From: Greg Kroah-Hartman Date: Mon, 16 Mar 2026 15:03:27 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v6.18.19~83 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f91707caaefed5b21919a97d25c2a1f393a26835;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: cgroup-fix-race-between-task-migration-and-iteration.patch net-usb-lan78xx-fix-silent-drop-of-packets-with-checksum-errors.patch net-usb-lan78xx-skip-ltm-configuration-for-lan7850.patch --- diff --git a/queue-5.10/cgroup-fix-race-between-task-migration-and-iteration.patch b/queue-5.10/cgroup-fix-race-between-task-migration-and-iteration.patch new file mode 100644 index 0000000000..78ffb40318 --- /dev/null +++ b/queue-5.10/cgroup-fix-race-between-task-migration-and-iteration.patch @@ -0,0 +1,84 @@ +From 5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1 Mon Sep 17 00:00:00 2001 +From: Qingye Zhao +Date: Wed, 11 Feb 2026 09:24:04 +0000 +Subject: cgroup: fix race between task migration and iteration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Qingye Zhao + +commit 5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1 upstream. + +When a task is migrated out of a css_set, cgroup_migrate_add_task() +first moves it from cset->tasks to cset->mg_tasks via: + + list_move_tail(&task->cg_list, &cset->mg_tasks); + +If a css_task_iter currently has it->task_pos pointing to this task, +css_set_move_task() calls css_task_iter_skip() to keep the iterator +valid. However, since the task has already been moved to ->mg_tasks, +the iterator is advanced relative to the mg_tasks list instead of the +original tasks list. As a result, remaining tasks on cset->tasks, as +well as tasks queued on cset->mg_tasks, can be skipped by iteration. + +Fix this by calling css_set_skip_task_iters() before unlinking +task->cg_list from cset->tasks. This advances all active iterators to +the next task on cset->tasks, so iteration continues correctly even +when a task is concurrently being migrated. + +This race is hard to hit in practice without instrumentation, but it +can be reproduced by artificially slowing down cgroup_procs_show(). +For example, on an Android device a temporary +/sys/kernel/cgroup/cgroup_test knob can be added to inject a delay +into cgroup_procs_show(), and then: + + 1) Spawn three long-running tasks (PIDs 101, 102, 103). + 2) Create a test cgroup and move the tasks into it. + 3) Enable a large delay via /sys/kernel/cgroup/cgroup_test. + 4) In one shell, read cgroup.procs from the test cgroup. + 5) Within the delay window, in another shell migrate PID 102 by + writing it to a different cgroup.procs file. + +Under this setup, cgroup.procs can intermittently show only PID 101 +while skipping PID 103. Once the migration completes, reading the +file again shows all tasks as expected. + +Note that this change does not allow removing the existing +css_set_skip_task_iters() call in css_set_move_task(). The new call +in cgroup_migrate_add_task() only handles iterators that are racing +with migration while the task is still on cset->tasks. Iterators may +also start after the task has been moved to cset->mg_tasks. If we +dropped css_set_skip_task_iters() from css_set_move_task(), such +iterators could keep task_pos pointing to a migrating task, causing +css_task_iter_advance() to malfunction on the destination css_set, +up to and including crashes or infinite loops. + +The race window between migration and iteration is very small, and +css_task_iter is not on a hot path. In the worst case, when an +iterator is positioned on the first thread of the migrating process, +cgroup_migrate_add_task() may have to skip multiple tasks via +css_set_skip_task_iters(). However, this only happens when migration +and iteration actually race, so the performance impact is negligible +compared to the correctness fix provided here. + +Fixes: b636fd38dc40 ("cgroup: Implement css_task_iter_skip()") +Cc: stable@vger.kernel.org # v5.2+ +Signed-off-by: Qingye Zhao +Reviewed-by: Michal Koutný +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cgroup/cgroup.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -2413,6 +2413,7 @@ static void cgroup_migrate_add_task(stru + + mgctx->tset.nr_tasks++; + ++ css_set_skip_task_iters(cset, task); + list_move_tail(&task->cg_list, &cset->mg_tasks); + if (list_empty(&cset->mg_node)) + list_add_tail(&cset->mg_node, diff --git a/queue-5.10/net-usb-lan78xx-fix-silent-drop-of-packets-with-checksum-errors.patch b/queue-5.10/net-usb-lan78xx-fix-silent-drop-of-packets-with-checksum-errors.patch new file mode 100644 index 0000000000..a7e4830442 --- /dev/null +++ b/queue-5.10/net-usb-lan78xx-fix-silent-drop-of-packets-with-checksum-errors.patch @@ -0,0 +1,65 @@ +From e4f774a0cc955ce762aec91c66915a6e15087ab7 Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Thu, 5 Mar 2026 15:34:26 +0100 +Subject: net: usb: lan78xx: fix silent drop of packets with checksum errors + +From: Oleksij Rempel + +commit e4f774a0cc955ce762aec91c66915a6e15087ab7 upstream. + +Do not drop packets with checksum errors at the USB driver level; +pass them to the network stack. + +Previously, the driver dropped all packets where the 'Receive Error +Detected' (RED) bit was set, regardless of the specific error type. This +caused packets with only IP or TCP/UDP checksum errors to be dropped +before reaching the kernel, preventing the network stack from accounting +for them or performing software fallback. + +Add a mask for hard hardware errors to safely drop genuinely corrupt +frames, while allowing checksum-errored frames to pass with their +ip_summed field explicitly set to CHECKSUM_NONE. + +Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") +Cc: stable@vger.kernel.org +Signed-off-by: Oleksij Rempel +Link: https://patch.msgid.link/20260305143429.530909-2-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/lan78xx.c | 4 +++- + drivers/net/usb/lan78xx.h | 3 +++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -3279,6 +3279,7 @@ static void lan78xx_rx_csum_offload(stru + */ + if (!(dev->net->features & NETIF_F_RXCSUM) || + unlikely(rx_cmd_a & RX_CMD_A_ICSM_) || ++ unlikely(rx_cmd_a & RX_CMD_A_CSE_MASK_) || + ((rx_cmd_a & RX_CMD_A_FVTG_) && + !(dev->net->features & NETIF_F_HW_VLAN_CTAG_RX))) { + skb->ip_summed = CHECKSUM_NONE; +@@ -3346,7 +3347,8 @@ static int lan78xx_rx(struct lan78xx_net + size = (rx_cmd_a & RX_CMD_A_LEN_MASK_); + align_count = (4 - ((size + RXW_PADDING) % 4)) % 4; + +- if (unlikely(rx_cmd_a & RX_CMD_A_RED_)) { ++ if (unlikely(rx_cmd_a & RX_CMD_A_RED_) && ++ (rx_cmd_a & RX_CMD_A_RX_HARD_ERRS_MASK_)) { + netif_dbg(dev, rx_err, dev->net, + "Error rx_cmd_a=0x%08x", rx_cmd_a); + } else { +--- a/drivers/net/usb/lan78xx.h ++++ b/drivers/net/usb/lan78xx.h +@@ -74,6 +74,9 @@ + #define RX_CMD_A_ICSM_ (0x00004000) + #define RX_CMD_A_LEN_MASK_ (0x00003FFF) + ++#define RX_CMD_A_RX_HARD_ERRS_MASK_ \ ++ (RX_CMD_A_RX_ERRS_MASK_ & ~RX_CMD_A_CSE_MASK_) ++ + /* Rx Command B */ + #define RX_CMD_B_CSUM_SHIFT_ (16) + #define RX_CMD_B_CSUM_MASK_ (0xFFFF0000) diff --git a/queue-5.10/net-usb-lan78xx-skip-ltm-configuration-for-lan7850.patch b/queue-5.10/net-usb-lan78xx-skip-ltm-configuration-for-lan7850.patch new file mode 100644 index 0000000000..c493acdbee --- /dev/null +++ b/queue-5.10/net-usb-lan78xx-skip-ltm-configuration-for-lan7850.patch @@ -0,0 +1,46 @@ +From d9cc0e440f0664f6f3e2c26e39ab9dd5f3badba7 Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Thu, 5 Mar 2026 15:34:28 +0100 +Subject: net: usb: lan78xx: skip LTM configuration for LAN7850 + +From: Oleksij Rempel + +commit d9cc0e440f0664f6f3e2c26e39ab9dd5f3badba7 upstream. + +Do not configure Latency Tolerance Messaging (LTM) on USB 2.0 hardware. + +The LAN7850 is a High-Speed (USB 2.0) only device and does not support +SuperSpeed features like LTM. Currently, the driver unconditionally +attempts to configure LTM registers during initialization. On the +LAN7850, these registers do not exist, resulting in writes to invalid +or undocumented memory space. + +This issue was identified during a port to the regmap API with strict +register validation enabled. While no functional issues or crashes have +been observed from these invalid writes, bypassing LTM initialization +on the LAN7850 ensures the driver strictly adheres to the hardware's +valid register map. + +Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") +Cc: stable@vger.kernel.org +Signed-off-by: Oleksij Rempel +Link: https://patch.msgid.link/20260305143429.530909-4-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/lan78xx.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2463,6 +2463,10 @@ static void lan78xx_init_ltm(struct lan7 + u32 buf; + u32 regs[6] = { 0 }; + ++ /* LAN7850 is USB 2.0 and does not support LTM */ ++ if (dev->chipid == ID_REV_CHIP_ID_7850_) ++ return 0; ++ + ret = lan78xx_read_reg(dev, USB_CFG1, &buf); + if (buf & USB_CFG1_LTM_ENABLE_) { + u8 temp[2]; diff --git a/queue-5.10/series b/queue-5.10/series index d16c6078a1..e9cc308253 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -86,3 +86,6 @@ e1000-e1000e-fix-leak-in-dma-error-cleanup.patch acpi-osl-fix-__iomem-type-on-return-from-acpi_os_map.patch asoc-amd-acp3x-rt5682-max9836-add-missing-error-chec.patch asoc-detect-empty-dmi-strings.patch +cgroup-fix-race-between-task-migration-and-iteration.patch +net-usb-lan78xx-fix-silent-drop-of-packets-with-checksum-errors.patch +net-usb-lan78xx-skip-ltm-configuration-for-lan7850.patch