This is a note to let you know that I've just added the patch titled net: ipa: fix page free in ipa_endpoint_trans_release() to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 155c0c90bca918de6e4327275dfc1d97fd604115 Mon Sep 17 00:00:00 2001 From: Alex Elder <elder@xxxxxxxxxx> Date: Thu, 26 May 2022 10:23:13 -0500 Subject: net: ipa: fix page free in ipa_endpoint_trans_release() From: Alex Elder <elder@xxxxxxxxxx> commit 155c0c90bca918de6e4327275dfc1d97fd604115 upstream. Currently the (possibly compound) page used for receive buffers are freed using __free_pages(). But according to this comment above the definition of that function, that's wrong: If you want to use the page's reference count to decide when to free the allocation, you should allocate a compound page, and use put_page() instead of __free_pages(). Convert the call to __free_pages() in ipa_endpoint_trans_release() to use put_page() instead. Fixes: ed23f02680caa ("net: ipa: define per-endpoint receive buffer size") Signed-off-by: Alex Elder <elder@xxxxxxxxxx> Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/ipa/ipa_endpoint.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ipa/ipa_endpoint.c +++ b/drivers/net/ipa/ipa_endpoint.c @@ -1389,7 +1389,7 @@ void ipa_endpoint_trans_release(struct i struct page *page = trans->data; if (page) - __free_pages(page, get_order(IPA_RX_BUFFER_SIZE)); + put_page(page); } } Patches currently in stable-queue which might be from elder@xxxxxxxxxx are queue-5.15/net-ipa-ignore-endianness-if-there-is-no-header.patch queue-5.15/net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch queue-5.15/net-ipa-fix-page-free-in-ipa_endpoint_trans_release.patch