Commit bfddc420afe8 for kernel

commit bfddc420afe827d9f06458cdf8087cd602f8c9cb
Author: Jan Beulich <jbeulich@suse.com>
Date:   Fri Nov 6 17:07:01 2026 +0100

    xen-netback: defer xenvif_mcast_addr_list_free()

    In order for the function to legitimately avoid locking/RCU, it needs to
    run after all TX/RX processing has finished/stopped: Lookups happen from
    xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()
    (called out of xenvif_poll()).

    Move the call out of xenvif_disconnect_data() (the call to the function
    from connect()'s error path doesn't require any cleaning up there), and
    put it past the synchronization point in backend_disconnect().

    This is XSA-527 / CVE-2026-100081.

    Fixes: b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect")
    Reported-by: kerhunt <kerhunt@proton.me>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Juergen Gross <jgross@suse.com>

diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index a0a438881388..b233834ec6cc 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -812,8 +812,6 @@ void xenvif_disconnect_data(struct xenvif *vif)

 		xenvif_disconnect_queue(queue);
 	}
-
-	xenvif_mcast_addr_list_free(vif);
 }

 void xenvif_disconnect_ctrl(struct xenvif *vif)
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index c1034d8f6bf0..a826fa24258b 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -267,6 +267,8 @@ static void backend_disconnect(struct backend_info *be)
 		vif->num_queues = 0;
 		synchronize_net();

+		xenvif_mcast_addr_list_free(vif);
+
 		for (queue_index = 0; queue_index < num_queues; ++queue_index)
 			xenvif_deinit_queue(&vif->queues[queue_index]);