--- /dev/null
+From cabc73958dfbb5957d014f26af426fa8b9cb9572 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 12:19:22 +0000
+Subject: drm/i915: ensure segment offset never exceeds allowed max
+
+From: Krzysztof Karas <krzysztof.karas@intel.com>
+
+[ Upstream commit 2e0438f9c3d25eea8bc8e9b4dcff7edfb64cb9e7 ]
+
+Commit 255fc1703e42 ("drm/i915/gem: Calculate object page offset for
+partial memory mapping") introduced a new offset, which accounts for
+userspace mapping not starting from the beginning of object's scatterlist.
+
+This works fine for cases where first object pte is larger than the new
+offset - "r->sgt.curr" counter is set to the offset to match the difference
+in the number of total pages. However, if object's first pte's size is
+equal to or smaller than the offset, then information about the offset
+in userspace is covered up by moving "r->sgt" pointer in remap_sg():
+
+ r->sgt.curr += PAGE_SIZE;
+ if (r->sgt.curr >= r->sgt.max)
+ r->sgt = __sgt_iter(__sg_next(r->sgt.sgp), use_dma(r->iobase));
+
+This means that two or more pages from virtual memory are counted for
+only one page in object's memory, because after moving "r->sgt" pointer
+"r->sgt.curr" will be 0.
+
+We should account for this mismatch by moving "r->sgt" pointer to the
+next pte. For that we may use "r.sgt.max", which already holds the max
+allowed size. This change also eliminates possible confusion, when
+looking at i915_scatterlist.h and remap_io_sg() code: former has
+scatterlist pointer definition, which differentiates "s.max" value
+based on "dma" flag (sg_dma_len() is used only when the flag is
+enabled), while latter uses sg_dma_len() indiscriminately.
+
+This patch aims to resolve issue:
+https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12031
+
+v3:
+ - instead of checking if r.sgt.curr would exceed allowed max, changed
+the value in the while loop to be aligned with `dma` value
+
+v4:
+ - remove unnecessary parent relation
+
+v5:
+ - update commit message with explanation about page counting mismatch
+ and link to the issue
+
+Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/upbjdavlbcxku63ns4vstp5kgbn2anxwewpmnppszgb67fn66t@tfclfgkqijue
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_mm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_mm.c b/drivers/gpu/drm/i915/i915_mm.c
+index f5c97a620962b6..76e2801619f092 100644
+--- a/drivers/gpu/drm/i915/i915_mm.c
++++ b/drivers/gpu/drm/i915/i915_mm.c
+@@ -143,8 +143,8 @@ int remap_io_sg(struct vm_area_struct *vma,
+ /* We rely on prevalidation of the io-mapping to skip track_pfn(). */
+ GEM_BUG_ON((vma->vm_flags & EXPECTED_FLAGS) != EXPECTED_FLAGS);
+
+- while (offset >= sg_dma_len(r.sgt.sgp) >> PAGE_SHIFT) {
+- offset -= sg_dma_len(r.sgt.sgp) >> PAGE_SHIFT;
++ while (offset >= r.sgt.max >> PAGE_SHIFT) {
++ offset -= r.sgt.max >> PAGE_SHIFT;
+ r.sgt = __sgt_iter(__sg_next(r.sgt.sgp), use_dma(iobase));
+ if (!r.sgt.sgp)
+ return -EINVAL;
+--
+2.53.0
+
--- /dev/null
+From 5557724771497d1ad077af68d94d5840fd3e0fba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 May 2026 09:44:29 +0800
+Subject: wifi: rtw89: correct drop logic for malformed AMPDU frames
+
+From: Po-Hao Huang <phhuang@realtek.com>
+
+[ Upstream commit 63ccdfac8677387dfdbd9d4336089e9823280704 ]
+
+The previous commit aims to fix issue caused by malformed AMPDU frames.
+But the drop logic fails to deal with the first AMPDU packet paired with
+certain range of sequence number, and leads to unexpected packet drop.
+It is more likely to encounter this failure when there are busy traffic
+during rekey process and could lead to disconnection from the AP.
+Fix this by adding a initial state judgement and only reset status
+during pairwise rekey.
+
+Fixes: bda294ed0ed0 ("wifi: rtw89: Drop malformed AMPDU frames with abnormal PN")
+Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260515014433.16168-10-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 3 ++-
+ drivers/net/wireless/realtek/rtw89/mac80211.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index 70feab97dccb5a..486c1774fb9759 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -3363,7 +3363,8 @@ static bool rtw89_core_skb_pn_valid(struct rtw89_dev *rtwdev,
+ last_pn = tid_stats->last_pn;
+
+ if (pn > last_pn) {
+- if (ieee80211_sn_less(mpdu_sn, tid_stats->last_sn)) {
++ if (last_pn != -1LL &&
++ ieee80211_sn_less(mpdu_sn, tid_stats->last_sn)) {
+ dev_kfree_skb_any(skb);
+
+ return false;
+diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
+index 501c3af1da01a9..0672d13d13a647 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
+@@ -964,7 +964,8 @@ static int rtw89_ops_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ rtw89_err(rtwdev, "failed to add key to sec cam\n");
+ return ret;
+ }
+- rtw89_core_tid_rx_stats_reset(rtwdev);
++ if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
++ rtw89_core_tid_rx_stats_reset(rtwdev);
+ break;
+ case DISABLE_KEY:
+ flush_work(&rtwdev->txq_work);
+--
+2.53.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
