--- /dev/null
+From 5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1 Mon Sep 17 00:00:00 2001
+From: Qingye Zhao <zhaoqingye@honor.com>
+Date: Wed, 11 Feb 2026 09:24:04 +0000
+Subject: cgroup: fix race between task migration and iteration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Qingye Zhao <zhaoqingye@honor.com>
+
+commit 5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1 upstream.
+
+When a task is migrated out of a css_set, cgroup_migrate_add_task()
+first moves it from cset->tasks to cset->mg_tasks via:
+
+ list_move_tail(&task->cg_list, &cset->mg_tasks);
+
+If a css_task_iter currently has it->task_pos pointing to this task,
+css_set_move_task() calls css_task_iter_skip() to keep the iterator
+valid. However, since the task has already been moved to ->mg_tasks,
+the iterator is advanced relative to the mg_tasks list instead of the
+original tasks list. As a result, remaining tasks on cset->tasks, as
+well as tasks queued on cset->mg_tasks, can be skipped by iteration.
+
+Fix this by calling css_set_skip_task_iters() before unlinking
+task->cg_list from cset->tasks. This advances all active iterators to
+the next task on cset->tasks, so iteration continues correctly even
+when a task is concurrently being migrated.
+
+This race is hard to hit in practice without instrumentation, but it
+can be reproduced by artificially slowing down cgroup_procs_show().
+For example, on an Android device a temporary
+/sys/kernel/cgroup/cgroup_test knob can be added to inject a delay
+into cgroup_procs_show(), and then:
+
+ 1) Spawn three long-running tasks (PIDs 101, 102, 103).
+ 2) Create a test cgroup and move the tasks into it.
+ 3) Enable a large delay via /sys/kernel/cgroup/cgroup_test.
+ 4) In one shell, read cgroup.procs from the test cgroup.
+ 5) Within the delay window, in another shell migrate PID 102 by
+ writing it to a different cgroup.procs file.
+
+Under this setup, cgroup.procs can intermittently show only PID 101
+while skipping PID 103. Once the migration completes, reading the
+file again shows all tasks as expected.
+
+Note that this change does not allow removing the existing
+css_set_skip_task_iters() call in css_set_move_task(). The new call
+in cgroup_migrate_add_task() only handles iterators that are racing
+with migration while the task is still on cset->tasks. Iterators may
+also start after the task has been moved to cset->mg_tasks. If we
+dropped css_set_skip_task_iters() from css_set_move_task(), such
+iterators could keep task_pos pointing to a migrating task, causing
+css_task_iter_advance() to malfunction on the destination css_set,
+up to and including crashes or infinite loops.
+
+The race window between migration and iteration is very small, and
+css_task_iter is not on a hot path. In the worst case, when an
+iterator is positioned on the first thread of the migrating process,
+cgroup_migrate_add_task() may have to skip multiple tasks via
+css_set_skip_task_iters(). However, this only happens when migration
+and iteration actually race, so the performance impact is negligible
+compared to the correctness fix provided here.
+
+Fixes: b636fd38dc40 ("cgroup: Implement css_task_iter_skip()")
+Cc: stable@vger.kernel.org # v5.2+
+Signed-off-by: Qingye Zhao <zhaoqingye@honor.com>
+Reviewed-by: Michal Koutný <mkoutny@suse.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/cgroup/cgroup.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -2413,6 +2413,7 @@ static void cgroup_migrate_add_task(stru
+
+ mgctx->tset.nr_tasks++;
+
++ css_set_skip_task_iters(cset, task);
+ list_move_tail(&task->cg_list, &cset->mg_tasks);
+ if (list_empty(&cset->mg_node))
+ list_add_tail(&cset->mg_node,
--- /dev/null
+From e4f774a0cc955ce762aec91c66915a6e15087ab7 Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+Date: Thu, 5 Mar 2026 15:34:26 +0100
+Subject: net: usb: lan78xx: fix silent drop of packets with checksum errors
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+commit e4f774a0cc955ce762aec91c66915a6e15087ab7 upstream.
+
+Do not drop packets with checksum errors at the USB driver level;
+pass them to the network stack.
+
+Previously, the driver dropped all packets where the 'Receive Error
+Detected' (RED) bit was set, regardless of the specific error type. This
+caused packets with only IP or TCP/UDP checksum errors to be dropped
+before reaching the kernel, preventing the network stack from accounting
+for them or performing software fallback.
