Commit 2daf8ac812c3 for kernel

commit 2daf8ac812c3d78c642fe7652f62e29df5e3da20
Author: David Howells <dhowells@redhat.com>
Date:   Wed Jun 24 17:38:11 2026 +0100

    afs: Fix further netns teardown to cancel the preallocation charger

    When an afs network namespace is torn down, it cancels and waits for the
    work item that keeps the preallocated rxrpc call/conn/peer queue charged
    before disabling incoming (i.e. listen 0), but there's a small window in
    which it can be requeued by an incoming call wending through the I/O
    thread.

    Fix this by cancelling the charger work item again after reducing the
    listen backlog to zero.

    Fixes: 47694fbc9d24 ("afs: Fix netns teardown to cancel the preallocation charger")
    Reported-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
    cc: Li Daming <d4n.for.sec@gmail.com>
    cc: Ren Wei <n05ec@lzu.edu.cn>
    cc: Marc Dionne <marc.dionne@auristor.com>
    cc: Jeffrey Altman <jaltman@auristor.com>
    cc: Simon Horman <horms@kernel.org>
    cc: linux-afs@lists.infradead.org
    cc: stable@kernel.org
    Link: https://patch.msgid.link/20260624163819.3017002-5-dhowells@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index d5cfd24e815b..6714a189d58f 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -128,8 +128,13 @@ void afs_close_socket(struct afs_net *net)
 	_enter("");

 	cancel_work_sync(&net->charge_preallocation_work);
+	/* Future work items should now see ->live is false. */
+
 	kernel_listen(net->socket, 0);
+
+	/* Make sure work items are no longer running. */
 	flush_workqueue(afs_async_calls);
+	cancel_work_sync(&net->charge_preallocation_work);

 	if (net->spare_incoming_call) {
 		afs_put_call(net->spare_incoming_call);