From: Greg Kroah-Hartman Date: Mon, 24 Nov 2025 13:58:21 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v6.6.118~23 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=002ed0b9ce5860aed61e3ff5cdf54a7b88c87300;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: drm-amdgpu-skip-emit-de-meta-data-on-gfx11-with-rs64-enabled.patch drm-tegra-dc-fix-reference-leak-in-tegra_dc_couple.patch mptcp-avoid-unneeded-subflow-level-drops.patch mptcp-do-not-fallback-when-ooo-is-present.patch mptcp-fix-ack-generation-for-fallback-msk.patch mptcp-fix-premature-close-in-case-of-fallback.patch --- diff --git a/queue-6.1/drm-amdgpu-skip-emit-de-meta-data-on-gfx11-with-rs64-enabled.patch b/queue-6.1/drm-amdgpu-skip-emit-de-meta-data-on-gfx11-with-rs64-enabled.patch new file mode 100644 index 0000000000..21da079c51 --- /dev/null +++ b/queue-6.1/drm-amdgpu-skip-emit-de-meta-data-on-gfx11-with-rs64-enabled.patch @@ -0,0 +1,43 @@ +From 80d8a9ad1587b64c545d515ab6cb7ecb9908e1b3 Mon Sep 17 00:00:00 2001 +From: Yifan Zha +Date: Fri, 14 Nov 2025 17:48:58 +0800 +Subject: drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled + +From: Yifan Zha + +commit 80d8a9ad1587b64c545d515ab6cb7ecb9908e1b3 upstream. + +[Why] +Accoreding to CP updated to RS64 on gfx11, +WRITE_DATA with PREEMPTION_META_MEMORY(dst_sel=8) is illegal for CP FW. +That packet is used for MCBP on F32 based system. +So it would lead to incorrect GRBM write and FW is not handling that +extra case correctly. + +[How] +With gfx11 rs64 enabled, skip emit de meta data. + +Signed-off-by: Yifan Zha +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 8366cd442d226463e673bed5d199df916f4ecbcf) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -5392,9 +5392,9 @@ static void gfx_v11_0_ring_emit_ib_gfx(s + if (flags & AMDGPU_IB_PREEMPTED) + control |= INDIRECT_BUFFER_PRE_RESUME(1); + +- if (vmid) ++ if (vmid && !ring->adev->gfx.rs64_enable) + gfx_v11_0_ring_emit_de_meta(ring, +- (!amdgpu_sriov_vf(ring->adev) && flags & AMDGPU_IB_PREEMPTED) ? true : false); ++ !amdgpu_sriov_vf(ring->adev) && (flags & AMDGPU_IB_PREEMPTED)); + } + + if (ring->is_mes_queue) diff --git a/queue-6.1/drm-tegra-dc-fix-reference-leak-in-tegra_dc_couple.patch b/queue-6.1/drm-tegra-dc-fix-reference-leak-in-tegra_dc_couple.patch new file mode 100644 index 0000000000..d26b490fc4 --- /dev/null +++ b/queue-6.1/drm-tegra-dc-fix-reference-leak-in-tegra_dc_couple.patch @@ -0,0 +1,37 @@ +From 4c5376b4b143c4834ebd392aef2215847752b16a Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Wed, 22 Oct 2025 19:47:20 +0800 +Subject: drm/tegra: dc: Fix reference leak in tegra_dc_couple() + +From: Ma Ke + +commit 4c5376b4b143c4834ebd392aef2215847752b16a upstream. + +driver_find_device() calls get_device() to increment the reference +count once a matching device is found, but there is no put_device() to +balance the reference count. To avoid reference count leakage, add +put_device() to decrease the reference count. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: a31500fe7055 ("drm/tegra: dc: Restore coupling of display controllers") +Signed-off-by: Ma Ke +Acked-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Link: https://patch.msgid.link/20251022114720.24937-1-make24@iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tegra/dc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/tegra/dc.c ++++ b/drivers/gpu/drm/tegra/dc.c +@@ -3141,6 +3141,7 @@ static int tegra_dc_couple(struct tegra_ + dc->client.parent = &parent->client; + + dev_dbg(dc->dev, "coupled to %s\n", dev_name(companion)); ++ put_device(companion); + } + + return 0; diff --git a/queue-6.1/mptcp-avoid-unneeded-subflow-level-drops.patch b/queue-6.1/mptcp-avoid-unneeded-subflow-level-drops.patch new file mode 100644 index 0000000000..d132249701 --- /dev/null +++ b/queue-6.1/mptcp-avoid-unneeded-subflow-level-drops.patch @@ -0,0 +1,116 @@ +From 4f102d747cadd8f595f2b25882eed9bec1675fb1 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Tue, 18 Nov 2025 08:20:20 +0100 +Subject: mptcp: avoid unneeded subflow-level drops + +From: Paolo Abeni + +commit 4f102d747cadd8f595f2b25882eed9bec1675fb1 upstream. + +The rcv window is shared among all the subflows. Currently, MPTCP sync +the TCP-level rcv window with the MPTCP one at tcp_transmit_skb() time. + +The above means that incoming data may sporadically observe outdated +TCP-level rcv window and being wrongly dropped by TCP. + +Address the issue checking for the edge condition before queuing the +data at TCP level, and eventually syncing the rcv window as needed. + +Note that the issue is actually present from the very first MPTCP +implementation, but backports older than the blamed commit below will +range from impossible to useless. + +Before: + + $ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow + TcpExtBeyondWindow 14 0.0 + +After: + + $ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow + TcpExtBeyondWindow 0 0.0 + +Fixes: fa3fe2b15031 ("mptcp: track window announced to peer") +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-2-806d3781c95f@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/options.c | 31 +++++++++++++++++++++++++++++++ + net/mptcp/protocol.h | 1 + + 2 files changed, 32 insertions(+) + +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -1028,6 +1028,31 @@ u64 __mptcp_expand_seq(u64 old_seq, u64 + return cur_seq; + } + ++static void rwin_update(struct mptcp_sock *msk, struct sock *ssk, ++ struct sk_buff *skb) ++{ ++ struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk); ++ struct tcp_sock *tp = tcp_sk(ssk); ++ u64 mptcp_rcv_wnd; ++ ++ /* Avoid touching extra cachelines if TCP is going to accept this ++ * skb without filling the TCP-level window even with a possibly ++ * outdated mptcp-level rwin. ++ */ ++ if (!skb->len || skb->len < tcp_receive_window(tp)) ++ return; ++ ++ mptcp_rcv_wnd = atomic64_read(&msk->rcv_wnd_sent); ++ if (!after64(mptcp_rcv_wnd, subflow->rcv_wnd_sent)) ++ return; ++ ++ /* Some other subflow grew the mptcp-level rwin since rcv_wup, ++ * resync. ++ */ ++ tp->rcv_wnd += mptcp_rcv_wnd - subflow->rcv_wnd_sent; ++ subflow->rcv_wnd_sent = mptcp_rcv_wnd; ++} ++ + static void ack_update_msk(struct mptcp_sock *msk, + struct sock *ssk, + struct mptcp_options_received *mp_opt) +@@ -1188,6 +1213,7 @@ bool mptcp_incoming_options(struct sock + */ + if (mp_opt.use_ack) + ack_update_msk(msk, sk, &mp_opt); ++ rwin_update(msk, sk, skb); + + /* Zero-data-length packets are dropped by the caller and not + * propagated to the MPTCP layer, so the skb extension does not +@@ -1274,6 +1300,10 @@ static void mptcp_set_rwin(struct tcp_so + + if (rcv_wnd_new != rcv_wnd_old) { + raise_win: ++ /* The msk-level rcv wnd is after the tcp level one, ++ * sync the latter. ++ */ ++ rcv_wnd_new = rcv_wnd_old; + win = rcv_wnd_old - ack_seq; + tp->rcv_wnd = min_t(u64, win, U32_MAX); + new_win = tp->rcv_wnd; +@@ -1297,6 +1327,7 @@ raise_win: + + update_wspace: + WRITE_ONCE(msk->old_wspace, tp->rcv_wnd); ++ subflow->rcv_wnd_sent = rcv_wnd_new; + } + + static void mptcp_track_rwin(struct tcp_sock *tp) +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -458,6 +458,7 @@ struct mptcp_subflow_context { + u64 remote_key; + u64 idsn; + u64 map_seq; ++ u64 rcv_wnd_sent; + u32 snd_isn; + u32 token; + u32 rel_write_seq; diff --git a/queue-6.1/mptcp-do-not-fallback-when-ooo-is-present.patch b/queue-6.1/mptcp-do-not-fallback-when-ooo-is-present.patch new file mode 100644 index 0000000000..5b5e01d9eb --- /dev/null +++ b/queue-6.1/mptcp-do-not-fallback-when-ooo-is-present.patch @@ -0,0 +1,43 @@ +From 1bba3f219c5e8c29e63afa3c1fc24f875ebec119 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Tue, 18 Nov 2025 08:20:22 +0100 +Subject: mptcp: do not fallback when OoO is present + +From: Paolo Abeni + +commit 1bba3f219c5e8c29e63afa3c1fc24f875ebec119 upstream. + +In case of DSS corruption, the MPTCP protocol tries to avoid the subflow +reset if fallback is possible. Such corruptions happen in the receive +path; to ensure fallback is possible the stack additionally needs to +check for OoO data, otherwise the fallback will break the data stream. + +Fixes: e32d262c89e2 ("mptcp: handle consistently DSS corruption") +Cc: stable@vger.kernel.org +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/598 +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-4-806d3781c95f@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -911,6 +911,13 @@ static bool __mptcp_finish_join(struct m + if (sk->sk_state != TCP_ESTABLISHED) + return false; + ++ /* The caller possibly is not holding the msk socket lock, but ++ * in the fallback case only the current subflow is touching ++ * the OoO queue. ++ */ ++ if (!RB_EMPTY_ROOT(&msk->out_of_order_queue)) ++ return false; ++ + spin_lock_bh(&msk->fallback_lock); + if (!msk->allow_subflows) { + spin_unlock_bh(&msk->fallback_lock); diff --git a/queue-6.1/mptcp-fix-ack-generation-for-fallback-msk.patch b/queue-6.1/mptcp-fix-ack-generation-for-fallback-msk.patch new file mode 100644 index 0000000000..7bb345786e --- /dev/null +++ b/queue-6.1/mptcp-fix-ack-generation-for-fallback-msk.patch @@ -0,0 +1,85 @@ +From 5e15395f6d9ec07395866c5511f4b4ac566c0c9b Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Tue, 18 Nov 2025 08:20:19 +0100 +Subject: mptcp: fix ack generation for fallback msk + +From: Paolo Abeni + +commit 5e15395f6d9ec07395866c5511f4b4ac566c0c9b upstream. + +mptcp_cleanup_rbuf() needs to know the last most recent, mptcp-level +rcv_wnd sent, and such information is tracked into the msk->old_wspace +field, updated at ack transmission time by mptcp_write_options(). + +Fallback socket do not add any mptcp options, such helper is never +invoked, and msk->old_wspace value remain stale. That in turn makes +ack generation at recvmsg() time quite random. + +Address the issue ensuring mptcp_write_options() is invoked even for +fallback sockets, and just update the needed info in such a case. + +The issue went unnoticed for a long time, as mptcp currently overshots +the fallback socket receive buffer autotune significantly. It is going +to change in the near future. + +Fixes: e3859603ba13 ("mptcp: better msk receive window updates") +Cc: stable@vger.kernel.org +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/594 +Signed-off-by: Paolo Abeni +Reviewed-by: Geliang Tang +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-1-806d3781c95f@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/options.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -834,8 +834,11 @@ bool mptcp_established_options(struct so + + opts->suboptions = 0; + ++ /* Force later mptcp_write_options(), but do not use any actual ++ * option space. ++ */ + if (unlikely(__mptcp_check_fallback(msk) && !mptcp_check_infinite_map(skb))) +- return false; ++ return true; + + if (unlikely(skb && TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST)) { + if (mptcp_established_options_fastclose(sk, &opt_size, remaining, opts) || +@@ -1296,6 +1299,20 @@ update_wspace: + WRITE_ONCE(msk->old_wspace, tp->rcv_wnd); + } + ++static void mptcp_track_rwin(struct tcp_sock *tp) ++{ ++ const struct sock *ssk = (const struct sock *)tp; ++ struct mptcp_subflow_context *subflow; ++ struct mptcp_sock *msk; ++ ++ if (!ssk) ++ return; ++ ++ subflow = mptcp_subflow_ctx(ssk); ++ msk = mptcp_sk(subflow->conn); ++ WRITE_ONCE(msk->old_wspace, tp->rcv_wnd); ++} ++ + __sum16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum) + { + struct csum_pseudo_header header; +@@ -1588,6 +1605,10 @@ mp_rst: + opts->reset_transient, + opts->reset_reason); + return; ++ } else if (unlikely(!opts->suboptions)) { ++ /* Fallback to TCP */ ++ mptcp_track_rwin(tp); ++ return; + } + + if (OPTION_MPTCP_PRIO & opts->suboptions) { diff --git a/queue-6.1/mptcp-fix-premature-close-in-case-of-fallback.patch b/queue-6.1/mptcp-fix-premature-close-in-case-of-fallback.patch new file mode 100644 index 0000000000..7e778945b1 --- /dev/null +++ b/queue-6.1/mptcp-fix-premature-close-in-case-of-fallback.patch @@ -0,0 +1,60 @@ +From 17393fa7b7086664be519e7230cb6ed7ec7d9462 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Tue, 18 Nov 2025 08:20:21 +0100 +Subject: mptcp: fix premature close in case of fallback + +From: Paolo Abeni + +commit 17393fa7b7086664be519e7230cb6ed7ec7d9462 upstream. + +I'm observing very frequent self-tests failures in case of fallback when +running on a CONFIG_PREEMPT kernel. + +The root cause is that subflow_sched_work_if_closed() closes any subflow +as soon as it is half-closed and has no incoming data pending. + +That works well for regular subflows - MPTCP needs bi-directional +connectivity to operate on a given subflow - but for fallback socket is +race prone. + +When TCP peer closes the connection before the MPTCP one, +subflow_sched_work_if_closed() will schedule the MPTCP worker to +gracefully close the subflow, and shortly after will do another schedule +to inject and process a dummy incoming DATA_FIN. + +On CONFIG_PREEMPT kernel, the MPTCP worker can kick-in and close the +fallback subflow before subflow_sched_work_if_closed() is able to create +the dummy DATA_FIN, unexpectedly interrupting the transfer. + +Address the issue explicitly avoiding closing fallback subflows on when +the peer is only half-closed. + +Note that, when the subflow is able to create the DATA_FIN before the +worker invocation, the worker will change the msk state before trying to +close the subflow and will skip the latter operation as the msk will not +match anymore the precondition in __mptcp_close_subflow(). + +Fixes: f09b0ad55a11 ("mptcp: close subflow when receiving TCP+FIN") +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-3-806d3781c95f@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2598,7 +2598,8 @@ static void __mptcp_close_subflow(struct + + if (ssk_state != TCP_CLOSE && + (ssk_state != TCP_CLOSE_WAIT || +- inet_sk_state_load(sk) != TCP_ESTABLISHED)) ++ inet_sk_state_load(sk) != TCP_ESTABLISHED || ++ __mptcp_check_fallback(msk))) + continue; + + /* 'subflow_data_ready' will re-sched once rx queue is empty */ diff --git a/queue-6.1/series b/queue-6.1/series index 6ff75175bd..79d93e36c7 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -445,3 +445,9 @@ scsi-target-tcm_loop-fix-segfault-in-tcm_loop_tpg_address_show.patch mips-malta-fix-eva-soc-it-pci-mmio.patch loongarch-don-t-panic-if-no-valid-cache-info-for-pci.patch mptcp-fix-race-condition-in-mptcp_schedule_work.patch +mptcp-fix-ack-generation-for-fallback-msk.patch +mptcp-fix-premature-close-in-case-of-fallback.patch +mptcp-avoid-unneeded-subflow-level-drops.patch +mptcp-do-not-fallback-when-ooo-is-present.patch +drm-tegra-dc-fix-reference-leak-in-tegra_dc_couple.patch +drm-amdgpu-skip-emit-de-meta-data-on-gfx11-with-rs64-enabled.patch