6.1-stable patches

added patches:
	net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch

diff --git a/queue-6.1/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch b/queue-6.1/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch
new file mode 100644 (file)
index 0000000..ab7448f
--- /dev/null
+++ b/queue-6.1/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch
@@ -0,0 +1,118 @@
+From 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 Mon Sep 17 00:00:00 2001
+From: Jamal Hadi Salim <jhs@mojatatu.com>
+Date: Tue, 30 Jun 2026 11:09:22 -0400
+Subject: net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
+
+From: Jamal Hadi Salim <jhs@mojatatu.com>
+
+commit 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 upstream.
+
+This is a followup based on sashiko comments [1] on commit e5b811fe7931
+("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF")
+
+Use plain rcu_read_lock()/spin_lock() in teql_master_xmit() instead of the
+_bh variants, since ndo_start_xmit is already invoked with BH disabled
+by the core stack and the _bh primitives can warn in_hardirq() when xmit
+is reached through netpoll or a softirq xmit path with hard IRQs disabled.
+
+Moves rcu_read_lock() after restart: label + adds rcu_read_unlock() before
+goto restart (fixes the unbounded RCU hold across retries)
+
+[1] https://sashiko.dev/#/patchset/20260628111229.669751-1-jhs%40mojatatu.com
+
+Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Fixes: e5b811fe7931 ("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF")
+Link: https://patch.msgid.link/20260630150922.238714-1-jhs@mojatatu.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_teql.c |   27 ++++++++++++++-------------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+--- a/net/sched/sch_teql.c
++++ b/net/sched/sch_teql.c
+@@ -311,14 +311,14 @@ static netdev_tx_t teql_master_xmit(stru
+       int subq = skb_get_queue_mapping(skb);
+       struct sk_buff *skb_res = NULL;
+ 
+-      rcu_read_lock_bh();
+-
+-      start = rcu_dereference_bh(master->slaves);
+-
+ restart:
+       nores = 0;
+       busy = 0;
+ 
++      rcu_read_lock();
++
++      start = rcu_dereference(master->slaves);
++
+       q = start;
+       if (!q)
+               goto drop;
+@@ -345,17 +345,17 @@ restart:
+                                   netdev_start_xmit(skb, slave, slave_txq, false) ==
+                                   NETDEV_TX_OK) {
+                                       __netif_tx_unlock(slave_txq);
+-                                      spin_lock_bh(&master->slaves_lock);
++                                      spin_lock(&master->slaves_lock);
+                                       if (rcu_dereference_protected(master->slaves,
+                                                                     lockdep_is_held(&master->slaves_lock)) == q)
+                                               rcu_assign_pointer(master->slaves,
+                                                                  rcu_dereference_protected(NEXT_SLAVE(q),
+                                                                                            lockdep_is_held(&master->slaves_lock)));
+-                                      spin_unlock_bh(&master->slaves_lock);
++                                      spin_unlock(&master->slaves_lock);
+                                       netif_wake_queue(dev);
+                                       master->tx_packets++;
+                                       master->tx_bytes += length;
+-                                      rcu_read_unlock_bh();
++                                      rcu_read_unlock();
+                                       return NETDEV_TX_OK;
+                               }
+                               __netif_tx_unlock(slave_txq);
+@@ -364,37 +364,38 @@ restart:
+                               busy = 1;
+                       break;
+               case 1:
+-                      spin_lock_bh(&master->slaves_lock);
++                      spin_lock(&master->slaves_lock);
+                       if (rcu_dereference_protected(master->slaves,
+                                                     lockdep_is_held(&master->slaves_lock)) == q)
+                               rcu_assign_pointer(master->slaves,
+                                                  rcu_dereference_protected(NEXT_SLAVE(q),
+                                                                            lockdep_is_held(&master->slaves_lock)));
+-                      spin_unlock_bh(&master->slaves_lock);
+-                      rcu_read_unlock_bh();
++                      spin_unlock(&master->slaves_lock);
++                      rcu_read_unlock();
+                       return NETDEV_TX_OK;
+               default:
+                       nores = 1;
+                       break;
+               }
+               __skb_pull(skb, skb_network_offset(skb));
+-      } while ((q = rcu_dereference_bh(NEXT_SLAVE(q))) != start);
++      } while ((q = rcu_dereference(NEXT_SLAVE(q))) != start);
+ 
+       if (nores && skb_res == NULL) {
+               skb_res = skb;
++              rcu_read_unlock();
+               goto restart;
+       }
+ 
+       if (busy) {
+               netif_stop_queue(dev);
+-              rcu_read_unlock_bh();
++              rcu_read_unlock();
+               return NETDEV_TX_BUSY;
+       }
+       master->tx_errors++;
+ 
+ drop:
+       master->tx_dropped++;
+-      rcu_read_unlock_bh();
++      rcu_read_unlock();
+       dev_kfree_skb(skb);
+       return NETDEV_TX_OK;
+ }

diff --git a/queue-6.1/series b/queue-6.1/series
index 789b4f3e9b7d17c6645b125bbbb9f4ae6dc12321..60db669daadc8c715920a5c516d970f6bad678a7 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -886,3 +886,4 @@ ieee802154-admin-gate-legacy-llsec-dump-operations.patch
 ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch
 ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch
 ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch
+net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch