From 83eacb6ab0596634131aa90510e52159cef08b93 Mon Sep 17 00:00:00 2001 From: Christian Marangi Date: Wed, 29 Oct 2025 15:15:53 +0100 Subject: [PATCH] airoha: backport minor fixes for NPU handling Backport upstream minor fixed for NPU handling that might result in kernel panic or handle leak. Signed-off-by: Christian Marangi --- ...ha-Fix-a-copy-and-paste-bug-in-probe.patch | 37 +++++++++++++++++ ...id-of-dma_sync_single_for_device-in-.patch | 40 ++++++++++++++++++ ...otential-use-after-free-in-airoha_np.patch | 41 +++++++++++++++++++ ...-airoha-deassert-XSI-line-on-hw-init.patch | 2 +- ...eference-for-SPORT-GDM4-in-qdma_get_.patch | 2 +- ...nitial-fixup-for-GDM3-4-port-support.patch | 2 +- ...7-airoha-ethernet-drop-xsi-mac-reset.patch | 4 +- ...iroha-add-phylink-support-for-GDM2-4.patch | 14 +++---- ...t-airoha-define-sport-value-for-GDM3.patch | 2 +- ...le-external-phy-code-if-PCS_AIROHA-i.patch | 20 ++++----- 10 files changed, 141 insertions(+), 23 deletions(-) create mode 100644 target/linux/airoha/patches-6.12/104-6.19-net-airoha-Fix-a-copy-and-paste-bug-in-probe.patch create mode 100644 target/linux/airoha/patches-6.12/105-6.17-net-airoha-Get-rid-of-dma_sync_single_for_device-in-.patch create mode 100644 target/linux/airoha/patches-6.12/106-6.16-net-airoha-fix-potential-use-after-free-in-airoha_np.patch diff --git a/target/linux/airoha/patches-6.12/104-6.19-net-airoha-Fix-a-copy-and-paste-bug-in-probe.patch b/target/linux/airoha/patches-6.12/104-6.19-net-airoha-Fix-a-copy-and-paste-bug-in-probe.patch new file mode 100644 index 0000000000..e87035ec54 --- /dev/null +++ b/target/linux/airoha/patches-6.12/104-6.19-net-airoha-Fix-a-copy-and-paste-bug-in-probe.patch @@ -0,0 +1,37 @@ +From 05e090620bacf317020f9591cfff8926093380bd Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 24 Oct 2025 14:23:35 +0300 +Subject: [PATCH] net: airoha: Fix a copy and paste bug in probe() + +This code has a copy and paste bug where it accidentally checks "if (err)" +instead of checking if "xsi_rsts" is NULL. Also, as a free bonus, I +changed the allocation from kzalloc() to kcalloc() which is a kernel +hardening measure to protect against integer overflows. + +Fixes: 5863b4e065e2 ("net: airoha: Add airoha_eth_soc_data struct") +Signed-off-by: Dan Carpenter +Acked-by: Lorenzo Bianconi +Link: https://patch.msgid.link/aPtht6y5DRokn9zv@stanley.mountain +Signed-off-by: Jakub Kicinski +--- + drivers/net/ethernet/airoha/airoha_eth.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/airoha/airoha_eth.c ++++ b/drivers/net/ethernet/airoha/airoha_eth.c +@@ -2990,11 +2990,11 @@ static int airoha_probe(struct platform_ + return err; + } + +- xsi_rsts = devm_kzalloc(eth->dev, +- eth->soc->num_xsi_rsts * sizeof(*xsi_rsts), ++ xsi_rsts = devm_kcalloc(eth->dev, ++ eth->soc->num_xsi_rsts, sizeof(*xsi_rsts), + GFP_KERNEL); +- if (err) +- return err; ++ if (!xsi_rsts) ++ return -ENOMEM; + + eth->xsi_rsts = xsi_rsts; + for (i = 0; i < eth->soc->num_xsi_rsts; i++) diff --git a/target/linux/airoha/patches-6.12/105-6.17-net-airoha-Get-rid-of-dma_sync_single_for_device-in-.patch b/target/linux/airoha/patches-6.12/105-6.17-net-airoha-Get-rid-of-dma_sync_single_for_device-in-.patch new file mode 100644 index 0000000000..0c690b0d65 --- /dev/null +++ b/target/linux/airoha/patches-6.12/105-6.17-net-airoha-Get-rid-of-dma_sync_single_for_device-in-.patch @@ -0,0 +1,40 @@ +From 4cd9d227ab838b3590c4b27e3707b8c3ef14d7e9 Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Wed, 25 Jun 2025 16:43:15 +0200 +Subject: [PATCH] net: airoha: Get rid of dma_sync_single_for_device() in + airoha_qdma_fill_rx_queue() + +Since the page_pool for airoha_eth driver is created with +PP_FLAG_DMA_SYNC_DEV flag, we do not need to sync_for_device each page +received from the pool since it is already done by the page_pool codebase. + +Signed-off-by: Lorenzo Bianconi +Reviewed-by: Alexander Lobakin +Link: https://patch.msgid.link/20250625-airoha-sync-for-device-v1-1-923741deaabf@kernel.org +Signed-off-by: Jakub Kicinski +--- + drivers/net/ethernet/airoha/airoha_eth.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/net/ethernet/airoha/airoha_eth.c ++++ b/drivers/net/ethernet/airoha/airoha_eth.c +@@ -539,9 +539,7 @@ static int airoha_fe_init(struct airoha_ + + static int airoha_qdma_fill_rx_queue(struct airoha_queue *q) + { +- enum dma_data_direction dir = page_pool_get_dma_dir(q->page_pool); + struct airoha_qdma *qdma = q->qdma; +- struct airoha_eth *eth = qdma->eth; + int qid = q - &qdma->q_rx[0]; + int nframes = 0; + +@@ -565,9 +563,6 @@ static int airoha_qdma_fill_rx_queue(str + e->dma_addr = page_pool_get_dma_addr(page) + offset; + e->dma_len = SKB_WITH_OVERHEAD(q->buf_size); + +- dma_sync_single_for_device(eth->dev, e->dma_addr, e->dma_len, +- dir); +- + val = FIELD_PREP(QDMA_DESC_LEN_MASK, e->dma_len); + WRITE_ONCE(desc->ctrl, cpu_to_le32(val)); + WRITE_ONCE(desc->addr, cpu_to_le32(e->dma_addr)); diff --git a/target/linux/airoha/patches-6.12/106-6.16-net-airoha-fix-potential-use-after-free-in-airoha_np.patch b/target/linux/airoha/patches-6.12/106-6.16-net-airoha-fix-potential-use-after-free-in-airoha_np.patch new file mode 100644 index 0000000000..251395c751 --- /dev/null +++ b/target/linux/airoha/patches-6.12/106-6.16-net-airoha-fix-potential-use-after-free-in-airoha_np.patch @@ -0,0 +1,41 @@ +From 3cd582e7d0787506990ef0180405eb6224fa90a6 Mon Sep 17 00:00:00 2001 +From: Alok Tiwari +Date: Tue, 15 Jul 2025 07:30:58 -0700 +Subject: [PATCH] net: airoha: fix potential use-after-free in airoha_npu_get() + +np->name was being used after calling of_node_put(np), which +releases the node and can lead to a use-after-free bug. +Previously, of_node_put(np) was called unconditionally after +of_find_device_by_node(np), which could result in a use-after-free if +pdev is NULL. + +This patch moves of_node_put(np) after the error check to ensure +the node is only released after both the error and success cases +are handled appropriately, preventing potential resource issues. + +Fixes: 23290c7bc190 ("net: airoha: Introduce Airoha NPU support") +Signed-off-by: Alok Tiwari +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250715143102.3458286-1-alok.a.tiwari@oracle.com +Signed-off-by: Jakub Kicinski +--- + drivers/net/ethernet/airoha/airoha_npu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/airoha/airoha_npu.c ++++ b/drivers/net/ethernet/airoha/airoha_npu.c +@@ -567,12 +567,13 @@ struct airoha_npu *airoha_npu_get(struct + return ERR_PTR(-ENODEV); + + pdev = of_find_device_by_node(np); +- of_node_put(np); + + if (!pdev) { + dev_err(dev, "cannot find device node %s\n", np->name); ++ of_node_put(np); + return ERR_PTR(-ENODEV); + } ++ of_node_put(np); + + if (!try_module_get(THIS_MODULE)) { + dev_err(dev, "failed to get the device driver module\n"); diff --git a/target/linux/airoha/patches-6.12/116-02-net-airoha-deassert-XSI-line-on-hw-init.patch b/target/linux/airoha/patches-6.12/116-02-net-airoha-deassert-XSI-line-on-hw-init.patch index 85af65e3b4..d7e312dfcf 100644 --- a/target/linux/airoha/patches-6.12/116-02-net-airoha-deassert-XSI-line-on-hw-init.patch +++ b/target/linux/airoha/patches-6.12/116-02-net-airoha-deassert-XSI-line-on-hw-init.patch @@ -13,7 +13,7 @@ Signed-off-by: Christian Marangi --- a/drivers/net/ethernet/airoha/airoha_eth.c +++ b/drivers/net/ethernet/airoha/airoha_eth.c -@@ -1388,6 +1388,10 @@ static int airoha_hw_init(struct platfor +@@ -1383,6 +1383,10 @@ static int airoha_hw_init(struct platfor if (err) return err; diff --git a/target/linux/airoha/patches-6.12/116-03-net-airoha-add-reference-for-SPORT-GDM4-in-qdma_get_.patch b/target/linux/airoha/patches-6.12/116-03-net-airoha-add-reference-for-SPORT-GDM4-in-qdma_get_.patch index cf6520dd53..2407246861 100644 --- a/target/linux/airoha/patches-6.12/116-03-net-airoha-add-reference-for-SPORT-GDM4-in-qdma_get_.patch +++ b/target/linux/airoha/patches-6.12/116-03-net-airoha-add-reference-for-SPORT-GDM4-in-qdma_get_.patch @@ -16,7 +16,7 @@ Signed-off-by: Christian Marangi --- a/drivers/net/ethernet/airoha/airoha_eth.c +++ b/drivers/net/ethernet/airoha/airoha_eth.c -@@ -593,8 +593,11 @@ static int airoha_qdma_get_gdm_port(stru +@@ -588,8 +588,11 @@ static int airoha_qdma_get_gdm_port(stru sport = FIELD_GET(QDMA_ETH_RXMSG_SPORT_MASK, msg1); switch (sport) { diff --git a/target/linux/airoha/patches-6.12/116-06-net-airoha-add-initial-fixup-for-GDM3-4-port-support.patch b/target/linux/airoha/patches-6.12/116-06-net-airoha-add-initial-fixup-for-GDM3-4-port-support.patch index f56e3b9356..7b395bfcb7 100644 --- a/target/linux/airoha/patches-6.12/116-06-net-airoha-add-initial-fixup-for-GDM3-4-port-support.patch +++ b/target/linux/airoha/patches-6.12/116-06-net-airoha-add-initial-fixup-for-GDM3-4-port-support.patch @@ -28,7 +28,7 @@ Signed-off-by: Christian Marangi airoha_fe_crsn_qsel_init(eth); -@@ -1630,7 +1632,8 @@ static int airoha_dev_open(struct net_de +@@ -1625,7 +1627,8 @@ static int airoha_dev_open(struct net_de if (err) return err; diff --git a/target/linux/airoha/patches-6.12/116-07-airoha-ethernet-drop-xsi-mac-reset.patch b/target/linux/airoha/patches-6.12/116-07-airoha-ethernet-drop-xsi-mac-reset.patch index a8a9e64802..508ae97154 100644 --- a/target/linux/airoha/patches-6.12/116-07-airoha-ethernet-drop-xsi-mac-reset.patch +++ b/target/linux/airoha/patches-6.12/116-07-airoha-ethernet-drop-xsi-mac-reset.patch @@ -15,7 +15,7 @@ Signed-off-by: Christian Marangi --- a/drivers/net/ethernet/airoha/airoha_eth.c +++ b/drivers/net/ethernet/airoha/airoha_eth.c -@@ -3100,7 +3100,6 @@ static void airoha_remove(struct platfor +@@ -3095,7 +3095,6 @@ static void airoha_remove(struct platfor } static const char * const en7581_xsi_rsts_names[] = { @@ -23,7 +23,7 @@ Signed-off-by: Christian Marangi "hsi0-mac", "hsi1-mac", "hsi-mac", -@@ -3132,7 +3131,6 @@ static int airoha_en7581_get_src_port_id +@@ -3127,7 +3126,6 @@ static int airoha_en7581_get_src_port_id } static const char * const an7583_xsi_rsts_names[] = { diff --git a/target/linux/airoha/patches-6.12/116-10-net-airoha-add-phylink-support-for-GDM2-4.patch