From: Greg Kroah-Hartman Date: Thu, 30 Jul 2026 13:28:26 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v6.6.148~25 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6441b3d2f6c257d905654dbea98d65274316ff22;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: gpu-fix-uninitialized-buddy-for-built-in-drivers.patch net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch net-stmmac-fix-dwmac4-transmit-performance-regression.patch --- diff --git a/queue-6.18/gpu-fix-uninitialized-buddy-for-built-in-drivers.patch b/queue-6.18/gpu-fix-uninitialized-buddy-for-built-in-drivers.patch new file mode 100644 index 0000000000..0a80ad6f4f --- /dev/null +++ b/queue-6.18/gpu-fix-uninitialized-buddy-for-built-in-drivers.patch @@ -0,0 +1,44 @@ +From cc27314c67516c138ee3829197d1c3b998e29fae Mon Sep 17 00:00:00 2001 +From: Koen Koning +Date: Fri, 13 Feb 2026 16:20:47 +0100 +Subject: gpu: Fix uninitialized buddy for built-in drivers + +From: Koen Koning + +commit cc27314c67516c138ee3829197d1c3b998e29fae upstream. + +Move buddy to the start of the link order, so its __init runs before any +other built-in drivers that may depend on it. Otherwise, a built-in +driver that tries to use the buddy allocator will run into a kernel NULL +pointer dereference because slab_blocks is uninitialized. + +Specifically, this fixes drm/xe (as built-in) running into a kernel +panic during boot, because it uses buddy during device probe. + +Fixes: ba110db8e1bc ("gpu: Move DRM buddy allocator one level up (part two)") +Cc: Joel Fernandes +Cc: Dave Airlie +Cc: intel-xe@lists.freedesktop.org +Reviewed-by: Dave Airlie +Tested-by: Peter Senna Tschudin +Signed-off-by: Koen Koning +Signed-off-by: Dave Airlie +Link: https://patch.msgid.link/20260213152047.179628-1-koen.koning@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/Makefile ++++ b/drivers/gpu/Makefile +@@ -2,8 +2,9 @@ + # drm/tegra depends on host1x, so if both drivers are built-in care must be + # taken to initialize them in the correct order. Link order is the only way + # to ensure this currently. ++# Similarly, buddy must come first since it is used by other drivers. ++obj-$(CONFIG_GPU_BUDDY) += buddy.o + obj-y += host1x/ drm/ vga/ tests/ + obj-$(CONFIG_IMX_IPUV3_CORE) += ipu-v3/ + obj-$(CONFIG_TRACE_GPU_MEM) += trace/ + obj-$(CONFIG_NOVA_CORE) += nova-core/ +-obj-$(CONFIG_GPU_BUDDY) += buddy.o diff --git a/queue-6.18/net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch b/queue-6.18/net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch new file mode 100644 index 0000000000..f7e97fd497 --- /dev/null +++ b/queue-6.18/net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch @@ -0,0 +1,45 @@ +From 7d36a4a8bf62dc508bc6bb4b59727aec25064ca5 Mon Sep 17 00:00:00 2001 +From: Gal Pressman +Date: Thu, 25 Dec 2025 15:27:15 +0200 +Subject: net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query + +From: Gal Pressman + +commit 7d36a4a8bf62dc508bc6bb4b59727aec25064ca5 upstream. + +The mlx5_query_mcia() function unconditionally dereferences the status +pointer to store the MCIA register status value. +However, mlx5e_get_module_id() passes NULL since it doesn't need the +status value. + +Add a NULL check before dereferencing the status pointer to prevent a +NULL pointer dereference. + +Fixes: 2e4c44b12f4d ("net/mlx5: Refactor EEPROM query error handling to return status separately") +Signed-off-by: Gal Pressman +Reviewed-by: Tariq Toukan +Reviewed-by: Dragos Tatulea +Signed-off-by: Mark Bloch +Link: https://patch.msgid.link/20251225132717.358820-4-mbloch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/port.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c +@@ -393,9 +393,11 @@ static int mlx5_query_mcia(struct mlx5_c + if (err) + return err; + +- *status = MLX5_GET(mcia_reg, out, status); +- if (*status) ++ if (MLX5_GET(mcia_reg, out, status)) { ++ if (status) ++ *status = MLX5_GET(mcia_reg, out, status); + return -EIO; ++ } + + ptr = MLX5_ADDR_OF(mcia_reg, out, dwords); + memcpy(data, ptr, size); diff --git a/queue-6.18/net-stmmac-fix-dwmac4-transmit-performance-regression.patch b/queue-6.18/net-stmmac-fix-dwmac4-transmit-performance-regression.patch new file mode 100644 index 0000000000..16ad742554 --- /dev/null +++ b/queue-6.18/net-stmmac-fix-dwmac4-transmit-performance-regression.patch @@ -0,0 +1,135 @@ +From 5ccde4c81e843ab6b3a324c8e2aa96d9b1270a1a Mon Sep 17 00:00:00 2001 +From: "Russell King (Oracle)" +Date: Fri, 16 Jan 2026 00:49:24 +0000 +Subject: net: stmmac: fix dwmac4 transmit performance regression + +From: Russell King (Oracle) + +commit 5ccde4c81e843ab6b3a324c8e2aa96d9b1270a1a upstream. + +dwmac4's transmit performance dropped by a factor of four due to an +incorrect assumption about which definitions are for what. This +highlights the need for sane register macros. + +Commit 8409495bf6c9 ("net: stmmac: cores: remove many xxx_SHIFT +definitions") changed the way the txpbl value is merged into the +register: + + value = readl(ioaddr + DMA_CHAN_TX_CONTROL(dwmac4_addrs, chan)); +- value = value | (txpbl << DMA_BUS_MODE_PBL_SHIFT); ++ value = value | FIELD_PREP(DMA_BUS_MODE_PBL, txpbl); + +With the following in the header file: + + #define DMA_BUS_MODE_PBL BIT(16) +-#define DMA_BUS_MODE_PBL_SHIFT 16 + +The assumption here was that DMA_BUS_MODE_PBL was the mask for +DMA_BUS_MODE_PBL_SHIFT, but this turns out not to be the case. + +The field is actually six bits wide, buts 21:16, and is called +TXPBL. + +What's even more confusing is, there turns out to be a PBLX8 +single bit in the DMA_CHAN_CONTROL register (0x1100 for channel 0), +and DMA_BUS_MODE_PBL seems to be used for that. However, this bit +et.al. was listed under a comment "/* DMA SYS Bus Mode bitmap */" +which is for register 0x1004. + +Fix this up by adding an appropriately named field definition under +the DMA_CHAN_TX_CONTROL() register address definition. + +Move the RPBL mask definition under DMA_CHAN_RX_CONTROL(), correctly +renaming it as well. + +Also move the PBL bit definition under DMA_CHAN_CONTROL(), correctly +renaming it. + +This removes confusion over the PBL fields. + +Fixes: 8409495bf6c9 ("net: stmmac: cores: remove many xxx_SHIFT definitions") +Signed-off-by: Russell King (Oracle) +Bisected-by: Maxime Chevallier +Link: https://lore.kernel.org/51859704-57fd-4913-b09d-9ac58a57f185@bootlin.com +Tested-by: Maxime Chevallier +Reviewed-by: Maxime Chevallier +Link: https://patch.msgid.link/E1vgY1k-00000003vOC-0Z1H@rmk-PC.armlinux.org.uk +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c | 8 ++++---- + drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h | 7 ++++--- + 2 files changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c +@@ -76,7 +76,7 @@ static void dwmac4_dma_init_rx_chan(stru + u32 rxpbl = dma_cfg->rxpbl ?: dma_cfg->pbl; + + value = readl(ioaddr + DMA_CHAN_RX_CONTROL(dwmac4_addrs, chan)); +- value = value | FIELD_PREP(DMA_BUS_MODE_RPBL_MASK, rxpbl); ++ value = value | FIELD_PREP(DMA_CHAN_RX_CTRL_RXPBL_MASK, rxpbl); + writel(value, ioaddr + DMA_CHAN_RX_CONTROL(dwmac4_addrs, chan)); + + if (IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT) && likely(dma_cfg->eame)) +@@ -97,7 +97,7 @@ static void dwmac4_dma_init_tx_chan(stru + u32 txpbl = dma_cfg->txpbl ?: dma_cfg->pbl; + + value = readl(ioaddr + DMA_CHAN_TX_CONTROL(dwmac4_addrs, chan)); +- value = value | FIELD_PREP(DMA_BUS_MODE_PBL, txpbl); ++ value = value | FIELD_PREP(DMA_CHAN_TX_CTRL_TXPBL_MASK, txpbl); + + /* Enable OSP to get best performance */ + value |= DMA_CONTROL_OSP; +@@ -122,7 +122,7 @@ static void dwmac4_dma_init_channel(stru + /* common channel control register config */ + value = readl(ioaddr + DMA_CHAN_CONTROL(dwmac4_addrs, chan)); + if (dma_cfg->pblx8) +- value = value | DMA_BUS_MODE_PBL; ++ value = value | DMA_CHAN_CTRL_PBLX8; + writel(value, ioaddr + DMA_CHAN_CONTROL(dwmac4_addrs, chan)); + + /* Mask interrupts by writing to CSR7 */ +@@ -140,7 +140,7 @@ static void dwmac410_dma_init_channel(st + /* common channel control register config */ + value = readl(ioaddr + DMA_CHAN_CONTROL(dwmac4_addrs, chan)); + if (dma_cfg->pblx8) +- value = value | DMA_BUS_MODE_PBL; ++ value = value | DMA_CHAN_CTRL_PBLX8; + + writel(value, ioaddr + DMA_CHAN_CONTROL(dwmac4_addrs, chan)); + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h +@@ -32,8 +32,6 @@ + + /* DMA SYS Bus Mode bitmap */ + #define DMA_BUS_MODE_SPH BIT(24) +-#define DMA_BUS_MODE_PBL BIT(16) +-#define DMA_BUS_MODE_RPBL_MASK GENMASK(21, 16) + #define DMA_BUS_MODE_MB BIT(14) + #define DMA_BUS_MODE_FB BIT(0) + +@@ -126,18 +124,21 @@ static inline u32 dma_chanx_base_addr(co + #define DMA_CHAN_STATUS(addrs, x) (dma_chanx_base_addr(addrs, x) + 0x60) + + /* DMA Control X */ ++#define DMA_CHAN_CTRL_PBLX8 BIT(16) + #define DMA_CONTROL_SPH BIT(24) + #define DMA_CONTROL_MSS_MASK GENMASK(13, 0) + + /* DMA Tx Channel X Control register defines */ + #define DMA_CONTROL_EDSE BIT(28) ++#define DMA_CHAN_TX_CTRL_TXPBL_MASK GENMASK(21, 16) + #define DMA_CONTROL_TSE BIT(12) + #define DMA_CONTROL_OSP BIT(4) + #define DMA_CONTROL_ST BIT(0) + + /* DMA Rx Channel X Control register defines */ +-#define DMA_CONTROL_SR BIT(0) ++#define DMA_CHAN_RX_CTRL_RXPBL_MASK GENMASK(21, 16) + #define DMA_RBSZ_MASK GENMASK(14, 1) ++#define DMA_CONTROL_SR BIT(0) + + /* Interrupt status per channel */ + #define DMA_CHAN_STATUS_REB GENMASK(21, 19) diff --git a/queue-6.18/series b/queue-6.18/series index 997f528a4f..5354733d18 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -669,3 +669,6 @@ mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch rust-allow-suspicious_runtime_symbol_definitions-lint-for-rust-1.98.patch rust-device-avoid-trailing-in-printing-macros.patch usb-gadget-f_tcm-synchronize-delayed-set_alt-with-teardown.patch +net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch +net-stmmac-fix-dwmac4-transmit-performance-regression.patch +gpu-fix-uninitialized-buddy-for-built-in-drivers.patch