From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 08:50:39 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ef69bae4bba785e68ee38d12d4081db6f4b0619a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch espintcp-use-sk_msg_free_partial-to-fix-partial-send.patch loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch rtc-mpfs-fix-counter-upload-completion-condition.patch --- diff --git a/queue-6.12/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch b/queue-6.12/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch index ec7abb4150..b62676369f 100644 --- a/queue-6.12/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch +++ b/queue-6.12/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch @@ -25,16 +25,14 @@ Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework") Signed-off-by: Sven Eckelmann Signed-off-by: Sasha Levin --- - net/batman-adv/main.c | 8 ++++++++ - net/batman-adv/soft-interface.c | 13 ++----------- - net/batman-adv/soft-interface.h | 2 ++ + net/batman-adv/main.c | 8 ++++++++ + net/batman-adv/soft-interface.c | 13 ++----------- + net/batman-adv/soft-interface.h | 2 ++ 3 files changed, 12 insertions(+), 11 deletions(-) -diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c -index ac7fa70c09ca85..87f798701dabdc 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c -@@ -259,6 +259,7 @@ int batadv_mesh_init(struct net_device *soft_iface) +@@ -259,6 +259,7 @@ err_orig: void batadv_mesh_free(struct net_device *soft_iface) { struct batadv_priv *bat_priv = netdev_priv(soft_iface); @@ -42,7 +40,7 @@ index ac7fa70c09ca85..87f798701dabdc 100644 atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); -@@ -274,6 +275,13 @@ void batadv_mesh_free(struct net_device *soft_iface) +@@ -274,6 +275,13 @@ void batadv_mesh_free(struct net_device batadv_mcast_free(bat_priv); @@ -56,11 +54,9 @@ index ac7fa70c09ca85..87f798701dabdc 100644 /* Free the TT and the originator tables only after having terminated * all the other depending components which may use these structures for * their purposes. -diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c -index bc72238e7a08c3..aaebe74c1bc0a9 100644 --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c -@@ -606,8 +606,8 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid) +@@ -606,8 +606,8 @@ int batadv_softif_create_vlan(struct bat * @bat_priv: the bat priv with all the soft interface information * @vlan: the object to remove */ @@ -71,7 +67,7 @@ index bc72238e7a08c3..aaebe74c1bc0a9 100644 { /* explicitly remove the associated TT local entry because it is marked * with the NOPURGE flag -@@ -1103,22 +1103,13 @@ static int batadv_softif_newlink(struct net *src_net, struct net_device *dev, +@@ -1103,22 +1103,13 @@ static int batadv_softif_newlink(struct static void batadv_softif_destroy_netlink(struct net_device *soft_iface, struct list_head *head) { @@ -94,11 +90,9 @@ index bc72238e7a08c3..aaebe74c1bc0a9 100644 unregister_netdevice_queue(soft_iface, head); } -diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h -index 9f2003f1a4972e..13709a5d23e3bf 100644 --- a/net/batman-adv/soft-interface.h +++ b/net/batman-adv/soft-interface.h -@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_device *soft_iface, +@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_devi bool batadv_softif_is_valid(const struct net_device *net_dev); extern struct rtnl_link_ops batadv_link_ops; int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid); @@ -107,6 +101,3 @@ index 9f2003f1a4972e..13709a5d23e3bf 100644 void batadv_softif_vlan_release(struct kref *ref); struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv, unsigned short vid); --- -2.53.0 - diff --git a/queue-6.12/bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch b/queue-6.12/bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch new file mode 100644 index 0000000000..c247034ab4 --- /dev/null +++ b/queue-6.12/bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch @@ -0,0 +1,43 @@ +From a986fde914d88af47eb78fd29c5d1af7952c3500 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Sat, 20 Jun 2026 11:53:50 +0530 +Subject: bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() + +From: Abdun Nihaal + +commit a986fde914d88af47eb78fd29c5d1af7952c3500 upstream. + +If the allocation of fp[i].tpa_info fails, the error path will not free +the struct bnx2x_fastpath allocated earlier, as it is not linked to the +bp structure yet. Fix that by linking it immediately after allocation. + +Cc: stable@vger.kernel.org +Fixes: 15192a8cf8a8 ("bnx2x: Split the FP structure") +Signed-off-by: Abdun Nihaal +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260620062402.89549-1-nihaal@cse.iitm.ac.in +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -4750,6 +4750,7 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp) + fp = kcalloc(bp->fp_array_size, sizeof(*fp), GFP_KERNEL); + if (!fp) + goto alloc_err; ++ bp->fp = fp; + for (i = 0; i < bp->fp_array_size; i++) { + fp[i].tpa_info = + kcalloc(ETH_MAX_AGGREGATION_QUEUES_E1H_E2, +@@ -4758,8 +4759,6 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp) + goto alloc_err; + } + +- bp->fp = fp; +- + /* allocate sp objs */ + bp->sp_objs = kcalloc(bp->fp_array_size, sizeof(struct bnx2x_sp_objs), + GFP_KERNEL); diff --git a/queue-6.12/espintcp-use-sk_msg_free_partial-to-fix-partial-send.patch b/queue-6.12/espintcp-use-sk_msg_free_partial-to-fix-partial-send.patch new file mode 100644 index 0000000000..d8e51c4201 --- /dev/null +++ b/queue-6.12/espintcp-use-sk_msg_free_partial-to-fix-partial-send.patch @@ -0,0 +1,78 @@ +From 007800408002d871f5699bdb944f985896730b8f Mon Sep 17 00:00:00 2001 +From: Sabrina Dubroca +Date: Fri, 12 Jun 2026 16:11:39 +0200 +Subject: espintcp: use sk_msg_free_partial to fix partial send + +From: Sabrina Dubroca + +commit 007800408002d871f5699bdb944f985896730b8f upstream. + +sk_msg_free_partial() ensures consistency of the skmsg at every +iteration, without having to manually handle uncharges and offsets. +This simplifies the code, and fixes some bugs in skmsg accounting when +we don't send the full contents. + +Cc: stable@vger.kernel.org +Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)") +Reported-by: Aaron Esau +Reported-by: Yiming Qian +Signed-off-by: Sabrina Dubroca +Signed-off-by: Steffen Klassert +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/espintcp.c | 34 +++++++--------------------------- + 1 file changed, 7 insertions(+), 27 deletions(-) + +--- a/net/xfrm/espintcp.c ++++ b/net/xfrm/espintcp.c +@@ -215,43 +215,23 @@ static int espintcp_sendskmsg_locked(str + struct sk_msg *skmsg = &emsg->skmsg; + bool more = flags & MSG_MORE; + struct scatterlist *sg; +- int done = 0; + int ret; + +- sg = &skmsg->sg.data[skmsg->sg.start]; + do { + struct bio_vec bvec; +- size_t size = sg->length - emsg->offset; +- int offset = sg->offset + emsg->offset; +- struct page *p; +- +- emsg->offset = 0; + ++ sg = &skmsg->sg.data[skmsg->sg.start]; + if (sg_is_last(sg) && !more) + msghdr.msg_flags &= ~MSG_MORE; + +- p = sg_page(sg); +-retry: +- bvec_set_page(&bvec, p, size, offset); +- iov_iter_bvec(&msghdr.msg_iter, ITER_SOURCE, &bvec, 1, size); +- ret = tcp_sendmsg_locked(sk, &msghdr, size); +- if (ret < 0) { +- emsg->offset = offset - sg->offset; +- skmsg->sg.start += done; ++ bvec_set_page(&bvec, sg_page(sg), sg->length, sg->offset); ++ iov_iter_bvec(&msghdr.msg_iter, ITER_SOURCE, &bvec, 1, sg->length); ++ ret = tcp_sendmsg_locked(sk, &msghdr, sg->length); ++ if (ret < 0) + return ret; +- } + +- if (ret != size) { +- offset += ret; +- size -= ret; +- goto retry; +- } +- +- done++; +- put_page(p); +- sk_mem_uncharge(sk, sg->length); +- sg = sg_next(sg); +- } while (sg); ++ sk_msg_free_partial(sk, skmsg, ret); ++ } while (skmsg->sg.size); + + memset(emsg, 0, sizeof(*emsg)); + diff --git a/queue-6.12/loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch b/queue-6.12/loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch new file mode 100644 index 0000000000..0e8021b07a --- /dev/null +++ b/queue-6.12/loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch @@ -0,0 +1,82 @@ +From 018e9828eb523c638fa3d9bdf0fd4956b74555b2 Mon Sep 17 00:00:00 2001 +From: Hongchen Zhang +Date: Thu, 25 Jun 2026 13:03:49 +0800 +Subject: LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() + +From: Hongchen Zhang + +commit 018e9828eb523c638fa3d9bdf0fd4956b74555b2 upstream. + +When hardware page table walker (PTW) is enabled on LoongArch, the CPU +may set _PAGE_DIRTY directly in the page table entry during a write TLB +miss, without going through the software TLB store handler. The software +TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED +together: + + ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED) + +Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e. +_PAGE_MODIFIED is left unchanged. This creates a window where a PTE has +_PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED +clear (software is unaware). + +When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls +pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and +_PAGE_DIRTY bits: + + pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY); + +Since _PAGE_MODIFIED was never set, the dirtiness information is lost +completely. Subsequently, when memory pressure triggers page reclaim, +page_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty() +returns false) and the page may be freed without writeback, causing data +corruption. + +Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in +both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits: + + if (pte_val(pte) & _PAGE_DIRTY) + pte_val(pte) |= _PAGE_MODIFIED; + +The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case, +where pmd entries need the same treatment. + +This ensures the software dirty tracking bit (checked by pte_dirty() and +pmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is +preserved across fork COW write-protection. + +The issue was found by the LTP madvise09 test case, which exercises page +reclaim after "madvise(MADV_FREE), write and fork" operation sequence on +private anonymous mappings. + +Cc: stable@vger.kernel.org +Fixes: 09cfefb7fa70 ("LoongArch: Add memory management") +Co-developed-by: Tianyang Zhang +Signed-off-by: Tianyang Zhang +Signed-off-by: Hongchen Zhang +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/include/asm/pgtable.h | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/loongarch/include/asm/pgtable.h ++++ b/arch/loongarch/include/asm/pgtable.h +@@ -390,6 +390,8 @@ static inline pte_t pte_mkwrite_novma(pt + + static inline pte_t pte_wrprotect(pte_t pte) + { ++ if (pte_val(pte) & _PAGE_DIRTY) ++ pte_val(pte) |= _PAGE_MODIFIED; + pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY); + return pte; + } +@@ -505,6 +507,8 @@ static inline pmd_t pmd_mkwrite_novma(pm + + static inline pmd_t pmd_wrprotect(pmd_t pmd) + { ++ if (pmd_val(pmd) & _PAGE_DIRTY) ++ pmd_val(pmd) |= _PAGE_MODIFIED; + pmd_val(pmd) &= ~(_PAGE_WRITE | _PAGE_DIRTY); + return pmd; + } diff --git a/queue-6.12/rtc-mpfs-fix-counter-upload-completion-condition.patch b/queue-6.12/rtc-mpfs-fix-counter-upload-completion-condition.patch new file mode 100644 index 0000000000..489b8865dd --- /dev/null +++ b/queue-6.12/rtc-mpfs-fix-counter-upload-completion-condition.patch @@ -0,0 +1,45 @@ +From 9792ff8afa9017fe14f436f3ef3cd75f41f9f145 Mon Sep 17 00:00:00 2001 +From: Conor Dooley +Date: Wed, 13 May 2026 18:55:55 +0100 +Subject: rtc: mpfs: fix counter upload completion condition + +From: Conor Dooley + +commit 9792ff8afa9017fe14f436f3ef3cd75f41f9f145 upstream. + +The condition that needs to be checked for upload completion is the +UPLOAD bit in the completion register going low. The original iterations +of this driver used a do-while and this was converted to a +read_poll_timeout() during upstreaming without the condition being +inverted as it should have been. + +I suspect that this went unnoticed until now because a) the first read +was done when the bit was still set, immediately completing the +read_poll_timeout() and b) because the RTC doesn't hold time when power +is removed from the SoC reducing its utility (I for one keep it +disabled). If my first suspicion was true when the driver was +upstreamed, it's not true any longer though, hence the detection of the +problem. + +Fixes: 0b31d703598dc ("rtc: Add driver for Microchip PolarFire SoC") +CC: stable@vger.kernel.org +Signed-off-by: Conor Dooley +Tested-by: Valentina Fernandez +Link: https://patch.msgid.link/20260513-panhandle-ashy-70c6abf84d59@spud +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-mpfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/rtc/rtc-mpfs.c ++++ b/drivers/rtc/rtc-mpfs.c +@@ -112,7 +112,7 @@ static int mpfs_rtc_settime(struct devic + ctrl |= CONTROL_UPLOAD_BIT; + writel(ctrl, rtcdev->base + CONTROL_REG); + +- ret = read_poll_timeout(readl, prog, prog & CONTROL_UPLOAD_BIT, 0, UPLOAD_TIMEOUT_US, ++ ret = read_poll_timeout(readl, prog, !(prog & CONTROL_UPLOAD_BIT), 0, UPLOAD_TIMEOUT_US, + false, rtcdev->base + CONTROL_REG); + if (ret) { + dev_err(dev, "timed out uploading time to rtc"); diff --git a/queue-6.12/series b/queue-6.12/series index 182053c18b..e0553b59d0 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1066,3 +1066,7 @@ batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch batman-adv-ensure-minimal-ethernet-header-on-tx.patch rust-block-allow-deprecated-for-fetch_update-for-rus.patch batman-adv-clean-untagged-vlan-on-netdev-registratio.patch +loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch +espintcp-use-sk_msg_free_partial-to-fix-partial-send.patch +bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch +rtc-mpfs-fix-counter-upload-completion-condition.patch