From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 12 Mar 2025 07:54:38 +0000 (+0100)
Subject: 6.12-stable patches
X-Git-Tag: v5.4.291~4
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=40e99f59196325582100cc643eac87ee7bf0dfa9;p=thirdparty%2Fkernel%2Fstable-queue.git

6.12-stable patches

added patches:
	wifi-iwlwifi-pcie-fix-tso-preparation.patch
---

diff --git a/queue-6.12/series b/queue-6.12/series
index 2b7ff02908..c84751b984 100644
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -267,3 +267,4 @@ kvm-e500-always-restore-irqs.patch
 uprobes-fix-race-in-uprobe_free_utask.patch
 selftests-bpf-clean-up-open-coded-gettid-syscall-invocations.patch
 x86-mm-don-t-disable-pcid-when-invlpg-has-been-fixed-by-microcode.patch
+wifi-iwlwifi-pcie-fix-tso-preparation.patch
diff --git a/queue-6.12/wifi-iwlwifi-pcie-fix-tso-preparation.patch b/queue-6.12/wifi-iwlwifi-pcie-fix-tso-preparation.patch
new file mode 100644
index 0000000000..7083863d00
--- /dev/null
+++ b/queue-6.12/wifi-iwlwifi-pcie-fix-tso-preparation.patch
@@ -0,0 +1,60 @@
+From bbb18f7e23a3f5f56d5c8b4ee0f78f00edb3b1b2 Mon Sep 17 00:00:00 2001
+From: Ilan Peer <ilan.peer@intel.com>
+Date: Thu, 6 Mar 2025 12:25:46 +0200
+Subject: wifi: iwlwifi: pcie: Fix TSO preparation
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+commit bbb18f7e23a3f5f56d5c8b4ee0f78f00edb3b1b2 upstream.
+
+The allocation of the scatter gather data structure should be done
+based on the number of memory chunks that need to be mapped, and it
+is not dependent on the overall payload length. Fix it.
+
+In addition, as the skb_to_sgvec() function returns an 'int' do not
+assign it to an 'unsigned int' as otherwise the error check would be
+useless.
+
+Fixes: 7f5e3038f029 ("wifi: iwlwifi: map entire SKB when sending AMSDUs")
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250306122425.8c0e23a3d583.I3cb4d6768c9d28ce3da6cd0a6c65466176cfc1ee@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/tx.c |   11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -1867,12 +1867,12 @@ struct sg_table *iwl_pcie_prep_tso(struc
+ 				   unsigned int offset)
+ {
+ 	struct sg_table *sgt;
+-	unsigned int n_segments;
++	unsigned int n_segments = skb_shinfo(skb)->nr_frags + 1;
++	int orig_nents;
+ 
+ 	if (WARN_ON_ONCE(skb_has_frag_list(skb)))
+ 		return NULL;
+ 
+-	n_segments = DIV_ROUND_UP(skb->len - offset, skb_shinfo(skb)->gso_size);
+ 	*hdr = iwl_pcie_get_page_hdr(trans,
+ 				     hdr_room + __alignof__(struct sg_table) +
+ 				     sizeof(struct sg_table) +
+@@ -1887,11 +1887,12 @@ struct sg_table *iwl_pcie_prep_tso(struc
+ 	sg_init_table(sgt->sgl, n_segments);
+ 
+ 	/* Only map the data, not the header (it is copied to the TSO page) */
+-	sgt->orig_nents = skb_to_sgvec(skb, sgt->sgl, offset,
+-				       skb->len - offset);
+-	if (WARN_ON_ONCE(sgt->orig_nents <= 0))
++	orig_nents = skb_to_sgvec(skb, sgt->sgl, offset, skb->len - offset);
++	if (WARN_ON_ONCE(orig_nents <= 0))
+ 		return NULL;
+ 
++	sgt->orig_nents = orig_nents;
++
+ 	/* And map the entire SKB */
+ 	if (dma_map_sgtable(trans->dev, sgt, DMA_TO_DEVICE, 0) < 0)
+ 		return NULL;