[openwrt/openwrt] airoha: backport minor fixes for NPU handling
LEDE Commits
lede-commits at lists.infradead.org
Wed Oct 29 07:16:56 PDT 2025
ansuel pushed a commit to openwrt/openwrt.git, branch main:
https://git.openwrt.org/83eacb6ab0596634131aa90510e52159cef08b93
commit 83eacb6ab0596634131aa90510e52159cef08b93
Author: Christian Marangi <ansuelsmth at gmail.com>
AuthorDate: Wed Oct 29 15:15:53 2025 +0100
airoha: backport minor fixes for NPU handling
Backport upstream minor fixed for NPU handling that might result in
kernel panic or handle leak.
Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
---
...-airoha-Fix-a-copy-and-paste-bug-in-probe.patch | 37 +++++++++++++++++++
...Get-rid-of-dma_sync_single_for_device-in-.patch | 40 +++++++++++++++++++++
...fix-potential-use-after-free-in-airoha_np.patch | 41 ++++++++++++++++++++++
...2-net-airoha-deassert-XSI-line-on-hw-init.patch | 2 +-
...add-reference-for-SPORT-GDM4-in-qdma_get_.patch | 2 +-
...add-initial-fixup-for-GDM3-4-port-support.patch | 2 +-
...116-07-airoha-ethernet-drop-xsi-mac-reset.patch | 4 +--
...net-airoha-add-phylink-support-for-GDM2-4.patch | 14 ++++----
...hernet-airoha-define-sport-value-for-GDM3.patch | 2 +-
...disable-external-phy-code-if-PCS_AIROHA-i.patch | 20 +++++------
10 files changed, 141 insertions(+), 23 deletions(-)
diff --git a/target/linux/airoha/patches-6.12/104-6.19-net-airoha-Fix-a-copy-and-paste-bug-in-probe.patch b/target/linux/airoha/patches-6.12/104-6.19-net-airoha-Fix-a-copy-and-paste-bug-in-probe.patch
new file mode 100644
index 0000000000..e87035ec54
--- /dev/null
+++ b/target/linux/airoha/patches-6.12/104-6.19-net-airoha-Fix-a-copy-and-paste-bug-in-probe.patch
@@ -0,0 +1,37 @@
+From 05e090620bacf317020f9591cfff8926093380bd Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter at linaro.org>
+Date: Fri, 24 Oct 2025 14:23:35 +0300
+Subject: [PATCH] net: airoha: Fix a copy and paste bug in probe()
+
+This code has a copy and paste bug where it accidentally checks "if (err)"
+instead of checking if "xsi_rsts" is NULL. Also, as a free bonus, I
+changed the allocation from kzalloc() to kcalloc() which is a kernel
+hardening measure to protect against integer overflows.
+
+Fixes: 5863b4e065e2 ("net: airoha: Add airoha_eth_soc_data struct")
+Signed-off-by: Dan Carpenter <dan.carpenter at linaro.org>
+Acked-by: Lorenzo Bianconi <lorenzo at kernel.org>
+Link: https://patch.msgid.link/aPtht6y5DRokn9zv@stanley.mountain
+Signed-off-by: Jakub Kicinski <kuba at kernel.org>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -2990,11 +2990,11 @@ static int airoha_probe(struct platform_
+ return err;
+ }
+
+- xsi_rsts = devm_kzalloc(eth->dev,
+- eth->soc->num_xsi_rsts * sizeof(*xsi_rsts),
++ xsi_rsts = devm_kcalloc(eth->dev,
++ eth->soc->num_xsi_rsts, sizeof(*xsi_rsts),
+ GFP_KERNEL);
+- if (err)
+- return err;
++ if (!xsi_rsts)
++ return -ENOMEM;
+
+ eth->xsi_rsts = xsi_rsts;
+ for (i = 0; i < eth->soc->num_xsi_rsts; i++)
diff --git a/target/linux/airoha/patches-6.12/105-6.17-net-airoha-Get-rid-of-dma_sync_single_for_device-in-.patch b/target/linux/airoha/patches-6.12/105-6.17-net-airoha-Get-rid-of-dma_sync_single_for_device-in-.patch
new file mode 100644
index 0000000000..0c690b0d65
--- /dev/null
+++ b/target/linux/airoha/patches-6.12/105-6.17-net-airoha-Get-rid-of-dma_sync_single_for_device-in-.patch
@@ -0,0 +1,40 @@
+From 4cd9d227ab838b3590c4b27e3707b8c3ef14d7e9 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo at kernel.org>
+Date: Wed, 25 Jun 2025 16:43:15 +0200
+Subject: [PATCH] net: airoha: Get rid of dma_sync_single_for_device() in
+ airoha_qdma_fill_rx_queue()
+
+Since the page_pool for airoha_eth driver is created with
+PP_FLAG_DMA_SYNC_DEV flag, we do not need to sync_for_device each page
+received from the pool since it is already done by the page_pool codebase.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo at kernel.org>
+Reviewed-by: Alexander Lobakin <aleksander.lobakin at intel.com>
+Link: https://patch.msgid.link/20250625-airoha-sync-for-device-v1-1-923741deaabf@kernel.org
+Signed-off-by: Jakub Kicinski <kuba at kernel.org>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -539,9 +539,7 @@ static int airoha_fe_init(struct airoha_
+
+ static int airoha_qdma_fill_rx_queue(struct airoha_queue *q)
+ {
+- enum dma_data_direction dir = page_pool_get_dma_dir(q->page_pool);
+ struct airoha_qdma *qdma = q->qdma;
+- struct airoha_eth *eth = qdma->eth;
+ int qid = q - &qdma->q_rx[0];
+ int nframes = 0;
+
+@@ -565,9 +563,6 @@ static int airoha_qdma_fill_rx_queue(str
+ e->dma_addr = page_pool_get_dma_addr(page) + offset;
+ e->dma_len = SKB_WITH_OVERHEAD(q->buf_size);
+
+- dma_sync_single_for_device(eth->dev, e->dma_addr, e->dma_len,
+- dir);
+-
+ val = FIELD_PREP(QDMA_DESC_LEN_MASK, e->dma_len);
+ WRITE_ONCE(desc->ctrl, cpu_to_le32(val));
+ WRITE_ONCE(desc->addr, cpu_to_le32(e->dma_addr));
diff --git a/target/linux/airoha/patches-6.12/106-6.16-net-airoha-fix-potential-use-after-free-in-airoha_np.patch b/target/linux/airoha/patches-6.12/106-6.16-net-airoha-fix-potential-use-after-free-in-airoha_np.patch
new file mode 100644
index 0000000000..251395c751
--- /dev/null
+++ b/target/linux/airoha/patches-6.12/106-6.16-net-airoha-fix-potential-use-after-free-in-airoha_np.patch
@@ -0,0 +1,41 @@
+From 3cd582e7d0787506990ef0180405eb6224fa90a6 Mon Sep 17 00:00:00 2001
+From: Alok Tiwari <alok.a.tiwari at oracle.com>
+Date: Tue, 15 Jul 2025 07:30:58 -0700
+Subject: [PATCH] net: airoha: fix potential use-after-free in airoha_npu_get()
+
+np->name was being used after calling of_node_put(np), which
+releases the node and can lead to a use-after-free bug.
+Previously, of_node_put(np) was called unconditionally after
+of_find_device_by_node(np), which could result in a use-after-free if
+pdev is NULL.
+
+This patch moves of_node_put(np) after the error check to ensure
+the node is only released after both the error and success cases
+are handled appropriately, preventing potential resource issues.
+
+Fixes: 23290c7bc190 ("net: airoha: Introduce Airoha NPU support")
+Signed-off-by: Alok Tiwari <alok.a.tiwari at oracle.com>
+Reviewed-by: Andrew Lunn <andrew at lunn.ch>
+Link: https://patch.msgid.link/20250715143102.3458286-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba at kernel.org>
+---
+ drivers/net/ethernet/airoha/airoha_npu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_npu.c
++++ b/drivers/net/ethernet/airoha/airoha_npu.c
+@@ -567,12 +567,13 @@ struct airoha_npu *airoha_npu_get(struct
+ return ERR_PTR(-ENODEV);
+
+ pdev = of_find_device_by_node(np);
+- of_node_put(np);
+
+ if (!pdev) {
+ dev_err(dev, "cannot find device node %s\n", np->name);
++ of_node_put(np);
+ return ERR_PTR(-ENODEV);
+ }
++ of_node_put(np);
+
+ if (!try_module_get(THIS_MODULE)) {
+ dev_err(dev, "failed to get the device driver module\n");
diff --git a/target/linux/airoha/patches-6.12/116-02-net-airoha-deassert-XSI-line-on-hw-init.patch b/target/linux/airoha/patches-6.12/116-02-net-airoha-deassert-XSI-line-on-hw-init.patch
index 85af65e3b4..d7e312dfcf 100644
--- a/target/linux/airoha/patches-6.12/116-02-net-airoha-deassert-XSI-line-on-hw-init.patch
+++ b/target/linux/airoha/patches-6.12/116-02-net-airoha-deassert-XSI-line-on-hw-init.patch
@@ -13,7 +13,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -1388,6 +1388,10 @@ static int airoha_hw_init(struct platfor
+@@ -1383,6 +1383,10 @@ static int airoha_hw_init(struct platfor
if (err)
return err;
diff --git a/target/linux/airoha/patches-6.12/116-03-net-airoha-add-reference-for-SPORT-GDM4-in-qdma_get_.patch b/target/linux/airoha/patches-6.12/116-03-net-airoha-add-reference-for-SPORT-GDM4-in-qdma_get_.patch
index cf6520dd53..2407246861 100644
--- a/target/linux/airoha/patches-6.12/116-03-net-airoha-add-reference-for-SPORT-GDM4-in-qdma_get_.patch
+++ b/target/linux/airoha/patches-6.12/116-03-net-airoha-add-reference-for-SPORT-GDM4-in-qdma_get_.patch
@@ -16,7 +16,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -593,8 +593,11 @@ static int airoha_qdma_get_gdm_port(stru
+@@ -588,8 +588,11 @@ static int airoha_qdma_get_gdm_port(stru
sport = FIELD_GET(QDMA_ETH_RXMSG_SPORT_MASK, msg1);
switch (sport) {
diff --git a/target/linux/airoha/patches-6.12/116-06-net-airoha-add-initial-fixup-for-GDM3-4-port-support.patch b/target/linux/airoha/patches-6.12/116-06-net-airoha-add-initial-fixup-for-GDM3-4-port-support.patch
index f56e3b9356..7b395bfcb7 100644
--- a/target/linux/airoha/patches-6.12/116-06-net-airoha-add-initial-fixup-for-GDM3-4-port-support.patch
+++ b/target/linux/airoha/patches-6.12/116-06-net-airoha-add-initial-fixup-for-GDM3-4-port-support.patch
@@ -28,7 +28,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
airoha_fe_crsn_qsel_init(eth);
-@@ -1630,7 +1632,8 @@ static int airoha_dev_open(struct net_de
+@@ -1625,7 +1627,8 @@ static int airoha_dev_open(struct net_de
if (err)
return err;
diff --git a/target/linux/airoha/patches-6.12/116-07-airoha-ethernet-drop-xsi-mac-reset.patch b/target/linux/airoha/patches-6.12/116-07-airoha-ethernet-drop-xsi-mac-reset.patch
index a8a9e64802..508ae97154 100644
--- a/target/linux/airoha/patches-6.12/116-07-airoha-ethernet-drop-xsi-mac-reset.patch
+++ b/target/linux/airoha/patches-6.12/116-07-airoha-ethernet-drop-xsi-mac-reset.patch
@@ -15,7 +15,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -3100,7 +3100,6 @@ static void airoha_remove(struct platfor
+@@ -3095,7 +3095,6 @@ static void airoha_remove(struct platfor
}
static const char * const en7581_xsi_rsts_names[] = {
@@ -23,7 +23,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
"hsi0-mac",
"hsi1-mac",
"hsi-mac",
-@@ -3132,7 +3131,6 @@ static int airoha_en7581_get_src_port_id
+@@ -3127,7 +3126,6 @@ static int airoha_en7581_get_src_port_id
}
static const char * const an7583_xsi_rsts_names[] = {
diff --git a/target/linux/airoha/patches-6.12/116-10-net-airoha-add-phylink-support-for-GDM2-4.patch b/target/linux/airoha/patches-6.12/116-10-net-airoha-add-phylink-support-for-GDM2-4.patch
index eb6b249b21..8ce66b706a 100644
--- a/target/linux/airoha/patches-6.12/116-10-net-airoha-add-phylink-support-for-GDM2-4.patch
+++ b/target/linux/airoha/patches-6.12/116-10-net-airoha-add-phylink-support-for-GDM2-4.patch
@@ -35,7 +35,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
static void airoha_set_macaddr(struct airoha_gdm_port *port, const u8 *addr)
{
struct airoha_eth *eth = port->qdma->eth;
-@@ -1627,6 +1633,17 @@ static int airoha_dev_open(struct net_de
+@@ -1622,6 +1628,17 @@ static int airoha_dev_open(struct net_de
struct airoha_gdm_port *port = netdev_priv(dev);
struct airoha_qdma *qdma = port->qdma;
@@ -53,7 +53,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
netif_tx_start_all_queues(dev);
err = airoha_set_vip_for_gdm_port(port, true);
if (err)
-@@ -1680,6 +1697,11 @@ static int airoha_dev_stop(struct net_de
+@@ -1675,6 +1692,11 @@ static int airoha_dev_stop(struct net_de
}
}
@@ -65,7 +65,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
return 0;
}
-@@ -2828,6 +2850,20 @@ static const struct ethtool_ops airoha_e
+@@ -2823,6 +2845,20 @@ static const struct ethtool_ops airoha_e
.get_link = ethtool_op_get_link,
};
@@ -86,7 +86,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
static int airoha_metadata_dst_alloc(struct airoha_gdm_port *port)
{
int i;
-@@ -2872,6 +2908,99 @@ bool airoha_is_valid_gdm_port(struct air
+@@ -2867,6 +2903,99 @@ bool airoha_is_valid_gdm_port(struct air
return false;
}
@@ -186,7 +186,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
static int airoha_alloc_gdm_port(struct airoha_eth *eth,
struct device_node *np, int index)
{
-@@ -2950,6 +3079,12 @@ static int airoha_alloc_gdm_port(struct
+@@ -2945,6 +3074,12 @@ static int airoha_alloc_gdm_port(struct
if (err)
return err;
@@ -199,7 +199,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
err = register_netdev(dev);
if (err)
goto free_metadata_dst;
-@@ -3065,6 +3200,10 @@ error_hw_cleanup:
+@@ -3060,6 +3195,10 @@ error_hw_cleanup:
if (port && port->dev->reg_state == NETREG_REGISTERED) {
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);
@@ -210,7 +210,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
}
}
free_netdev(eth->napi_dev);
-@@ -3092,6 +3231,10 @@ static void airoha_remove(struct platfor
+@@ -3087,6 +3226,10 @@ static void airoha_remove(struct platfor
airoha_dev_stop(port->dev);
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);
diff --git a/target/linux/airoha/patches-6.12/604-02-net-ethernet-airoha-define-sport-value-for-GDM3.patch b/target/linux/airoha/patches-6.12/604-02-net-ethernet-airoha-define-sport-value-for-GDM3.patch
index 5270c26e99..db0e9b4f48 100644
--- a/target/linux/airoha/patches-6.12/604-02-net-ethernet-airoha-define-sport-value-for-GDM3.patch
+++ b/target/linux/airoha/patches-6.12/604-02-net-ethernet-airoha-define-sport-value-for-GDM3.patch
@@ -14,7 +14,7 @@ Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -604,6 +604,9 @@ static int airoha_qdma_get_gdm_port(stru
+@@ -599,6 +599,9 @@ static int airoha_qdma_get_gdm_port(stru
case 0x18:
port = 3; /* GDM4 */
break;
diff --git a/target/linux/airoha/patches-6.12/606-net-airoha-disable-external-phy-code-if-PCS_AIROHA-i.patch b/target/linux/airoha/patches-6.12/606-net-airoha-disable-external-phy-code-if-PCS_AIROHA-i.patch
