diff options
author | Marek BehĂșn <kabel@kernel.org> | 2023-04-12 13:01:25 +0200 |
---|---|---|
committer | Christian Lamparter <chunkeey@gmail.com> | 2023-06-08 15:33:14 +0200 |
commit | 76cabb95da1994b84a373346c46e52ec836edfc7 (patch) | |
tree | 292892222b3d112739adc67e238e4ea85f84ccd0 /target/linux/generic/backport-5.15 | |
parent | 47437563aafcd7158584cbfc991f754f27aebeba (diff) | |
download | upstream-76cabb95da1994b84a373346c46e52ec836edfc7.tar.gz upstream-76cabb95da1994b84a373346c46e52ec836edfc7.tar.bz2 upstream-76cabb95da1994b84a373346c46e52ec836edfc7.zip |
kernel: Backport mvneta crash fix to 5.15
Backport Russell King's series [1]
net: mvneta: reduce size of TSO header allocation
to pending-5.15 to fix random crashes on Turris Omnia.
This also backports two patches that are dependencies to this series:
net: mvneta: Delete unused variable
net: mvneta: fix potential double-frees in mvneta_txq_sw_deinit()
[1] https://lore.kernel.org/netdev/ZCsbJ4nG+So%2Fn9qY@shell.armlinux.org.uk/
Signed-off-by: Marek BehĂșn <kabel@kernel.org>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (squashed)
(cherry picked from commit 7b31c2e9ed4da7bfeecbd393c17c249eca870717)
Diffstat (limited to 'target/linux/generic/backport-5.15')
2 files changed, 99 insertions, 0 deletions
diff --git a/target/linux/generic/backport-5.15/708-01-v5.16-net-mvneta-Delete-unused-variable.patch b/target/linux/generic/backport-5.15/708-01-v5.16-net-mvneta-Delete-unused-variable.patch new file mode 100644 index 0000000000..421563ef08 --- /dev/null +++ b/target/linux/generic/backport-5.15/708-01-v5.16-net-mvneta-Delete-unused-variable.patch @@ -0,0 +1,62 @@ +From 43ed6fff01333868a1d0e19876f67c22d9939952 Mon Sep 17 00:00:00 2001 +From: Yuval Shaia <yshaia@marvell.com> +Date: Wed, 13 Oct 2021 09:49:21 +0300 +Subject: [PATCH] net: mvneta: Delete unused variable + +The variable pp is not in use - delete it. + +Signed-off-by: Yuval Shaia <yshaia@marvell.com> +Link: https://lore.kernel.org/r/20211013064921.26346-1-yshaia@marvell.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +--- + drivers/net/ethernet/marvell/mvneta.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -1914,7 +1914,7 @@ static int mvneta_rx_refill(struct mvnet + } + + /* Handle tx checksum */ +-static u32 mvneta_skb_tx_csum(struct mvneta_port *pp, struct sk_buff *skb) ++static u32 mvneta_skb_tx_csum(struct sk_buff *skb) + { + if (skb->ip_summed == CHECKSUM_PARTIAL) { + int ip_hdr_len = 0; +@@ -2595,8 +2595,7 @@ err_drop_frame: + } + + static inline void +-mvneta_tso_put_hdr(struct sk_buff *skb, +- struct mvneta_port *pp, struct mvneta_tx_queue *txq) ++mvneta_tso_put_hdr(struct sk_buff *skb, struct mvneta_tx_queue *txq) + { + int hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb); + struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index]; +@@ -2604,7 +2603,7 @@ mvneta_tso_put_hdr(struct sk_buff *skb, + + tx_desc = mvneta_txq_next_desc_get(txq); + tx_desc->data_size = hdr_len; +- tx_desc->command = mvneta_skb_tx_csum(pp, skb); ++ tx_desc->command = mvneta_skb_tx_csum(skb); + tx_desc->command |= MVNETA_TXD_F_DESC; + tx_desc->buf_phys_addr = txq->tso_hdrs_phys + + txq->txq_put_index * TSO_HEADER_SIZE; +@@ -2681,7 +2680,7 @@ static int mvneta_tx_tso(struct sk_buff + hdr = txq->tso_hdrs + txq->txq_put_index * TSO_HEADER_SIZE; + tso_build_hdr(skb, hdr, &tso, data_left, total_len == 0); + +- mvneta_tso_put_hdr(skb, pp, txq); ++ mvneta_tso_put_hdr(skb, txq); + + while (data_left > 0) { + int size; +@@ -2799,7 +2798,7 @@ static netdev_tx_t mvneta_tx(struct sk_b + /* Get a descriptor for the first part of the packet */ + tx_desc = mvneta_txq_next_desc_get(txq); + +- tx_cmd = mvneta_skb_tx_csum(pp, skb); ++ tx_cmd = mvneta_skb_tx_csum(skb); + + tx_desc->data_size = skb_headlen(skb); + diff --git a/target/linux/generic/backport-5.15/708-02-v6.3-net-mvneta-fix-potential-double-frees-in-mvneta_txq_.patch b/target/linux/generic/backport-5.15/708-02-v6.3-net-mvneta-fix-potential-double-frees-in-mvneta_txq_.patch new file mode 100644 index 0000000000..a16e68ee4f --- /dev/null +++ b/target/linux/generic/backport-5.15/708-02-v6.3-net-mvneta-fix-potential-double-frees-in-mvneta_txq_.patch @@ -0,0 +1,37 @@ +From 0cf39c6543469aae4a30cba354243125514ed568 Mon Sep 17 00:00:00 2001 +From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk> +Date: Wed, 29 Mar 2023 13:11:17 +0100 +Subject: [PATCH] net: mvneta: fix potential double-frees in + mvneta_txq_sw_deinit() + +Reported on the Turris forum, mvneta provokes kernel warnings in the +architecture DMA mapping code when mvneta_setup_txqs() fails to +allocate memory. This happens because when mvneta_cleanup_txqs() is +called in the mvneta_stop() path, we leave pointers in the structure +that have been freed. + +Then on mvneta_open(), we call mvneta_setup_txqs(), which starts +allocating memory. On memory allocation failure, mvneta_cleanup_txqs() +will walk all the queues freeing any non-NULL pointers - which includes +pointers that were previously freed in mvneta_stop(). + +Fix this by setting these pointers to NULL to prevent double-freeing +of the same memory. + +Link: https://forum.turris.cz/t/random-kernel-exceptions-on-hbl-tos-7-0/18865/8 +Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> +--- + drivers/net/ethernet/marvell/mvneta.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -3481,6 +3481,8 @@ static void mvneta_txq_sw_deinit(struct + + netdev_tx_reset_queue(nq); + ++ txq->buf = NULL; ++ txq->tso_hdrs = NULL; + txq->descs = NULL; + txq->last_desc = 0; + txq->next_desc_to_proc = 0; |