]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 5.4
authorSasha Levin <sashal@kernel.org>
Mon, 28 Aug 2023 01:51:24 +0000 (21:51 -0400)
committerSasha Levin <sashal@kernel.org>
Mon, 28 Aug 2023 01:51:24 +0000 (21:51 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
queue-5.4/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch [new file with mode: 0644]
queue-5.4/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch [new file with mode: 0644]
queue-5.4/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch [new file with mode: 0644]
queue-5.4/series

diff --git a/queue-5.4/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch b/queue-5.4/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch
new file mode 100644 (file)
index 0000000..66215f5
--- /dev/null
@@ -0,0 +1,146 @@
+From 74a25bed6a8c7df83e75d1c20b2c703c64309b5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jul 2023 18:51:40 +0100
+Subject: clk: Fix undefined reference to `clk_rate_exclusive_{get,put}'
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 2746f13f6f1df7999001d6595b16f789ecc28ad1 ]
+
+The COMMON_CLK config is not enabled in some of the architectures.
+This causes below build issues:
+
+pwm-rz-mtu3.c:(.text+0x114):
+undefined reference to `clk_rate_exclusive_put'
+pwm-rz-mtu3.c:(.text+0x32c):
+undefined reference to `clk_rate_exclusive_get'
+
+Fix these issues by moving clk_rate_exclusive_{get,put} inside COMMON_CLK
+code block, as clk.c is enabled by COMMON_CLK.
+
+Fixes: 55e9b8b7b806 ("clk: add clk_rate_exclusive api")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/all/202307251752.vLfmmhYm-lkp@intel.com/
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20230725175140.361479-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/clk.h | 80 ++++++++++++++++++++++-----------------------
+ 1 file changed, 40 insertions(+), 40 deletions(-)
+
+diff --git a/include/linux/clk.h b/include/linux/clk.h
+index 87730337e28f8..562859ee24f43 100644
+--- a/include/linux/clk.h
++++ b/include/linux/clk.h
+@@ -172,6 +172,39 @@ int clk_get_scaled_duty_cycle(struct clk *clk, unsigned int scale);
+  */
+ bool clk_is_match(const struct clk *p, const struct clk *q);
++/**
++ * clk_rate_exclusive_get - get exclusivity over the rate control of a
++ *                          producer
++ * @clk: clock source
++ *
++ * This function allows drivers to get exclusive control over the rate of a
++ * provider. It prevents any other consumer to execute, even indirectly,
++ * opereation which could alter the rate of the provider or cause glitches
++ *
++ * If exlusivity is claimed more than once on clock, even by the same driver,
++ * the rate effectively gets locked as exclusivity can't be preempted.
++ *
++ * Must not be called from within atomic context.
++ *
++ * Returns success (0) or negative errno.
++ */
++int clk_rate_exclusive_get(struct clk *clk);
++
++/**
++ * clk_rate_exclusive_put - release exclusivity over the rate control of a
++ *                          producer
++ * @clk: clock source
++ *
++ * This function allows drivers to release the exclusivity it previously got
++ * from clk_rate_exclusive_get()
++ *
++ * The caller must balance the number of clk_rate_exclusive_get() and
++ * clk_rate_exclusive_put() calls.
++ *
++ * Must not be called from within atomic context.
++ */
++void clk_rate_exclusive_put(struct clk *clk);
++
+ #else
+ static inline int clk_notifier_register(struct clk *clk,
+@@ -218,6 +251,13 @@ static inline bool clk_is_match(const struct clk *p, const struct clk *q)
+       return p == q;
+ }
++static inline int clk_rate_exclusive_get(struct clk *clk)
++{
++      return 0;
++}
++
++static inline void clk_rate_exclusive_put(struct clk *clk) {}
++
+ #endif
+ /**
+@@ -530,38 +570,6 @@ struct clk *devm_clk_get_optional_enabled(struct device *dev, const char *id);
+  */
+ struct clk *devm_get_clk_from_child(struct device *dev,
+                                   struct device_node *np, const char *con_id);
+-/**
+- * clk_rate_exclusive_get - get exclusivity over the rate control of a
+- *                          producer
+- * @clk: clock source
+- *
+- * This function allows drivers to get exclusive control over the rate of a
+- * provider. It prevents any other consumer to execute, even indirectly,
+- * opereation which could alter the rate of the provider or cause glitches
+- *
+- * If exlusivity is claimed more than once on clock, even by the same driver,
+- * the rate effectively gets locked as exclusivity can't be preempted.
+- *
+- * Must not be called from within atomic context.
+- *
+- * Returns success (0) or negative errno.
+- */
+-int clk_rate_exclusive_get(struct clk *clk);
+-
+-/**
+- * clk_rate_exclusive_put - release exclusivity over the rate control of a
+- *                          producer
+- * @clk: clock source
+- *
+- * This function allows drivers to release the exclusivity it previously got
+- * from clk_rate_exclusive_get()
+- *
+- * The caller must balance the number of clk_rate_exclusive_get() and
+- * clk_rate_exclusive_put() calls.
+- *
+- * Must not be called from within atomic context.
+- */
+-void clk_rate_exclusive_put(struct clk *clk);
+ /**
+  * clk_enable - inform the system when the clock source should be running.
+@@ -918,14 +926,6 @@ static inline void clk_bulk_put_all(int num_clks, struct clk_bulk_data *clks) {}
+ static inline void devm_clk_put(struct device *dev, struct clk *clk) {}
+-
+-static inline int clk_rate_exclusive_get(struct clk *clk)
+-{
+-      return 0;
+-}
+-
+-static inline void clk_rate_exclusive_put(struct clk *clk) {}
+-
+ static inline int clk_enable(struct clk *clk)
+ {
+       return 0;
+-- 
+2.40.1
+
diff --git a/queue-5.4/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch b/queue-5.4/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch
new file mode 100644 (file)
index 0000000..770aede
--- /dev/null
@@ -0,0 +1,81 @@
+From eeae553d30a48a04789a070c65da4a07f19ccb97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Aug 2023 07:59:38 -0700
+Subject: dma-buf/sw_sync: Avoid recursive lock during fence signal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit e531fdb5cd5ee2564b7fe10c8a9219e2b2fac61e ]
+
+If a signal callback releases the sw_sync fence, that will trigger a
+deadlock as the timeline_fence_release recurses onto the fence->lock
+(used both for signaling and the the timeline tree).
+
+To avoid that, temporarily hold an extra reference to the signalled
+fences until after we drop the lock.
+
+(This is an alternative implementation of https://patchwork.kernel.org/patch/11664717/
+which avoids some potential UAF issues with the original patch.)
+
+v2: Remove now obsolete comment, use list_move_tail() and
+    list_del_init()
+
+Reported-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
+Fixes: d3c6dd1fb30d ("dma-buf/sw_sync: Synchronize signal vs syncpt free")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230818145939.39697-1-robdclark@gmail.com
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/sw_sync.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
+index 6713cfb1995c6..7e7356970d5fc 100644
+--- a/drivers/dma-buf/sw_sync.c
++++ b/drivers/dma-buf/sw_sync.c
+@@ -191,6 +191,7 @@ static const struct dma_fence_ops timeline_fence_ops = {
+  */
+ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
+ {
++      LIST_HEAD(signalled);
+       struct sync_pt *pt, *next;
+       trace_sync_timeline(obj);
+@@ -203,21 +204,20 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
+               if (!timeline_fence_signaled(&pt->base))
+                       break;
+-              list_del_init(&pt->link);
++              dma_fence_get(&pt->base);
++
++              list_move_tail(&pt->link, &signalled);
+               rb_erase(&pt->node, &obj->pt_tree);
+-              /*
+-               * A signal callback may release the last reference to this
+-               * fence, causing it to be freed. That operation has to be
+-               * last to avoid a use after free inside this loop, and must
+-               * be after we remove the fence from the timeline in order to
+-               * prevent deadlocking on timeline->lock inside
+-               * timeline_fence_release().
+-               */
+               dma_fence_signal_locked(&pt->base);
+       }
+       spin_unlock_irq(&obj->lock);
++
++      list_for_each_entry_safe(pt, next, &signalled, link) {
++              list_del_init(&pt->link);
++              dma_fence_put(&pt->base);
++      }
+ }
+ /**
+-- 
+2.40.1
+
diff --git a/queue-5.4/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch b/queue-5.4/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch
new file mode 100644 (file)
index 0000000..6cc19dd
--- /dev/null
@@ -0,0 +1,91 @@
+From c0c75aa8bf086de9e79bc4756035fa9c48137c4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Aug 2023 14:15:58 +0100
+Subject: pinctrl: renesas: rza2: Add lock around
+ pinctrl_generic{{add,remove}_group,{add,remove}_function}
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 8fcc1c40b747069644db6102c1d84c942c9d4d86 ]
+
+The pinctrl group and function creation/remove calls expect
+caller to take care of locking. Add lock around these functions.
+
+Fixes: b59d0e782706 ("pinctrl: Add RZ/A2 pin and gpio controller")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230815131558.33787-4-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-rza2.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-rza2.c b/drivers/pinctrl/pinctrl-rza2.c
+index eda88cdf870df..8c3174d007507 100644
+--- a/drivers/pinctrl/pinctrl-rza2.c
++++ b/drivers/pinctrl/pinctrl-rza2.c
+@@ -14,6 +14,7 @@
+ #include <linux/gpio/driver.h>
+ #include <linux/io.h>
+ #include <linux/module.h>
++#include <linux/mutex.h>
+ #include <linux/of_device.h>
+ #include <linux/pinctrl/pinmux.h>
+@@ -46,6 +47,7 @@ struct rza2_pinctrl_priv {
+       struct pinctrl_dev *pctl;
+       struct pinctrl_gpio_range gpio_range;
+       int npins;
++      struct mutex mutex; /* serialize adding groups and functions */
+ };
+ #define RZA2_PDR(port)                (0x0000 + (port) * 2)   /* Direction 16-bit */
+@@ -359,10 +361,14 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev,
+               psel_val[i] = MUX_FUNC(value);
+       }
++      mutex_lock(&priv->mutex);
++
+       /* Register a single pin group listing all the pins we read from DT */
+       gsel = pinctrl_generic_add_group(pctldev, np->name, pins, npins, NULL);
+-      if (gsel < 0)
+-              return gsel;
++      if (gsel < 0) {
++              ret = gsel;
++              goto unlock;
++      }
+       /*
+        * Register a single group function where the 'data' is an array PSEL
+@@ -391,6 +397,8 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev,
+       (*map)->data.mux.function = np->name;
+       *num_maps = 1;
++      mutex_unlock(&priv->mutex);
++
+       return 0;
+ remove_function:
+@@ -399,6 +407,9 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev,
+ remove_group:
+       pinctrl_generic_remove_group(pctldev, gsel);
++unlock:
++      mutex_unlock(&priv->mutex);
++
+       dev_err(priv->dev, "Unable to parse DT node %s\n", np->name);
+       return ret;
+@@ -476,6 +487,8 @@ static int rza2_pinctrl_probe(struct platform_device *pdev)
+       if (IS_ERR(priv->base))
+               return PTR_ERR(priv->base);
++      mutex_init(&priv->mutex);
++
+       platform_set_drvdata(pdev, priv);
+       priv->npins = (int)(uintptr_t)of_device_get_match_data(&pdev->dev) *
+-- 
+2.40.1
+
index 8fbd453d3027ad91cd357502d8e66be9f4bd5dd7..105f42708ba6aff061b4d62fdcf41ec7076d843a 100644 (file)
@@ -153,3 +153,6 @@ interconnect-do-not-skip-aggregation-for-disabled-paths.patch
 alsa-pcm-check-for-null-pointer-of-pointer-substream-before-dereferencing-it.patch
 documentation-sysctl-document-page_lock_unfairness.patch
 irqchip-mips-gic-don-t-touch-vl_map-if-a-local-interrupt-is-not-routable.patch
+clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch
+pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch
+dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch