From: Sasha Levin Date: Sun, 12 Jul 2026 20:24:37 +0000 (-0400) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=09adb380c5bbdea9ab2309fc08658c673bb57447;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-6.12/drm-i915-ensure-segment-offset-never-exceeds-allowed.patch b/queue-6.12/drm-i915-ensure-segment-offset-never-exceeds-allowed.patch new file mode 100644 index 0000000000..30dea500d7 --- /dev/null +++ b/queue-6.12/drm-i915-ensure-segment-offset-never-exceeds-allowed.patch @@ -0,0 +1,76 @@ +From cabc73958dfbb5957d014f26af426fa8b9cb9572 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2024 12:19:22 +0000 +Subject: drm/i915: ensure segment offset never exceeds allowed max + +From: Krzysztof Karas + +[ Upstream commit 2e0438f9c3d25eea8bc8e9b4dcff7edfb64cb9e7 ] + +Commit 255fc1703e42 ("drm/i915/gem: Calculate object page offset for +partial memory mapping") introduced a new offset, which accounts for +userspace mapping not starting from the beginning of object's scatterlist. + +This works fine for cases where first object pte is larger than the new +offset - "r->sgt.curr" counter is set to the offset to match the difference +in the number of total pages. However, if object's first pte's size is +equal to or smaller than the offset, then information about the offset +in userspace is covered up by moving "r->sgt" pointer in remap_sg(): + + r->sgt.curr += PAGE_SIZE; + if (r->sgt.curr >= r->sgt.max) + r->sgt = __sgt_iter(__sg_next(r->sgt.sgp), use_dma(r->iobase)); + +This means that two or more pages from virtual memory are counted for +only one page in object's memory, because after moving "r->sgt" pointer +"r->sgt.curr" will be 0. + +We should account for this mismatch by moving "r->sgt" pointer to the +next pte. For that we may use "r.sgt.max", which already holds the max +allowed size. This change also eliminates possible confusion, when +looking at i915_scatterlist.h and remap_io_sg() code: former has +scatterlist pointer definition, which differentiates "s.max" value +based on "dma" flag (sg_dma_len() is used only when the flag is +enabled), while latter uses sg_dma_len() indiscriminately. + +This patch aims to resolve issue: +https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12031 + +v3: + - instead of checking if r.sgt.curr would exceed allowed max, changed +the value in the while loop to be aligned with `dma` value + +v4: + - remove unnecessary parent relation + +v5: + - update commit message with explanation about page counting mismatch + and link to the issue + +Signed-off-by: Krzysztof Karas +Reviewed-by: Andi Shyti +Signed-off-by: Andi Shyti +Link: https://patchwork.freedesktop.org/patch/msgid/upbjdavlbcxku63ns4vstp5kgbn2anxwewpmnppszgb67fn66t@tfclfgkqijue +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/i915_mm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_mm.c b/drivers/gpu/drm/i915/i915_mm.c +index f5c97a620962b6..76e2801619f092 100644 +--- a/drivers/gpu/drm/i915/i915_mm.c ++++ b/drivers/gpu/drm/i915/i915_mm.c +@@ -143,8 +143,8 @@ int remap_io_sg(struct vm_area_struct *vma, + /* We rely on prevalidation of the io-mapping to skip track_pfn(). */ + GEM_BUG_ON((vma->vm_flags & EXPECTED_FLAGS) != EXPECTED_FLAGS); + +- while (offset >= sg_dma_len(r.sgt.sgp) >> PAGE_SHIFT) { +- offset -= sg_dma_len(r.sgt.sgp) >> PAGE_SHIFT; ++ while (offset >= r.sgt.max >> PAGE_SHIFT) { ++ offset -= r.sgt.max >> PAGE_SHIFT; + r.sgt = __sgt_iter(__sg_next(r.sgt.sgp), use_dma(iobase)); + if (!r.sgt.sgp) + return -EINVAL; +-- +2.53.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 5fc35e4868..01ea1ec19a 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -38,3 +38,4 @@ loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch perf-core-detach-event-groups-during-remove_on_exec.patch rust-kasan-kasan-rust-requires-clang.patch +drm-i915-ensure-segment-offset-never-exceeds-allowed.patch diff --git a/queue-7.1/series b/queue-7.1/series index bd3b1dc87f..46b99670e9 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -27,3 +27,4 @@ bpf-restrict-jit-predictor-flush-to-cbpf.patch bpf-skip-redundant-ibpb-in-pack-allocator.patch bpf-prefer-packs-that-won-t-trigger-an-ibpb-flush-on.patch bpf-prefer-dirty-packs-for-ebpf-allocations.patch +wifi-rtw89-correct-drop-logic-for-malformed-ampdu-fr.patch diff --git a/queue-7.1/wifi-rtw89-correct-drop-logic-for-malformed-ampdu-fr.patch b/queue-7.1/wifi-rtw89-correct-drop-logic-for-malformed-ampdu-fr.patch new file mode 100644 index 0000000000..e9dc635327 --- /dev/null +++ b/queue-7.1/wifi-rtw89-correct-drop-logic-for-malformed-ampdu-fr.patch @@ -0,0 +1,58 @@ +From 5557724771497d1ad077af68d94d5840fd3e0fba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 May 2026 09:44:29 +0800 +Subject: wifi: rtw89: correct drop logic for malformed AMPDU frames + +From: Po-Hao Huang + +[ Upstream commit 63ccdfac8677387dfdbd9d4336089e9823280704 ] + +The previous commit aims to fix issue caused by malformed AMPDU frames. +But the drop logic fails to deal with the first AMPDU packet paired with +certain range of sequence number, and leads to unexpected packet drop. +It is more likely to encounter this failure when there are busy traffic +during rekey process and could lead to disconnection from the AP. +Fix this by adding a initial state judgement and only reset status +during pairwise rekey. + +Fixes: bda294ed0ed0 ("wifi: rtw89: Drop malformed AMPDU frames with abnormal PN") +Signed-off-by: Po-Hao Huang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20260515014433.16168-10-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/core.c | 3 ++- + drivers/net/wireless/realtek/rtw89/mac80211.c | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index 70feab97dccb5a..486c1774fb9759 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -3363,7 +3363,8 @@ static bool rtw89_core_skb_pn_valid(struct rtw89_dev *rtwdev, + last_pn = tid_stats->last_pn; + + if (pn > last_pn) { +- if (ieee80211_sn_less(mpdu_sn, tid_stats->last_sn)) { ++ if (last_pn != -1LL && ++ ieee80211_sn_less(mpdu_sn, tid_stats->last_sn)) { + dev_kfree_skb_any(skb); + + return false; +diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c +index 501c3af1da01a9..0672d13d13a647 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac80211.c ++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c +@@ -964,7 +964,8 @@ static int rtw89_ops_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + rtw89_err(rtwdev, "failed to add key to sec cam\n"); + return ret; + } +- rtw89_core_tid_rx_stats_reset(rtwdev); ++ if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ++ rtw89_core_tid_rx_stats_reset(rtwdev); + break; + case DISABLE_KEY: + flush_work(&rtwdev->txq_work); +-- +2.53.0 +