Commit 2c0f1b651d87 for kernel

commit 2c0f1b651d8730c74a4b0cc325ec25808ec92e44
Merge: b78f348d4c4d a5462da5a349
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Thu Jun 25 10:07:35 2026 -0700

    Merge branch 'rxrpc-miscellaneous-fixes'

    David Howells says:

    ====================
    rxrpc: Miscellaneous fixes

    Here are some miscellaneous AF_RXRPC fixes for more stuff found by Sashiko[1][2]:

     (1) Fix ACKALL handling by adding two more call states to simplify when
         ACKs are valid.

     (2) Fix connection leak from AF_RXRPC recvmsg userspace OOB handling.

     (3) Fix double unlock in AF_RXRPC recvmsg userspace OOB handling.

     (4) Fix AFS preallocate charge to flush the waitqueue after unlistening
         the socket so that any charging thread that does manage to get started
         will be waited for before socket destruction.

     (5) Fix AFS OOB notify handling to cancel in-progress OOB notification
         handling and then to flush the workqueue it's on.

     (6) Fix handling of apparent reply reception before initial transmission
         starts in client call.

     (7) Fix OOB challenge leak in cleanup on notification failure.

     (8) Fix infinite loop in recvmsg if OOB packet available, but no calls.

     (9) Fix notify vs recvmsg race where notify thinks the call is already
         queued.

    (10) Fix MSG_PEEK call leak for calls with no content.

    (11) Fix rxrpc_rotate_tx_window() to check that there's something in the Tx
         buffer before attempting to rotate it.
    ====================

    Link: https://patch.msgid.link/20260624163819.3017002-1-dhowells@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>