* [PATCH 0/2] net: ipa: v5.18.2 backport to fix page free
@ 2022-06-06 14:15 Alex Elder
2022-06-06 14:15 ` [PATCH 1/2] net: ipa: fix page free in ipa_endpoint_trans_release() Alex Elder
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Alex Elder @ 2022-06-06 14:15 UTC (permalink / raw)
To: stable; +Cc: kuba
This series back-ports two bug fixes that landed very late in v5.18
cycle and didn't make it to the final release. They're present in
v5.19-rc1, but don't cherry-pick cleanly onto v5.18.2.
-Alex
Alex Elder (2):
net: ipa: fix page free in ipa_endpoint_trans_release()
net: ipa: fix page free in ipa_endpoint_replenish_one()
drivers/net/ipa/ipa_endpoint.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
--
2.32.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 1/2] net: ipa: fix page free in ipa_endpoint_trans_release()
2022-06-06 14:15 [PATCH 0/2] net: ipa: v5.18.2 backport to fix page free Alex Elder
@ 2022-06-06 14:15 ` Alex Elder
2022-06-06 14:15 ` [PATCH 2/2] net: ipa: fix page free in ipa_endpoint_replenish_one() Alex Elder
2022-06-06 17:00 ` [PATCH 0/2] net: ipa: v5.18.2 backport to fix page free Greg KH
2 siblings, 0 replies; 4+ messages in thread
From: Alex Elder @ 2022-06-06 14:15 UTC (permalink / raw)
To: stable; +Cc: kuba
commit 155c0c90bca918de6e4327275dfc1d97fd604115 upstream.
Currently the (possibly compound) page used for receive buffers are
freed using __free_pages(). But according to this comment above the
definition of that function, that's wrong:
If you want to use the page's reference count to decide when
to free the allocation, you should allocate a compound page,
and use put_page() instead of __free_pages().
Convert the call to __free_pages() in ipa_endpoint_trans_release()
to use put_page() instead.
Cc: <stable@vger.kernel.org> # 5.18.x
Fixes: ed23f02680caa ("net: ipa: define per-endpoint receive buffer size")
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
drivers/net/ipa/ipa_endpoint.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c
index 53764f3c0c7e4..04a2aa0f120ac 100644
--- a/drivers/net/ipa/ipa_endpoint.c
+++ b/drivers/net/ipa/ipa_endpoint.c
@@ -1383,11 +1383,8 @@ void ipa_endpoint_trans_release(struct ipa_endpoint *endpoint,
} else {
struct page *page = trans->data;
- if (page) {
- u32 buffer_size = endpoint->data->rx.buffer_size;
-
- __free_pages(page, get_order(buffer_size));
- }
+ if (page)
+ put_page(page);
}
}
--
2.32.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 2/2] net: ipa: fix page free in ipa_endpoint_replenish_one()
2022-06-06 14:15 [PATCH 0/2] net: ipa: v5.18.2 backport to fix page free Alex Elder
2022-06-06 14:15 ` [PATCH 1/2] net: ipa: fix page free in ipa_endpoint_trans_release() Alex Elder
@ 2022-06-06 14:15 ` Alex Elder
2022-06-06 17:00 ` [PATCH 0/2] net: ipa: v5.18.2 backport to fix page free Greg KH
2 siblings, 0 replies; 4+ messages in thread
From: Alex Elder @ 2022-06-06 14:15 UTC (permalink / raw)
To: stable; +Cc: kuba
commit 70132763d5d2e94cd185e3aa92ac6a3ba89068fa upstream.
Currently the (possibly compound) pages used for receive buffers are
freed using __free_pages(). But according to this comment above the
definition of that function, that's wrong:
If you want to use the page's reference count to decide
when to free the allocation, you should allocate a compound
page, and use put_page() instead of __free_pages().
Convert the call to __free_pages() in ipa_endpoint_replenish_one()
to use put_page() instead.
Cc: <stable@vger.kernel.org> # 5.18.x
Fixes: 6a606b90153b8 ("net: ipa: allocate transaction in replenish loop")
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
drivers/net/ipa/ipa_endpoint.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c
index 04a2aa0f120ac..5edb728e7100c 100644
--- a/drivers/net/ipa/ipa_endpoint.c
+++ b/drivers/net/ipa/ipa_endpoint.c
@@ -1060,7 +1060,7 @@ static int ipa_endpoint_replenish_one(struct ipa_endpoint *endpoint,
ret = gsi_trans_page_add(trans, page, len, offset);
if (ret)
- __free_pages(page, get_order(buffer_size));
+ put_page(page);
else
trans->data = page; /* transaction owns page now */
--
2.32.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 0/2] net: ipa: v5.18.2 backport to fix page free
2022-06-06 14:15 [PATCH 0/2] net: ipa: v5.18.2 backport to fix page free Alex Elder
2022-06-06 14:15 ` [PATCH 1/2] net: ipa: fix page free in ipa_endpoint_trans_release() Alex Elder
2022-06-06 14:15 ` [PATCH 2/2] net: ipa: fix page free in ipa_endpoint_replenish_one() Alex Elder
@ 2022-06-06 17:00 ` Greg KH
2 siblings, 0 replies; 4+ messages in thread
From: Greg KH @ 2022-06-06 17:00 UTC (permalink / raw)
To: Alex Elder; +Cc: stable, kuba
On Mon, Jun 06, 2022 at 09:15:46AM -0500, Alex Elder wrote:
> This series back-ports two bug fixes that landed very late in v5.18
> cycle and didn't make it to the final release. They're present in
> v5.19-rc1, but don't cherry-pick cleanly onto v5.18.2.
>
> -Alex
>
> Alex Elder (2):
> net: ipa: fix page free in ipa_endpoint_trans_release()
> net: ipa: fix page free in ipa_endpoint_replenish_one()
>
> drivers/net/ipa/ipa_endpoint.c | 9 +++------
> 1 file changed, 3 insertions(+), 6 deletions(-)
>
> --
> 2.32.0
>
All now queued up, thanks,
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-06-06 17:12 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-06 14:15 [PATCH 0/2] net: ipa: v5.18.2 backport to fix page free Alex Elder
2022-06-06 14:15 ` [PATCH 1/2] net: ipa: fix page free in ipa_endpoint_trans_release() Alex Elder
2022-06-06 14:15 ` [PATCH 2/2] net: ipa: fix page free in ipa_endpoint_replenish_one() Alex Elder
2022-06-06 17:00 ` [PATCH 0/2] net: ipa: v5.18.2 backport to fix page free Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).