From: Sasha Levin Date: Mon, 28 Aug 2023 01:51:24 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v6.4.13~9^2~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cebc98b651fc49826c4a7314c679ff95ac138257;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch b/queue-5.4/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch new file mode 100644 index 00000000000..66215f5b829 --- /dev/null +++ b/queue-5.4/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch @@ -0,0 +1,146 @@ +From 74a25bed6a8c7df83e75d1c20b2c703c64309b5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 18:51:40 +0100 +Subject: clk: Fix undefined reference to `clk_rate_exclusive_{get,put}' + +From: Biju Das + +[ Upstream commit 2746f13f6f1df7999001d6595b16f789ecc28ad1 ] + +The COMMON_CLK config is not enabled in some of the architectures. +This causes below build issues: + +pwm-rz-mtu3.c:(.text+0x114): +undefined reference to `clk_rate_exclusive_put' +pwm-rz-mtu3.c:(.text+0x32c): +undefined reference to `clk_rate_exclusive_get' + +Fix these issues by moving clk_rate_exclusive_{get,put} inside COMMON_CLK +code block, as clk.c is enabled by COMMON_CLK. + +Fixes: 55e9b8b7b806 ("clk: add clk_rate_exclusive api") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/all/202307251752.vLfmmhYm-lkp@intel.com/ +Signed-off-by: Biju Das +Link: https://lore.kernel.org/r/20230725175140.361479-1-biju.das.jz@bp.renesas.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + include/linux/clk.h | 80 ++++++++++++++++++++++----------------------- + 1 file changed, 40 insertions(+), 40 deletions(-) + +diff --git a/include/linux/clk.h b/include/linux/clk.h +index 87730337e28f8..562859ee24f43 100644 +--- a/include/linux/clk.h ++++ b/include/linux/clk.h +@@ -172,6 +172,39 @@ int clk_get_scaled_duty_cycle(struct clk *clk, unsigned int scale); + */ + bool clk_is_match(const struct clk *p, const struct clk *q); + ++/** ++ * clk_rate_exclusive_get - get exclusivity over the rate control of a ++ * producer ++ * @clk: clock source ++ * ++ * This function allows drivers to get exclusive control over the rate of a ++ * provider. It prevents any other consumer to execute, even indirectly, ++ * opereation which could alter the rate of the provider or cause glitches ++ * ++ * If exlusivity is claimed more than once on clock, even by the same driver, ++ * the rate effectively gets locked as exclusivity can't be preempted. ++ * ++ * Must not be called from within atomic context. ++ * ++ * Returns success (0) or negative errno. ++ */ ++int clk_rate_exclusive_get(struct clk *clk); ++ ++/** ++ * clk_rate_exclusive_put - release exclusivity over the rate control of a ++ * producer ++ * @clk: clock source ++ * ++ * This function allows drivers to release the exclusivity it previously got ++ * from clk_rate_exclusive_get() ++ * ++ * The caller must balance the number of clk_rate_exclusive_get() and ++ * clk_rate_exclusive_put() calls. ++ * ++ * Must not be called from within atomic context. ++ */ ++void clk_rate_exclusive_put(struct clk *clk); ++ + #else + + static inline int clk_notifier_register(struct clk *clk, +@@ -218,6 +251,13 @@ static inline bool clk_is_match(const struct clk *p, const struct clk *q) + return p == q; + } + ++static inline int clk_rate_exclusive_get(struct clk *clk) ++{ ++ return 0; ++} ++ ++static inline void clk_rate_exclusive_put(struct clk *clk) {} ++ + #endif + + /** +@@ -530,38 +570,6 @@ struct clk *devm_clk_get_optional_enabled(struct device *dev, const char *id); + */ + struct clk *devm_get_clk_from_child(struct device *dev, + struct device_node *np, const char *con_id); +-/** +- * clk_rate_exclusive_get - get exclusivity over the rate control of a +- * producer +- * @clk: clock source +- * +- * This function allows drivers to get exclusive control over the rate of a +- * provider. It prevents any other consumer to execute, even indirectly, +- * opereation which could alter the rate of the provider or cause glitches +- * +- * If exlusivity is claimed more than once on clock, even by the same driver, +- * the rate effectively gets locked as exclusivity can't be preempted. +- * +- * Must not be called from within atomic context. +- * +- * Returns success (0) or negative errno. +- */ +-int clk_rate_exclusive_get(struct clk *clk); +- +-/** +- * clk_rate_exclusive_put - release exclusivity over the rate control of a +- * producer +- * @clk: clock source +- * +- * This function allows drivers to release the exclusivity it previously got +- * from clk_rate_exclusive_get() +- * +- * The caller must balance the number of clk_rate_exclusive_get() and +- * clk_rate_exclusive_put() calls. +- * +- * Must not be called from within atomic context. +- */ +-void clk_rate_exclusive_put(struct clk *clk); + + /** + * clk_enable - inform the system when the clock source should be running. +@@ -918,14 +926,6 @@ static inline void clk_bulk_put_all(int num_clks, struct clk_bulk_data *clks) {} + + static inline void devm_clk_put(struct device *dev, struct clk *clk) {} + +- +-static inline int clk_rate_exclusive_get(struct clk *clk) +-{ +- return 0; +-} +- +-static inline void clk_rate_exclusive_put(struct clk *clk) {} +- + static inline int clk_enable(struct clk *clk) + { + return 0; +-- +2.40.1 + diff --git a/queue-5.4/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch b/queue-5.4/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch new file mode 100644 index 00000000000..770aede4c1a --- /dev/null +++ b/queue-5.4/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch @@ -0,0 +1,81 @@ +From eeae553d30a48a04789a070c65da4a07f19ccb97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 07:59:38 -0700 +Subject: dma-buf/sw_sync: Avoid recursive lock during fence signal +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rob Clark + +[ Upstream commit e531fdb5cd5ee2564b7fe10c8a9219e2b2fac61e ] + +If a signal callback releases the sw_sync fence, that will trigger a +deadlock as the timeline_fence_release recurses onto the fence->lock +(used both for signaling and the the timeline tree). + +To avoid that, temporarily hold an extra reference to the signalled +fences until after we drop the lock. + +(This is an alternative implementation of https://patchwork.kernel.org/patch/11664717/ +which avoids some potential UAF issues with the original patch.) + +v2: Remove now obsolete comment, use list_move_tail() and + list_del_init() + +Reported-by: Bas Nieuwenhuizen +Fixes: d3c6dd1fb30d ("dma-buf/sw_sync: Synchronize signal vs syncpt free") +Signed-off-by: Rob Clark +Link: https://patchwork.freedesktop.org/patch/msgid/20230818145939.39697-1-robdclark@gmail.com +Reviewed-by: Christian König +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/sw_sync.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c +index 6713cfb1995c6..7e7356970d5fc 100644 +--- a/drivers/dma-buf/sw_sync.c ++++ b/drivers/dma-buf/sw_sync.c +@@ -191,6 +191,7 @@ static const struct dma_fence_ops timeline_fence_ops = { + */ + static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc) + { ++ LIST_HEAD(signalled); + struct sync_pt *pt, *next; + + trace_sync_timeline(obj); +@@ -203,21 +204,20 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc) + if (!timeline_fence_signaled(&pt->base)) + break; + +- list_del_init(&pt->link); ++ dma_fence_get(&pt->base); ++ ++ list_move_tail(&pt->link, &signalled); + rb_erase(&pt->node, &obj->pt_tree); + +- /* +- * A signal callback may release the last reference to this +- * fence, causing it to be freed. That operation has to be +- * last to avoid a use after free inside this loop, and must +- * be after we remove the fence from the timeline in order to +- * prevent deadlocking on timeline->lock inside +- * timeline_fence_release(). +- */ + dma_fence_signal_locked(&pt->base); + } + + spin_unlock_irq(&obj->lock); ++ ++ list_for_each_entry_safe(pt, next, &signalled, link) { ++ list_del_init(&pt->link); ++ dma_fence_put(&pt->base); ++ } + } + + /** +-- +2.40.1 + diff --git a/queue-5.4/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch b/queue-5.4/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch new file mode 100644 index 00000000000..6cc19dd16b5 --- /dev/null +++ b/queue-5.4/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch @@ -0,0 +1,91 @@ +From c0c75aa8bf086de9e79bc4756035fa9c48137c4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Aug 2023 14:15:58 +0100 +Subject: pinctrl: renesas: rza2: Add lock around + pinctrl_generic{{add,remove}_group,{add,remove}_function} + +From: Biju Das + +[ Upstream commit 8fcc1c40b747069644db6102c1d84c942c9d4d86 ] + +The pinctrl group and function creation/remove calls expect +caller to take care of locking. Add lock around these functions. + +Fixes: b59d0e782706 ("pinctrl: Add RZ/A2 pin and gpio controller") +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230815131558.33787-4-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rza2.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-rza2.c b/drivers/pinctrl/pinctrl-rza2.c +index eda88cdf870df..8c3174d007507 100644 +--- a/drivers/pinctrl/pinctrl-rza2.c ++++ b/drivers/pinctrl/pinctrl-rza2.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -46,6 +47,7 @@ struct rza2_pinctrl_priv { + struct pinctrl_dev *pctl; + struct pinctrl_gpio_range gpio_range; + int npins; ++ struct mutex mutex; /* serialize adding groups and functions */ + }; + + #define RZA2_PDR(port) (0x0000 + (port) * 2) /* Direction 16-bit */ +@@ -359,10 +361,14 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev, + psel_val[i] = MUX_FUNC(value); + } + ++ mutex_lock(&priv->mutex); ++ + /* Register a single pin group listing all the pins we read from DT */ + gsel = pinctrl_generic_add_group(pctldev, np->name, pins, npins, NULL); +- if (gsel < 0) +- return gsel; ++ if (gsel < 0) { ++ ret = gsel; ++ goto unlock; ++ } + + /* + * Register a single group function where the 'data' is an array PSEL +@@ -391,6 +397,8 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev, + (*map)->data.mux.function = np->name; + *num_maps = 1; + ++ mutex_unlock(&priv->mutex); ++ + return 0; + + remove_function: +@@ -399,6 +407,9 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev, + remove_group: + pinctrl_generic_remove_group(pctldev, gsel); + ++unlock: ++ mutex_unlock(&priv->mutex); ++ + dev_err(priv->dev, "Unable to parse DT node %s\n", np->name); + + return ret; +@@ -476,6 +487,8 @@ static int rza2_pinctrl_probe(struct platform_device *pdev) + if (IS_ERR(priv->base)) + return PTR_ERR(priv->base); + ++ mutex_init(&priv->mutex); ++ + platform_set_drvdata(pdev, priv); + + priv->npins = (int)(uintptr_t)of_device_get_match_data(&pdev->dev) * +-- +2.40.1 + diff --git a/queue-5.4/series b/queue-5.4/series index 8fbd453d302..105f42708ba 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -153,3 +153,6 @@ interconnect-do-not-skip-aggregation-for-disabled-paths.patch alsa-pcm-check-for-null-pointer-of-pointer-substream-before-dereferencing-it.patch documentation-sysctl-document-page_lock_unfairness.patch irqchip-mips-gic-don-t-touch-vl_map-if-a-local-interrupt-is-not-routable.patch +clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch +pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch +dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch