FAILED: patch "[PATCH] bnxt_en: Propagate TPA buffer allocation failures in" failed to apply to 6.12-stable tree
[email protected]
maintainerThe patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x b814dfbfeb0a68c9a52073f2caa05a2d5247a329
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026091638-excretory-liquid-7149@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b814dfbfeb0a68c9a52073f2caa05a2d5247a329 Mon Sep 17 00:00:00 2001
From: Joe Damato <[email protected]>
Date: Tue, 1 Sep 2026 18:56:46 -0700
Subject: [PATCH] bnxt_en: Propagate TPA buffer allocation failures in
bnxt_queue_mem_alloc()
bnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr->rx_tpa[] entries zeroed.
bnxt_queue_mem_alloc() discards that return value, so the partially initialized ring is installed by bnxt_queue_start().
Since the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps it to a SW index in rxr->rx_tpa[], it is possible that an uninitialized slot can be chosen which would hand a zero DMA address to the device.
Fix this by checking the return value of bnxt_alloc_one_tpa_info_data and unwinding, freeing the ring buffers.
drivers/net/ethernet/broadcom/bnxt/bnxt.c +7 -2
@@ -16402,11 +16402,16 @@ static int bnxt_queue_mem_alloc(struct net_device *dev,bnxt_alloc_one_rx_ring_skb (bp, clone, idx);if (bp->flags &BNXT_FLAG_AGG_RINGS )bnxt_alloc_one_rx_ring_netmem (bp, clone, idx); -if (bp->flags &BNXT_FLAG_TPA ) -bnxt_alloc_one_tpa_info_data (bp, clone); +if (bp->flags &BNXT_FLAG_TPA ) { + rc =bnxt_alloc_one_tpa_info_data (bp, clone); +if (rc) + goto err_free_rx_ring_skbs; + }return 0 ; +err_free_rx_ring_skbs: +bnxt_free_one_rx_ring_skbs (bp, clone); err_free_tpa_info:bnxt_free_one_tpa_info (bp, clone); err_free_rx_agg_ring:
Sasha Levin
maintainerPATCH 1/4 netmem: add a couple of page helper wrappers
From: Alexander Lobakin <[email protected]>
[ Upstream commit 9bd9f72a74344b54cfb6fcabf1173e6c6e5c6952 ]
Add the following netmem counterparts:
* virt_to_netmem() -- simple page_to_netmem(virt_to_page()) wrapper;
* netmem_is_pfmemalloc() -- page_is_pfmemalloc() for page-backed
netmems, false otherwise;
and the following "unsafe" versions:
* __netmem_to_page()
* __netmem_get_pp()
* __netmem_address()
They do the same as their non-underscored buddies, but assume the netmem is always page-backed. When working with header &page_pools, you don't need to check whether netmem belongs to the host memory and you can never get NULL instead of &page. Checks for the LSB, clearing the LSB, branches take cycles and increase object code size, sometimes significantly. When you're sure your PP is always host, you can avoid this by using the underscored counterparts.
Stable-dep-of: b814dfbfeb0a ("bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()")
--- include/net/netmem.h | 78 ++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 76 insertions(+), 2 deletions(-)
include/net/netmem.h +76 -2
@@ -72,6 +72,22 @@ static inline bool netmem_is_net_iov(const netmem_ref netmem)return (__force unsigned long )netmem &NET_IOV ; } +/** +* __netmem_to_page - unsafely get pointer to the &page backing @netmem +* @netmem: netmem reference to convert +* +* Unsafe version of netmem_to_page(). When @netmem is always page-backed, +* e.g. when it's a header buffer, performs faster and generates smaller +* object code (no check for the LSB, no WARN). When @netmem points to IOV, +* provokes undefined behaviour. +* +* Return: pointer to the &page (garbage if @netmem is not page-backed). +*/ +static inline struct page *__netmem_to_page (netmem_ref netmem) +{ +return (__force struct page *)netmem; +} +/* This conversion fails (returns NULL) if the netmem_ref is not struct page * backed. */
@@ -80,7 +96,7 @@ static inline struct page *netmem_to_page(netmem_ref netmem)if (WARN_ON_ONCE (netmem_is_net_iov (netmem)))return NULL ; -return (__force struct page *)netmem; +return __netmem_to_page (netmem); }static inline struct net_iov *netmem_to_net_iov (netmem_ref netmem)
@@ -103,6 +119,17 @@ static inline netmem_ref page_to_netmem(struct page *page)return (__force netmem_ref )page; } +/** +* virt_to_netmem - convert virtual memory pointer to a netmem reference +* @data: host memory pointer to convert +* +* Return: netmem reference to the &page backing this virtual address. +*/ +static inline netmem_ref virt_to_netmem (const void *data) +{ +return page_to_netmem (virt_to_page (data)); +} +static inline int netmem_ref_count (netmem_ref netmem) {/* The non-pp refcount of net_iov is always 1. On net_iov, we only
@@ -127,6 +154,22 @@ static inline struct net_iov *__netmem_clear_lsb(netmem_ref netmem)return (struct net_iov *)((__force unsigned long )netmem & ~NET_IOV ); } +/** +* __netmem_get_pp - unsafely get pointer to the &page_pool backing @netmem +* @netmem: netmem reference to get the pointer from +* +* Unsafe version of netmem_get_pp(). When @netmem is always page-backed, +* e.g. when it's a header buffer, performs faster and generates smaller +* object code (avoids clearing the LSB). When @netmem points to IOV, +* provokes invalid memory access. +* +* Return: pointer to the &page_pool (garbage if @netmem is not page-backed). +*/ +static inline struct page_pool *__netmem_get_pp (netmem_ref netmem) +{ +return __netmem_to_page (netmem)->pp; +} +static inline struct page_pool *netmem_get_pp (netmem_ref netmem) {return __netmem_clear_lsb (netmem)->pp;
@@ -158,12 +201,43 @@ static inline netmem_ref netmem_compound_head(netmem_ref netmem)return page_to_netmem (compound_head (netmem_to_page (netmem))); } +/** +* __netmem_address - unsafely get pointer to the memory backing @netmem +* @netmem: netmem reference to get the pointer for +* +* Unsafe version of netmem_address(). When @netmem is always page-backed, +* e.g. when it's a header buffer, performs faster and generates smaller +* object code (no check for the LSB). When @netmem points to IOV, provokes +* undefined behaviour. +* +* Return: pointer to the memory (garbage if @netmem is not page-backed). +*/ +static inline void *__netmem_address (netmem_ref netmem) +{ +return page_address (__netmem_to_page (netmem)); +} +static inline void *netmem_address (netmem_ref netmem) {if (netmem_is_net_iov (netmem))return NULL ; -return page_address (netmem_to_page (netmem)); +return __netmem_address (netmem); +} + +/** +* netmem_is_pfmemalloc - check if @netmem was allocated under memory pressure +* @netmem: netmem reference to check +* +* Return: true if @netmem is page-backed and the page was allocated under +* memory pressure, false otherwise. +*/ +static inline bool netmem_is_pfmemalloc (netmem_ref netmem) +{ +if (netmem_is_net_iov (netmem)) +return false; + +return page_is_pfmemalloc (netmem_to_page (netmem)); }static inline unsigned long netmem_get_dma_addr (netmem_ref netmem)
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/4 net: page_pool: rename page_pool_alloc_netmem to *_netmems
From: Mina Almasry <[email protected]>
[ Upstream commit 91a152cbb49c26609d217cf2f116d46143b9b8be ]
page_pool_alloc_netmem (without an s) was the mirror of page_pool_alloc_pages (with an s), which was confusing.
Rename to page_pool_alloc_netmems so it's the mirror of page_pool_alloc_pages.