b/target/linux/airoha/patches-6.12/116-10-net-airoha-add-phylink-support-for-GDM2-4.patch index eb6b249b21..8ce66b706a 100644 --- a/target/linux/airoha/patches-6.12/116-10-net-airoha-add-phylink-support-for-GDM2-4.patch +++ b/target/linux/airoha/patches-6.12/116-10-net-airoha-add-phylink-support-for-GDM2-4.patch @@ -35,7 +35,7 @@ Signed-off-by: Christian Marangi static void airoha_set_macaddr(struct airoha_gdm_port *port, const u8 *addr) { struct airoha_eth *eth = port->qdma->eth; -@@ -1627,6 +1633,17 @@ static int airoha_dev_open(struct net_de +@@ -1622,6 +1628,17 @@ static int airoha_dev_open(struct net_de struct airoha_gdm_port *port = netdev_priv(dev); struct airoha_qdma *qdma = port->qdma; @@ -53,7 +53,7 @@ Signed-off-by: Christian Marangi netif_tx_start_all_queues(dev); err = airoha_set_vip_for_gdm_port(port, true); if (err) -@@ -1680,6 +1697,11 @@ static int airoha_dev_stop(struct net_de +@@ -1675,6 +1692,11 @@ static int airoha_dev_stop(struct net_de } } @@ -65,7 +65,7 @@ Signed-off-by: Christian Marangi return 0; } -@@ -2828,6 +2850,20 @@ static const struct ethtool_ops airoha_e +@@ -2823,6 +2845,20 @@ static const struct ethtool_ops airoha_e .get_link = ethtool_op_get_link, }; @@ -86,7 +86,7 @@ Signed-off-by: Christian Marangi static int airoha_metadata_dst_alloc(struct airoha_gdm_port *port) { int i; -@@ -2872,6 +2908,99 @@ bool airoha_is_valid_gdm_port(struct air +@@ -2867,6 +2903,99 @@ bool airoha_is_valid_gdm_port(struct air return false; } @@ -186,7 +186,7 @@ Signed-off-by: Christian Marangi static int airoha_alloc_gdm_port(struct airoha_eth *eth, struct device_node *np, int index) { -@@ -2950,6 +3079,12 @@ static int airoha_alloc_gdm_port(struct +@@ -2945,6 +3074,12 @@ static int airoha_alloc_gdm_port(struct if (err) return err; @@ -199,7 +199,7 @@ Signed-off-by: Christian Marangi err = register_netdev(dev); if (err) goto free_metadata_dst; -@@ -3065,6 +3200,10 @@ error_hw_cleanup: +@@ -3060,6 +3195,10 @@ error_hw_cleanup: if (port && port->dev->reg_state == NETREG_REGISTERED) { unregister_netdev(port->dev); airoha_metadata_dst_free(port); @@ -210,7 +210,7 @@ Signed-off-by: Christian Marangi } } free_netdev(eth->napi_dev); -@@ -3092,6 +3231,10 @@ static void airoha_remove(struct platfor +@@ -3087,6 +3226,10 @@ static void airoha_remove(struct platfor airoha_dev_stop(port->dev); unregister_netdev(port->dev); airoha_metadata_dst_free(port); diff --git a/target/linux/airoha/patches-6.12/604-02-net-ethernet-airoha-define-sport-value-for-GDM3.patch b/target/linux/airoha/patches-6.12/604-02-net-ethernet-airoha-define-sport-value-for-GDM3.patch index 5270c26e99..db0e9b4f48 100644 --- a/target/linux/airoha/patches-6.12/604-02-net-ethernet-airoha-define-sport-value-for-GDM3.patch +++ b/target/linux/airoha/patches-6.12/604-02-net-ethernet-airoha-define-sport-value-for-GDM3.patch @@ -14,7 +14,7 @@ Signed-off-by: Christian Marangi --- a/drivers/net/ethernet/airoha/airoha_eth.c +++ b/drivers/net/ethernet/airoha/airoha_eth.c -@@ -604,6 +604,9 @@ static int airoha_qdma_get_gdm_port(stru +@@ -599,6 +599,9 @@ static int airoha_qdma_get_gdm_port(stru case 0x18: port = 3; /* GDM4 */ break; diff --git a/target/linux/airoha/patches-6.12/606-net-airoha-disable-external-phy-code-if-PCS_AIROHA-i.patch b/target/linux/airoha/patches-6.12/606-net-airoha-disable-external-phy-code-if-PCS_AIROHA-i.patch