+
+Add a mask for hard hardware errors to safely drop genuinely corrupt
+frames, while allowing checksum-errored frames to pass with their
+ip_summed field explicitly set to CHECKSUM_NONE.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://patch.msgid.link/20260305143429.530909-2-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/lan78xx.c | 4 +++-
+ drivers/net/usb/lan78xx.h | 3 +++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -3279,6 +3279,7 @@ static void lan78xx_rx_csum_offload(stru
+ */
+ if (!(dev->net->features & NETIF_F_RXCSUM) ||
+ unlikely(rx_cmd_a & RX_CMD_A_ICSM_) ||
++ unlikely(rx_cmd_a & RX_CMD_A_CSE_MASK_) ||
+ ((rx_cmd_a & RX_CMD_A_FVTG_) &&
+ !(dev->net->features & NETIF_F_HW_VLAN_CTAG_RX))) {
+ skb->ip_summed = CHECKSUM_NONE;
+@@ -3346,7 +3347,8 @@ static int lan78xx_rx(struct lan78xx_net
+ size = (rx_cmd_a & RX_CMD_A_LEN_MASK_);
+ align_count = (4 - ((size + RXW_PADDING) % 4)) % 4;
+
+- if (unlikely(rx_cmd_a & RX_CMD_A_RED_)) {
++ if (unlikely(rx_cmd_a & RX_CMD_A_RED_) &&
++ (rx_cmd_a & RX_CMD_A_RX_HARD_ERRS_MASK_)) {
+ netif_dbg(dev, rx_err, dev->net,
+ "Error rx_cmd_a=0x%08x", rx_cmd_a);
+ } else {
+--- a/drivers/net/usb/lan78xx.h
++++ b/drivers/net/usb/lan78xx.h
+@@ -74,6 +74,9 @@
+ #define RX_CMD_A_ICSM_ (0x00004000)
+ #define RX_CMD_A_LEN_MASK_ (0x00003FFF)
+
++#define RX_CMD_A_RX_HARD_ERRS_MASK_ \
++ (RX_CMD_A_RX_ERRS_MASK_ & ~RX_CMD_A_CSE_MASK_)
++
+ /* Rx Command B */
+ #define RX_CMD_B_CSUM_SHIFT_ (16)
+ #define RX_CMD_B_CSUM_MASK_ (0xFFFF0000)
--- /dev/null
+From d9cc0e440f0664f6f3e2c26e39ab9dd5f3badba7 Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+Date: Thu, 5 Mar 2026 15:34:28 +0100
+Subject: net: usb: lan78xx: skip LTM configuration for LAN7850
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+commit d9cc0e440f0664f6f3e2c26e39ab9dd5f3badba7 upstream.
+
+Do not configure Latency Tolerance Messaging (LTM) on USB 2.0 hardware.
+
+The LAN7850 is a High-Speed (USB 2.0) only device and does not support
+SuperSpeed features like LTM. Currently, the driver unconditionally
+attempts to configure LTM registers during initialization. On the
+LAN7850, these registers do not exist, resulting in writes to invalid
+or undocumented memory space.
+
+This issue was identified during a port to the regmap API with strict
+register validation enabled. While no functional issues or crashes have
+been observed from these invalid writes, bypassing LTM initialization
+on the LAN7850 ensures the driver strictly adheres to the hardware's
+valid register map.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://patch.msgid.link/20260305143429.530909-4-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/lan78xx.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2463,6 +2463,10 @@ static void lan78xx_init_ltm(struct lan7
+ u32 buf;
+ u32 regs[6] = { 0 };
+
++ /* LAN7850 is USB 2.0 and does not support LTM */
++ if (dev->chipid == ID_REV_CHIP_ID_7850_)
++ return 0;
++
+ ret = lan78xx_read_reg(dev, USB_CFG1, &buf);
+ if (buf & USB_CFG1_LTM_ENABLE_) {
+ u8 temp[2];
acpi-osl-fix-__iomem-type-on-return-from-acpi_os_map.patch
asoc-amd-acp3x-rt5682-max9836-add-missing-error-chec.patch
asoc-detect-empty-dmi-strings.patch
+cgroup-fix-race-between-task-migration-and-iteration.patch
+net-usb-lan78xx-fix-silent-drop-of-packets-with-checksum-errors.patch
+net-usb-lan78xx-skip-ltm-configuration-for-lan7850.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
