From: Greg Kroah-Hartman Date: Tue, 12 Aug 2025 15:23:17 +0000 (+0200) Subject: 6.16-stable patches X-Git-Tag: v6.1.148~24 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c4ed9536fed0f3013487f260ee987ea6238d84a9;p=thirdparty%2Fkernel%2Fstable-queue.git 6.16-stable patches added patches: bluetooth-btusb-add-usb-id-3625-010b-for-tp-link-archer-tx10ub-nano.patch net-usbnet-avoid-potential-rcu-stall-on-link_change-event.patch net-usbnet-fix-the-wrong-netif_carrier_on-call.patch --- diff --git a/queue-6.16/bluetooth-btusb-add-usb-id-3625-010b-for-tp-link-archer-tx10ub-nano.patch b/queue-6.16/bluetooth-btusb-add-usb-id-3625-010b-for-tp-link-archer-tx10ub-nano.patch new file mode 100644 index 0000000000..7340aa8c91 --- /dev/null +++ b/queue-6.16/bluetooth-btusb-add-usb-id-3625-010b-for-tp-link-archer-tx10ub-nano.patch @@ -0,0 +1,79 @@ +From d9da920233ec85af8b9c87154f2721a7dc4623f5 Mon Sep 17 00:00:00 2001 +From: Zenm Chen +Date: Wed, 21 May 2025 09:30:20 +0800 +Subject: Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano + +From: Zenm Chen + +commit d9da920233ec85af8b9c87154f2721a7dc4623f5 upstream. + +Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano which is based on +a Realtek RTL8851BU chip. + +The information in /sys/kernel/debug/usb/devices about the Bluetooth +device is listed as the below: + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=3625 ProdID=010b Rev= 0.00 +S: Manufacturer=Realtek +S: Product=802.11ax WLAN Adapter +S: SerialNumber=00e04c000001 +C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtl8851bu +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org +Signed-off-by: Zenm Chen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -516,6 +516,10 @@ static const struct usb_device_id quirks + { USB_DEVICE(0x0bda, 0xb850), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3600), .driver_info = BTUSB_REALTEK }, + ++ /* Realtek 8851BU Bluetooth devices */ ++ { USB_DEVICE(0x3625, 0x010b), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, ++ + /* Realtek 8852AE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, diff --git a/queue-6.16/net-usbnet-avoid-potential-rcu-stall-on-link_change-event.patch b/queue-6.16/net-usbnet-avoid-potential-rcu-stall-on-link_change-event.patch new file mode 100644 index 0000000000..1f6b546c0a --- /dev/null +++ b/queue-6.16/net-usbnet-avoid-potential-rcu-stall-on-link_change-event.patch @@ -0,0 +1,120 @@ +From 0d9cfc9b8cb17dbc29a98792d36ec39a1cf1395f Mon Sep 17 00:00:00 2001 +From: John Ernberg +Date: Wed, 23 Jul 2025 10:25:35 +0000 +Subject: net: usbnet: Avoid potential RCU stall on LINK_CHANGE event + +From: John Ernberg + +commit 0d9cfc9b8cb17dbc29a98792d36ec39a1cf1395f upstream. + +The Gemalto Cinterion PLS83-W modem (cdc_ether) is emitting confusing link +up and down events when the WWAN interface is activated on the modem-side. + +Interrupt URBs will in consecutive polls grab: +* Link Connected +* Link Disconnected +* Link Connected + +Where the last Connected is then a stable link state. + +When the system is under load this may cause the unlink_urbs() work in +__handle_link_change() to not complete before the next usbnet_link_change() +call turns the carrier on again, allowing rx_submit() to queue new SKBs. + +In that event the URB queue is filled faster than it can drain, ending up +in a RCU stall: + + rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 0-.... } 33108 jiffies s: 201 root: 0x1/. + rcu: blocking rcu_node structures (internal RCU debug): + Sending NMI from CPU 1 to CPUs 0: + NMI backtrace for cpu 0 + + Call trace: + arch_local_irq_enable+0x4/0x8 + local_bh_enable+0x18/0x20 + __netdev_alloc_skb+0x18c/0x1cc + rx_submit+0x68/0x1f8 [usbnet] + rx_alloc_submit+0x4c/0x74 [usbnet] + usbnet_bh+0x1d8/0x218 [usbnet] + usbnet_bh_tasklet+0x10/0x18 [usbnet] + tasklet_action_common+0xa8/0x110 + tasklet_action+0x2c/0x34 + handle_softirqs+0x2cc/0x3a0 + __do_softirq+0x10/0x18 + ____do_softirq+0xc/0x14 + call_on_irq_stack+0x24/0x34 + do_softirq_own_stack+0x18/0x20 + __irq_exit_rcu+0xa8/0xb8 + irq_exit_rcu+0xc/0x30 + el1_interrupt+0x34/0x48 + el1h_64_irq_handler+0x14/0x1c + el1h_64_irq+0x68/0x6c + _raw_spin_unlock_irqrestore+0x38/0x48 + xhci_urb_dequeue+0x1ac/0x45c [xhci_hcd] + unlink1+0xd4/0xdc [usbcore] + usb_hcd_unlink_urb+0x70/0xb0 [usbcore] + usb_unlink_urb+0x24/0x44 [usbcore] + unlink_urbs.constprop.0.isra.0+0x64/0xa8 [usbnet] + __handle_link_change+0x34/0x70 [usbnet] + usbnet_deferred_kevent+0x1c0/0x320 [usbnet] + process_scheduled_works+0x2d0/0x48c + worker_thread+0x150/0x1dc + kthread+0xd8/0xe8 + ret_from_fork+0x10/0x20 + +Get around the problem by delaying the carrier on to the scheduled work. + +This needs a