index 4f65e111a2..1734019d53 100644
--- a/target/linux/airoha/patches-6.12/606-net-airoha-disable-external-phy-code-if-PCS_AIROHA-i.patch
+++ b/target/linux/airoha/patches-6.12/606-net-airoha-disable-external-phy-code-if-PCS_AIROHA-i.patch
@@ -28,7 +28,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy at iopsys.eu>
static void airoha_set_macaddr(struct airoha_gdm_port *port, const u8 *addr)
{
-@@ -1636,6 +1638,7 @@ static int airoha_dev_open(struct net_de
+@@ -1631,6 +1633,7 @@ static int airoha_dev_open(struct net_de
struct airoha_gdm_port *port = netdev_priv(dev);
struct airoha_qdma *qdma = port->qdma;
@@ -36,7 +36,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy at iopsys.eu>
if (airhoa_is_phy_external(port)) {
err = phylink_of_phy_connect(port->phylink, dev->dev.of_node, 0);
if (err) {
-@@ -1646,6 +1649,7 @@ static int airoha_dev_open(struct net_de
+@@ -1641,6 +1644,7 @@ static int airoha_dev_open(struct net_de
phylink_start(port->phylink);
}
@@ -44,7 +44,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy at iopsys.eu>
netif_tx_start_all_queues(dev);
err = airoha_set_vip_for_gdm_port(port, true);
-@@ -1700,10 +1704,12 @@ static int airoha_dev_stop(struct net_de
+@@ -1695,10 +1699,12 @@ static int airoha_dev_stop(struct net_de
}
}
@@ -57,7 +57,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy at iopsys.eu>
return 0;
}
-@@ -2853,6 +2859,7 @@ static const struct ethtool_ops airoha_e
+@@ -2848,6 +2854,7 @@ static const struct ethtool_ops airoha_e
.get_link = ethtool_op_get_link,
};
@@ -65,7 +65,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy at iopsys.eu>
static struct phylink_pcs *airoha_phylink_mac_select_pcs(struct phylink_config *config,
phy_interface_t interface)
{
-@@ -2866,6 +2873,7 @@ static void airoha_mac_config(struct phy
+@@ -2861,6 +2868,7 @@ static void airoha_mac_config(struct phy
const struct phylink_link_state *state)
{
}
@@ -73,7 +73,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy at iopsys.eu>
static int airoha_metadata_dst_alloc(struct airoha_gdm_port *port)
{
-@@ -2911,6 +2919,7 @@ bool airoha_is_valid_gdm_port(struct air
+@@ -2906,6 +2914,7 @@ bool airoha_is_valid_gdm_port(struct air
return false;
}
@@ -81,7 +81,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy at iopsys.eu>
static void airoha_mac_link_up(struct phylink_config *config, struct phy_device *phy,
unsigned int mode, phy_interface_t interface,
int speed, int duplex, bool tx_pause, bool rx_pause)
-@@ -3003,6 +3012,7 @@ static int airoha_setup_phylink(struct n
+@@ -2998,6 +3007,7 @@ static int airoha_setup_phylink(struct n
return 0;
}
@@ -89,7 +89,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy at iopsys.eu>
static int airoha_alloc_gdm_port(struct airoha_eth *eth,
struct device_node *np, int index)
-@@ -3082,11 +3092,13 @@ static int airoha_alloc_gdm_port(struct
+@@ -3077,11 +3087,13 @@ static int airoha_alloc_gdm_port(struct
if (err)
return err;
@@ -103,7 +103,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy at iopsys.eu>
err = register_netdev(dev);
if (err)
-@@ -3203,10 +3215,12 @@ error_hw_cleanup:
+@@ -3198,10 +3210,12 @@ error_hw_cleanup:
if (port && port->dev->reg_state == NETREG_REGISTERED) {
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);
@@ -116,7 +116,7 @@ Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy at iopsys.eu>
}
}
free_netdev(eth->napi_dev);
-@@ -3234,10 +3248,12 @@ static void airoha_remove(struct platfor
+@@ -3229,10 +3243,12 @@ static void airoha_remove(struct platfor
airoha_dev_stop(port->dev);
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);
More information about the lede-commits
mailing list