Commit f96f16592a32 for kernel

commit f96f16592a32430a0582309d73a873b6d3ee2bdb
Author: Tu Dinh <ngoc-tu.dinh@vates.tech>
Date:   Sat Nov 7 12:35:51 2026 +0100

    xen-netback: Zero out sring pointers on unmap

    If xenvif_map_frontend_data_rings() fails when a ring is already mapped,
    it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the
    ring pointers unchanged. xenvif_connect_data()'s cleanup path calls
    xenvif_disconnect_queue() which in turn calls
    xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the
    pointers a second time.

    Zero out the ring pointers after they are unmapped to avoid this issue.

    This is XSA-532

    Fixes: 2ac061ce97f4 ("xen/netback: cleanup init and deinit code")
    Signed-off-by: Tu Dinh <ngoc-tu.dinh@vates.tech>
    Reviewed-by: Juergen Gross <jgross@suse.com>

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 3cdb7fd659db..dc229756bdc2 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1530,12 +1530,17 @@ static inline bool tx_dealloc_work_todo(struct xenvif_queue *queue)

 void xenvif_unmap_frontend_data_rings(struct xenvif_queue *queue)
 {
-	if (queue->tx.sring)
+	if (queue->tx.sring) {
 		xenbus_unmap_ring_vfree(xenvif_to_xenbus_device(queue->vif),
 					queue->tx.sring);
-	if (queue->rx.sring)
+		queue->tx.sring = NULL;
+	}
+
+	if (queue->rx.sring) {
 		xenbus_unmap_ring_vfree(xenvif_to_xenbus_device(queue->vif),
 					queue->rx.sring);
+		queue->rx.sring = NULL;
+	}
 }

 int xenvif_map_frontend_data_rings(struct xenvif_queue *queue,