[PATCH 0/2] net: ipa: v5.18.2 backport to fix page free

[PATCH 0/2] net: ipa: v5.18.2 backport to fix page free

[Alex Elder]

This series back-ports two bug fixes that landed very late in v5.18
cycle and didn't make it to the final release.  They're present in
v5.19-rc1, but don't cherry-pick cleanly onto v5.18.2.

					-Alex

Alex Elder (2):
  net: ipa: fix page free in ipa_endpoint_trans_release()
  net: ipa: fix page free in ipa_endpoint_replenish_one()

 drivers/net/ipa/ipa_endpoint.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

-- 
2.32.0

[PATCH 1/2] net: ipa: fix page free in ipa_endpoint_trans_release()

[Alex Elder]

commit 155c0c90bca918de6e4327275dfc1d97fd604115 upstream.

Currently the (possibly compound) page used for receive buffers are
freed using __free_pages().  But according to this comment above the
definition of that function, that's wrong:
    If you want to use the page's reference count to decide when
    to free the allocation, you should allocate a compound page,
    and use put_page() instead of __free_pages().

Convert the call to __free_pages() in ipa_endpoint_trans_release()
to use put_page() instead.

Cc: <stable@vger.kernel.org>    # 5.18.x
Fixes: ed23f02680caa ("net: ipa: define per-endpoint receive buffer size")
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 drivers/net/ipa/ipa_endpoint.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c
index 53764f3c0c7e4..04a2aa0f120ac 100644
--- a/drivers/net/ipa/ipa_endpoint.c
+++ b/drivers/net/ipa/ipa_endpoint.c
@@ -1383,11 +1383,8 @@ void ipa_endpoint_trans_release(struct ipa_endpoint *endpoint,
 	} else {
 		struct page *page = trans->data;
 
-		if (page) {
-			u32 buffer_size = endpoint->data->rx.buffer_size;
-
-			__free_pages(page, get_order(buffer_size));
-		}
+		if (page)
+			put_page(page);
 	}
 }
 
-- 
2.32.0

[PATCH 2/2] net: ipa: fix page free in ipa_endpoint_replenish_one()

[Alex Elder]

commit 70132763d5d2e94cd185e3aa92ac6a3ba89068fa upstream.

Currently the (possibly compound) pages used for receive buffers are
freed using __free_pages().  But according to this comment above the
definition of that function, that's wrong:
    If you want to use the page's reference count to decide
    when to free the allocation, you should allocate a compound
    page, and use put_page() instead of __free_pages().

Convert the call to __free_pages() in ipa_endpoint_replenish_one()
to use put_page() instead.

Cc: <stable@vger.kernel.org>    # 5.18.x
Fixes: 6a606b90153b8 ("net: ipa: allocate transaction in replenish loop")
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 drivers/net/ipa/ipa_endpoint.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c
index 04a2aa0f120ac..5edb728e7100c 100644
--- a/drivers/net/ipa/ipa_endpoint.c
+++ b/drivers/net/ipa/ipa_endpoint.c
@@ -1060,7 +1060,7 @@ static int ipa_endpoint_replenish_one(struct ipa_endpoint *endpoint,
 
 	ret = gsi_trans_page_add(trans, page, len, offset);
 	if (ret)
-		__free_pages(page, get_order(buffer_size));
+		put_page(page);
 	else
 		trans->data = page;	/* transaction owns page now */
 
-- 
2.32.0

Re: [PATCH 0/2] net: ipa: v5.18.2 backport to fix page free

[Greg KH]

On Mon, Jun 06, 2022 at 09:15:46AM -0500, Alex Elder wrote:
> This series back-ports two bug fixes that landed very late in v5.18
> cycle and didn't make it to the final release.  They're present in
> v5.19-rc1, but don't cherry-pick cleanly onto v5.18.2.
> 
> 					-Alex
> 
> Alex Elder (2):
>   net: ipa: fix page free in ipa_endpoint_trans_release()
>   net: ipa: fix page free in ipa_endpoint_replenish_one()
> 
>  drivers/net/ipa/ipa_endpoint.c | 9 +++------
>  1 file changed, 3 insertions(+), 6 deletions(-)
> 
> -- 
> 2.32.0
> 

All now queued up, thanks,

greg k-h