12/selftests-mptcp-disable-add_addr-retrans-in-endpoint_tests.patch @@ -0,0 +1,39 @@ +From stable+bounces-189997-greg=kroah.com@vger.kernel.org Mon Oct 27 15:31:19 2025 +From: Sasha Levin +Date: Mon, 27 Oct 2025 10:22:11 -0400 +Subject: selftests: mptcp: disable add_addr retrans in endpoint_tests +To: stable@vger.kernel.org +Cc: Geliang Tang , Matthieu Baerts , Jakub Kicinski , Sasha Levin +Message-ID: <20251027142212.514463-1-sashal@kernel.org> + +From: Geliang Tang + +[ Upstream commit f92199f551e617fae028c5c5905ddd63e3616e18 ] + +To prevent test instability in the "delete re-add signal" test caused by +ADD_ADDR retransmissions, disable retransmissions for this test by setting +net.mptcp.add_addr_timeout to 0. + +Suggested-by: Matthieu Baerts +Signed-off-by: Geliang Tang +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-6-521fe9957892@kernel.org +Signed-off-by: Jakub Kicinski +Stable-dep-of: c3496c052ac3 ("selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 1 + + 1 file changed, 1 insertion(+) + +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -3824,6 +3824,7 @@ endpoint_tests() + # remove and re-add + if reset_with_events "delete re-add signal" && + mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then ++ ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=0 + pm_nl_set_limits $ns1 0 3 + pm_nl_set_limits $ns2 3 3 + pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal diff --git a/queue-6.12/selftests-mptcp-join-mark-delete-re-add-signal-as-skipped-if-not-supported.patch b/queue-6.12/selftests-mptcp-join-mark-delete-re-add-signal-as-skipped-if-not-supported.patch new file mode 100644 index 0000000000..d556d39246 --- /dev/null +++ b/queue-6.12/selftests-mptcp-join-mark-delete-re-add-signal-as-skipped-if-not-supported.patch @@ -0,0 +1,40 @@ +From stable+bounces-189998-greg=kroah.com@vger.kernel.org Mon Oct 27 15:22:21 2025 +From: Sasha Levin +Date: Mon, 27 Oct 2025 10:22:12 -0400 +Subject: selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported +To: stable@vger.kernel.org +Cc: "Matthieu Baerts (NGI0)" , Geliang Tang , Jakub Kicinski , Sasha Levin +Message-ID: <20251027142212.514463-2-sashal@kernel.org> + +From: "Matthieu Baerts (NGI0)" + +[ Upstream commit c3496c052ac36ea98ec4f8e95ae6285a425a2457 ] + +The call to 'continue_if' was missing: it properly marks a subtest as +'skipped' if the attached condition is not valid. + +Without that, the test is wrongly marked as passed on older kernels. + +Fixes: b5e2fb832f48 ("selftests: mptcp: add explicit test case for remove/readd") +Cc: stable@vger.kernel.org +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-4-8207030cb0e8@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -3823,7 +3823,7 @@ endpoint_tests() + + # remove and re-add + if reset_with_events "delete re-add signal" && +- mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then ++ continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=0 + pm_nl_set_limits $ns1 0 3 + pm_nl_set_limits $ns2 3 3 diff --git a/queue-6.12/series b/queue-6.12/series index 25b0257c82..1b366661fc 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -22,3 +22,10 @@ btrfs-use-smp_mb__after_atomic-when-forcing-cow-in-c.patch sched_ext-make-qmap-dump-operation-non-destructive.patch arch-add-the-macro-compile_offsets-to-all-the-asm-of.patch docs-kdoc-handle-the-obsolescensce-of-docutils.errorstring.patch +selftests-mptcp-disable-add_addr-retrans-in-endpoint_tests.patch +selftests-mptcp-join-mark-delete-re-add-signal-as-skipped-if-not-supported.patch +mptcp-pm-in-kernel-c-flag-handle-late-add_addr.patch +f2fs-fix-to-avoid-panic-once-fallocation-fails-for-pinfile.patch +wifi-cfg80211-add-missing-lock-in-cfg80211_check_and_end_cac.patch +bonding-return-detailed-error-when-loading-native-xdp-fails.patch +bonding-check-xdp-prog-when-set-bond-mode.patch diff --git a/queue-6.12/wifi-cfg80211-add-missing-lock-in-cfg80211_check_and_end_cac.patch b/queue-6.12/wifi-cfg80211-add-missing-lock-in-cfg80211_check_and_end_cac.patch new file mode 100644 