5.15-stable patches

added patches:
	ntb_perf-delete-duplicate-dmaengine_unmap_put-call-in-perf_copy_chunk.patch
	platform-x86-isst-correct-command-storage-data-length.patch
	usbnet-fix-npe-during-rx_complete.patch

diff --git a/queue-5.15/ntb_perf-delete-duplicate-dmaengine_unmap_put-call-in-perf_copy_chunk.patch b/queue-5.15/ntb_perf-delete-duplicate-dmaengine_unmap_put-call-in-perf_copy_chunk.patch
new file mode 100644 (file)
index 0000000..f664c69
--- /dev/null
+++ b/queue-5.15/ntb_perf-delete-duplicate-dmaengine_unmap_put-call-in-perf_copy_chunk.patch
@@ -0,0 +1,41 @@
+From 4279e72cab31dd3eb8c89591eb9d2affa90ab6aa Mon Sep 17 00:00:00 2001
+From: Markus Elfring <elfring@users.sourceforge.net>
+Date: Mon, 23 Sep 2024 10:38:11 +0200
+Subject: ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Elfring <elfring@users.sourceforge.net>
+
+commit 4279e72cab31dd3eb8c89591eb9d2affa90ab6aa upstream.
+
+The function call “dmaengine_unmap_put(unmap)” was used in an if branch.
+The same call was immediately triggered by a subsequent goto statement.
+Thus avoid such a call repetition.
+
+This issue was detected by using the Coccinelle software.
+
+Fixes: 5648e56d03fa ("NTB: ntb_perf: Add full multi-port NTB API support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ntb/test/ntb_perf.c |    4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/ntb/test/ntb_perf.c
++++ b/drivers/ntb/test/ntb_perf.c
+@@ -839,10 +839,8 @@ static int perf_copy_chunk(struct perf_t
+       dma_set_unmap(tx, unmap);
+ 
+       ret = dma_submit_error(dmaengine_submit(tx));
+-      if (ret) {
+-              dmaengine_unmap_put(unmap);
++      if (ret)
+               goto err_free_resource;
+-      }
+ 
+       dmaengine_unmap_put(unmap);
+ 

diff --git a/queue-5.15/platform-x86-isst-correct-command-storage-data-length.patch b/queue-5.15/platform-x86-isst-correct-command-storage-data-length.patch
new file mode 100644 (file)
index 0000000..64c0a6c
--- /dev/null
+++ b/queue-5.15/platform-x86-isst-correct-command-storage-data-length.patch
@@ -0,0 +1,45 @@
+From 9462e74c5c983cce34019bfb27f734552bebe59f Mon Sep 17 00:00:00 2001
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Date: Fri, 28 Mar 2025 15:47:49 -0700
+Subject: platform/x86: ISST: Correct command storage data length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+commit 9462e74c5c983cce34019bfb27f734552bebe59f upstream.
+
+After resume/online turbo limit ratio (TRL) is restored partially if
+the admin explicitly changed TRL from user space.
+
+A hash table is used to store SST mail box and MSR settings when modified
+to restore those settings after resume or online. This uses a struct
+isst_cmd field "data" to store these settings. This is a 64 bit field.
+But isst_store_new_cmd() is only assigning as u32. This results in
+truncation of 32 bits.
+
+Change the argument to u64 from u32.
+
+Fixes: f607874f35cb ("platform/x86: ISST: Restore state on resume")
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20250328224749.2691272-1-srinivas.pandruvada@linux.intel.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/intel/speed_select_if/isst_if_common.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
++++ b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
+@@ -77,7 +77,7 @@ static DECLARE_HASHTABLE(isst_hash, 8);
+ static DEFINE_MUTEX(isst_hash_lock);
+ 
+ static int isst_store_new_cmd(int cmd, u32 cpu, int mbox_cmd_type, u32 param,
+-                            u32 data)
++                            u64 data)
+ {
+       struct isst_cmd *sst_cmd;
+ 

diff --git a/queue-5.15/series b/queue-5.15/series
index 72e0c902614bc4e5e4f4d2182e5bd2d8ea321ef6..94a4d282469f60fc7ed0bc923beb0c6afe65c7d0 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -256,3 +256,6 @@ tty-serial-fsl_lpuart-use-uartmodir-register-bits-fo.patch
 tty-serial-fsl_lpuart-disable-transmitter-before-cha.patch
 drm-amd-pm-fix-negative-array-index-read.patch
 drm-amd-display-skip-inactive-planes-within-modesupportandsystemconfiguration.patch
+usbnet-fix-npe-during-rx_complete.patch
+platform-x86-isst-correct-command-storage-data-length.patch
+ntb_perf-delete-duplicate-dmaengine_unmap_put-call-in-perf_copy_chunk.patch

diff --git a/queue-5.15/usbnet-fix-npe-during-rx_complete.patch b/queue-5.15/usbnet-fix-npe-during-rx_complete.patch
new file mode 100644 (file)
index 0000000..d805cd9
--- /dev/null
+++ b/queue-5.15/usbnet-fix-npe-during-rx_complete.patch
@@ -0,0 +1,57 @@
+From 51de3600093429e3b712e5f091d767babc5dd6df Mon Sep 17 00:00:00 2001
+From: Ying Lu <luying1@xiaomi.com>
+Date: Wed, 2 Apr 2025 16:58:59 +0800
+Subject: usbnet:fix NPE during rx_complete
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ying Lu <luying1@xiaomi.com>
+
+commit 51de3600093429e3b712e5f091d767babc5dd6df upstream.
+
+Missing usbnet_going_away Check in Critical Path.
+The usb_submit_urb function lacks a usbnet_going_away
+validation, whereas __usbnet_queue_skb includes this check.
+
+This inconsistency creates a race condition where:
+A URB request may succeed, but the corresponding SKB data
+fails to be queued.
+
+Subsequent processes:
+(e.g., rx_complete → defer_bh → __skb_unlink(skb, list))
+attempt to access skb->next, triggering a NULL pointer
+dereference (Kernel Panic).
+
+Fixes: 04e906839a05 ("usbnet: fix cyclical race on disconnect with work queue")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ying Lu <luying1@xiaomi.com>
+Link: https://patch.msgid.link/4c9ef2efaa07eb7f9a5042b74348a67e5a3a7aea.1743584159.git.luying1@xiaomi.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/usbnet.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -533,7 +533,8 @@ static int rx_submit (struct usbnet *dev
+           netif_device_present (dev->net) &&
+           test_bit(EVENT_DEV_OPEN, &dev->flags) &&
+           !test_bit (EVENT_RX_HALT, &dev->flags) &&
+-          !test_bit (EVENT_DEV_ASLEEP, &dev->flags)) {
++          !test_bit (EVENT_DEV_ASLEEP, &dev->flags) &&
++          !usbnet_going_away(dev)) {
+               switch (retval = usb_submit_urb (urb, GFP_ATOMIC)) {
+               case -EPIPE:
+                       usbnet_defer_kevent (dev, EVENT_RX_HALT);
+@@ -554,8 +555,7 @@ static int rx_submit (struct usbnet *dev
+                       tasklet_schedule (&dev->bh);
+                       break;
+               case 0:
+-                      if (!usbnet_going_away(dev))
+-                              __usbnet_queue_skb(&dev->rxq, skb, rx_start);
++                      __usbnet_queue_skb(&dev->rxq, skb, rx_start);
+               }
+       } else {
+               netif_dbg(dev, ifdown, dev->net, "rx: stopped\n");