5.18-stable patches

added patches:
	net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch
	net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch

diff --git a/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch b/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch
new file mode 100644 (file)
index 0000000..dd570aa
--- /dev/null
+++ b/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch
@@ -0,0 +1,38 @@
+From 70132763d5d2e94cd185e3aa92ac6a3ba89068fa Mon Sep 17 00:00:00 2001
+From: Alex Elder <elder@linaro.org>
+Date: Thu, 26 May 2022 10:23:14 -0500
+Subject: net: ipa: fix page free in ipa_endpoint_replenish_one()
+
+From: Alex Elder <elder@linaro.org>
+
+commit 70132763d5d2e94cd185e3aa92ac6a3ba89068fa upstream.
+
+Currently the (possibly compound) pages used for receive buffers are
+freed using __free_pages().  But according to this comment above the
+definition of that function, that's wrong:
+    If you want to use the page's reference count to decide
+    when to free the allocation, you should allocate a compound
+    page, and use put_page() instead of __free_pages().
+
+Convert the call to __free_pages() in ipa_endpoint_replenish_one()
+to use put_page() instead.
+
+Fixes: 6a606b90153b8 ("net: ipa: allocate transaction in replenish loop")
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipa/ipa_endpoint.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ipa/ipa_endpoint.c
++++ b/drivers/net/ipa/ipa_endpoint.c
+@@ -1062,7 +1062,7 @@ static int ipa_endpoint_replenish_one(st
+ 
+       ret = gsi_trans_page_add(trans, page, len, offset);
+       if (ret)
+-              __free_pages(page, get_order(buffer_size));
++              put_page(page);
+       else
+               trans->data = page;     /* transaction owns page now */
+ 

diff --git a/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch b/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch
new file mode 100644 (file)
index 0000000..e8a65aa
--- /dev/null
+++ b/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch
@@ -0,0 +1,43 @@
+From 155c0c90bca918de6e4327275dfc1d97fd604115 Mon Sep 17 00:00:00 2001
+From: Alex Elder <elder@linaro.org>
+Date: Thu, 26 May 2022 10:23:13 -0500
+Subject: net: ipa: fix page free in ipa_endpoint_trans_release()
+
+From: Alex Elder <elder@linaro.org>
+
+commit 155c0c90bca918de6e4327275dfc1d97fd604115 upstream.
+
+Currently the (possibly compound) page used for receive buffers are
+freed using __free_pages().  But according to this comment above the
+definition of that function, that's wrong:
+    If you want to use the page's reference count to decide when
+    to free the allocation, you should allocate a compound page,
+    and use put_page() instead of __free_pages().
+
+Convert the call to __free_pages() in ipa_endpoint_trans_release()
+to use put_page() instead.
+
+Fixes: ed23f02680caa ("net: ipa: define per-endpoint receive buffer size")
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipa/ipa_endpoint.c |    7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ipa/ipa_endpoint.c
++++ b/drivers/net/ipa/ipa_endpoint.c
+@@ -1385,11 +1385,8 @@ void ipa_endpoint_trans_release(struct i
+       } else {
+               struct page *page = trans->data;
+ 
+-              if (page) {
+-                      u32 buffer_size = endpoint->data->rx.buffer_size;
+-
+-                      __free_pages(page, get_order(buffer_size));
+-              }
++              if (page)
++                      put_page(page);
+       }
+ }
+ 

diff --git a/queue-5.18/series b/queue-5.18/series
index 435a7173a2062a91930f32c8f38f86d62c40ed6b..c22529b507996afd53302651240f2c20770b1122 100644 (file)
--- a/queue-5.18/series
+++ b/queue-5.18/series
@@ -859,3 +859,5 @@ vdpasim-allow-to-enable-a-vq-repeatedly.patch
 blk-iolatency-fix-inflight-count-imbalances-and-io-hangs-on-offline.patch
 coresight-core-fix-coresight-device-probe-failure-issue.patch
 phy-qcom-qmp-fix-reset-controller-leak-on-probe-errors.patch
+net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch
+net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch