--- /dev/null
+From 24e715a9a73a088e10168d39382474c0c7d39bf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jul 2023 18:51:40 +0100
+Subject: clk: Fix undefined reference to `clk_rate_exclusive_{get,put}'
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 2746f13f6f1df7999001d6595b16f789ecc28ad1 ]
+
+The COMMON_CLK config is not enabled in some of the architectures.
+This causes below build issues:
+
+pwm-rz-mtu3.c:(.text+0x114):
+undefined reference to `clk_rate_exclusive_put'
+pwm-rz-mtu3.c:(.text+0x32c):
+undefined reference to `clk_rate_exclusive_get'
+
+Fix these issues by moving clk_rate_exclusive_{get,put} inside COMMON_CLK
+code block, as clk.c is enabled by COMMON_CLK.
+
+Fixes: 55e9b8b7b806 ("clk: add clk_rate_exclusive api")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/all/202307251752.vLfmmhYm-lkp@intel.com/
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20230725175140.361479-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/clk.h | 80 ++++++++++++++++++++++-----------------------
+ 1 file changed, 40 insertions(+), 40 deletions(-)
+
+diff --git a/include/linux/clk.h b/include/linux/clk.h
+index 1814eabb7c204..12c85ba606ec5 100644
+--- a/include/linux/clk.h
++++ b/include/linux/clk.h
+@@ -172,6 +172,39 @@ int clk_get_scaled_duty_cycle(struct clk *clk, unsigned int scale);
+ */
+ bool clk_is_match(const struct clk *p, const struct clk *q);
+
++/**
++ * clk_rate_exclusive_get - get exclusivity over the rate control of a
++ * producer
++ * @clk: clock source
++ *
++ * This function allows drivers to get exclusive control over the rate of a
++ * provider. It prevents any other consumer to execute, even indirectly,
++ * opereation which could alter the rate of the provider or cause glitches
++ *
++ * If exlusivity is claimed more than once on clock, even by the same driver,
++ * the rate effectively gets locked as exclusivity can't be preempted.
++ *
++ * Must not be called from within atomic context.
++ *
++ * Returns success (0) or negative errno.
++ */
++int clk_rate_exclusive_get(struct clk *clk);
++
++/**
++ * clk_rate_exclusive_put - release exclusivity over the rate control of a
++ * producer
++ * @clk: clock source
++ *
++ * This function allows drivers to release the exclusivity it previously got
++ * from clk_rate_exclusive_get()
++ *
++ * The caller must balance the number of clk_rate_exclusive_get() and
++ * clk_rate_exclusive_put() calls.
++ *
++ * Must not be called from within atomic context.
++ */
++void clk_rate_exclusive_put(struct clk *clk);
++
+ #else
+
+ static inline int clk_notifier_register(struct clk *clk,
+@@ -218,6 +251,13 @@ static inline bool clk_is_match(const struct clk *p, const struct clk *q)
+ return p == q;
+ }
+
++static inline int clk_rate_exclusive_get(struct clk *clk)
++{
++ return 0;
++}
++
++static inline void clk_rate_exclusive_put(struct clk *clk) {}
++
+ #endif
+
+ /**
+@@ -530,38 +570,6 @@ struct clk *devm_clk_get_optional_enabled(struct device *dev, const char *id);
+ */
+ struct clk *devm_get_clk_from_child(struct device *dev,
+ struct device_node *np, const char *con_id);
+-/**
+- * clk_rate_exclusive_get - get exclusivity over the rate control of a
+- * producer
+- * @clk: clock source
+- *
+- * This function allows drivers to get exclusive control over the rate of a
+- * provider. It prevents any other consumer to execute, even indirectly,
+- * opereation which could alter the rate of the provider or cause glitches
+- *
+- * If exlusivity is claimed more than once on clock, even by the same driver,
+- * the rate effectively gets locked as exclusivity can't be preempted.
+- *
+- * Must not be called from within atomic context.
+- *
+- * Returns success (0) or negative errno.
+- */
+-int clk_rate_exclusive_get(struct clk *clk);
+-
+-/**
+- * clk_rate_exclusive_put - release exclusivity over the rate control of a
+- * producer
+- * @clk: clock source
+- *
+- * This function allows drivers to release the exclusivity it previously got
+- * from clk_rate_exclusive_get()
+- *
+- * The caller must balance the number of clk_rate_exclusive_get() and
+- * clk_rate_exclusive_put() calls.
+- *
+- * Must not be called from within atomic context.
+- */
+-void clk_rate_exclusive_put(struct clk *clk);
+
+ /**
+ * clk_enable - inform the system when the clock source should be running.
+@@ -921,14 +929,6 @@ static inline void clk_bulk_put_all(int num_clks, struct clk_bulk_data *clks) {}
+
+ static inline void devm_clk_put(struct device *dev, struct clk *clk) {}
+
+-
+-static inline int clk_rate_exclusive_get(struct clk *clk)
+-{
+- return 0;
+-}
+-
+-static inline void clk_rate_exclusive_put(struct clk *clk) {}
+-
+ static inline int clk_enable(struct clk *clk)
+ {
+ return 0;
+--
+2.40.1
+
--- /dev/null
+From 96ed8fbe2197e38119c1c6a2bd95f21759eb7be0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Aug 2023 07:59:38 -0700
+Subject: dma-buf/sw_sync: Avoid recursive lock during fence signal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit e531fdb5cd5ee2564b7fe10c8a9219e2b2fac61e ]
+
+If a signal callback releases the sw_sync fence, that will trigger a
+deadlock as the timeline_fence_release recurses onto the fence->lock
+(used both for signaling and the the timeline tree).
+
+To avoid that, temporarily hold an extra reference to the signalled
+fences until after we drop the lock.
+
+(This is an alternative implementation of https://patchwork.kernel.org/patch/11664717/
+which avoids some potential UAF issues with the original patch.)
+
+v2: Remove now obsolete comment, use list_move_tail() and
+ list_del_init()
+
+Reported-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
+Fixes: d3c6dd1fb30d ("dma-buf/sw_sync: Synchronize signal vs syncpt free")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230818145939.39697-1-robdclark@gmail.com
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/sw_sync.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
+index 348b3a9170fa4..7f5ed1aa7a9f8 100644
+--- a/drivers/dma-buf/sw_sync.c
++++ b/drivers/dma-buf/sw_sync.c
+@@ -191,6 +191,7 @@ static const struct dma_fence_ops timeline_fence_ops = {
+ */
+ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
+ {
++ LIST_HEAD(signalled);
+ struct sync_pt *pt, *next;
+
+ trace_sync_timeline(obj);
+@@ -203,21 +204,20 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
+ if (!timeline_fence_signaled(&pt->base))
+ break;
+
+- list_del_init(&pt->link);
++ dma_fence_get(&pt->base);
++
++ list_move_tail(&pt->link, &signalled);
+ rb_erase(&pt->node, &obj->pt_tree);
+
+- /*
+- * A signal callback may release the last reference to this
+- * fence, causing it to be freed. That operation has to be
+- * last to avoid a use after free inside this loop, and must
+- * be after we remove the fence from the timeline in order to
+- * prevent deadlocking on timeline->lock inside
+- * timeline_fence_release().
+- */
+ dma_fence_signal_locked(&pt->base);
+ }
+
+ spin_unlock_irq(&obj->lock);
++
++ list_for_each_entry_safe(pt, next, &signalled, link) {
++ list_del_init(&pt->link);
++ dma_fence_put(&pt->base);
++ }
+ }
+
+ /**
+--
+2.40.1
+
--- /dev/null
+From bf84cd0c490086b98cd0a7f26e86c44077b40ab2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Jan 2021 21:01:52 -0800
+Subject: mm: fix page reference leak in soft_offline_page()
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+[ Upstream commit dad4e5b390866ca902653df0daa864ae4b8d4147 ]
+
+The conversion to move pfn_to_online_page() internal to
+soft_offline_page() missed that the get_user_pages() reference taken by
+the madvise() path needs to be dropped when pfn_to_online_page() fails.
