From: Greg Kroah-Hartman Date: Tue, 8 Apr 2025 07:06:59 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v5.4.292~59 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3fc9207cb09dc90e3ba5826f1feb9b7c603cdf6a;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: ntb_perf-delete-duplicate-dmaengine_unmap_put-call-in-perf_copy_chunk.patch platform-x86-isst-correct-command-storage-data-length.patch usbnet-fix-npe-during-rx_complete.patch --- diff --git a/queue-5.15/ntb_perf-delete-duplicate-dmaengine_unmap_put-call-in-perf_copy_chunk.patch b/queue-5.15/ntb_perf-delete-duplicate-dmaengine_unmap_put-call-in-perf_copy_chunk.patch new file mode 100644 index 0000000000..f664c695e9 --- /dev/null +++ b/queue-5.15/ntb_perf-delete-duplicate-dmaengine_unmap_put-call-in-perf_copy_chunk.patch @@ -0,0 +1,41 @@ +From 4279e72cab31dd3eb8c89591eb9d2affa90ab6aa Mon Sep 17 00:00:00 2001 +From: Markus Elfring +Date: Mon, 23 Sep 2024 10:38:11 +0200 +Subject: ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Markus Elfring + +commit 4279e72cab31dd3eb8c89591eb9d2affa90ab6aa upstream. + +The function call “dmaengine_unmap_put(unmap)” was used in an if branch. +The same call was immediately triggered by a subsequent goto statement. +Thus avoid such a call repetition. + +This issue was detected by using the Coccinelle software. + +Fixes: 5648e56d03fa ("NTB: ntb_perf: Add full multi-port NTB API support") +Cc: stable@vger.kernel.org +Signed-off-by: Markus Elfring +Signed-off-by: Jon Mason +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ntb/test/ntb_perf.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/ntb/test/ntb_perf.c ++++ b/drivers/ntb/test/ntb_perf.c +@@ -839,10 +839,8 @@ static int perf_copy_chunk(struct perf_t + dma_set_unmap(tx, unmap); + + ret = dma_submit_error(dmaengine_submit(tx)); +- if (ret) { +- dmaengine_unmap_put(unmap); ++ if (ret) + goto err_free_resource; +- } + + dmaengine_unmap_put(unmap); + diff --git a/queue-5.15/platform-x86-isst-correct-command-storage-data-length.patch b/queue-5.15/platform-x86-isst-correct-command-storage-data-length.patch new file mode 100644 index 0000000000..64c0a6cf49 --- /dev/null +++ b/queue-5.15/platform-x86-isst-correct-command-storage-data-length.patch @@ -0,0 +1,45 @@ +From 9462e74c5c983cce34019bfb27f734552bebe59f Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada +Date: Fri, 28 Mar 2025 15:47:49 -0700 +Subject: platform/x86: ISST: Correct command storage data length +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivas Pandruvada + +commit 9462e74c5c983cce34019bfb27f734552bebe59f upstream. + +After resume/online turbo limit ratio (TRL) is restored partially if +the admin explicitly changed TRL from user space. + +A hash table is used to store SST mail box and MSR settings when modified +to restore those settings after resume or online. This uses a struct +isst_cmd field "data" to store these settings. This is a 64 bit field. +But isst_store_new_cmd() is only assigning as u32. This results in +truncation of 32 bits. + +Change the argument to u64 from u32. + +Fixes: f607874f35cb ("platform/x86: ISST: Restore state on resume") +Signed-off-by: Srinivas Pandruvada +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250328224749.2691272-1-srinivas.pandruvada@linux.intel.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c ++++ b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c +@@ -77,7 +77,7 @@ static DECLARE_HASHTABLE(isst_hash, 8); + static DEFINE_MUTEX(isst_hash_lock); + + static int isst_store_new_cmd(int cmd, u32 cpu, int mbox_cmd_type, u32 param, +- u32 data) ++ u64 data) + { + struct isst_cmd *sst_cmd; + diff --git a/queue-5.15/series b/queue-5.15/series index 72e0c90261..94a4d28246 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -256,3 +256,6 @@ tty-serial-fsl_lpuart-use-uartmodir-register-bits-fo.patch tty-serial-fsl_lpuart-disable-transmitter-before-cha.patch drm-amd-pm-fix-negative-array-index-read.patch drm-amd-display-skip-inactive-planes-within-modesupportandsystemconfiguration.patch +usbnet-fix-npe-during-rx_complete.patch +platform-x86-isst-correct-command-storage-data-length.patch +ntb_perf-delete-duplicate-dmaengine_unmap_put-call-in-perf_copy_chunk.patch diff --git a/queue-5.15/usbnet-fix-npe-during-rx_complete.patch b/queue-5.15/usbnet-fix-npe-during-rx_complete.patch new file mode 100644 index 0000000000..d805cd9aa3 --- /dev/null +++ b/queue-5.15/usbnet-fix-npe-during-rx_complete.patch @@ -0,0 +1,57 @@ +From 51de3600093429e3b712e5f091d767babc5dd6df Mon Sep 17 00:00:00 2001 +From: Ying Lu +Date: Wed, 2 Apr 2025 16:58:59 +0800 +Subject: usbnet:fix NPE during rx_complete +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ying Lu + +commit 51de3600093429e3b712e5f091d767babc5dd6df upstream. + +Missing usbnet_going_away Check in Critical Path. +The usb_submit_urb function lacks a usbnet_going_away +validation, whereas __usbnet_queue_skb includes this check. + +This inconsistency creates a race condition where: +A URB request may succeed, but the corresponding SKB data +fails to be queued. + +Subsequent processes: +(e.g., rx_complete → defer_bh → __skb_unlink(skb, list)) +attempt to access skb->next, triggering a NULL pointer +dereference (Kernel Panic). + +Fixes: 04e906839a05 ("usbnet: fix cyclical race on disconnect with work queue") +Cc: stable@vger.kernel.org +Signed-off-by: Ying Lu +Link: https://patch.msgid.link/4c9ef2efaa07eb7f9a5042b74348a67e5a3a7aea.1743584159.git.luying1@xiaomi.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/usbnet.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -533,7 +533,8 @@ static int rx_submit (struct usbnet *dev + netif_device_present (dev->net) && + test_bit(EVENT_DEV_OPEN, &dev->flags) && + !test_bit (EVENT_RX_HALT, &dev->flags) && +- !test_bit (EVENT_DEV_ASLEEP, &dev->flags)) { ++ !test_bit (EVENT_DEV_ASLEEP, &dev->flags) && ++ !usbnet_going_away(dev)) { + switch (retval = usb_submit_urb (urb, GFP_ATOMIC)) { + case -EPIPE: + usbnet_defer_kevent (dev, EVENT_RX_HALT); +@@ -554,8 +555,7 @@ static int rx_submit (struct usbnet *dev + tasklet_schedule (&dev->bh); + break; + case 0: +- if (!usbnet_going_away(dev)) +- __usbnet_queue_skb(&dev->rxq, skb, rx_start); ++ __usbnet_queue_skb(&dev->rxq, skb, rx_start); + } + } else { + netif_dbg(dev, ifdown, dev->net, "rx: stopped\n");