Commit 13b4ece33cf9 for kernel

commit 13b4ece33cf9def67966bb8716783c42cec20617
Author: Mat Martineau <martineau@kernel.org>
Date:   Mon Apr 21 19:07:13 2025 +0200

    mptcp: pm: Defer freeing of MPTCP userspace path manager entries

    When path manager entries are deleted from the local address list, they
    are first unlinked from the address list using list_del_rcu(). The
    entries must not be freed until after the RCU grace period, but the
    existing code immediately frees the entry.

    Use kfree_rcu_mightsleep() and adjust sk_omem_alloc in open code instead
    of using the sock_kfree_s() helper. This code path is only called in a
    netlink handler, so the "might sleep" function is preferable to adding
    a rarely-used rcu_head member to struct mptcp_pm_addr_entry.

    Fixes: 88d097316371 ("mptcp: drop free_list for deleting entries")
    Cc: stable@vger.kernel.org
    Signed-off-by: Mat Martineau <martineau@kernel.org>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20250421-net-mptcp-pm-defer-freeing-v1-1-e731dc6e86b9@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c
index 2cb62f026b1f..a715dcbe0146 100644
--- a/net/mptcp/pm_userspace.c
+++ b/net/mptcp/pm_userspace.c
@@ -337,7 +337,11 @@ int mptcp_pm_nl_remove_doit(struct sk_buff *skb, struct genl_info *info)

 	release_sock(sk);

-	sock_kfree_s(sk, match, sizeof(*match));
+	kfree_rcu_mightsleep(match);
+	/* Adjust sk_omem_alloc like sock_kfree_s() does, to match
+	 * with allocation of this memory by sock_kmemdup()
+	 */
+	atomic_sub(sizeof(*match), &sk->sk_omem_alloc);

 	err = 0;
 out: