From: Greg Kroah-Hartman Date: Tue, 31 Mar 2026 16:07:02 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.6.131~5 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=01427dd924b37628fbd060eb2fa92e5fd22a37d0;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: idpf-nullify-pointers-after-they-are-freed.patch net-bcmasp-fix-network-filter-wake-for-asp-3.0.patch net-bcmasp-restore-programming-of-tx-map-vector-register.patch --- diff --git a/queue-6.12/idpf-nullify-pointers-after-they-are-freed.patch b/queue-6.12/idpf-nullify-pointers-after-they-are-freed.patch new file mode 100644 index 0000000000..e7aa01ceff --- /dev/null +++ b/queue-6.12/idpf-nullify-pointers-after-they-are-freed.patch @@ -0,0 +1,35 @@ +From bc3b31977314433e4685ae92853d1b6e91ad7bc2 Mon Sep 17 00:00:00 2001 +From: Li Li +Date: Fri, 23 Jan 2026 06:58:06 +0000 +Subject: idpf: nullify pointers after they are freed + +From: Li Li + +commit bc3b31977314433e4685ae92853d1b6e91ad7bc2 upstream. + +rss_data->rss_key needs to be nullified after it is freed. +Checks like "if (!rss_data->rss_key)" in the code could fail +if it is not nullified. + +Tested: built and booted the kernel. + +Fixes: 83f38f210b85 ("idpf: Fix RSS LUT NULL pointer crash on early ethtool operations") +Signed-off-by: Li Li +Reviewed-by: Aleksandr Loktionov +Tested-by: Samuel Salin +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/idpf/idpf_lib.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c +@@ -1230,6 +1230,7 @@ static struct idpf_vport *idpf_vport_all + + free_rss_key: + kfree(rss_data->rss_key); ++ rss_data->rss_key = NULL; + free_vector_idxs: + kfree(vport->q_vector_idxs); + free_vport: diff --git a/queue-6.12/net-bcmasp-fix-network-filter-wake-for-asp-3.0.patch b/queue-6.12/net-bcmasp-fix-network-filter-wake-for-asp-3.0.patch new file mode 100644 index 0000000000..e13318473e --- /dev/null +++ b/queue-6.12/net-bcmasp-fix-network-filter-wake-for-asp-3.0.patch @@ -0,0 +1,61 @@ +From bbb11b8d758d17a4ce34b8ed0b49de150568265b Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Tue, 20 Jan 2026 11:23:39 -0800 +Subject: net: bcmasp: Fix network filter wake for asp-3.0 + +From: Justin Chen + +commit bbb11b8d758d17a4ce34b8ed0b49de150568265b upstream. + +We need to apply the tx_chan_offset to the netfilter cfg channel or the +output channel will be incorrect for asp-3.0 and newer. + +Fixes: e9f31435ee7d ("net: bcmasp: Add support for asp-v3.0") +Signed-off-by: Justin Chen +Reviewed-by: Florian Fainelli +Link: https://patch.msgid.link/20260120192339.2031648-1-justin.chen@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/asp2/bcmasp.c | 5 +++-- + drivers/net/ethernet/broadcom/asp2/bcmasp.h | 1 + + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/asp2/bcmasp.c ++++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.c +@@ -156,7 +156,7 @@ static void bcmasp_netfilt_hw_en_wake(st + ASP_RX_FILTER_NET_OFFSET_L4(32), + ASP_RX_FILTER_NET_OFFSET(nfilt->hw_index + 1)); + +- rx_filter_core_wl(priv, ASP_RX_FILTER_NET_CFG_CH(nfilt->port + 8) | ++ rx_filter_core_wl(priv, ASP_RX_FILTER_NET_CFG_CH(nfilt->ch) | + ASP_RX_FILTER_NET_CFG_EN | + ASP_RX_FILTER_NET_CFG_L2_EN | + ASP_RX_FILTER_NET_CFG_L3_EN | +@@ -166,7 +166,7 @@ static void bcmasp_netfilt_hw_en_wake(st + ASP_RX_FILTER_NET_CFG_UMC(nfilt->port), + ASP_RX_FILTER_NET_CFG(nfilt->hw_index)); + +- rx_filter_core_wl(priv, ASP_RX_FILTER_NET_CFG_CH(nfilt->port + 8) | ++ rx_filter_core_wl(priv, ASP_RX_FILTER_NET_CFG_CH(nfilt->ch) | + ASP_RX_FILTER_NET_CFG_EN | + ASP_RX_FILTER_NET_CFG_L2_EN | + ASP_RX_FILTER_NET_CFG_L3_EN | +@@ -714,6 +714,7 @@ struct bcmasp_net_filter *bcmasp_netfilt + nfilter = &priv->net_filters[open_index]; + nfilter->claimed = true; + nfilter->port = intf->port; ++ nfilter->ch = intf->channel + priv->tx_chan_offset; + nfilter->hw_index = open_index; + } + +--- a/drivers/net/ethernet/broadcom/asp2/bcmasp.h ++++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.h +@@ -348,6 +348,7 @@ struct bcmasp_net_filter { + bool wake_filter; + + int port; ++ int ch; + unsigned int hw_index; + }; + diff --git a/queue-6.12/net-bcmasp-restore-programming-of-tx-map-vector-register.patch b/queue-6.12/net-bcmasp-restore-programming-of-tx-map-vector-register.patch new file mode 100644 index 0000000000..475eb5844e --- /dev/null +++ b/queue-6.12/net-bcmasp-restore-programming-of-tx-map-vector-register.patch @@ -0,0 +1,37 @@ +From 18ff09c1b94fa1584b31d3f4e9eecdca29230ce5 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Fri, 18 Jul 2025 14:22:42 -0700 +Subject: net: bcmasp: Restore programming of TX map vector register + +From: Florian Fainelli + +commit 18ff09c1b94fa1584b31d3f4e9eecdca29230ce5 upstream. + +On ASP versions v2.x we need to program the TX map vector register to +properly exercise end-to-end flow control, otherwise the TX engine can +either lock-up, or cause the hardware calculated checksum to be +wrong/corrupted when multiple back to back packets are being submitted +for transmission. This register defaults to 0, which means no flow +control being applied. + +Fixes: e9f31435ee7d ("net: bcmasp: Add support for asp-v3.0") +Signed-off-by: Florian Fainelli +Link: https://patch.msgid.link/20250718212242.3447751-1-florian.fainelli@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c ++++ b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +@@ -815,6 +815,9 @@ static void bcmasp_init_tx(struct bcmasp + /* Tx SPB */ + tx_spb_ctrl_wl(intf, ((intf->channel + 8) << TX_SPB_CTRL_XF_BID_SHIFT), + TX_SPB_CTRL_XF_CTRL2); ++ ++ if (intf->parent->tx_chan_offset) ++ tx_pause_ctrl_wl(intf, (1 << (intf->channel + 8)), TX_PAUSE_MAP_VECTOR); + tx_spb_top_wl(intf, 0x1e, TX_SPB_TOP_BLKOUT); + + tx_spb_dma_wq(intf, intf->tx_spb_dma_addr, TX_SPB_DMA_READ); diff --git a/queue-6.12/series b/queue-6.12/series index ab3600c080..2dadcbc6c5 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -239,3 +239,6 @@ btrfs-fix-lost-error-when-running-device-stats-on-mu.patch xen-privcmd-unregister-xenstore-notifier-on-module-e.patch futex-require-sys_futex_requeue-to-have-identical-fl.patch dmaengine-idxd-fix-leaking-event-log-memory.patch +net-bcmasp-restore-programming-of-tx-map-vector-register.patch +net-bcmasp-fix-network-filter-wake-for-asp-3.0.patch +idpf-nullify-pointers-after-they-are-freed.patch