hurricos/openwrt-mirror
1
0
Fork 0
mirror of git://git.openwrt.org/openwrt/openwrt.git synced 2025-12-09 06:02:10 -05:00
Code Issues Projects Releases Wiki Activity

airoha: backport minor fixes for NPU handling

Browse Source 
Backport upstream minor fixed for NPU handling that might result in
kernel panic or handle leak.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
This commit is contained in:
Christian Marangi 2025-10-29 15:15:53 +01:00
parent 738eacb9a0
commit 83eacb6ab0
No known key found for this signature in database
GPG Key ID: AC001D09ADBFEAD7
10 changed files with 141 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
target/linux/airoha/patches-6.12/104-6.19-net-airoha-Fix-a-copy-and-paste-bug-in-probe.patch Normal file
View File

@ -0,0 +1,37 @@
From 05e090620bacf317020f9591cfff8926093380bd Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Fri, 24 Oct 2025 14:23:35 +0300
Subject: [PATCH] net: airoha: Fix a copy and paste bug in probe()
This code has a copy and paste bug where it accidentally checks "if (err)"
instead of checking if "xsi_rsts" is NULL. Also, as a free bonus, I
changed the allocation from kzalloc() to kcalloc() which is a kernel
hardening measure to protect against integer overflows.
Fixes: 5863b4e065e2 ("net: airoha: Add airoha_eth_soc_data struct")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/aPtht6y5DRokn9zv@stanley.mountain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
drivers/net/ethernet/airoha/airoha_eth.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -2990,11 +2990,11 @@ static int airoha_probe(struct platform_
return err;
}
- xsi_rsts = devm_kzalloc(eth->dev,
- eth->soc->num_xsi_rsts * sizeof(*xsi_rsts),
+ xsi_rsts = devm_kcalloc(eth->dev,
+ eth->soc->num_xsi_rsts, sizeof(*xsi_rsts),
GFP_KERNEL);
- if (err)
- return err;
+ if (!xsi_rsts)
+ return -ENOMEM;
eth->xsi_rsts = xsi_rsts;
for (i = 0; i < eth->soc->num_xsi_rsts; i++)

40
target/linux/airoha/patches-6.12/105-6.17-net-airoha-Get-rid-of-dma_sync_single_for_device-in-.patch Normal file
View File

@ -0,0 +1,40 @@
From 4cd9d227ab838b3590c4b27e3707b8c3ef14d7e9 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Wed, 25 Jun 2025 16:43:15 +0200
Subject: [PATCH] net: airoha: Get rid of dma_sync_single_for_device() in
airoha_qdma_fill_rx_queue()
Since the page_pool for airoha_eth driver is created with
PP_FLAG_DMA_SYNC_DEV flag, we do not need to sync_for_device each page
received from the pool since it is already done by the page_pool codebase.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Link: https://patch.msgid.link/20250625-airoha-sync-for-device-v1-1-923741deaabf@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
drivers/net/ethernet/airoha/airoha_eth.c | 5 -----
1 file changed, 5 deletions(-)
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -539,9 +539,7 @@ static int airoha_fe_init(struct airoha_
static int airoha_qdma_fill_rx_queue(struct airoha_queue *q)
{
- enum dma_data_direction dir = page_pool_get_dma_dir(q->page_pool);
struct airoha_qdma *qdma = q->qdma;
- struct airoha_eth *eth = qdma->eth;
int qid = q - &qdma->q_rx[0];
int nframes = 0;
@@ -565,9 +563,6 @@ static int airoha_qdma_fill_rx_queue(str
e->dma_addr = page_pool_get_dma_addr(page) + offset;
e->dma_len = SKB_WITH_OVERHEAD(q->buf_size);
- dma_sync_single_for_device(eth->dev, e->dma_addr, e->dma_len,
- dir);
-
val = FIELD_PREP(QDMA_DESC_LEN_MASK, e->dma_len);
WRITE_ONCE(desc->ctrl, cpu_to_le32(val));
WRITE_ONCE(desc->addr, cpu_to_le32(e->dma_addr));

41
target/linux/airoha/patches-6.12/106-6.16-net-airoha-fix-potential-use-after-free-in-airoha_np.patch Normal file
View File

@ -0,0 +1,41 @@
From 3cd582e7d0787506990ef0180405eb6224fa90a6 Mon Sep 17 00:00:00 2001
From: Alok Tiwari <alok.a.tiwari@oracle.com>
Date: Tue, 15 Jul 2025 07:30:58 -0700
Subject: [PATCH] net: airoha: fix potential use-after-free in airoha_npu_get()
np->name was being used after calling of_node_put(np), which
releases the node and can lead to a use-after-free bug.
Previously, of_node_put(np) was called unconditionally after
of_find_device_by_node(np), which could result in a use-after-free if
pdev is NULL.
This patch moves of_node_put(np) after the error check to ensure
the node is only released after both the error and success cases
are handled appropriately, preventing potential resource issues.
Fixes: 23290c7bc190 ("net: airoha: Introduce Airoha NPU support")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20250715143102.3458286-1-alok.a.tiwari@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
drivers/net/ethernet/airoha/airoha_npu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/airoha/airoha_npu.c
+++ b/drivers/net/ethernet/airoha/airoha_npu.c
@@ -567,12 +567,13 @@ struct airoha_npu *airoha_npu_get(struct
return ERR_PTR(-ENODEV);
pdev = of_find_device_by_node(np);
- of_node_put(np);
if (!pdev) {
dev_err(dev, "cannot find device node %s\n", np->name);
+ of_node_put(np);
return ERR_PTR(-ENODEV);
}
+ of_node_put(np);
if (!try_module_get(THIS_MODULE)) {
dev_err(dev, "failed to get the device driver module\n");

2
target/linux/airoha/patches-6.12/116-02-net-airoha-deassert-XSI-line-on-hw-init.patch
View File

@ -13,7 +13,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -1388,6 +1388,10 @@ static int airoha_hw_init(struct platfor
@@ -1383,6 +1383,10 @@ static int airoha_hw_init(struct platfor
if (err)
return err;

2
target/linux/airoha/patches-6.12/116-03-net-airoha-add-reference-for-SPORT-GDM4-in-qdma_get_.patch
View File

@ -16,7 +16,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -593,8 +593,11 @@ static int airoha_qdma_get_gdm_port(stru
@@ -588,8 +588,11 @@ static int airoha_qdma_get_gdm_port(stru
sport = FIELD_GET(QDMA_ETH_RXMSG_SPORT_MASK, msg1);
switch (sport) {

2
target/linux/airoha/patches-6.12/116-06-net-airoha-add-initial-fixup-for-GDM3-4-port-support.patch
View File

@ -28,7 +28,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
airoha_fe_crsn_qsel_init(eth);
@@ -1630,7 +1632,8 @@ static int airoha_dev_open(struct net_de
@@ -1625,7 +1627,8 @@ static int airoha_dev_open(struct net_de
if (err)
return err;

4
target/linux/airoha/patches-6.12/116-07-airoha-ethernet-drop-xsi-mac-reset.patch
View File

@ -15,7 +15,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -3100,7 +3100,6 @@ static void airoha_remove(struct platfor
@@ -3095,7 +3095,6 @@ static void airoha_remove(struct platfor
}
static const char * const en7581_xsi_rsts_names[] = {
@ -23,7 +23,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
"hsi0-mac",
"hsi1-mac",
"hsi-mac",
@@ -3132,7 +3131,6 @@ static int airoha_en7581_get_src_port_id
@@ -3127,7 +3126,6 @@ static int airoha_en7581_get_src_port_id
}
static const char * const an7583_xsi_rsts_names[] = {

14
target/linux/airoha/patches-6.12/116-10-net-airoha-add-phylink-support-for-GDM2-4.patch
View File

@ -35,7 +35,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
static void airoha_set_macaddr(struct airoha_gdm_port *port, const u8 *addr)
{
struct airoha_eth *eth = port->qdma->eth;
@@ -1627,6 +1633,17 @@ static int airoha_dev_open(struct net_de
@@ -1622,6 +1628,17 @@ static int airoha_dev_open(struct net_de
struct airoha_gdm_port *port = netdev_priv(dev);
struct airoha_qdma *qdma = port->qdma;
@ -53,7 +53,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
netif_tx_start_all_queues(dev);
err = airoha_set_vip_for_gdm_port(port, true);
if (err)
@@ -1680,6 +1697,11 @@ static int airoha_dev_stop(struct net_de
@@ -1675,6 +1692,11 @@ static int airoha_dev_stop(struct net_de
}
}
@ -65,7 +65,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
return 0;
}
@@ -2828,6 +2850,20 @@ static const struct ethtool_ops airoha_e
@@ -2823,6 +2845,20 @@ static const struct ethtool_ops airoha_e
.get_link = ethtool_op_get_link,
};
@ -86,7 +86,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
static int airoha_metadata_dst_alloc(struct airoha_gdm_port *port)
{
int i;
@@ -2872,6 +2908,99 @@ bool airoha_is_valid_gdm_port(struct air
@@ -2867,6 +2903,99 @@ bool airoha_is_valid_gdm_port(struct air
return false;
}
@ -186,7 +186,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
static int airoha_alloc_gdm_port(struct airoha_eth *eth,
struct device_node *np, int index)
{
@@ -2950,6 +3079,12 @@ static int airoha_alloc_gdm_port(struct
@@ -2945,6 +3074,12 @@ static int airoha_alloc_gdm_port(struct
if (err)
return err;
@ -199,7 +199,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
err = register_netdev(dev);
if (err)
goto free_metadata_dst;
@@ -3065,6 +3200,10 @@ error_hw_cleanup:
@@ -3060,6 +3195,10 @@ error_hw_cleanup:
if (port && port->dev->reg_state == NETREG_REGISTERED) {
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);
@ -210,7 +210,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
}
}
free_netdev(eth->napi_dev);
@@ -3092,6 +3231,10 @@ static void airoha_remove(struct platfor
@@ -3087,6 +3226,10 @@ static void airoha_remove(struct platfor
airoha_dev_stop(port->dev);
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);