Stable-dep-of: b814dfbfeb0a ("bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()")
--- include/net/page_pool/types.h | 2 +- net/core/page_pool.c | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-)
include/net/page_pool/types.h +1 -1
@@ -252,7 +252,7 @@ struct page_pool { };struct page *page_pool_alloc_pages (struct page_pool *pool,gfp_t gfp); -netmem_ref page_pool_alloc_netmem (struct page_pool *pool,gfp_t gfp); +netmem_ref page_pool_alloc_netmems (struct page_pool *pool,gfp_t gfp);struct page *page_pool_alloc_frag (struct page_pool *pool,unsigned int *offset,unsigned int size,gfp_t gfp); netmem_ref page_pool_alloc_frag_netmem(struct page_pool *pool,
net/core/page_pool.c +4 -4
@@ -673,7 +673,7 @@ static noinline netmem_ref __page_pool_alloc_pages_slow(struct page_pool *pool,/* For using page_pool replace: alloc_pages() API calls, but provide * synchronization guarantee for allocation side. */ -netmem_ref page_pool_alloc_netmem (struct page_pool *pool,gfp_t gfp) +netmem_ref page_pool_alloc_netmems (struct page_pool *pool,gfp_t gfp) {netmem_ref netmem;
@@ -689,11 +689,11 @@ netmem_ref page_pool_alloc_netmem(struct page_pool *pool, gfp_t gfp) netmem =__page_pool_alloc_pages_slow (pool, gfp);return netmem; } -EXPORT_SYMBOL (page_pool_alloc_netmem); +EXPORT_SYMBOL (page_pool_alloc_netmems);struct page *page_pool_alloc_pages (struct page_pool *pool,gfp_t gfp) { -return netmem_to_page (page_pool_alloc_netmem (pool, gfp)); +return netmem_to_page (page_pool_alloc_netmems (pool, gfp)); }EXPORT_SYMBOL (page_pool_alloc_pages);ALLOW_ERROR_INJECTION (page_pool_alloc_pages,NULL );
@@ -1051,7 +1051,7 @@ netmem_ref page_pool_alloc_frag_netmem(struct page_pool *pool, }if (!netmem) { - netmem =page_pool_alloc_netmem (pool, gfp); + netmem =page_pool_alloc_netmems (pool, gfp);if (unlikely (!netmem)) { pool->frag_page =0 ;return 0 ;
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/4 page_pool: disable sync for cpu for dmabuf memory provider
In reply to Sasha LevinFrom: Mina Almasry <[email protected]>
[ Upstream commit 7dba339faae991a23c54f7b93a58798c58f8c16f ]
dmabuf dma-addresses should not be dma_sync'd for CPU/device. Typically its the driver responsibility to dma_sync for CPU, but the driver should not dma_sync for CPU if the netmem is actually coming from a dmabuf memory provider.
The page_pool already exposes a helper for dma_sync_for_cpu:page_pool_dma_sync_for_cpu. Upgrade this existing helper to handle netmem, and have it skip dma_sync if the memory is from a dmabuf memory provider. Drivers should migrate to using this helper when adding support for netmem.
Also minimize the impact on the dma syncing performance for pages. Special case the dma-sync path for pages to not go through the overhead checks for dma-syncing and conversion to netmem.
Stable-dep-of: b814dfbfeb0a ("bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()")
--- include/net/page_pool/helpers.h | 35 ++++++++++++++++++++++++++++----- include/net/page_pool/types.h | 3 ++- net/core/devmem.c | 1 + net/core/page_pool.c | 1 + 4 files changed, 34 insertions(+), 6 deletions(-)
include/net/page_pool/helpers.h +30 -5
@@ -418,7 +418,21 @@ static inline dma_addr_t page_pool_get_dma_addr_netmem(netmem_ref netmem)*/ static inline dma_addr_t page_pool_get_dma_addr (const struct page *page) { -return page_pool_get_dma_addr_netmem (page_to_netmem ((struct page *)page)); +dma_addr_t ret = page->dma_addr; + +if (PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA ) + ret <<=PAGE_SHIFT ; + +return ret; +} + +static inline void __page_pool_dma_sync_for_cpu (const struct page_pool *pool, +const dma_addr_t dma_addr, +u32 offset,u32 dma_sync_size) +{ +dma_sync_single_range_for_cpu (pool->p.dev, dma_addr, + offset + pool->p.offset, dma_sync_size, +page_pool_get_dma_dir (pool)); }/**
@@ -437,10 +451,21 @@ static inline void page_pool_dma_sync_for_cpu(const struct page_pool *pool,const struct page *page, u32 offset, u32 dma_sync_size) { - dma_sync_single_range_for_cpu(pool->p.dev, -page_pool_get_dma_addr (page ), - offset + pool->p.offset, dma_sync_size, -page_pool_get_dma_dir (pool )); +__page_pool_dma_sync_for_cpu (pool ,page_pool_get_dma_addr (page ),offset , +dma_sync_size ); +} + +static inline void +page_pool_dma_sync_netmem_for_cpu (const struct page_pool *pool, +const netmem_ref netmem,u32 offset, +u32 dma_sync_size) +{ +if (!pool->dma_sync_for_cpu) +return ; + +__page_pool_dma_sync_for_cpu (pool, +page_pool_get_dma_addr_netmem (netmem), + offset, dma_sync_size); }static inline bool page_pool_put (struct page_pool *pool)
include/net/page_pool/types.h +2 -1
@@ -171,7 +171,8 @@ struct page_pool { bool has_init_callback:1; /* slow::init_callback is set */ bool dma_map:1; /* Perform DMA mapping */ - bool dma_sync:1; /* Perform DMA sync */ + bool dma_sync:1; /* Perform DMA sync for device */ + bool dma_sync_for_cpu:1; /* Perform DMA sync for cpu */#ifdef CONFIG_PAGE_POOL_STATS bool system:1; /* This is a global percpu pool */#endif
net/core/devmem.c +1 -0
@@ -343,6 +343,7 @@ int mp_dmabuf_devmem_init(struct page_pool *pool)* dma_sync_for_cpu/device. Force disable dma_sync. */ pool->dma_sync = false; + pool->dma_sync_for_cpu = false;if (pool->p.order !=0 )return -E2BIG ;
net/core/page_pool.c +1 -0
@@ -203,6 +203,7 @@ static int page_pool_init(struct page_pool *pool,memcpy (&pool->slow, ¶ms->slow,sizeof (pool->slow)); pool->cpuid = cpuid; + pool->dma_sync_for_cpu = true;/* Validate only known flags were used */ if (pool->slow.flags & ~PP_FLAG_ALL )
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 4/4 bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()
In reply to Sasha LevinFrom: Joe Damato <[email protected]>
[ Upstream commit b814dfbfeb0a68c9a52073f2caa05a2d5247a329 ]
bnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr->rx_tpa[] entries zeroed.
bnxt_queue_mem_alloc() discards that return value, so the partially initialized ring is installed by bnxt_queue_start().
Since the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps it to a SW index in rxr->rx_tpa[], it is possible that an uninitialized slot can be chosen which would hand a zero DMA address to the device.
Fix this by checking the return value of bnxt_alloc_one_tpa_info_data and unwinding, freeing the ring buffers.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +7 -2
@@ -15417,11 +15417,16 @@ static int bnxt_queue_mem_alloc(struct net_device *dev, void *qmem, int idx)bnxt_alloc_one_rx_ring_skb (bp, clone, idx);if (bp->flags &BNXT_FLAG_AGG_RINGS )bnxt_alloc_one_rx_ring_page (bp, clone, idx); -if (bp->flags &BNXT_FLAG_TPA ) -bnxt_alloc_one_tpa_info_data (bp, clone); +if (bp->flags &BNXT_FLAG_TPA ) { + rc =bnxt_alloc_one_tpa_info_data (bp, clone); +if (rc) + goto err_free_rx_ring_skbs; + }return 0 ; +err_free_rx_ring_skbs: +bnxt_free_one_rx_ring_skbs (bp, clone); err_free_tpa_info:bnxt_free_one_tpa_info (bp, clone); err_free_rx_agg_ring:
Signature · 1 line
2.53.0