From: Greg Kroah-Hartman Date: Mon, 6 Jun 2022 17:02:43 +0000 (+0200) Subject: 5.18-stable patches X-Git-Tag: v5.10.121~59 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f104c18bcfdcf6209ee4463716c7484af35ed056;p=thirdparty%2Fkernel%2Fstable-queue.git 5.18-stable patches added patches: net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch --- diff --git a/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch b/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch new file mode 100644 index 00000000000..dd570aa80ea --- /dev/null +++ b/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch @@ -0,0 +1,38 @@ +From 70132763d5d2e94cd185e3aa92ac6a3ba89068fa Mon Sep 17 00:00:00 2001 +From: Alex Elder +Date: Thu, 26 May 2022 10:23:14 -0500 +Subject: net: ipa: fix page free in ipa_endpoint_replenish_one() + +From: Alex Elder + +commit 70132763d5d2e94cd185e3aa92ac6a3ba89068fa upstream. + +Currently the (possibly compound) pages used for receive buffers are +freed using __free_pages(). But according to this comment above the +definition of that function, that's wrong: + If you want to use the page's reference count to decide + when to free the allocation, you should allocate a compound + page, and use put_page() instead of __free_pages(). + +Convert the call to __free_pages() in ipa_endpoint_replenish_one() +to use put_page() instead. + +Fixes: 6a606b90153b8 ("net: ipa: allocate transaction in replenish loop") +Signed-off-by: Alex Elder +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipa/ipa_endpoint.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ipa/ipa_endpoint.c ++++ b/drivers/net/ipa/ipa_endpoint.c +@@ -1062,7 +1062,7 @@ static int ipa_endpoint_replenish_one(st + + ret = gsi_trans_page_add(trans, page, len, offset); + if (ret) +- __free_pages(page, get_order(buffer_size)); ++ put_page(page); + else + trans->data = page; /* transaction owns page now */ + diff --git a/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch b/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch new file mode 100644 index 00000000000..e8a65aa67e7 --- /dev/null +++ b/queue-5.18/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch @@ -0,0 +1,43 @@ +From 155c0c90bca918de6e4327275dfc1d97fd604115 Mon Sep 17 00:00:00 2001 +From: Alex Elder +Date: Thu, 26 May 2022 10:23:13 -0500 +Subject: net: ipa: fix page free in ipa_endpoint_trans_release() + +From: Alex Elder + +commit 155c0c90bca918de6e4327275dfc1d97fd604115 upstream. + +Currently the (possibly compound) page used for receive buffers are +freed using __free_pages(). But according to this comment above the +definition of that function, that's wrong: + If you want to use the page's reference count to decide when + to free the allocation, you should allocate a compound page, + and use put_page() instead of __free_pages(). + +Convert the call to __free_pages() in ipa_endpoint_trans_release() +to use put_page() instead. + +Fixes: ed23f02680caa ("net: ipa: define per-endpoint receive buffer size") +Signed-off-by: Alex Elder +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipa/ipa_endpoint.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/drivers/net/ipa/ipa_endpoint.c ++++ b/drivers/net/ipa/ipa_endpoint.c +@@ -1385,11 +1385,8 @@ void ipa_endpoint_trans_release(struct i + } else { + struct page *page = trans->data; + +- if (page) { +- u32 buffer_size = endpoint->data->rx.buffer_size; +- +- __free_pages(page, get_order(buffer_size)); +- } ++ if (page) ++ put_page(page); + } + } + diff --git a/queue-5.18/series b/queue-5.18/series index 435a7173a20..c22529b5079 100644 --- a/queue-5.18/series +++ b/queue-5.18/series @@ -859,3 +859,5 @@ vdpasim-allow-to-enable-a-vq-repeatedly.patch blk-iolatency-fix-inflight-count-imbalances-and-io-hangs-on-offline.patch coresight-core-fix-coresight-device-probe-failure-issue.patch phy-qcom-qmp-fix-reset-controller-leak-on-probe-errors.patch +net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch +net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch