5.17-stable patches

added patches:
	net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch
	net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch

diff --git a/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch b/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch
new file mode 100644 (file)
index 0000000..310696d
--- /dev/null
+++ b/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch
@@ -0,0 +1,38 @@
+From 70132763d5d2e94cd185e3aa92ac6a3ba89068fa Mon Sep 17 00:00:00 2001
+From: Alex Elder <elder@linaro.org>
+Date: Thu, 26 May 2022 10:23:14 -0500
+Subject: net: ipa: fix page free in ipa_endpoint_replenish_one()
+
+From: Alex Elder <elder@linaro.org>
+
+commit 70132763d5d2e94cd185e3aa92ac6a3ba89068fa upstream.
+
+Currently the (possibly compound) pages used for receive buffers are
+freed using __free_pages().  But according to this comment above the
+definition of that function, that's wrong:
+    If you want to use the page's reference count to decide
+    when to free the allocation, you should allocate a compound
+    page, and use put_page() instead of __free_pages().
+
+Convert the call to __free_pages() in ipa_endpoint_replenish_one()
+to use put_page() instead.
+
+Fixes: 6a606b90153b8 ("net: ipa: allocate transaction in replenish loop")
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipa/ipa_endpoint.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ipa/ipa_endpoint.c
++++ b/drivers/net/ipa/ipa_endpoint.c
+@@ -1062,7 +1062,7 @@ static int ipa_endpoint_replenish_one(st
+ err_trans_free:
+       gsi_trans_free(trans);
+ err_free_pages:
+-      __free_pages(page, get_order(IPA_RX_BUFFER_SIZE));
++      put_page(page);
+ 
+       return -ENOMEM;
+ }

diff --git a/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch b/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch
new file mode 100644 (file)
index 0000000..021d2c2
--- /dev/null
+++ b/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch
@@ -0,0 +1,38 @@
+From 155c0c90bca918de6e4327275dfc1d97fd604115 Mon Sep 17 00:00:00 2001
+From: Alex Elder <elder@linaro.org>
+Date: Thu, 26 May 2022 10:23:13 -0500
+Subject: net: ipa: fix page free in ipa_endpoint_trans_release()
+
+From: Alex Elder <elder@linaro.org>
+
+commit 155c0c90bca918de6e4327275dfc1d97fd604115 upstream.
+
+Currently the (possibly compound) page used for receive buffers are
+freed using __free_pages().  But according to this comment above the
+definition of that function, that's wrong:
+    If you want to use the page's reference count to decide when
+    to free the allocation, you should allocate a compound page,
+    and use put_page() instead of __free_pages().
+
+Convert the call to __free_pages() in ipa_endpoint_trans_release()
+to use put_page() instead.
+
+Fixes: ed23f02680caa ("net: ipa: define per-endpoint receive buffer size")
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipa/ipa_endpoint.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ipa/ipa_endpoint.c
++++ b/drivers/net/ipa/ipa_endpoint.c
+@@ -1402,7 +1402,7 @@ void ipa_endpoint_trans_release(struct i
+               struct page *page = trans->data;
+ 
+               if (page)
+-                      __free_pages(page, get_order(IPA_RX_BUFFER_SIZE));
++                      put_page(page);
+       }
+ }
+ 

diff --git a/queue-5.17/series b/queue-5.17/series
index 7ac0d662fde7fe4b6028744c643d8523cd7d1816..7216d0659dac84e59863eec896d641b30b107477 100644 (file)
--- a/queue-5.17/series
+++ b/queue-5.17/series
@@ -752,3 +752,5 @@ vdpasim-allow-to-enable-a-vq-repeatedly.patch
 blk-iolatency-fix-inflight-count-imbalances-and-io-hangs-on-offline.patch
 coresight-core-fix-coresight-device-probe-failure-issue.patch
 phy-qcom-qmp-fix-reset-controller-leak-on-probe-errors.patch
+net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch
+net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch