airoha: backport minor fixes for NPU handling

Backport upstream minor fixed for NPU handling that might result in
kernel panic or handle leak.

(cherry picked from commit 83eacb6ab0596634131aa90510e52159cef08b93)
[ fix conflict errors ]
Signed-off-by: Christian Marangi <[email protected]>

target/linux/airoha/patches-6.6/104-6.19-net-airoha-Fix-a-copy-and-paste-bug-in-probe.patch

@@ -0,0 +1,37 @@
+From 05e090620bacf317020f9591cfff8926093380bd Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <[email protected]>
+Date: Fri, 24 Oct 2025 14:23:35 +0300
+Subject: [PATCH] net: airoha: Fix a copy and paste bug in probe()
+
+This code has a copy and paste bug where it accidentally checks "if (err)"
+instead of checking if "xsi_rsts" is NULL.  Also, as a free bonus, I
+changed the allocation from kzalloc() to  kcalloc() which is a kernel
+hardening measure to protect against integer overflows.
+
+Fixes: 5863b4e065e2 ("net: airoha: Add airoha_eth_soc_data struct")
+Signed-off-by: Dan Carpenter <[email protected]>
+Acked-by: Lorenzo Bianconi <[email protected]>
+Link: https://patch.msgid.link/[email protected]
+Signed-off-by: Jakub Kicinski <[email protected]>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -2990,11 +2990,11 @@ static int airoha_probe(struct platform_
+ 		return err;
+ 	}
+ 
+-	xsi_rsts = devm_kzalloc(eth->dev,
+-				eth->soc->num_xsi_rsts * sizeof(*xsi_rsts),
++	xsi_rsts = devm_kcalloc(eth->dev,
++				eth->soc->num_xsi_rsts, sizeof(*xsi_rsts),
+ 				GFP_KERNEL);
+-	if (err)
+-		return err;
++	if (!xsi_rsts)
++		return -ENOMEM;
+ 
+ 	eth->xsi_rsts = xsi_rsts;
+ 	for (i = 0; i < eth->soc->num_xsi_rsts; i++)

target/linux/airoha/patches-6.6/105-6.17-net-airoha-Get-rid-of-dma_sync_single_for_device-in-.patch

@@ -0,0 +1,40 @@
+From 4cd9d227ab838b3590c4b27e3707b8c3ef14d7e9 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <[email protected]>
+Date: Wed, 25 Jun 2025 16:43:15 +0200
+Subject: [PATCH] net: airoha: Get rid of dma_sync_single_for_device() in
+ airoha_qdma_fill_rx_queue()
+
+Since the page_pool for airoha_eth driver is created with
+PP_FLAG_DMA_SYNC_DEV flag, we do not need to sync_for_device each page
+received from the pool since it is already done by the page_pool codebase.
+
+Signed-off-by: Lorenzo Bianconi <[email protected]>
+Reviewed-by: Alexander Lobakin <[email protected]>
+Link: https://patch.msgid.link/[email protected]
+Signed-off-by: Jakub Kicinski <[email protected]>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -539,9 +539,7 @@ static int airoha_fe_init(struct airoha_
+ 
+ static int airoha_qdma_fill_rx_queue(struct airoha_queue *q)
+ {
+-	enum dma_data_direction dir = page_pool_get_dma_dir(q->page_pool);
+ 	struct airoha_qdma *qdma = q->qdma;
+-	struct airoha_eth *eth = qdma->eth;
+ 	int qid = q - &qdma->q_rx[0];
+ 	int nframes = 0;
+ 
+@@ -565,9 +563,6 @@ static int airoha_qdma_fill_rx_queue(str
+ 		e->dma_addr = page_pool_get_dma_addr(page) + offset;
+ 		e->dma_len = SKB_WITH_OVERHEAD(q->buf_size);
+ 
+-		dma_sync_single_for_device(eth->dev, e->dma_addr, e->dma_len,
+-					   dir);
+-
+ 		val = FIELD_PREP(QDMA_DESC_LEN_MASK, e->dma_len);
+ 		WRITE_ONCE(desc->ctrl, cpu_to_le32(val));
+ 		WRITE_ONCE(desc->addr, cpu_to_le32(e->dma_addr));

target/linux/airoha/patches-6.6/106-6.16-net-airoha-fix-potential-use-after-free-in-airoha_np.patch

@@ -0,0 +1,41 @@
+From 3cd582e7d0787506990ef0180405eb6224fa90a6 Mon Sep 17 00:00:00 2001
+From: Alok Tiwari <[email protected]>
+Date: Tue, 15 Jul 2025 07:30:58 -0700
+Subject: [PATCH] net: airoha: fix potential use-after-free in airoha_npu_get()
+
+np->name was being used after calling of_node_put(np), which
+releases the node and can lead to a use-after-free bug.
+Previously, of_node_put(np) was called unconditionally after
+of_find_device_by_node(np), which could result in a use-after-free if
+pdev is NULL.
+
+This patch moves of_node_put(np) after the error check to ensure
+the node is only released after both the error and success cases
+are handled appropriately, preventing potential resource issues.
+
+Fixes: 23290c7bc190 ("net: airoha: Introduce Airoha NPU support")
+Signed-off-by: Alok Tiwari <[email protected]>
+Reviewed-by: Andrew Lunn <[email protected]>
+Link: https://patch.msgid.link/[email protected]
+Signed-off-by: Jakub Kicinski <[email protected]>
+---
+ drivers/net/ethernet/airoha/airoha_npu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_npu.c
++++ b/drivers/net/ethernet/airoha/airoha_npu.c
+@@ -567,12 +567,13 @@ struct airoha_npu *airoha_npu_get(struct
+ 		return ERR_PTR(-ENODEV);
+ 
+ 	pdev = of_find_device_by_node(np);
+-	of_node_put(np);
+ 
+ 	if (!pdev) {
+ 		dev_err(dev, "cannot find device node %s\n", np->name);
++		of_node_put(np);
+ 		return ERR_PTR(-ENODEV);
+ 	}
++	of_node_put(np);
+ 
+ 	if (!try_module_get(THIS_MODULE)) {
+ 		dev_err(dev, "failed to get the device driver module\n");

target/linux/airoha/patches-6.6/116-02-net-airoha-deassert-XSI-line-on-hw-init.patch

@@ -13,7 +13,7 @@ Signed-off-by: Christian Marangi <[email protected]>
 
 --- a/drivers/net/ethernet/airoha/airoha_eth.c
 +++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -1388,6 +1388,10 @@ static int airoha_hw_init(struct platfor
+@@ -1383,6 +1383,10 @@ static int airoha_hw_init(struct platfor
  	if (err)
  		return err;
  

target/linux/airoha/patches-6.6/116-03-net-airoha-add-reference-for-SPORT-GDM4-in-qdma_get_.patch

@@ -16,7 +16,7 @@ Signed-off-by: Christian Marangi <[email protected]>
 
 --- a/drivers/net/ethernet/airoha/airoha_eth.c
 +++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -593,8 +593,11 @@ static int airoha_qdma_get_gdm_port(stru
+@@ -588,8 +588,11 @@ static int airoha_qdma_get_gdm_port(stru
  
  	sport = FIELD_GET(QDMA_ETH_RXMSG_SPORT_MASK, msg1);
  	switch (sport) {

target/linux/airoha/patches-6.6/116-06-net-airoha-add-initial-fixup-for-GDM3-4-port-support.patch

@@ -28,7 +28,7 @@ Signed-off-by: Christian Marangi <[email protected]>
  
  	airoha_fe_crsn_qsel_init(eth);
  
-@@ -1630,7 +1632,8 @@ static int airoha_dev_open(struct net_de
+@@ -1625,7 +1627,8 @@ static int airoha_dev_open(struct net_de
  	if (err)
  		return err;
  

target/linux/airoha/patches-6.6/116-07-airoha-ethernet-drop-xsi-mac-reset.patch

@@ -15,7 +15,7 @@ Signed-off-by: Christian Marangi <[email protected]>
 
 --- a/drivers/net/ethernet/airoha/airoha_eth.c
 +++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -3100,7 +3100,6 @@ static void airoha_remove(struct platfor
+@@ -3095,7 +3095,6 @@ static void airoha_remove(struct platfor
  }
  
  static const char * const en7581_xsi_rsts_names[] = {
@@ -23,7 +23,7 @@ Signed-off-by: Christian Marangi <[email protected]>
  	"hsi0-mac",
  	"hsi1-mac",
  	"hsi-mac",
-@@ -3132,7 +3131,6 @@ static int airoha_en7581_get_src_port_id
+@@ -3127,7 +3126,6 @@ static int airoha_en7581_get_src_port_id
  }
  
  static const char * const an7583_xsi_rsts_names[] = {

target/linux/airoha/patches-6.6/116-10-net-airoha-add-phylink-support-for-GDM2-4.patch

@@ -35,7 +35,7 @@ Signed-off-by: Christian Marangi <[email protected]>
  static void airoha_set_macaddr(struct airoha_gdm_port *port, const u8 *addr)
  {
  	struct airoha_eth *eth = port->qdma->eth;
-@@ -1627,6 +1633,17 @@ static int airoha_dev_open(struct net_de
+@@ -1622,6 +1628,17 @@ static int airoha_dev_open(struct net_de
  	struct airoha_gdm_port *port = netdev_priv(dev);
  	struct airoha_qdma *qdma = port->qdma;
  
@@ -53,7 +53,7 @@ Signed-off-by: Christian Marangi <[email protected]>
  	netif_tx_start_all_queues(dev);
  	err = airoha_set_vip_for_gdm_port(port, true);
  	if (err)
-@@ -1680,6 +1697,11 @@ static int airoha_dev_stop(struct net_de
+@@ -1675,6 +1692,11 @@ static int airoha_dev_stop(struct net_de
  		}
  	}
  
@@ -65,7 +65,7 @@ Signed-off-by: Christian Marangi <[email protected]>
  	return 0;
  }
  
-@@ -2828,6 +2850,20 @@ static const struct ethtool_ops airoha_e
+@@ -2823,6 +2845,20 @@ static const struct ethtool_ops airoha_e
  	.get_link		= ethtool_op_get_link,
  };
  
@@ -86,7 +86,7 @@ Signed-off-by: Christian Marangi <[email protected]>
  static int airoha_metadata_dst_alloc(struct airoha_gdm_port *port)
  {
  	int i;
-@@ -2872,6 +2908,99 @@ bool airoha_is_valid_gdm_port(struct air
+@@ -2867,6 +2903,99 @@ bool airoha_is_valid_gdm_port(struct air
  	return false;
  }
  
@@ -186,7 +186,7 @@ Signed-off-by: Christian Marangi <[email protected]>
  static int airoha_alloc_gdm_port(struct airoha_eth *eth,
  				 struct device_node *np, int index)
  {
-@@ -2950,6 +3079,12 @@ static int airoha_alloc_gdm_port(struct
+@@ -2945,6 +3074,12 @@ static int airoha_alloc_gdm_port(struct
  	if (err)
  		return err;
  
@@ -199,7 +199,7 @@ Signed-off-by: Christian Marangi <[email protected]>
  	err = register_netdev(dev);
  	if (err)
  		goto free_metadata_dst;
-@@ -3065,6 +3200,10 @@ error_hw_cleanup:
+@@ -3060,6 +3195,10 @@ error_hw_cleanup:
  		if (port && port->dev->reg_state == NETREG_REGISTERED) {
  			unregister_netdev(port->dev);
  			airoha_metadata_dst_free(port);
@@ -210,7 +210,7 @@ Signed-off-by: Christian Marangi <[email protected]>
  		}
  	}
  	free_netdev(eth->napi_dev);
-@@ -3092,6 +3231,10 @@ static void airoha_remove(struct platfor
+@@ -3087,6 +3226,10 @@ static void airoha_remove(struct platfor
  		airoha_dev_stop(port->dev);
  		unregister_netdev(port->dev);
  		airoha_metadata_dst_free(port);

target/linux/airoha/patches-6.6/604-02-net-ethernet-airoha-define-sport-value-for-GDM3.patch

@@ -14,7 +14,7 @@ Signed-off-by: Christian Marangi <[email protected]>
 
 --- a/drivers/net/ethernet/airoha/airoha_eth.c
 +++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -604,6 +604,9 @@ static int airoha_qdma_get_gdm_port(stru
+@@ -599,6 +599,9 @@ static int airoha_qdma_get_gdm_port(stru
  	case 0x18:
  		port = 3; /* GDM4 */
  		break;