2
target/linux/airoha/patches-6.12/604-02-net-ethernet-airoha-define-sport-value-for-GDM3.patch
View File

@ -14,7 +14,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -604,6 +604,9 @@ static int airoha_qdma_get_gdm_port(stru
@@ -599,6 +599,9 @@ static int airoha_qdma_get_gdm_port(stru
case 0x18:
port = 3; /* GDM4 */
break;

20
target/linux/airoha/patches-6.12/606-net-airoha-disable-external-phy-code-if-PCS_AIROHA-i.patch
View File

@ -28,7 +28,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
static void airoha_set_macaddr(struct airoha_gdm_port *port, const u8 *addr)
{
@@ -1636,6 +1638,7 @@ static int airoha_dev_open(struct net_de
@@ -1631,6 +1633,7 @@ static int airoha_dev_open(struct net_de
struct airoha_gdm_port *port = netdev_priv(dev);
struct airoha_qdma *qdma = port->qdma;
@ -36,7 +36,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
if (airhoa_is_phy_external(port)) {
err = phylink_of_phy_connect(port->phylink, dev->dev.of_node, 0);
if (err) {
@@ -1646,6 +1649,7 @@ static int airoha_dev_open(struct net_de
@@ -1641,6 +1644,7 @@ static int airoha_dev_open(struct net_de
phylink_start(port->phylink);
}
@ -44,7 +44,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
netif_tx_start_all_queues(dev);
err = airoha_set_vip_for_gdm_port(port, true);
@@ -1700,10 +1704,12 @@ static int airoha_dev_stop(struct net_de
@@ -1695,10 +1699,12 @@ static int airoha_dev_stop(struct net_de
}
}
@ -57,7 +57,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
return 0;
}
@@ -2853,6 +2859,7 @@ static const struct ethtool_ops airoha_e
@@ -2848,6 +2854,7 @@ static const struct ethtool_ops airoha_e
.get_link = ethtool_op_get_link,
};
@ -65,7 +65,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
static struct phylink_pcs *airoha_phylink_mac_select_pcs(struct phylink_config *config,
phy_interface_t interface)
{
@@ -2866,6 +2873,7 @@ static void airoha_mac_config(struct phy
@@ -2861,6 +2868,7 @@ static void airoha_mac_config(struct phy
const struct phylink_link_state *state)
{
}
@ -73,7 +73,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
static int airoha_metadata_dst_alloc(struct airoha_gdm_port *port)
{
@@ -2911,6 +2919,7 @@ bool airoha_is_valid_gdm_port(struct air
@@ -2906,6 +2914,7 @@ bool airoha_is_valid_gdm_port(struct air
return false;
}
@ -81,7 +81,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
static void airoha_mac_link_up(struct phylink_config *config, struct phy_device *phy,
unsigned int mode, phy_interface_t interface,
int speed, int duplex, bool tx_pause, bool rx_pause)
@@ -3003,6 +3012,7 @@ static int airoha_setup_phylink(struct n
@@ -2998,6 +3007,7 @@ static int airoha_setup_phylink(struct n
return 0;
}
@ -89,7 +89,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
static int airoha_alloc_gdm_port(struct airoha_eth *eth,
struct device_node *np, int index)
@@ -3082,11 +3092,13 @@ static int airoha_alloc_gdm_port(struct
@@ -3077,11 +3087,13 @@ static int airoha_alloc_gdm_port(struct
if (err)
return err;
@ -103,7 +103,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
err = register_netdev(dev);
if (err)
@@ -3203,10 +3215,12 @@ error_hw_cleanup:
@@ -3198,10 +3210,12 @@ error_hw_cleanup:
if (port && port->dev->reg_state == NETREG_REGISTERED) {
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);
@ -116,7 +116,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
}
}
free_netdev(eth->napi_dev);
@@ -3234,10 +3248,12 @@ static void airoha_remove(struct platfor
@@ -3229,10 +3243,12 @@ static void airoha_remove(struct platfor
airoha_dev_stop(port->dev);
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);