+
+Note the direct sysfs-path to soft_offline_page() does not perform a
+get_user_pages() lookup.
+
+When soft_offline_page() is handed a pfn_valid() && !pfn_to_online_page()
+pfn the kernel hangs at dax-device shutdown due to a leaked reference.
+
+Link: https://lkml.kernel.org/r/161058501210.1840162.8108917599181157327.stgit@dwillia2-desk3.amr.corp.intel.com
+Fixes: feec24a6139d ("mm, soft-offline: convert parameter to pfn")
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Reviewed-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Qian Cai <cai@lca.pw>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Stable-dep-of: e2c1ab070fdc ("mm: memory-failure: fix unexpected return value in soft_offline_page()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memory-failure.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 71fd546dbdc37..e3c0fa2464ff8 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1867,6 +1867,12 @@ static int soft_offline_free_page(struct page *page)
+ return rc;
+ }
+
++static void put_ref_page(struct page *page)
++{
++ if (page)
++ put_page(page);
++}
++
+ /**
+ * soft_offline_page - Soft offline a page.
+ * @pfn: pfn to soft-offline
+@@ -1892,20 +1898,26 @@ static int soft_offline_free_page(struct page *page)
+ int soft_offline_page(unsigned long pfn, int flags)
+ {
+ int ret;
+- struct page *page;
+ bool try_again = true;
++ struct page *page, *ref_page = NULL;
++
++ WARN_ON_ONCE(!pfn_valid(pfn) && (flags & MF_COUNT_INCREASED));
+
+ if (!pfn_valid(pfn))
+ return -ENXIO;
++ if (flags & MF_COUNT_INCREASED)
++ ref_page = pfn_to_page(pfn);
++
+ /* Only online pages can be soft-offlined (esp., not ZONE_DEVICE). */
+ page = pfn_to_online_page(pfn);
+- if (!page)
++ if (!page) {
++ put_ref_page(ref_page);
+ return -EIO;
++ }
+
+ if (PageHWPoison(page)) {
+ pr_info("%s: %#lx page already poisoned\n", __func__, pfn);
+- if (flags & MF_COUNT_INCREASED)
+- put_page(page);
++ put_ref_page(ref_page);
+ return 0;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From 87ba88fa0fd07fcc978c8afab4099f16d9dd71e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:11:38 -0800
+Subject: mm,hwpoison: refactor get_any_page
+
+From: Oscar Salvador <osalvador@suse.de>
+
+[ Upstream commit 8295d535e2aa198bdf65a4045d622df38955ffe2 ]
+
+Patch series "HWPoison: Refactor get page interface", v2.
+
+This patch (of 3):
+
+When we want to grab a refcount via get_any_page, we call __get_any_page
+that calls get_hwpoison_page to get the actual refcount.
+
+get_any_page() is only there because we have a sort of retry mechanism in
+case the page we met is unknown to us or if we raced with an allocation.
+
+Also __get_any_page() prints some messages about the page type in case the
+page was a free page or the page type was unknown, but if anything, we
+only need to print a message in case the pagetype was unknown, as that is
+reporting an error down the chain.
+
+Let us merge get_any_page() and __get_any_page(), and let the message be
+printed in soft_offline_page. While we are it, we can also remove the
+'pfn' parameter as it is no longer used.
+
+Link: https://lkml.kernel.org/r/20201204102558.31607-1-osalvador@suse.de
+Link: https://lkml.kernel.org/r/20201204102558.31607-2-osalvador@suse.de
+Signed-off-by: Oscar Salvador <osalvador@suse.de>
+Acked-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Acked-by: Vlastimil Babka <Vbabka@suse.cz>
+Cc: Qian Cai <qcai@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Stable-dep-of: e2c1ab070fdc ("mm: memory-failure: fix unexpected return value in soft_offline_page()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memory-failure.c | 101 +++++++++++++++++++-------------------------
+ 1 file changed, 43 insertions(+), 58 deletions(-)
+
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index b21dd4a793926..71fd546dbdc37 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1690,70 +1690,51 @@ EXPORT_SYMBOL(unpoison_memory);
+
+ /*
+ * Safely get reference count of an arbitrary page.
