From: Greg Kroah-Hartman Date: Mon, 6 Jun 2022 17:02:29 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v5.10.121~61 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0e5b4088673ef00ad49bdd84bb29b811a1dc8284;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch --- diff --git a/queue-5.15/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch b/queue-5.15/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch new file mode 100644 index 00000000000..97bc0ae0127 --- /dev/null +++ b/queue-5.15/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch @@ -0,0 +1,38 @@ +From 70132763d5d2e94cd185e3aa92ac6a3ba89068fa Mon Sep 17 00:00:00 2001 +From: Alex Elder +Date: Thu, 26 May 2022 10:23:14 -0500 +Subject: net: ipa: fix page free in ipa_endpoint_replenish_one() + +From: Alex Elder + +commit 70132763d5d2e94cd185e3aa92ac6a3ba89068fa upstream. + +Currently the (possibly compound) pages used for receive buffers are +freed using __free_pages(). But according to this comment above the +definition of that function, that's wrong: + If you want to use the page's reference count to decide + when to free the allocation, you should allocate a compound + page, and use put_page() instead of __free_pages(). + +Convert the call to __free_pages() in ipa_endpoint_replenish_one() +to use put_page() instead. + +Fixes: 6a606b90153b8 ("net: ipa: allocate transaction in replenish loop") +Signed-off-by: Alex Elder +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipa/ipa_endpoint.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ipa/ipa_endpoint.c ++++ b/drivers/net/ipa/ipa_endpoint.c +@@ -1049,7 +1049,7 @@ static int ipa_endpoint_replenish_one(st + err_trans_free: + gsi_trans_free(trans); + err_free_pages: +- __free_pages(page, get_order(IPA_RX_BUFFER_SIZE)); ++ put_page(page); + + return -ENOMEM; + } diff --git a/queue-5.15/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch b/queue-5.15/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch new file mode 100644 index 00000000000..04e78c5e9b7 --- /dev/null +++ b/queue-5.15/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch @@ -0,0 +1,38 @@ +From 155c0c90bca918de6e4327275dfc1d97fd604115 Mon Sep 17 00:00:00 2001 +From: Alex Elder +Date: Thu, 26 May 2022 10:23:13 -0500 +Subject: net: ipa: fix page free in ipa_endpoint_trans_release() + +From: Alex Elder + +commit 155c0c90bca918de6e4327275dfc1d97fd604115 upstream. + +Currently the (possibly compound) page used for receive buffers are +freed using __free_pages(). But according to this comment above the +definition of that function, that's wrong: + If you want to use the page's reference count to decide when + to free the allocation, you should allocate a compound page, + and use put_page() instead of __free_pages(). + +Convert the call to __free_pages() in ipa_endpoint_trans_release() +to use put_page() instead. + +Fixes: ed23f02680caa ("net: ipa: define per-endpoint receive buffer size") +Signed-off-by: Alex Elder +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipa/ipa_endpoint.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ipa/ipa_endpoint.c ++++ b/drivers/net/ipa/ipa_endpoint.c +@@ -1389,7 +1389,7 @@ void ipa_endpoint_trans_release(struct i + struct page *page = trans->data; + + if (page) +- __free_pages(page, get_order(IPA_RX_BUFFER_SIZE)); ++ put_page(page); + } + } + diff --git a/queue-5.15/series b/queue-5.15/series index 4b4105f0f9d..ce9a9e89662 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -646,3 +646,5 @@ vdpasim-allow-to-enable-a-vq-repeatedly.patch blk-iolatency-fix-inflight-count-imbalances-and-io-hangs-on-offline.patch coresight-core-fix-coresight-device-probe-failure-issue.patch phy-qcom-qmp-fix-reset-controller-leak-on-probe-errors.patch +net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch +net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch