Patch "rxrpc: Fix double unlock in rxrpc_recvmsg()" has been added to the 6.18-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    rxrpc: Fix double unlock in rxrpc_recvmsg()

to the 6.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch
and it can be found in the queue-6.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From a2f299b4d5510147fa8629a6aba2869bbcc88aea Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Wed, 24 Jun 2026 17:38:10 +0100
Subject: rxrpc: Fix double unlock in rxrpc_recvmsg()

From: David Howells <dhowells at redhat.com>

commit a2f299b4d5510147fa8629a6aba2869bbcc88aea upstream.

Fix a double unlock in rxrpc_recvmsg() when dealing with OOB messages.

Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20260624163819.3017002-4-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 net/rxrpc/recvmsg.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -470,7 +470,7 @@ try_again:
 		release_sock(&rx->sk);
 		if (ret == -EAGAIN)
 			goto try_again;
-		goto error_no_call;
+		goto error_trace;
 	}
 
 	/* Find the next call and dequeue it if we're not just peeking.  If we


Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.18/rxrpc-don-t-move-a-peeked-oob-message-onto-the-pending-queue.patch
queue-6.18/rxrpc-fix-potential-infinite-loop-in-rxrpc_recvmsg.patch
queue-6.18/rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch
queue-6.18/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.18/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.18/rxrpc-fix-ackall-packet-handling.patch
queue-6.18/rxrpc-fix-leak-of-connection-from-oob-challenge.patch
queue-6.18/rxrpc-fix-oob-challenge-leak-in-cleanup-after-notification-failure.patch
queue-6.18/afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch
queue-6.18/rxrpc-fix-socket-notification-race.patch
queue-6.18/rxrpc-fix-rxrpc_rotate_tx_rotate-to-check-there-s-something-to-rotate.patch
queue-6.18/rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch
queue-6.18/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
queue-6.18/afs-fix-null-pointer-dereference-in-afs_get_tree.patch
queue-6.18/rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch
queue-6.18/rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch
queue-6.18/afs-fix-uncancelled-rxrpc-oob-message-handler.patch
queue-6.18/rxrpc-fix-uaf-in-rxgk_issue_challenge.patch