Patch "rxrpc: Fix double IRQ enablement" has been added to the 6.18-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    rxrpc: Fix double IRQ enablement

to the 6.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-fix-double-irq-enablement.patch
and it can be found in the queue-6.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From 41eb0af096ba8754e584d47e6de42f1e4980ceae Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Tue, 6 Oct 2026 14:30:00 +0100
Subject: rxrpc: Fix double IRQ enablement

From: David Howells <dhowells at redhat.com>

commit 41eb0af096ba8754e584d47e6de42f1e4980ceae upstream.

rxrpc_notify_socket() explicitly disables and then re-enables IRQs, but one
of its call chains (rxrpc_input_queue_data() -> rxrpc_end_rx_phase() ->
rxrpc_call_completed() -> rxrpc_set_call_completion()) has IRQs disabled
around it.

Fix this by making rxrpc_notify_socket() use irqsave spinlocks.

Fixes: a2ea9a907260 ("rxrpc: Use irq-disabling spinlocks between app and I/O thread")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260812110129.979970-6-dhowells@redhat.com
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Eric Dumazet <edumazet at google.com>
cc: "David S. Miller" <davem at davemloft.net>
cc: Jakub Kicinski <kuba at kernel.org>
cc: Paolo Abeni <pabeni at redhat.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20261006133011.531806-9-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni at redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 net/rxrpc/recvmsg.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -24,6 +24,7 @@ void rxrpc_notify_socket(struct rxrpc_ca
 {
 	struct rxrpc_sock *rx;
 	struct sock *sk;
+	unsigned long flags;
 
 	_enter("%d", call->debug_id);
 
@@ -38,16 +39,16 @@ void rxrpc_notify_socket(struct rxrpc_ca
 	sk = &rx->sk;
 	if (rx && sk->sk_state < RXRPC_CLOSE) {
 		if (call->notify_rx) {
-			spin_lock_irq(&call->notify_lock);
+			spin_lock_irqsave(&call->notify_lock, flags);
 			call->notify_rx(sk, call, call->user_call_ID);
-			spin_unlock_irq(&call->notify_lock);
+			spin_unlock_irqrestore(&call->notify_lock, flags);
 		} else {
-			spin_lock_irq(&rx->recvmsg_lock);
+			spin_lock_irqsave(&rx->recvmsg_lock, flags);
 			if (list_empty(&call->recvmsg_link)) {
 				rxrpc_get_call(call, rxrpc_call_get_notify_socket);
 				list_add_tail(&call->recvmsg_link, &rx->recvmsg_q);
 			}
-			spin_unlock_irq(&rx->recvmsg_lock);
+			spin_unlock_irqrestore(&rx->recvmsg_lock, flags);
 
 			if (!sock_flag(sk, SOCK_DEAD)) {
 				_debug("call %ps", sk->sk_data_ready);


Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.18/rxrpc-fix-double-irq-enablement.patch
queue-6.18/rxrpc-fix-return-in-rxrpc_recvmsg_data-for-service-calls.patch
queue-6.18/smb-client-discard-post-eof-pagecache-when-extending.patch
queue-6.18/smb-client-fix-use-after-free-infoleak-via-the-readdir-resume-name.patch
queue-6.18/smb-client-clear-post-eof-pagecache-when-extending-a.patch
queue-6.18/smb-client-fix-fattr-leaking-on-wsl_to_fattr-failure.patch
queue-6.18/smb-client-fix-oob-last_entry-pointer-from-unbounded-lastnameoffset.patch
queue-6.18/smb-client-don-t-resurrect-an-exiting-tcon-from-cached-dir-workers.patch
queue-6.18/afs-fix-afs-to-abort-the-rxrpc-call-on-send-error.patch
queue-6.18/smb-client-require-stable-pages-for-signed-connectio.patch
queue-6.18/rxrpc-fix-update-of-call-tx_pending-without-holding-lock.patch
queue-6.18/rxrpc-fix-lack-of-short-send-handling-in-rxrpc_kernel_send_data.patch
queue-6.18/smb-client-fix-use-after-free-in-cifs_ses_add_channel.patch
queue-6.18/smb-client-only-require-read-lease-for-size-extendin.patch
queue-6.18/smb-client-drain-and-invalidate-before-server-side-c.patch