6.12-stable patches

added patches:
	net-rds-reset-op_nents-when-zerocopy-page-pin-fails.patch

diff --git a/queue-6.12/net-rds-reset-op_nents-when-zerocopy-page-pin-fails.patch b/queue-6.12/net-rds-reset-op_nents-when-zerocopy-page-pin-fails.patch
new file mode 100644 (file)
index 0000000..359cbbf
--- /dev/null
+++ b/queue-6.12/net-rds-reset-op_nents-when-zerocopy-page-pin-fails.patch
@@ -0,0 +1,41 @@
+From e174929793195e0cd6a4adb0cad731b39f9019b4 Mon Sep 17 00:00:00 2001
+From: Allison Henderson <achender@kernel.org>
+Date: Tue, 5 May 2026 16:43:36 -0700
+Subject: net/rds: reset op_nents when zerocopy page pin fails
+
+From: Allison Henderson <achender@kernel.org>
+
+commit e174929793195e0cd6a4adb0cad731b39f9019b4 upstream.
+
+When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),
+the pinned pages are released with put_page(), and
+rm->data.op_mmp_znotifier is cleared.  But we fail to properly
+clear rm->data.op_nents.
+
+Later when rds_message_purge() is called from rds_sendmsg() the
+cleanup loop iterates over the incorrectly non zero number of
+op_nents and frees them again.
+
+Fix this by properly resetting op_nents when it should be in
+rds_message_zcopy_from_user().
+
+Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.")
+Signed-off-by: Allison Henderson <achender@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260505234336.2132721-1-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rds/message.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/rds/message.c
++++ b/net/rds/message.c
+@@ -408,6 +408,7 @@ static int rds_message_zcopy_from_user(s
+ 
+                       for (i = 0; i < rm->data.op_nents; i++)
+                               put_page(sg_page(&rm->data.op_sg[i]));
++                      rm->data.op_nents = 0;
+                       mmp = &rm->data.op_mmp_znotifier->z_mmp;
+                       mm_unaccount_pinned_pages(mmp);
+                       ret = -EFAULT;

diff --git a/queue-6.12/series b/queue-6.12/series
index 5b07ea1db28b5d34a7a8ec33b7b193fdce624c1a..52ec839c44639fa33a7ce3bd775005c0d296872a 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -664,3 +664,4 @@ spi-sifive-fix-controller-deregistration.patch
 mptcp-pm-kernel-correctly-retransmit-add_addr-id-0.patch
 mptcp-pm-add_addr-rtx-fix-potential-data-race.patch
 mptcp-pm-add_addr-rtx-resched-blocked-add_addr-quicker.patch
+net-rds-reset-op_nents-when-zerocopy-page-pin-fails.patch