From 651b4b46b9719b1e51cd4fe651144188176f0f9c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 6 Jun 2022 19:02:36 +0200 Subject: [PATCH] 5.17-stable patches added patches: net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch --- ...e-free-in-ipa_endpoint_replenish_one.patch | 38 +++++++++++++++++++ ...e-free-in-ipa_endpoint_trans_release.patch | 38 +++++++++++++++++++ queue-5.17/series | 2 + 3 files changed, 78 insertions(+) create mode 100644 queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch create mode 100644 queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch diff --git a/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch b/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch new file mode 100644 index 00000000000..310696d2d77 --- /dev/null +++ b/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch @@ -0,0 +1,38 @@ +From 70132763d5d2e94cd185e3aa92ac6a3ba89068fa Mon Sep 17 00:00:00 2001 +From: Alex Elder +Date: Thu, 26 May 2022 10:23:14 -0500 +Subject: net: ipa: fix page free in ipa_endpoint_replenish_one() + +From: Alex Elder + +commit 70132763d5d2e94cd185e3aa92ac6a3ba89068fa upstream. + +Currently the (possibly compound) pages used for receive buffers are +freed using __free_pages(). But according to this comment above the +definition of that function, that's wrong: + If you want to use the page's reference count to decide + when to free the allocation, you should allocate a compound + page, and use put_page() instead of __free_pages(). + +Convert the call to __free_pages() in ipa_endpoint_replenish_one() +to use put_page() instead. + +Fixes: 6a606b90153b8 ("net: ipa: allocate transaction in replenish loop") +Signed-off-by: Alex Elder +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipa/ipa_endpoint.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ipa/ipa_endpoint.c ++++ b/drivers/net/ipa/ipa_endpoint.c +@@ -1062,7 +1062,7 @@ static int ipa_endpoint_replenish_one(st + err_trans_free: + gsi_trans_free(trans); + err_free_pages: +- __free_pages(page, get_order(IPA_RX_BUFFER_SIZE)); ++ put_page(page); + + return -ENOMEM; + } diff --git a/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch b/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch new file mode 100644 index 00000000000..021d2c2c376 --- /dev/null +++ b/queue-5.17/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch @@ -0,0 +1,38 @@ +From 155c0c90bca918de6e4327275dfc1d97fd604115 Mon Sep 17 00:00:00 2001 +From: Alex Elder +Date: Thu, 26 May 2022 10:23:13 -0500 +Subject: net: ipa: fix page free in ipa_endpoint_trans_release() + +From: Alex Elder + +commit 155c0c90bca918de6e4327275dfc1d97fd604115 upstream. + +Currently the (possibly compound) page used for receive buffers are +freed using __free_pages(). But according to this comment above the +definition of that function, that's wrong: + If you want to use the page's reference count to decide when + to free the allocation, you should allocate a compound page, + and use put_page() instead of __free_pages(). + +Convert the call to __free_pages() in ipa_endpoint_trans_release() +to use put_page() instead. + +Fixes: ed23f02680caa ("net: ipa: define per-endpoint receive buffer size") +Signed-off-by: Alex Elder +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipa/ipa_endpoint.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ipa/ipa_endpoint.c ++++ b/drivers/net/ipa/ipa_endpoint.c +@@ -1402,7 +1402,7 @@ void ipa_endpoint_trans_release(struct i + struct page *page = trans->data; + + if (page) +- __free_pages(page, get_order(IPA_RX_BUFFER_SIZE)); ++ put_page(page); + } + } + diff --git a/queue-5.17/series b/queue-5.17/series index 7ac0d662fde..7216d0659da 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -752,3 +752,5 @@ vdpasim-allow-to-enable-a-vq-repeatedly.patch blk-iolatency-fix-inflight-count-imbalances-and-io-hangs-on-offline.patch coresight-core-fix-coresight-device-probe-failure-issue.patch phy-qcom-qmp-fix-reset-controller-leak-on-probe-errors.patch +net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch +net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch -- 2.47.3