From: Greg Kroah-Hartman Date: Mon, 12 Jan 2026 11:09:15 +0000 (+0100) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a828984fcfe7fb4ef245acbf35f6be728b3b9ed0;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: drm-xe-ensure-gt-is-in-c0-during-resumes.patch drm-xe-make-xe_gt_idle_disable_c6-handle-the-forcewake-internally.patch tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch --- diff --git a/queue-6.12/drm-xe-ensure-gt-is-in-c0-during-resumes.patch b/queue-6.12/drm-xe-ensure-gt-is-in-c0-during-resumes.patch new file mode 100644 index 0000000000..7752549ca7 --- /dev/null +++ b/queue-6.12/drm-xe-ensure-gt-is-in-c0-during-resumes.patch @@ -0,0 +1,61 @@ +From 95d0883ac8105717f59c2dcdc0d8b9150f13aa12 Mon Sep 17 00:00:00 2001 +From: Xin Wang +Date: Tue, 26 Aug 2025 17:06:33 -0700 +Subject: drm/xe: Ensure GT is in C0 during resumes + +From: Xin Wang + +commit 95d0883ac8105717f59c2dcdc0d8b9150f13aa12 upstream. + +This patch ensures the gt will be awake for the entire duration +of the resume sequences until GuCRC takes over and GT-C6 gets +re-enabled. + +Before suspending GT-C6 is kept enabled, but upon resume, GuCRC +is not yet alive to properly control the exits and some cases of +instability and corruption related to GT-C6 can be observed. + +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4037 + +Suggested-by: Rodrigo Vivi +Signed-off-by: Xin Wang +Reviewed-by: Rodrigo Vivi +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4037 +Link: https://lore.kernel.org/r/20250827000633.1369890-3-x.wang@intel.com +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_pm.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/xe/xe_pm.c ++++ b/drivers/gpu/drm/xe/xe_pm.c +@@ -17,7 +17,7 @@ + #include "xe_device_sysfs.h" + #include "xe_ggtt.h" + #include "xe_gt.h" +-#include "xe_guc.h" ++#include "xe_gt_idle.h" + #include "xe_irq.h" + #include "xe_pcode.h" + #include "xe_trace.h" +@@ -165,6 +165,9 @@ int xe_pm_resume(struct xe_device *xe) + drm_dbg(&xe->drm, "Resuming device\n"); + trace_xe_pm_resume(xe, __builtin_return_address(0)); + ++ for_each_gt(gt, xe, id) ++ xe_gt_idle_disable_c6(gt); ++ + for_each_tile(tile, xe, id) + xe_wa_apply_tile_workarounds(tile); + +@@ -451,6 +454,9 @@ int xe_pm_runtime_resume(struct xe_devic + + xe_rpm_lockmap_acquire(xe); + ++ for_each_gt(gt, xe, id) ++ xe_gt_idle_disable_c6(gt); ++ + if (xe->d3cold.allowed) { + err = xe_pcode_ready(xe, true); + if (err) diff --git a/queue-6.12/drm-xe-make-xe_gt_idle_disable_c6-handle-the-forcewake-internally.patch b/queue-6.12/drm-xe-make-xe_gt_idle_disable_c6-handle-the-forcewake-internally.patch new file mode 100644 index 0000000000..c42af802b6 --- /dev/null +++ b/queue-6.12/drm-xe-make-xe_gt_idle_disable_c6-handle-the-forcewake-internally.patch @@ -0,0 +1,96 @@ +From 1313351e71181a4818afeb8dfe202e4162091ef6 Mon Sep 17 00:00:00 2001 +From: Xin Wang +Date: Tue, 26 Aug 2025 17:06:32 -0700 +Subject: drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally + +From: Xin Wang + +commit 1313351e71181a4818afeb8dfe202e4162091ef6 upstream. + +Move forcewake_get() into xe_gt_idle_enable_c6() to streamline the +code and make it easier to use. + +Suggested-by: Rodrigo Vivi +Signed-off-by: Xin Wang +Reviewed-by: Rodrigo Vivi +Link: https://lore.kernel.org/r/20250827000633.1369890-2-x.wang@intel.com +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_gt_idle.c | 20 +++++++++++++------- + drivers/gpu/drm/xe/xe_gt_idle.h | 2 +- + drivers/gpu/drm/xe/xe_guc_pc.c | 10 +--------- + 3 files changed, 15 insertions(+), 17 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_gt_idle.c ++++ b/drivers/gpu/drm/xe/xe_gt_idle.c +@@ -204,11 +204,8 @@ static void gt_idle_fini(void *arg) + + xe_gt_idle_disable_pg(gt); + +- if (gt_to_xe(gt)->info.skip_guc_pc) { +- XE_WARN_ON(xe_force_wake_get(gt_to_fw(gt), XE_FW_GT)); ++ if (gt_to_xe(gt)->info.skip_guc_pc) + xe_gt_idle_disable_c6(gt); +- xe_force_wake_put(gt_to_fw(gt), XE_FW_GT); +- } + + sysfs_remove_files(kobj, gt_idle_attrs); + kobject_put(kobj); +@@ -266,14 +263,23 @@ void xe_gt_idle_enable_c6(struct xe_gt * + RC_CTL_HW_ENABLE | RC_CTL_TO_MODE | RC_CTL_RC6_ENABLE); + } + +-void xe_gt_idle_disable_c6(struct xe_gt *gt) ++int xe_gt_idle_disable_c6(struct xe_gt *gt) + { ++ unsigned int fw_ref; ++ + xe_device_assert_mem_access(gt_to_xe(gt)); +- xe_force_wake_assert_held(gt_to_fw(gt), XE_FW_GT); + + if (IS_SRIOV_VF(gt_to_xe(gt))) +- return; ++ return 0; ++ ++ fw_ref = xe_force_wake_get(gt_to_fw(gt), XE_FW_GT); ++ if (!fw_ref) ++ return -ETIMEDOUT; + + xe_mmio_write32(gt, RC_CONTROL, 0); + xe_mmio_write32(gt, RC_STATE, 0); ++ ++ xe_force_wake_put(gt_to_fw(gt), fw_ref); ++ ++ return 0; + } +--- a/drivers/gpu/drm/xe/xe_gt_idle.h ++++ b/drivers/gpu/drm/xe/xe_gt_idle.h +@@ -12,7 +12,7 @@ struct xe_gt; + + int xe_gt_idle_init(struct xe_gt_idle *gtidle); + void xe_gt_idle_enable_c6(struct xe_gt *gt); +-void xe_gt_idle_disable_c6(struct xe_gt *gt); ++int xe_gt_idle_disable_c6(struct xe_gt *gt); + void xe_gt_idle_enable_pg(struct xe_gt *gt); + void xe_gt_idle_disable_pg(struct xe_gt *gt); + +--- a/drivers/gpu/drm/xe/xe_guc_pc.c ++++ b/drivers/gpu/drm/xe/xe_guc_pc.c +@@ -1008,15 +1008,7 @@ int xe_guc_pc_gucrc_disable(struct xe_gu + if (ret) + return ret; + +- ret = xe_force_wake_get(gt_to_fw(gt), XE_FORCEWAKE_ALL); +- if (ret) +- return ret; +- +- xe_gt_idle_disable_c6(gt); +- +- XE_WARN_ON(xe_force_wake_put(gt_to_fw(gt), XE_FORCEWAKE_ALL)); +- +- return 0; ++ return xe_gt_idle_disable_c6(gt); + } + + /** diff --git a/queue-6.12/series b/queue-6.12/series index 846a19c626..cf20e46965 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -25,3 +25,6 @@ libceph-make-free_choose_arg_map-resilient-to-partial-allocation.patch libceph-return-the-handler-error-from-mon_handle_auth_done.patch libceph-reset-sparse-read-state-in-osd_fault.patch libceph-make-calc_target-set-t-paused-not-just-clear-it.patch +tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch +drm-xe-make-xe_gt_idle_disable_c6-handle-the-forcewake-internally.patch +drm-xe-ensure-gt-is-in-c0-during-resumes.patch diff --git a/queue-6.12/tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch b/queue-6.12/tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch new file mode 100644 index 0000000000..b14afefd17 --- /dev/null +++ b/queue-6.12/tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch @@ -0,0 +1,62 @@ +From c65f27b9c3be2269918e1cbad6d8884741f835c5 Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Tue, 16 Sep 2025 21:47:23 +0000 +Subject: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). + +From: Kuniyuki Iwashima + +commit c65f27b9c3be2269918e1cbad6d8884741f835c5 upstream. + +get_netdev_for_sock() is called during setsockopt(), +so not under RCU. + +Using sk_dst_get(sk)->dev could trigger UAF. + +Let's use __sk_dst_get() and dst_dev_rcu(). + +Note that the only ->ndo_sk_get_lower_dev() user is +bond_sk_get_lower_dev(), which uses RCU. + +Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Reviewed-by: Sabrina Dubroca +Link: https://patch.msgid.link/20250916214758.650211-6-kuniyu@google.com +Signed-off-by: Jakub Kicinski +[ Keerthana: Backport to v6.12.y ] +Signed-off-by: Keerthana K +Signed-off-by: Greg Kroah-Hartman +--- + net/tls/tls_device.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -123,17 +123,19 @@ static void tls_device_queue_ctx_destruc + /* We assume that the socket is already connected */ + static struct net_device *get_netdev_for_sock(struct sock *sk) + { +- struct dst_entry *dst = sk_dst_get(sk); +- struct net_device *netdev = NULL; ++ struct net_device *dev, *lowest_dev = NULL; ++ struct dst_entry *dst; + +- if (likely(dst)) { +- netdev = netdev_sk_get_lowest_dev(dst->dev, sk); +- dev_hold(netdev); ++ rcu_read_lock(); ++ dst = __sk_dst_get(sk); ++ dev = dst ? dst_dev_rcu(dst) : NULL; ++ if (likely(dev)) { ++ lowest_dev = netdev_sk_get_lowest_dev(dev, sk); ++ dev_hold(lowest_dev); + } ++ rcu_read_unlock(); + +- dst_release(dst); +- +- return netdev; ++ return lowest_dev; + } + + static void destroy_record(struct tls_record_info *record)