From: Greg Kroah-Hartman Date: Fri, 22 Aug 2025 15:48:24 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.16.3~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a570dc79365096215a915c5f58907e09fc863597;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: platform-x86-intel-uncore-freq-check-write-blocked-for-elc.patch rdma-rxe-flush-delayed-skbs-while-releasing-rxe-resources.patch s390-sclp-fix-sccb-present-check.patch --- diff --git a/queue-6.12/platform-x86-intel-uncore-freq-check-write-blocked-for-elc.patch b/queue-6.12/platform-x86-intel-uncore-freq-check-write-blocked-for-elc.patch new file mode 100644 index 0000000000..a7b1a6a607 --- /dev/null +++ b/queue-6.12/platform-x86-intel-uncore-freq-check-write-blocked-for-elc.patch @@ -0,0 +1,44 @@ +From dff6f36878799a5ffabd15336ce993dc737374dc Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada +Date: Sun, 27 Jul 2025 14:05:13 -0700 +Subject: platform/x86/intel-uncore-freq: Check write blocked for ELC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivas Pandruvada + +commit dff6f36878799a5ffabd15336ce993dc737374dc upstream. + +Add the missing write_blocked check for updating sysfs related to uncore +efficiency latency control (ELC). If write operation is blocked return +error. + +Fixes: bb516dc79c4a ("platform/x86/intel-uncore-freq: Add support for efficiency latency control") +Signed-off-by: Srinivas Pandruvada +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250727210513.2898630-1-srinivas.pandruvada@linux.intel.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c ++++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c +@@ -189,9 +189,14 @@ static int uncore_read_control_freq(stru + static int write_eff_lat_ctrl(struct uncore_data *data, unsigned int val, enum uncore_index index) + { + struct tpmi_uncore_cluster_info *cluster_info; ++ struct tpmi_uncore_struct *uncore_root; + u64 control; + + cluster_info = container_of(data, struct tpmi_uncore_cluster_info, uncore_data); ++ uncore_root = cluster_info->uncore_root; ++ ++ if (uncore_root->write_blocked) ++ return -EPERM; + + if (cluster_info->root_domain) + return -ENODATA; diff --git a/queue-6.12/rdma-rxe-flush-delayed-skbs-while-releasing-rxe-resources.patch b/queue-6.12/rdma-rxe-flush-delayed-skbs-while-releasing-rxe-resources.patch new file mode 100644 index 0000000000..e9ee510424 --- /dev/null +++ b/queue-6.12/rdma-rxe-flush-delayed-skbs-while-releasing-rxe-resources.patch @@ -0,0 +1,117 @@ +From 3c3e9a9f2972b364e8c2cfbfdeb23c6d6be4f87f Mon Sep 17 00:00:00 2001 +From: Zhu Yanjun +Date: Fri, 25 Jul 2025 18:31:04 -0700 +Subject: RDMA/rxe: Flush delayed SKBs while releasing RXE resources + +From: Zhu Yanjun + +commit 3c3e9a9f2972b364e8c2cfbfdeb23c6d6be4f87f upstream. + +When skb packets are sent out, these skb packets still depends on +the rxe resources, for example, QP, sk, when these packets are +destroyed. + +If these rxe resources are released when the skb packets are destroyed, +the call traces will appear. + +To avoid skb packets hang too long time in some network devices, +a timestamp is added when these skb packets are created. If these +skb packets hang too long time in network devices, these network +devices can free these skb packets to release rxe resources. + +Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153 +Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com +Fixes: 1a633bdc8fd9 ("RDMA/rxe: Let destroy qp succeed with stuck packet") +Signed-off-by: Zhu Yanjun +Link: https://patch.msgid.link/20250726013104.463570-1-yanjun.zhu@linux.dev +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/sw/rxe/rxe_net.c | 29 ++++++++--------------------- + drivers/infiniband/sw/rxe/rxe_qp.c | 2 +- + 2 files changed, 9 insertions(+), 22 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c +index 132a87e52d5c..ac0183a2ff7a 100644 +--- a/drivers/infiniband/sw/rxe/rxe_net.c ++++ b/drivers/infiniband/sw/rxe/rxe_net.c +@@ -345,33 +345,15 @@ int rxe_prepare(struct rxe_av *av, struct rxe_pkt_info *pkt, + + static void rxe_skb_tx_dtor(struct sk_buff *skb) + { +- struct net_device *ndev = skb->dev; +- struct rxe_dev *rxe; +- unsigned int qp_index; +- struct rxe_qp *qp; ++ struct rxe_qp *qp = skb->sk->sk_user_data; + int skb_out; + +- rxe = rxe_get_dev_from_net(ndev); +- if (!rxe && is_vlan_dev(ndev)) +- rxe = rxe_get_dev_from_net(vlan_dev_real_dev(ndev)); +- if (WARN_ON(!rxe)) +- return; +- +- qp_index = (int)(uintptr_t)skb->sk->sk_user_data; +- if (!qp_index) +- return; +- +- qp = rxe_pool_get_index(&rxe->qp_pool, qp_index); +- if (!qp) +- goto put_dev; +- + skb_out = atomic_dec_return(&qp->skb_out); +- if (qp->need_req_skb && skb_out < RXE_INFLIGHT_SKBS_PER_QP_LOW) ++ if (unlikely(qp->need_req_skb && ++ skb_out < RXE_INFLIGHT_SKBS_PER_QP_LOW)) + rxe_sched_task(&qp->send_task); + + rxe_put(qp); +-put_dev: +- ib_device_put(&rxe->ib_dev); + sock_put(skb->sk); + } + +@@ -383,6 +365,7 @@ static int rxe_send(struct sk_buff *skb, struct rxe_pkt_info *pkt) + sock_hold(sk); + skb->sk = sk; + skb->destructor = rxe_skb_tx_dtor; ++ rxe_get(pkt->qp); + atomic_inc(&pkt->qp->skb_out); + + if (skb->protocol == htons(ETH_P_IP)) +@@ -405,6 +388,7 @@ static int rxe_loopback(struct sk_buff *skb, struct rxe_pkt_info *pkt) + sock_hold(sk); + skb->sk = sk; + skb->destructor = rxe_skb_tx_dtor; ++ rxe_get(pkt->qp); + atomic_inc(&pkt->qp->skb_out); + + if (skb->protocol == htons(ETH_P_IP)) +@@ -497,6 +481,9 @@ struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av, + goto out; + } + ++ /* Add time stamp to skb. */ ++ skb->tstamp = ktime_get(); ++ + skb_reserve(skb, hdr_len + LL_RESERVED_SPACE(ndev)); + + /* FIXME: hold reference to this netdev until life of this skb. */ +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index f2af3e0aef35..95f1c1c2949d 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -244,7 +244,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + err = sock_create_kern(&init_net, AF_INET, SOCK_DGRAM, 0, &qp->sk); + if (err < 0) + return err; +- qp->sk->sk->sk_user_data = (void *)(uintptr_t)qp->elem.index; ++ qp->sk->sk->sk_user_data = qp; + + /* pick a source UDP port number for this QP based on + * the source QPN. this spreads traffic for different QPs +-- +2.50.1 + diff --git a/queue-6.12/s390-sclp-fix-sccb-present-check.patch b/queue-6.12/s390-sclp-fix-sccb-present-check.patch new file mode 100644 index 0000000000..697b05c3d5 --- /dev/null +++ b/queue-6.12/s390-sclp-fix-sccb-present-check.patch @@ -0,0 +1,65 @@ +From 430fa71027b6ac9bb0ce5532b8d0676777d4219a Mon Sep 17 00:00:00 2001 +From: Peter Oberparleiter +Date: Mon, 18 Aug 2025 12:21:52 +0200 +Subject: s390/sclp: Fix SCCB present check + +From: Peter Oberparleiter + +commit 430fa71027b6ac9bb0ce5532b8d0676777d4219a upstream. + +Tracing code called by the SCLP interrupt handler contains early exits +if the SCCB address associated with an interrupt is NULL. This check is +performed after physical to virtual address translation. + +If the kernel identity mapping does not start at address zero, the +resulting virtual address is never zero, so that the NULL checks won't +work. Subsequently this may result in incorrect accesses to the first +page of the identity mapping. + +Fix this by introducing a function that handles the NULL case before +address translation. + +Fixes: ada1da31ce34 ("s390/sclp: sort out physical vs virtual pointers usage") +Cc: stable@vger.kernel.org +Reviewed-by: Alexander Gordeev +Signed-off-by: Peter Oberparleiter +Signed-off-by: Alexander Gordeev +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/char/sclp.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/s390/char/sclp.c ++++ b/drivers/s390/char/sclp.c +@@ -76,6 +76,13 @@ unsigned long sclp_console_full; + /* The currently active SCLP command word. */ + static sclp_cmdw_t active_cmd; + ++static inline struct sccb_header *sclpint_to_sccb(u32 sccb_int) ++{ ++ if (sccb_int) ++ return __va(sccb_int); ++ return NULL; ++} ++ + static inline void sclp_trace(int prio, char *id, u32 a, u64 b, bool err) + { + struct sclp_trace_entry e; +@@ -619,7 +626,7 @@ __sclp_find_req(u32 sccb) + + static bool ok_response(u32 sccb_int, sclp_cmdw_t cmd) + { +- struct sccb_header *sccb = (struct sccb_header *)__va(sccb_int); ++ struct sccb_header *sccb = sclpint_to_sccb(sccb_int); + struct evbuf_header *evbuf; + u16 response; + +@@ -658,7 +665,7 @@ static void sclp_interrupt_handler(struc + + /* INT: Interrupt received (a=intparm, b=cmd) */ + sclp_trace_sccb(0, "INT", param32, active_cmd, active_cmd, +- (struct sccb_header *)__va(finished_sccb), ++ sclpint_to_sccb(finished_sccb), + !ok_response(finished_sccb, active_cmd)); + + if (finished_sccb) { diff --git a/queue-6.12/series b/queue-6.12/series index a95c41f7de..2eb417f516 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -172,3 +172,6 @@ squashfs-fix-memory-leak-in-squashfs_fill_super.patch mm-debug_vm_pgtable-clear-page-table-entries-at-destroy_args.patch mm-memory-failure-fix-infinite-uce-for-vm_pfnmap-pfn.patch alsa-hda-realtek-add-support-for-hp-elitebook-x360-830-g6-and-elitebook-830-g6.patch +rdma-rxe-flush-delayed-skbs-while-releasing-rxe-resources.patch +s390-sclp-fix-sccb-present-check.patch +platform-x86-intel-uncore-freq-check-write-blocked-for-elc.patch