Patch "afs: Fix further netns teardown to cancel the preallocation charger" has been added to the 6.18-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    afs: Fix further netns teardown to cancel the preallocation charger

to the 6.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch
and it can be found in the queue-6.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From 2daf8ac812c3d78c642fe7652f62e29df5e3da20 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Wed, 24 Jun 2026 17:38:11 +0100
Subject: afs: Fix further netns teardown to cancel the preallocation charger

From: David Howells <dhowells at redhat.com>

commit 2daf8ac812c3d78c642fe7652f62e29df5e3da20 upstream.

When an afs network namespace is torn down, it cancels and waits for the
work item that keeps the preallocated rxrpc call/conn/peer queue charged
before disabling incoming (i.e. listen 0), but there's a small window in
which it can be requeued by an incoming call wending through the I/O
thread.

Fix this by cancelling the charger work item again after reducing the
listen backlog to zero.

Fixes: 47694fbc9d24 ("afs: Fix netns teardown to cancel the preallocation charger")
Reported-by: Jakub Kicinski <kuba at kernel.org>
Signed-off-by: David Howells <dhowells at redhat.com>
Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
cc: Li Daming <d4n.for.sec at gmail.com>
cc: Ren Wei <n05ec at lzu.edu.cn>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20260624163819.3017002-5-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 fs/afs/rxrpc.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -128,8 +128,13 @@ void afs_close_socket(struct afs_net *ne
 	_enter("");
 
 	cancel_work_sync(&net->charge_preallocation_work);
+	/* Future work items should now see ->live is false. */
+
 	kernel_listen(net->socket, 0);
+
+	/* Make sure work items are no longer running. */
 	flush_workqueue(afs_async_calls);
+	cancel_work_sync(&net->charge_preallocation_work);
 
 	if (net->spare_incoming_call) {
 		afs_put_call(net->spare_incoming_call);


Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.18/rxrpc-don-t-move-a-peeked-oob-message-onto-the-pending-queue.patch
queue-6.18/rxrpc-fix-potential-infinite-loop-in-rxrpc_recvmsg.patch
queue-6.18/rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch
queue-6.18/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.18/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.18/rxrpc-fix-ackall-packet-handling.patch
queue-6.18/rxrpc-fix-leak-of-connection-from-oob-challenge.patch
queue-6.18/rxrpc-fix-oob-challenge-leak-in-cleanup-after-notification-failure.patch
queue-6.18/afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch
queue-6.18/rxrpc-fix-socket-notification-race.patch
queue-6.18/rxrpc-fix-rxrpc_rotate_tx_rotate-to-check-there-s-something-to-rotate.patch
queue-6.18/rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch
queue-6.18/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
queue-6.18/afs-fix-null-pointer-dereference-in-afs_get_tree.patch
queue-6.18/rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch
queue-6.18/rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch
queue-6.18/afs-fix-uncancelled-rxrpc-oob-message-handler.patch
queue-6.18/rxrpc-fix-uaf-in-rxgk_issue_challenge.patch