+- * Returns 0 for a free page, -EIO for a zero refcount page
+- * that is not free, and 1 for any other page type.
+- * For 1 the page is returned with increased page count, otherwise not.
++ * Returns 0 for a free page, 1 for an in-use page, -EIO for a page-type we
++ * cannot handle and -EBUSY if we raced with an allocation.
++ * We only incremented refcount in case the page was already in-use and it is
++ * a known type we can handle.
+ */
+-static int __get_any_page(struct page *p, unsigned long pfn, int flags)
++static int get_any_page(struct page *p, int flags)
+ {
+- int ret;
++ int ret = 0, pass = 0;
++ bool count_increased = false;
+
+ if (flags & MF_COUNT_INCREASED)
+- return 1;
+-
+- /*
+- * When the target page is a free hugepage, just remove it
+- * from free hugepage list.
+- */
+- if (!get_hwpoison_page(p)) {
+- if (PageHuge(p)) {
+- pr_info("%s: %#lx free huge page\n", __func__, pfn);
+- ret = 0;
+- } else if (is_free_buddy_page(p)) {
+- pr_info("%s: %#lx free buddy page\n", __func__, pfn);
+- ret = 0;
+- } else if (page_count(p)) {
+- /* raced with allocation */
++ count_increased = true;
++
++try_again:
++ if (!count_increased && !get_hwpoison_page(p)) {
++ if (page_count(p)) {
++ /* We raced with an allocation, retry. */
++ if (pass++ < 3)
++ goto try_again;
+ ret = -EBUSY;
+- } else {
+- pr_info("%s: %#lx: unknown zero refcount page type %lx\n",
+- __func__, pfn, p->flags);
++ } else if (!PageHuge(p) && !is_free_buddy_page(p)) {
++ /* We raced with put_page, retry. */
++ if (pass++ < 3)
++ goto try_again;
+ ret = -EIO;
+ }
+ } else {
+- /* Not a free page */
+- ret = 1;
+- }
+- return ret;
+-}
+-
+-static int get_any_page(struct page *page, unsigned long pfn, int flags)
+-{
+- int ret = __get_any_page(page, pfn, flags);
+-
+- if (ret == -EBUSY)
+- ret = __get_any_page(page, pfn, flags);
+-
+- if (ret == 1 && !PageHuge(page) &&
+- !PageLRU(page) && !__PageMovable(page)) {
+- /*
+- * Try to free it.
+- */
+- put_page(page);
+- shake_page(page, 1);
+-
+- /*
+- * Did it turn free?
+- */
+- ret = __get_any_page(page, pfn, 0);
+- if (ret == 1 && !PageLRU(page)) {
+- /* Drop page reference which is from __get_any_page() */
+- put_page(page);
+- pr_info("soft_offline: %#lx: unknown non LRU page type %lx (%pGp)\n",
+- pfn, page->flags, &page->flags);
+- return -EIO;
++ if (PageHuge(p) || PageLRU(p) || __PageMovable(p)) {
++ ret = 1;
++ } else {
++ /*
++ * A page we cannot handle. Check whether we can turn
++ * it into something we can handle.
++ */
++ if (pass++ < 3) {
++ put_page(p);
++ shake_page(p, 1);
++ count_increased = false;
++ goto try_again;
++ }
++ put_page(p);
++ ret = -EIO;
+ }
+ }
++
+ return ret;
+ }
+
+@@ -1922,7 +1903,7 @@ int soft_offline_page(unsigned long pfn, int flags)
+ return -EIO;
+
+ if (PageHWPoison(page)) {
+- pr_info("soft offline: %#lx page already poisoned\n", pfn);
++ pr_info("%s: %#lx page already poisoned\n", __func__, pfn);
+ if (flags & MF_COUNT_INCREASED)
+ put_page(page);
+ return 0;
+@@ -1930,17 +1911,21 @@ int soft_offline_page(unsigned long pfn, int flags)
+
+ retry:
+ get_online_mems();
+- ret = get_any_page(page, pfn, flags);
++ ret = get_any_page(page, flags);
+ put_online_mems();
+
+- if (ret > 0)
++ if (ret > 0) {
+ ret = soft_offline_in_use_page(page);
+- else if (ret == 0)
++ } else if (ret == 0) {
+ if (soft_offline_free_page(page) && try_again) {
+ try_again = false;
+ flags &= ~MF_COUNT_INCREASED;
+ goto retry;
+ }
++ } else if (ret == -EIO) {
++ pr_info("%s: %#lx: unknown page type: %lx (%pGP)\n",
++ __func__, pfn, page->flags, &page->flags);
++ }
+
+ return ret;
+ }
+--
+2.40.1
+
--- /dev/null
+From 5c80bc50a4aa181f4f00448c6c90a7641c1a7a61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 19:28:08 +0800
+Subject: mm: memory-failure: fix unexpected return value in
+ soft_offline_page()
+
+From: Miaohe Lin <linmiaohe@huawei.com>
+
+[ Upstream commit e2c1ab070fdc81010ec44634838d24fce9ff9e53 ]
+
+When page_handle_poison() fails to handle the hugepage or free page in
+retry path, soft_offline_page() will return 0 while -EBUSY is expected in
+this case.
+
+Consequently the user will think soft_offline_page succeeds while it in
+fact failed. So the user will not try again later in this case.
+
+Link: https://lkml.kernel.org/r/20230627112808.1275241-1-linmiaohe@huawei.com
+Fixes: b94e02822deb ("mm,hwpoison: try to narrow window race for free pages")
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Acked-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memory-failure.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 6375fe9be87b6..0c08e803ed42d 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1919,10 +1919,13 @@ int soft_offline_page(unsigned long pfn, int flags)
+ if (ret > 0) {
+ ret = soft_offline_in_use_page(page);
+ } else if (ret == 0) {
+- if (!page_handle_poison(page, true, false) && try_again) {
+- try_again = false;
+- flags &= ~MF_COUNT_INCREASED;
+- goto retry;
++ if (!page_handle_poison(page, true, false)) {
++ if (try_again) {
++ try_again = false;
++ flags &= ~MF_COUNT_INCREASED;
++ goto retry;
++ }
++ ret = -EBUSY;
+ }
+ } else if (ret == -EIO) {
+ pr_info("%s: %#lx: unknown page type: %lx (%pGP)\n",
+--
+2.40.1
+
--- /dev/null
+From c55e54f3d00d41ca58f63e0d51db73a622b5d635 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Aug 2022 11:34:01 +0800
+Subject: mm: memory-failure: kill soft_offline_free_page()
+
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+
+[ Upstream commit 7adb45887c8af88985c335b53d253654e9d2dd16 ]
+
+Open-code the page_handle_poison() into soft_offline_page() and kill
+unneeded soft_offline_free_page().
