Patch "afs: Fix incorrect free in candidate cleanup in afs_lookup_server()" has been added to the 6.18-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    afs: Fix incorrect free in candidate cleanup in afs_lookup_server()

to the 6.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     afs-fix-incorrect-free-in-candidate-cleanup-in-afs_lookup_server.patch
and it can be found in the queue-6.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From 044d596094af4b769fb8e1173dff0d08bd68db6c Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Wed, 2 Sep 2026 13:10:21 +0100
Subject: afs: Fix incorrect free in candidate cleanup in afs_lookup_server()

From: David Howells <dhowells at redhat.com>

commit 044d596094af4b769fb8e1173dff0d08bd68db6c upstream.

Fix afs_lookup_server() to not free an existing server's endpoint state
when cleaning up a candidate server.  The candidate record doesn't have an
endpoint state yet at this point, so the free for that can just be removed.

Fixes: 4882ba78574e ("afs: Fix afs_server ref accounting")
Link: https://sashiko.dev/#/patchset/20260729160108.2031453-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells at redhat.com>
Link: https://patch.msgid.link/20260902121024.3328255-4-dhowells@redhat.com
cc: Marc Dionne <marc.dionne at auristor.com>
cc: linux-afs at lists.infradead.org
cc: linux-fsdevel at vger.kernel.org
cc: stable at vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 fs/afs/server.c |    1 -
 1 file changed, 1 deletion(-)

--- a/fs/afs/server.c
+++ b/fs/afs/server.c
@@ -242,7 +242,6 @@ struct afs_server *afs_lookup_server(str
 out:
 	afs_put_addrlist(alist, afs_alist_trace_put_server_create);
 	if (candidate) {
-		kfree(rcu_access_pointer(server->endpoint_state));
 		kfree(candidate);
 		afs_dec_servers_outstanding(cell->net);
 	}


Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.18/afs-fix-double-unmap-of-directory-block.patch
queue-6.18/afs-clear-stale-peer-app-data-after-address-list-changes.patch
queue-6.18/netfs-fix-subreq-ref-leak.patch
queue-6.18/netfs-fix-unbuffered-dio-write-partial-transfer-erro.patch
queue-6.18/cachefiles-fix-potential-uaf-kasan-warning.patch
queue-6.18/netfs-fix-i_size-update-for-partial-transfer.patch
queue-6.18/netfs-break-unbuffered-write-when-netfs_alloc_subreq.patch
queue-6.18/netfs-fix-uninitialized-return-value-in-netfs_unbuffered_write.patch
queue-6.18/cachefiles-fix-double-fput.patch
queue-6.18/netfs-fix-barriering-when-walking-subrequest-list.patch
queue-6.18/netfs-fix-decision-whether-to-disallow-write-streami.patch
queue-6.18/afs-fix-missing-kunmap-in-afs_dir_search_bucket.patch
queue-6.18/netfs-fix-error-vs-transferred-passed-to-ki_complete.patch
queue-6.18/afs-fix-incorrect-free-in-candidate-cleanup-in-afs_lookup_server.patch