Patch "rxrpc: Fix irq-disabled in local_bh_enable()" has been added to the 6.6-stable tree
gregkh at linuxfoundation.org
gregkh at linuxfoundation.org
Fri Aug 7 06:49:55 PDT 2026
This is a note to let you know that I've just added the patch titled
rxrpc: Fix irq-disabled in local_bh_enable()
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rxrpc-fix-irq-disabled-in-local_bh_enable.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.
>From stable+bounces-296804-greg=kroah.com at vger.kernel.org Thu Aug 6 14:49:19 2026
From: Sasha Levin <sashal at kernel.org>
Date: Thu, 6 Aug 2026 08:46:13 -0400
Subject: rxrpc: Fix irq-disabled in local_bh_enable()
To: stable at vger.kernel.org
Cc: David Howells <dhowells at redhat.com>, Jeffrey Altman <jaltman at auristor.com>, Marc Dionne <marc.dionne at auristor.com>, "Junvyyang, Tencent Zhuque Lab" <zhuque at tencent.com>, LePremierHomme <kwqcheii at proton.me>, Simon Horman <horms at kernel.org>, linux-afs at lists.infradead.org, Jakub Kicinski <kuba at kernel.org>, Sasha Levin <sashal at kernel.org>
Message-ID: <20260806124613.299390-1-sashal at kernel.org>
From: David Howells <dhowells at redhat.com>
[ Upstream commit e4d2878369d590bf8455e3678a644e503172eafa ]
The rxrpc_assess_MTU_size() function calls down into the IP layer to find
out the MTU size for a route. When accepting an incoming call, this is
called from rxrpc_new_incoming_call() which holds interrupts disabled
across the code that calls down to it. Unfortunately, the IP layer uses
local_bh_enable() which, config dependent, throws a warning if IRQs are
enabled:
WARNING: CPU: 1 PID: 5544 at kernel/softirq.c:387 __local_bh_enable_ip+0x43/0xd0
...
RIP: 0010:__local_bh_enable_ip+0x43/0xd0
...
Call Trace:
<TASK>
rt_cache_route+0x7e/0xa0
rt_set_nexthop.isra.0+0x3b3/0x3f0
__mkroute_output+0x43a/0x460
ip_route_output_key_hash+0xf7/0x140
ip_route_output_flow+0x1b/0x90
rxrpc_assess_MTU_size.isra.0+0x2a0/0x590
rxrpc_new_incoming_peer+0x46/0x120
rxrpc_alloc_incoming_call+0x1b1/0x400
rxrpc_new_incoming_call+0x1da/0x5e0
rxrpc_input_packet+0x827/0x900
rxrpc_io_thread+0x403/0xb60
kthread+0x2f7/0x310
ret_from_fork+0x2a/0x230
ret_from_fork_asm+0x1a/0x30
...
hardirqs last enabled at (23): _raw_spin_unlock_irq+0x24/0x50
hardirqs last disabled at (24): _raw_read_lock_irq+0x17/0x70
softirqs last enabled at (0): copy_process+0xc61/0x2730
softirqs last disabled at (25): rt_add_uncached_list+0x3c/0x90
Fix this by moving the call to rxrpc_assess_MTU_size() out of
rxrpc_init_peer() and further up the stack where it can be done without
interrupts disabled.
It shouldn't be a problem for rxrpc_new_incoming_call() to do it after the
locks are dropped as pmtud is going to be performed by the I/O thread - and
we're in the I/O thread at this point.
Fixes: a2ea9a907260 ("rxrpc: Use irq-disabling spinlocks between app and I/O thread")
Signed-off-by: David Howells <dhowells at redhat.com>
Reviewed-by: Jeffrey Altman <jaltman at auristor.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Junvyyang, Tencent Zhuque Lab <zhuque at tencent.com>
cc: LePremierHomme <kwqcheii at proton.me>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
Link: https://patch.msgid.link/20250717074350.3767366-2-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
[ moved `peer->mtu`/`peer->maxdata` derivation into `rxrpc_assess_MTU_size()` at both exits since 6.12 predates the `max_data` rework ]
Signed-off-by: Sasha Levin <sashal at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
net/rxrpc/ar-internal.h | 1 +
net/rxrpc/call_accept.c | 1 +
net/rxrpc/peer_object.c | 12 +++++++-----
3 files changed, 9 insertions(+), 5 deletions(-)
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -1188,6 +1188,7 @@ struct rxrpc_peer *rxrpc_lookup_peer_rcu
const struct sockaddr_rxrpc *);
struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_local *local,
struct sockaddr_rxrpc *srx, gfp_t gfp);
+void rxrpc_assess_MTU_size(struct rxrpc_local *local, struct rxrpc_peer *peer);
struct rxrpc_peer *rxrpc_alloc_peer(struct rxrpc_local *, gfp_t,
enum rxrpc_peer_trace);
void rxrpc_new_incoming_peer(struct rxrpc_local *local, struct rxrpc_peer *peer);
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -407,6 +407,7 @@ bool rxrpc_new_incoming_call(struct rxrp
spin_unlock(&rx->incoming_lock);
read_unlock_irq(&local->services_lock);
+ rxrpc_assess_MTU_size(local, call->peer);
if (hlist_unhashed(&call->error_link)) {
spin_lock_irq(&call->peer->lock);
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -147,8 +147,7 @@ struct rxrpc_peer *rxrpc_lookup_peer_rcu
* assess the MTU size for the network interface through which this peer is
* reached
*/
-static void rxrpc_assess_MTU_size(struct rxrpc_local *local,
- struct rxrpc_peer *peer)
+void rxrpc_assess_MTU_size(struct rxrpc_local *local, struct rxrpc_peer *peer)
{
struct net *net = local->net;
struct dst_entry *dst;
@@ -160,6 +159,8 @@ static void rxrpc_assess_MTU_size(struct
#endif
peer->if_mtu = 1500;
+ peer->mtu = peer->if_mtu;
+ peer->maxdata = peer->mtu - peer->hdrsize;
memset(&fl, 0, sizeof(fl));
switch (peer->srx.transport.family) {
@@ -199,6 +200,9 @@ static void rxrpc_assess_MTU_size(struct
peer->if_mtu = dst_mtu(dst);
dst_release(dst);
+ peer->mtu = peer->if_mtu;
+ peer->maxdata = peer->mtu - peer->hdrsize;
+
_leave(" [if_mtu %u]", peer->if_mtu);
}
@@ -240,8 +244,6 @@ static void rxrpc_init_peer(struct rxrpc
unsigned long hash_key)
{
peer->hash_key = hash_key;
- rxrpc_assess_MTU_size(local, peer);
- peer->mtu = peer->if_mtu;
peer->rtt_last_req = ktime_get_real();
switch (peer->srx.transport.family) {
@@ -266,7 +268,6 @@ static void rxrpc_init_peer(struct rxrpc
}
peer->hdrsize += sizeof(struct rxrpc_wire_header);
- peer->maxdata = peer->mtu - peer->hdrsize;
}
/*
@@ -285,6 +286,7 @@ static struct rxrpc_peer *rxrpc_create_p
if (peer) {
memcpy(&peer->srx, srx, sizeof(*srx));
rxrpc_init_peer(local, peer, hash_key);
+ rxrpc_assess_MTU_size(local, peer);
}
_leave(" = %p", peer);
Patches currently in stable-queue which might be from sashal at kernel.org are
queue-6.6/sysctl-treewide-constify-ctl_table_header-ctl_table_arg.patch
queue-6.6/wifi-brcmfmac-set-f2-blocksize-to-256-for-bcm43752.patch
queue-6.6/usb-gadget-f_tcm-synchronize-delayed-set_alt-with-teardown.patch
queue-6.6/net-sxgbe-free-tx-rings-on-rx-allocation-failure.patch
queue-6.6/usb-typec-ucsi-fix-race-condition-and-ordering-in-port-unregistration.patch
queue-6.6/drm-fb-helper-allocate-and-release-fb_info-in-single-place.patch
queue-6.6/pinctrl-qcom-sc8280xp-add-missing-wakeup-entries-for.patch
queue-6.6/forcedeth-fix-uaf-of-txrx_stats-in-nv_remove.patch
queue-6.6/hid-logitech-dj-standardise-hid_report_enum-variable.patch
queue-6.6/scsi-libsas-fix-ha-resume-deadlock-and-hisi_sas-disk.patch
queue-6.6/netfilter-nft_payload-fix-mask-build-for-partial-fie.patch
queue-6.6/bluetooth-iso-fix-timeout-vs-sync_timeout-typo-in-ch.patch
queue-6.6/net-sxgbe-check-descriptor-ring-allocation-failures.patch
queue-6.6/ipvs-fix-the-checksum-validations.patch
queue-6.6/mptcp-pm-avoid-code-duplication-to-lookup-endp.patch
queue-6.6/spi-spi-cadence-move-tx-fifo-full-busy-wait-into-fif.patch
queue-6.6/powerpc-boot-fix-simpleboot-cpu-node-lookup-check.patch
queue-6.6/ata-sata_mv-accept-1-or-2-resources-in-platform-prob.patch
queue-6.6/wifi-mac80211-validate-individual-twt-params-before-.patch
queue-6.6/mm-hugetlb-fix-swap-entry-corruption-when-clearing-u.patch
queue-6.6/dmaengine-idxd-fix-fdev-setup-failure-cleanup-in-idx.patch
queue-6.6/asoc-max98090-fix-missing-is_err-before-ptr_err-on-m.patch
queue-6.6/mptcp-pm-use-addr-entry-for-get_local_id.patch
queue-6.6/sched-add-task_struct-faults_disabled_mapping.patch
queue-6.6/libceph-add-doutc-and-_client-debug-macros-support.patch
queue-6.6/gve-fix-rx-queue-stall-on-alloc-failure.patch
queue-6.6/bluetooth-hci_sync-remove-unnecessary-hci_conn_get-i.patch
queue-6.6/drm-mediatek-check-crtc-state-before-freeing.patch
queue-6.6/usb-musb-omap2430-clean-up-probe-error-handling.patch
queue-6.6/bluetooth-iso-clear-iso_data-always-when-detaching-c.patch
queue-6.6/accel-qaic-use-sizeof-trans_hdr-for-transaction-leng.patch
queue-6.6/pinctrl-amd-don-t-clear-s4-wake-bits-at-probe.patch
queue-6.6/net-bridge-mrp-fix-option-tlv-length-in-mrp_test-fra.patch
queue-6.6/gpio-pch-use-raw_spinlock_t-for-the-register-lock.patch
queue-6.6/powerpc-boot-fix-treeboot-currituck-cpu-node-lookup-.patch
queue-6.6/wifi-ath6kl-fix-use-after-free-in-aggr_reset_state.patch
queue-6.6/wifi-brcmfmac-fix-43752-sdio-fwvid-incorrectly-labelled-as-cypress-cyw.patch
queue-6.6/keys-make-keyring-key-chunk-byte-order-agree-with-ke.patch
queue-6.6/hwmon-adt7470-fix-fans-stuck-in-manual-mode-on-i2c-e.patch
queue-6.6/ata-ahci_ceva-fix-error-paths-in-ceva_ahci_platform_.patch
queue-6.6/qede-sync-udp_tunnel-ports-outside-qede_lock-in-the-.patch
queue-6.6/tracing-mmiotrace-reset-dropped_count-in-mmio_reset_.patch
queue-6.6/netfilter-nf_conntrack_sip-widen-nat-rewrite-delta-t.patch
queue-6.6/usb-typec-ucsi-split-connector-lock-classes.patch
queue-6.6/ahci-introduce-ahci_ignore_port-helper.patch
queue-6.6/mm-huge_memory-unlock-i_mmap_rwsem-before-releasing-.patch
queue-6.6/bluetooth-l2cap-fix-uaf-in-l2cap_le_connect_rsp.patch
queue-6.6/scsi-zfcp-fix-memory-leak-during-adapter-release-by-.patch
queue-6.6/mptcp-pm-userspace-fix-use-after-free-in-get_local_id.patch
queue-6.6/net-dsa-mt7530-error-out-on-failed-reads-in-mt7531-p.patch
queue-6.6/scsi-libiscsi_tcp-bound-scsi-response-data-segment-t.patch
queue-6.6/bluetooth-hci_conn-hold-conn-reference-in-abort_conn.patch
queue-6.6/ipvs-do-not-mangle-icmp-replies-for-non-first-fragme.patch
queue-6.6/phy-zynqmp-fix-clock-error-handling-in-xpsgtr_phy_in.patch
queue-6.6/asoc-max98095-fix-missing-is_err-before-ptr_err-on-m.patch
queue-6.6/hid-logitech-dj-fix-wrong-detection-of-bad-dj_short-.patch
queue-6.6/rds-tcp-hold-the-rcu-lock-across-ipv6_chk_addr-in-rd.patch
queue-6.6/hwmon-lm90-only-report-alarms-if-driver-is-ready.patch
queue-6.6/ceph-print-cluster-fsid-and-client-global_id-in-all-debug-logs.patch
queue-6.6/media-v4l2-fwnode-fix-subdev-owner-overwritten-in-v4l2_async_register_subdev_sensor.patch
queue-6.6/wifi-brcmfmac-drain-bus_reset-work-on-device-removal.patch
queue-6.6/hwmon-adt7470-fix-divide-by-zero-toctou-crash-in-fan.patch
queue-6.6/mptcp-add-mptcp_userspace_pm_lookup_addr-helper.patch
queue-6.6/hwmon-adt7470-fix-temperature-alarm-logic-in-hwmon_t.patch
queue-6.6/ksmbd-return-success-for-deferred-final-close.patch
queue-6.6/drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch
queue-6.6/drm-renesas-move-rz-g2l-mipi-dsi-driver-to-rz-du.patch
queue-6.6/scsi-ufs-core-cancel-rtc-work-in-active-active-suspe.patch
queue-6.6/hwmon-adt7470-fix-cache-updated-before-hardware-writ.patch
queue-6.6/assoc_array-trim-the-final-shortcut-word-using-the-c.patch
queue-6.6/usb-musb-omap2430-do-not-put-borrowed-of_node-in-probe.patch
queue-6.6/ksmbd-fix-use-after-free-in-__close_file_table_ids.patch
queue-6.6/netfilter-xt_hashlimit-validate-hashtable-supports-x.patch
queue-6.6/scsi-target-iblock-fix-wrong-pr-ops-null-check-for-p.patch
queue-6.6/hwmon-adt7470-fix-swapped-pwm3-and-pwm4-auto-mode-ma.patch
queue-6.6/media-i2c-imx219-access-height-from-active-format-in-imx219_set_ctrl.patch
queue-6.6/usb-typec-ucsi-only-enable-supported-notifications.patch
queue-6.6/drm-i915-vrr-check-has_vrr-first-in-intel_vrr_is_capable.patch
queue-6.6/ipv6-fib6-fix-null-deref-in-fib6_walk_continue-on-mu.patch
queue-6.6/netfilter-br_netfilter-reallocate-headroom-if-necess.patch
queue-6.6/keys-fix-out-of-bounds-read-in-keyring_get_key_chunk.patch
queue-6.6/hwmon-adt7470-use-cached-pwm-frequency-value.patch
queue-6.6/hwmon-pmbus-fix-return-value-from-pmbus_update_byte_.patch
queue-6.6/phy-zynqmp-fix-runtime-pm-leak-on-probe-allocation-f.patch
queue-6.6/scsi-libiscsi-fix-stale-data-leak-into-the-scsi-sens.patch
queue-6.6/soc-qcom-ice-allow-explicit-votes-on-iface-clock-for.patch
queue-6.6/spi-spi-cadence-supports-transmission-with-bits_per_.patch
queue-6.6/sctp-close-udp-tunnel-sockets-during-netns-teardown.patch
queue-6.6/ipvs-fix-places-with-wrong-packet-offsets.patch
queue-6.6/drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch
queue-6.6/hwmon-adt7470-fix-pwm-auto-temp-state-array-and-boun.patch
queue-6.6/bluetooth-hci_sync-make-hci_cmd_sync_run_once-return.patch
queue-6.6/hwmon-adt7470-fix-busy-loop-and-i2c-flooding-in-upda.patch
queue-6.6/rxrpc-fix-irq-disabled-in-local_bh_enable.patch
queue-6.6/hwmon-nct6775-core-fix-number-of-temperature-registe.patch
queue-6.6/hwmon-nct6775-core-prevent-access-to-unsupported-wei.patch
queue-6.6/dmaengine-sun6i-dma-fix-reclaim-descriptors-while-te.patch
queue-6.6/media-i2c-imx219-drop-imx219_vts_-macros.patch
queue-6.6/rds-fix-inet6_addr_lst-null-dereference-when-ipv6-is.patch
queue-6.6/media-i2c-imx219-rename-vts-to-frm_length.patch
queue-6.6/smb-client-fix-buffer-leaks-in-smb1-read-and-write.patch
queue-6.6/scsi-target-clear-cmd_cnt-when-initial-counter-enrol.patch
queue-6.6/bluetooth-hci_sync-fix-hci_conn_del-use-in-hci_le_cr.patch
queue-6.6/net-phylink-put-link_gpio-if-phylink_create-fails.patch
queue-6.6/btrfs-zoned-fix-deadlock-between-metadata-writeback-.patch
queue-6.6/media-imx219-fix-maximum-frame-length-in-lines.patch
queue-6.6/media-i2c-imx219-group-functions-by-purpose.patch
queue-6.6/drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch
queue-6.6/media-i2c-imx219-don-t-store-the-current-mode-in-the-imx219-structure.patch
queue-6.6/hwmon-nzxt-smart2-dma-align-output-buffer.patch
queue-6.6/rhashtable-clear-stale-iter-p-on-table-restart.patch
queue-6.6/drm-amdgpu-respect-placement-requirements-in-amdgpu_gtt_mgr-functions.patch
queue-6.6/powerpc-boot-fix-treeboot-akebono-cpu-node-lookup-ch.patch
queue-6.6/media-v4l-async-set-owner-for-async-sub-devices.patch
queue-6.6/thunderbolt-prevent-xdomain-delayed-work-use-after-f.patch
queue-6.6/netfilter-nf_tables-clone-set-on-flush-only.patch
queue-6.6/ata-libahci_platform-support-non-consecutive-port-nu.patch
queue-6.6/octeontx2-pf-set-correct-sequence-for-carrier-off-an.patch
queue-6.6/net-mpls-initialize-rtm_tos-in-mpls_getroute.patch
queue-6.6/ceph-fix-refcount-leak-in-ceph_readdir.patch
queue-6.6/netfilter-nf_conntrack_expect-restore-helper-propaga.patch
queue-6.6/bluetooth-btintel-validate-length-before-parsing-dia.patch
queue-6.6/firmware-stratix10-svc-fix-memory-leaks-and-list-cor.patch
queue-6.6/hid-logitech-dj-prevent-report_id_dj_short-related-u.patch
queue-6.6/sctp-avoid-auth_enable-sysctl-uaf-during-netns-teardown.patch
queue-6.6/iommu-sva-move-x86-disable-check-before-allocation.patch
queue-6.6/media-i2c-imx219-calculate-crop-rectangle-dynamically.patch
queue-6.6/net-do-not-send-icmp-ndisc-redirects-when-peer-alloc.patch
queue-6.6/phy-zynqmp-postpone-getting-clock-rate-until-actuall.patch
queue-6.6/can-isotp-check-register_netdevice_notifier-error-in.patch
More information about the linux-afs
mailing list