+
+Link: https://lkml.kernel.org/r/20220819033402.156519-1-wangkefeng.wang@huawei.com
+Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
+Acked-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: e2c1ab070fdc ("mm: memory-failure: fix unexpected return value in soft_offline_page()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memory-failure.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index e3c0fa2464ff8..6375fe9be87b6 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1857,16 +1857,6 @@ static int soft_offline_in_use_page(struct page *page)
+ return __soft_offline_page(page);
+ }
+
+-static int soft_offline_free_page(struct page *page)
+-{
+- int rc = 0;
+-
+- if (!page_handle_poison(page, true, false))
+- rc = -EBUSY;
+-
+- return rc;
+-}
+-
+ static void put_ref_page(struct page *page)
+ {
+ if (page)
+@@ -1929,7 +1919,7 @@ int soft_offline_page(unsigned long pfn, int flags)
+ if (ret > 0) {
+ ret = soft_offline_in_use_page(page);
+ } else if (ret == 0) {
+- if (soft_offline_free_page(page) && try_again) {
++ if (!page_handle_poison(page, true, false) && try_again) {
+ try_again = false;
+ flags &= ~MF_COUNT_INCREASED;
+ goto retry;
+--
+2.40.1
+
--- /dev/null
+From 333ed7ba2a2611fe39d648e3746adce72a67f1b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Aug 2023 14:15:58 +0100
+Subject: pinctrl: renesas: rza2: Add lock around
+ pinctrl_generic{{add,remove}_group,{add,remove}_function}
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 8fcc1c40b747069644db6102c1d84c942c9d4d86 ]
+
+The pinctrl group and function creation/remove calls expect
+caller to take care of locking. Add lock around these functions.
+
+Fixes: b59d0e782706 ("pinctrl: Add RZ/A2 pin and gpio controller")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230815131558.33787-4-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rza2.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rza2.c b/drivers/pinctrl/renesas/pinctrl-rza2.c
+index 32829eb9656c9..ddd8ee6b604ef 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rza2.c
++++ b/drivers/pinctrl/renesas/pinctrl-rza2.c
+@@ -14,6 +14,7 @@
+ #include <linux/gpio/driver.h>
+ #include <linux/io.h>
+ #include <linux/module.h>
++#include <linux/mutex.h>
+ #include <linux/of_device.h>
+ #include <linux/pinctrl/pinmux.h>
+
+@@ -46,6 +47,7 @@ struct rza2_pinctrl_priv {
+ struct pinctrl_dev *pctl;
+ struct pinctrl_gpio_range gpio_range;
+ int npins;
++ struct mutex mutex; /* serialize adding groups and functions */
+ };
+
+ #define RZA2_PDR(port) (0x0000 + (port) * 2) /* Direction 16-bit */
+@@ -359,10 +361,14 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev,
+ psel_val[i] = MUX_FUNC(value);
+ }
+
++ mutex_lock(&priv->mutex);
++
+ /* Register a single pin group listing all the pins we read from DT */
+ gsel = pinctrl_generic_add_group(pctldev, np->name, pins, npins, NULL);
+- if (gsel < 0)
+- return gsel;
++ if (gsel < 0) {
++ ret = gsel;
++ goto unlock;
++ }
+
+ /*
+ * Register a single group function where the 'data' is an array PSEL
+@@ -391,6 +397,8 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev,
+ (*map)->data.mux.function = np->name;
+ *num_maps = 1;
+
++ mutex_unlock(&priv->mutex);
++
+ return 0;
+
+ remove_function:
+@@ -399,6 +407,9 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev,
+ remove_group:
+ pinctrl_generic_remove_group(pctldev, gsel);
+
++unlock:
++ mutex_unlock(&priv->mutex);
++
+ dev_err(priv->dev, "Unable to parse DT node %s\n", np->name);
+
+ return ret;
+@@ -474,6 +485,8 @@ static int rza2_pinctrl_probe(struct platform_device *pdev)
+ if (IS_ERR(priv->base))
+ return PTR_ERR(priv->base);
+
++ mutex_init(&priv->mutex);
++
+ platform_set_drvdata(pdev, priv);
+
+ priv->npins = (int)(uintptr_t)of_device_get_match_data(&pdev->dev) *
+--
+2.40.1
+
cgroup-cpuset-free-dl-bw-in-case-can_attach-fails.patch
drm-i915-fix-premature-release-of-request-s-reusable-memory.patch
asoc-rt711-add-two-jack-detection-modes.patch
+clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch
+pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch
+dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch
+mm-hwpoison-refactor-get_any_page.patch
+mm-fix-page-reference-leak-in-soft_offline_page.patch
+mm-memory-failure-kill-soft_offline_free_page.patch
+mm-memory-failure-fix-unexpected-return-value-in-sof.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