new flag to keep track of the necessary action. + +The carrier ok check cannot be removed as it remains required for the +LINK_RESET event flow. + +Fixes: 4b49f58fff00 ("usbnet: handle link change") +Cc: stable@vger.kernel.org +Signed-off-by: John Ernberg +Link: https://patch.msgid.link/20250723102526.1305339-1-john.ernberg@actia.se +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/usbnet.c | 11 ++++++++--- + include/linux/usb/usbnet.h | 1 + + 2 files changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1122,6 +1122,9 @@ static void __handle_link_change(struct + * tx queue is stopped by netcore after link becomes off + */ + } else { ++ if (test_and_clear_bit(EVENT_LINK_CARRIER_ON, &dev->flags)) ++ netif_carrier_on(dev->net); ++ + /* submitting URBs for reading packets */ + tasklet_schedule(&dev->bh); + } +@@ -2009,10 +2012,12 @@ EXPORT_SYMBOL(usbnet_manage_power); + void usbnet_link_change(struct usbnet *dev, bool link, bool need_reset) + { + /* update link after link is reseted */ +- if (link && !need_reset) +- netif_carrier_on(dev->net); +- else ++ if (link && !need_reset) { ++ set_bit(EVENT_LINK_CARRIER_ON, &dev->flags); ++ } else { ++ clear_bit(EVENT_LINK_CARRIER_ON, &dev->flags); + netif_carrier_off(dev->net); ++ } + + if (need_reset && link) + usbnet_defer_kevent(dev, EVENT_LINK_RESET); +--- a/include/linux/usb/usbnet.h ++++ b/include/linux/usb/usbnet.h +@@ -76,6 +76,7 @@ struct usbnet { + # define EVENT_LINK_CHANGE 11 + # define EVENT_SET_RX_MODE 12 + # define EVENT_NO_IP_ALIGN 13 ++# define EVENT_LINK_CARRIER_ON 14 + /* This one is special, as it indicates that the device is going away + * there are cyclic dependencies between tasklet, timer and bh + * that must be broken diff --git a/queue-6.16/net-usbnet-fix-the-wrong-netif_carrier_on-call.patch b/queue-6.16/net-usbnet-fix-the-wrong-netif_carrier_on-call.patch new file mode 100644 index 0000000000..2c0e319398 --- /dev/null +++ b/queue-6.16/net-usbnet-fix-the-wrong-netif_carrier_on-call.patch @@ -0,0 +1,57 @@ +From 8466d393700f9ccef68134d3349f4e0a087679b9 Mon Sep 17 00:00:00 2001 +From: Ammar Faizi +Date: Wed, 6 Aug 2025 07:31:05 +0700 +Subject: net: usbnet: Fix the wrong netif_carrier_on() call + +From: Ammar Faizi + +commit 8466d393700f9ccef68134d3349f4e0a087679b9 upstream. + +The commit referenced in the Fixes tag causes usbnet to malfunction +(identified via git bisect). Post-commit, my external RJ45 LAN cable +fails to connect. Linus also reported the same issue after pulling that +commit. + +The code has a logic error: netif_carrier_on() is only called when the +link is already on. Fix this by moving the netif_carrier_on() call +outside the if-statement entirely. This ensures it is always called +when EVENT_LINK_CARRIER_ON is set and properly clears it regardless +of the link state. + +Cc: stable@vger.kernel.org +Cc: Armando Budianto +Reviewed-by: Simon Horman +Suggested-by: Linus Torvalds +Link: https://lore.kernel.org/all/CAHk-=wjqL4uF0MG_c8+xHX1Vv8==sPYQrtzbdA3kzi96284nuQ@mail.gmail.com +Closes: https://lore.kernel.org/netdev/CAHk-=wjKh8X4PT_mU1kD4GQrbjivMfPn-_hXa6han_BTDcXddw@mail.gmail.com +Closes: https://lore.kernel.org/netdev/0752dee6-43d6-4e1f-81d2-4248142cccd2@gnuweeb.org +Fixes: 0d9cfc9b8cb1 ("net: usbnet: Avoid potential RCU stall on LINK_CHANGE event") +Signed-off-by: Ammar Faizi +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/usbnet.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1113,6 +1113,9 @@ static void __handle_link_change(struct + if (!test_bit(EVENT_DEV_OPEN, &dev->flags)) + return; + ++ if (test_and_clear_bit(EVENT_LINK_CARRIER_ON, &dev->flags)) ++ netif_carrier_on(dev->net); ++ + if (!netif_carrier_ok(dev->net)) { + /* kill URBs for reading packets to save bus bandwidth */ + unlink_urbs(dev, &dev->rxq); +@@ -1122,9 +1125,6 @@ static void __handle_link_change(struct + * tx queue is stopped by netcore after link becomes off + */ + } else { +- if (test_and_clear_bit(EVENT_LINK_CARRIER_ON, &dev->flags)) +- netif_carrier_on(dev->net); +- + /* submitting URBs for reading packets */ + tasklet_schedule(&dev->bh); + } diff --git a/queue-6.16/series b/queue-6.16/series index 78819d652a..ba25b1f997 100644 --- a/queue-6.16/series +++ b/queue-6.16/series @@ -590,3 +590,6 @@ smb-client-default-to-nonativesocket-under-posix-mounts.patch ksmbd-limit-repeated-connections-from-clients-with-the-same-ip.patch smb-server-fix-extension-string-in-ksmbd_extract_shortname.patch usb-serial-option-add-foxconn-t99w709.patch +bluetooth-btusb-add-usb-id-3625-010b-for-tp-link-archer-tx10ub-nano.patch +net-usbnet-avoid-potential-rcu-stall-on-link_change-event.patch +net-usbnet-fix-the-wrong-netif_carrier_on-call.patch