index 0000000000..671b6e2758 --- /dev/null +++ b/queue-6.12/wifi-cfg80211-add-missing-lock-in-cfg80211_check_and_end_cac.patch @@ -0,0 +1,96 @@ +From stable+bounces-191772-greg=kroah.com@vger.kernel.org Fri Oct 31 02:51:23 2025 +From: alvalan9@foxmail.com +Date: Fri, 31 Oct 2025 09:50:24 +0800 +Subject: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() +To: gregkh@linuxfoundation.org, stable@vger.kernel.org +Cc: Alexander Wetzel , Johannes Berg , Alva Lan +Message-ID: + +From: Alexander Wetzel + +[ Upstream commit 2c5dee15239f3f3e31aa5c8808f18996c039e2c1 ] + +Callers of wdev_chandef() must hold the wiphy mutex. + +But the worker cfg80211_propagate_cac_done_wk() never takes the lock. +Which triggers the warning below with the mesh_peer_connected_dfs +test from hostapd and not (yet) released mac80211 code changes: + +WARNING: CPU: 0 PID: 495 at net/wireless/chan.c:1552 wdev_chandef+0x60/0x165 +Modules linked in: +CPU: 0 UID: 0 PID: 495 Comm: kworker/u4:2 Not tainted 6.14.0-rc5-wt-g03960e6f9d47 #33 13c287eeabfe1efea01c0bcc863723ab082e17cf +Workqueue: cfg80211 cfg80211_propagate_cac_done_wk +Stack: + 00000000 00000001 ffffff00 6093267c + 00000000 6002ec30 6d577c50 60037608 + 00000000 67e8d108 6063717b 00000000 +Call Trace: + [<6002ec30>] ? _printk+0x0/0x98 + [<6003c2b3>] show_stack+0x10e/0x11a + [<6002ec30>] ? _printk+0x0/0x98 + [<60037608>] dump_stack_lvl+0x71/0xb8 + [<6063717b>] ? wdev_chandef+0x60/0x165 + [<6003766d>] dump_stack+0x1e/0x20 + [<6005d1b7>] __warn+0x101/0x20f + [<6005d3a8>] warn_slowpath_fmt+0xe3/0x15d + [<600b0c5c>] ? mark_lock.part.0+0x0/0x4ec + [<60751191>] ? __this_cpu_preempt_check+0x0/0x16 + [<600b11a2>] ? mark_held_locks+0x5a/0x6e + [<6005d2c5>] ? warn_slowpath_fmt+0x0/0x15d + [<60052e53>] ? unblock_signals+0x3a/0xe7 + [<60052f2d>] ? um_set_signals+0x2d/0x43 + [<60751191>] ? __this_cpu_preempt_check+0x0/0x16 + [<607508b2>] ? lock_is_held_type+0x207/0x21f + [<6063717b>] wdev_chandef+0x60/0x165 + [<605f89b4>] regulatory_propagate_dfs_state+0x247/0x43f + [<60052f00>] ? um_set_signals+0x0/0x43 + [<605e6bfd>] cfg80211_propagate_cac_done_wk+0x3a/0x4a + [<6007e460>] process_scheduled_works+0x3bc/0x60e + [<6007d0ec>] ? move_linked_works+0x4d/0x81 + [<6007d120>] ? assign_work+0x0/0xaa + [<6007f81f>] worker_thread+0x220/0x2dc + [<600786ef>] ? set_pf_worker+0x0/0x57 + [<60087c96>] ? to_kthread+0x0/0x43 + [<6008ab3c>] kthread+0x2d3/0x2e2 + [<6007f5ff>] ? worker_thread+0x0/0x2dc + [<6006c05b>] ? calculate_sigpending+0x0/0x56 + [<6003b37d>] new_thread_handler+0x4a/0x64 +irq event stamp: 614611 +hardirqs last enabled at (614621): [<00000000600bc96b>] __up_console_sem+0x82/0xaf +hardirqs last disabled at (614630): [<00000000600bc92c>] __up_console_sem+0x43/0xaf +softirqs last enabled at (614268): [<00000000606c55c6>] __ieee80211_wake_queue+0x933/0x985 +softirqs last disabled at (614266): [<00000000606c52d6>] __ieee80211_wake_queue+0x643/0x985 + +Fixes: 26ec17a1dc5e ("cfg80211: Fix radar event during another phy CAC") +Signed-off-by: Alexander Wetzel +Link: https://patch.msgid.link/20250717162547.94582-1-Alexander@wetzel-home.de +Signed-off-by: Johannes Berg +[ The author recommends that when porting to older kernels, we should use wiphy_lock() +and wiphy_unlock() instead of guard(). This tip is mentioned in the link: +https://patch.msgid.link/20250717162547.94582-1-Alexander@wetzel-home.de. ] +Signed-off-by: Alva Lan +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/reg.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -4234,6 +4234,8 @@ static void cfg80211_check_and_end_cac(s + struct wireless_dev *wdev; + unsigned int link_id; + ++ wiphy_lock(&rdev->wiphy); ++ + /* If we finished CAC or received radar, we should end any + * CAC running on the same channels. + * the check !cfg80211_chandef_dfs_usable contain 2 options: +@@ -4258,6 +4260,8 @@ static void cfg80211_check_and_end_cac(s + rdev_end_cac(rdev, wdev->netdev, link_id); + } + } ++ ++ wiphy_unlock(&rdev->wiphy); + } + + void regulatory_propagate_dfs_state(struct wiphy *wiphy, -- 2.47.3