From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 08:50:20 +0000 (+0200) Subject: 6.1-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eff8d2606f0248269ff17b5fe933ff542b85f944;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch rtc-mpfs-fix-counter-upload-completion-condition.patch --- diff --git a/queue-6.1/bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch b/queue-6.1/bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch new file mode 100644 index 0000000000..8778c3c419 --- /dev/null +++ b/queue-6.1/bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch @@ -0,0 +1,43 @@ +From a986fde914d88af47eb78fd29c5d1af7952c3500 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Sat, 20 Jun 2026 11:53:50 +0530 +Subject: bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() + +From: Abdun Nihaal + +commit a986fde914d88af47eb78fd29c5d1af7952c3500 upstream. + +If the allocation of fp[i].tpa_info fails, the error path will not free +the struct bnx2x_fastpath allocated earlier, as it is not linked to the +bp structure yet. Fix that by linking it immediately after allocation. + +Cc: stable@vger.kernel.org +Fixes: 15192a8cf8a8 ("bnx2x: Split the FP structure") +Signed-off-by: Abdun Nihaal +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260620062402.89549-1-nihaal@cse.iitm.ac.in +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -4735,6 +4735,7 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp) + fp = kcalloc(bp->fp_array_size, sizeof(*fp), GFP_KERNEL); + if (!fp) + goto alloc_err; ++ bp->fp = fp; + for (i = 0; i < bp->fp_array_size; i++) { + fp[i].tpa_info = + kcalloc(ETH_MAX_AGGREGATION_QUEUES_E1H_E2, +@@ -4743,8 +4744,6 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp) + goto alloc_err; + } + +- bp->fp = fp; +- + /* allocate sp objs */ + bp->sp_objs = kcalloc(bp->fp_array_size, sizeof(struct bnx2x_sp_objs), + GFP_KERNEL); diff --git a/queue-6.1/loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch b/queue-6.1/loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch new file mode 100644 index 0000000000..ab1118db95 --- /dev/null +++ b/queue-6.1/loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch @@ -0,0 +1,82 @@ +From 018e9828eb523c638fa3d9bdf0fd4956b74555b2 Mon Sep 17 00:00:00 2001 +From: Hongchen Zhang +Date: Thu, 25 Jun 2026 13:03:49 +0800 +Subject: LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() + +From: Hongchen Zhang + +commit 018e9828eb523c638fa3d9bdf0fd4956b74555b2 upstream. + +When hardware page table walker (PTW) is enabled on LoongArch, the CPU +may set _PAGE_DIRTY directly in the page table entry during a write TLB +miss, without going through the software TLB store handler. The software +TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED +together: + + ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED) + +Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e. +_PAGE_MODIFIED is left unchanged. This creates a window where a PTE has +_PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED +clear (software is unaware). + +When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls +pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and +_PAGE_DIRTY bits: + + pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY); + +Since _PAGE_MODIFIED was never set, the dirtiness information is lost +completely. Subsequently, when memory pressure triggers page reclaim, +page_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty() +returns false) and the page may be freed without writeback, causing data +corruption. + +Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in +both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits: + + if (pte_val(pte) & _PAGE_DIRTY) + pte_val(pte) |= _PAGE_MODIFIED; + +The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case, +where pmd entries need the same treatment. + +This ensures the software dirty tracking bit (checked by pte_dirty() and +pmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is +preserved across fork COW write-protection. + +The issue was found by the LTP madvise09 test case, which exercises page +reclaim after "madvise(MADV_FREE), write and fork" operation sequence on +private anonymous mappings. + +Cc: stable@vger.kernel.org +Fixes: 09cfefb7fa70 ("LoongArch: Add memory management") +Co-developed-by: Tianyang Zhang +Signed-off-by: Tianyang Zhang +Signed-off-by: Hongchen Zhang +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/include/asm/pgtable.h | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/loongarch/include/asm/pgtable.h ++++ b/arch/loongarch/include/asm/pgtable.h +@@ -365,6 +365,8 @@ static inline pte_t pte_mkwrite(pte_t pt + + static inline pte_t pte_wrprotect(pte_t pte) + { ++ if (pte_val(pte) & _PAGE_DIRTY) ++ pte_val(pte) |= _PAGE_MODIFIED; + pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY); + return pte; + } +@@ -468,6 +470,8 @@ static inline pmd_t pmd_mkwrite(pmd_t pm + + static inline pmd_t pmd_wrprotect(pmd_t pmd) + { ++ if (pmd_val(pmd) & _PAGE_DIRTY) ++ pmd_val(pmd) |= _PAGE_MODIFIED; + pmd_val(pmd) &= ~(_PAGE_WRITE | _PAGE_DIRTY); + return pmd; + } diff --git a/queue-6.1/rtc-mpfs-fix-counter-upload-completion-condition.patch b/queue-6.1/rtc-mpfs-fix-counter-upload-completion-condition.patch new file mode 100644 index 0000000000..489b8865dd --- /dev/null +++ b/queue-6.1/rtc-mpfs-fix-counter-upload-completion-condition.patch @@ -0,0 +1,45 @@ +From 9792ff8afa9017fe14f436f3ef3cd75f41f9f145 Mon Sep 17 00:00:00 2001 +From: Conor Dooley +Date: Wed, 13 May 2026 18:55:55 +0100 +Subject: rtc: mpfs: fix counter upload completion condition + +From: Conor Dooley + +commit 9792ff8afa9017fe14f436f3ef3cd75f41f9f145 upstream. + +The condition that needs to be checked for upload completion is the +UPLOAD bit in the completion register going low. The original iterations +of this driver used a do-while and this was converted to a +read_poll_timeout() during upstreaming without the condition being +inverted as it should have been. + +I suspect that this went unnoticed until now because a) the first read +was done when the bit was still set, immediately completing the +read_poll_timeout() and b) because the RTC doesn't hold time when power +is removed from the SoC reducing its utility (I for one keep it +disabled). If my first suspicion was true when the driver was +upstreamed, it's not true any longer though, hence the detection of the +problem. + +Fixes: 0b31d703598dc ("rtc: Add driver for Microchip PolarFire SoC") +CC: stable@vger.kernel.org +Signed-off-by: Conor Dooley +Tested-by: Valentina Fernandez +Link: https://patch.msgid.link/20260513-panhandle-ashy-70c6abf84d59@spud +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-mpfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/rtc/rtc-mpfs.c ++++ b/drivers/rtc/rtc-mpfs.c +@@ -112,7 +112,7 @@ static int mpfs_rtc_settime(struct devic + ctrl |= CONTROL_UPLOAD_BIT; + writel(ctrl, rtcdev->base + CONTROL_REG); + +- ret = read_poll_timeout(readl, prog, prog & CONTROL_UPLOAD_BIT, 0, UPLOAD_TIMEOUT_US, ++ ret = read_poll_timeout(readl, prog, !(prog & CONTROL_UPLOAD_BIT), 0, UPLOAD_TIMEOUT_US, + false, rtcdev->base + CONTROL_REG); + if (ret) { + dev_err(dev, "timed out uploading time to rtc"); diff --git a/queue-6.1/series b/queue-6.1/series index 314487b1d4..91219a9a40 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -890,3 +890,6 @@ mm-damon-reclaim-fix-typo-in-damon_reclaim_timer_fn.patch batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch batman-adv-ensure-minimal-ethernet-header-on-tx.patch batman-adv-clean-untagged-vlan-on-netdev-registratio.patch +loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch +bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch +rtc-mpfs-fix-counter-upload-completion-condition.patch