index 4f65e111a2..1734019d53 100644 --- a/target/linux/airoha/patches-6.12/606-net-airoha-disable-external-phy-code-if-PCS_AIROHA-i.patch +++ b/target/linux/airoha/patches-6.12/606-net-airoha-disable-external-phy-code-if-PCS_AIROHA-i.patch @@ -28,7 +28,7 @@ Signed-off-by: Mikhail Kshevetskiy static void airoha_set_macaddr(struct airoha_gdm_port *port, const u8 *addr) { -@@ -1636,6 +1638,7 @@ static int airoha_dev_open(struct net_de +@@ -1631,6 +1633,7 @@ static int airoha_dev_open(struct net_de struct airoha_gdm_port *port = netdev_priv(dev); struct airoha_qdma *qdma = port->qdma; @@ -36,7 +36,7 @@ Signed-off-by: Mikhail Kshevetskiy if (airhoa_is_phy_external(port)) { err = phylink_of_phy_connect(port->phylink, dev->dev.of_node, 0); if (err) { -@@ -1646,6 +1649,7 @@ static int airoha_dev_open(struct net_de +@@ -1641,6 +1644,7 @@ static int airoha_dev_open(struct net_de phylink_start(port->phylink); } @@ -44,7 +44,7 @@ Signed-off-by: Mikhail Kshevetskiy netif_tx_start_all_queues(dev); err = airoha_set_vip_for_gdm_port(port, true); -@@ -1700,10 +1704,12 @@ static int airoha_dev_stop(struct net_de +@@ -1695,10 +1699,12 @@ static int airoha_dev_stop(struct net_de } } @@ -57,7 +57,7 @@ Signed-off-by: Mikhail Kshevetskiy return 0; } -@@ -2853,6 +2859,7 @@ static const struct ethtool_ops airoha_e +@@ -2848,6 +2854,7 @@ static const struct ethtool_ops airoha_e .get_link = ethtool_op_get_link, }; @@ -65,7 +65,7 @@ Signed-off-by: Mikhail Kshevetskiy static struct phylink_pcs *airoha_phylink_mac_select_pcs(struct phylink_config *config, phy_interface_t interface) { -@@ -2866,6 +2873,7 @@ static void airoha_mac_config(struct phy +@@ -2861,6 +2868,7 @@ static void airoha_mac_config(struct phy const struct phylink_link_state *state) { } @@ -73,7 +73,7 @@ Signed-off-by: Mikhail Kshevetskiy static int airoha_metadata_dst_alloc(struct airoha_gdm_port *port) { -@@ -2911,6 +2919,7 @@ bool airoha_is_valid_gdm_port(struct air +@@ -2906,6 +2914,7 @@ bool airoha_is_valid_gdm_port(struct air return false; } @@ -81,7 +81,7 @@ Signed-off-by: Mikhail Kshevetskiy static void airoha_mac_link_up(struct phylink_config *config, struct phy_device *phy, unsigned int mode, phy_interface_t interface, int speed, int duplex, bool tx_pause, bool rx_pause) -@@ -3003,6 +3012,7 @@ static int airoha_setup_phylink(struct n +@@ -2998,6 +3007,7 @@ static int airoha_setup_phylink(struct n return 0; } @@ -89,7 +89,7 @@ Signed-off-by: Mikhail Kshevetskiy static int airoha_alloc_gdm_port(struct airoha_eth *eth, struct device_node *np, int index) -@@ -3082,11 +3092,13 @@ static int airoha_alloc_gdm_port(struct +@@ -3077,11 +3087,13 @@ static int airoha_alloc_gdm_port(struct if (err) return err; @@ -103,7 +103,7 @@ Signed-off-by: Mikhail Kshevetskiy err = register_netdev(dev); if (err) -@@ -3203,10 +3215,12 @@ error_hw_cleanup: +@@ -3198,10 +3210,12 @@ error_hw_cleanup: if (port && port->dev->reg_state == NETREG_REGISTERED) { unregister_netdev(port->dev); airoha_metadata_dst_free(port); @@ -116,7 +116,7 @@ Signed-off-by: Mikhail Kshevetskiy } } free_netdev(eth->napi_dev); -@@ -3234,10 +3248,12 @@ static void airoha_remove(struct platfor +@@ -3229,10 +3243,12 @@ static void airoha_remove(struct platfor airoha_dev_stop(port->dev); unregister_netdev(port->dev); airoha_metadata_dst_free(port); -- 2.30.2