Commit 4c46beb807ef for kernel

commit 4c46beb807efcc93f5899ebe1f5958248eb296c6
Author: Long Li <longli@microsoft.com>
Date:   Fri Sep 4 13:26:40 2026 -0700

    net: mana: restore the XDP program pointer when pre-allocation fails

    mana_xdp_set() publishes the new program into apc->bpf_prog before it
    allocates anything, because mana_pre_alloc_rxbufs() sizes the buffers
    from it via mana_get_rxbuf_cfg(). When that allocation fails the
    function returns the error directly, skipping the err_dealloc_rxbuffs
    label which is the only place that restores the previous pointer.

    The attach is reported as failed, so the BPF core drops the reference it
    held for the caller and the program can be freed, while apc->bpf_prog
    still points at it. The next consumer of mana_xdp_get() - typically
    mana_chn_setxdp() from mana_alloc_queues() on the following ifup, or
    after a TX timeout reset - then calls bpf_prog_add() on freed memory.

    This is reachable from an ordinary "ip link set dev ethX xdp obj ..."
    whenever the per-queue RX buffer pre-allocation cannot be satisfied.

    Restore the previous program on that error path.

    Fixes: 730ff06d3f5c ("net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.")
    Signed-off-by: Long Li <longli@microsoft.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20260904202640.3900685-1-longli@microsoft.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/microsoft/mana/mana_bpf.c b/drivers/net/ethernet/microsoft/mana/mana_bpf.c
index 53308e139cbe..5c9961ee9747 100644
--- a/drivers/net/ethernet/microsoft/mana/mana_bpf.c
+++ b/drivers/net/ethernet/microsoft/mana/mana_bpf.c
@@ -208,6 +208,7 @@ static int mana_xdp_set(struct net_device *ndev, struct bpf_prog *prog,
 		if (err) {
 			NL_SET_ERR_MSG_MOD(extack,
 					   "XDP: Insufficient memory for tx/rx re-config");
+			apc->bpf_prog = old_prog;
 			return err;
 		}