From ba4c8f64f4188aedcac7d1cea7b520080574a643 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 27 Aug 2023 21:51:24 -0400 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...d-reference-to-clk_rate_exclusive_-g.patch | 146 ++++++++++++++ ...avoid-recursive-lock-during-fence-si.patch | 81 ++++++++ ...-reference-leak-in-soft_offline_page.patch | 87 ++++++++ .../mm-hwpoison-refactor-get_any_page.patch | 189 ++++++++++++++++++ ...e-fix-unexpected-return-value-in-sof.patch | 53 +++++ ...-failure-kill-soft_offline_free_page.patch | 56 ++++++ ...rza2-add-lock-around-pinctrl_generic.patch | 91 +++++++++ queue-5.10/series | 7 + 8 files changed, 710 insertions(+) create mode 100644 queue-5.10/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch create mode 100644 queue-5.10/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch create mode 100644 queue-5.10/mm-fix-page-reference-leak-in-soft_offline_page.patch create mode 100644 queue-5.10/mm-hwpoison-refactor-get_any_page.patch create mode 100644 queue-5.10/mm-memory-failure-fix-unexpected-return-value-in-sof.patch create mode 100644 queue-5.10/mm-memory-failure-kill-soft_offline_free_page.patch create mode 100644 queue-5.10/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch diff --git a/queue-5.10/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch b/queue-5.10/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch new file mode 100644 index 00000000000..d6a438a9166 --- /dev/null +++ b/queue-5.10/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch @@ -0,0 +1,146 @@ +From 24e715a9a73a088e10168d39382474c0c7d39bf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 18:51:40 +0100 +Subject: clk: Fix undefined reference to `clk_rate_exclusive_{get,put}' + +From: Biju Das + +[ Upstream commit 2746f13f6f1df7999001d6595b16f789ecc28ad1 ] + +The COMMON_CLK config is not enabled in some of the architectures. +This causes below build issues: + +pwm-rz-mtu3.c:(.text+0x114): +undefined reference to `clk_rate_exclusive_put' +pwm-rz-mtu3.c:(.text+0x32c): +undefined reference to `clk_rate_exclusive_get' + +Fix these issues by moving clk_rate_exclusive_{get,put} inside COMMON_CLK +code block, as clk.c is enabled by COMMON_CLK. + +Fixes: 55e9b8b7b806 ("clk: add clk_rate_exclusive api") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/all/202307251752.vLfmmhYm-lkp@intel.com/ +Signed-off-by: Biju Das +Link: https://lore.kernel.org/r/20230725175140.361479-1-biju.das.jz@bp.renesas.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + include/linux/clk.h | 80 ++++++++++++++++++++++----------------------- + 1 file changed, 40 insertions(+), 40 deletions(-) + +diff --git a/include/linux/clk.h b/include/linux/clk.h +index 1814eabb7c204..12c85ba606ec5 100644 +--- a/include/linux/clk.h ++++ b/include/linux/clk.h +@@ -172,6 +172,39 @@ int clk_get_scaled_duty_cycle(struct clk *clk, unsigned int scale); + */ + bool clk_is_match(const struct clk *p, const struct clk *q); + ++/** ++ * clk_rate_exclusive_get - get exclusivity over the rate control of a ++ * producer ++ * @clk: clock source ++ * ++ * This function allows drivers to get exclusive control over the rate of a ++ * provider. It prevents any other consumer to execute, even indirectly, ++ * opereation which could alter the rate of the provider or cause glitches ++ * ++ * If exlusivity is claimed more than once on clock, even by the same driver, ++ * the rate effectively gets locked as exclusivity can't be preempted. ++ * ++ * Must not be called from within atomic context. ++ * ++ * Returns success (0) or negative errno. ++ */ ++int clk_rate_exclusive_get(struct clk *clk); ++ ++/** ++ * clk_rate_exclusive_put - release exclusivity over the rate control of a ++ * producer ++ * @clk: clock source ++ * ++ * This function allows drivers to release the exclusivity it previously got ++ * from clk_rate_exclusive_get() ++ * ++ * The caller must balance the number of clk_rate_exclusive_get() and ++ * clk_rate_exclusive_put() calls. ++ * ++ * Must not be called from within atomic context. ++ */ ++void clk_rate_exclusive_put(struct clk *clk); ++ + #else + + static inline int clk_notifier_register(struct clk *clk, +@@ -218,6 +251,13 @@ static inline bool clk_is_match(const struct clk *p, const struct clk *q) + return p == q; + } + ++static inline int clk_rate_exclusive_get(struct clk *clk) ++{ ++ return 0; ++} ++ ++static inline void clk_rate_exclusive_put(struct clk *clk) {} ++ + #endif + + /** +@@ -530,38 +570,6 @@ struct clk *devm_clk_get_optional_enabled(struct device *dev, const char *id); + */ + struct clk *devm_get_clk_from_child(struct device *dev, + struct device_node *np, const char *con_id); +-/** +- * clk_rate_exclusive_get - get exclusivity over the rate control of a +- * producer +- * @clk: clock source +- * +- * This function allows drivers to get exclusive control over the rate of a +- * provider. It prevents any other consumer to execute, even indirectly, +- * opereation which could alter the rate of the provider or cause glitches +- * +- * If exlusivity is claimed more than once on clock, even by the same driver, +- * the rate effectively gets locked as exclusivity can't be preempted. +- * +- * Must not be called from within atomic context. +- * +- * Returns success (0) or negative errno. +- */ +-int clk_rate_exclusive_get(struct clk *clk); +- +-/** +- * clk_rate_exclusive_put - release exclusivity over the rate control of a +- * producer +- * @clk: clock source +- * +- * This function allows drivers to release the exclusivity it previously got +- * from clk_rate_exclusive_get() +- * +- * The caller must balance the number of clk_rate_exclusive_get() and +- * clk_rate_exclusive_put() calls. +- * +- * Must not be called from within atomic context. +- */ +-void clk_rate_exclusive_put(struct clk *clk); + + /** + * clk_enable - inform the system when the clock source should be running. +@@ -921,14 +929,6 @@ static inline void clk_bulk_put_all(int num_clks, struct clk_bulk_data *clks) {} + + static inline void devm_clk_put(struct device *dev, struct clk *clk) {} + +- +-static inline int clk_rate_exclusive_get(struct clk *clk) +-{ +- return 0; +-} +- +-static inline void clk_rate_exclusive_put(struct clk *clk) {} +- + static inline int clk_enable(struct clk *clk) + { + return 0; +-- +2.40.1 + diff --git a/queue-5.10/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch b/queue-5.10/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch new file mode 100644 index 00000000000..af5f10d809d --- /dev/null +++ b/queue-5.10/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch @@ -0,0 +1,81 @@ +From 96ed8fbe2197e38119c1c6a2bd95f21759eb7be0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 07:59:38 -0700 +Subject: dma-buf/sw_sync: Avoid recursive lock during fence signal +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rob Clark + +[ Upstream commit e531fdb5cd5ee2564b7fe10c8a9219e2b2fac61e ] + +If a signal callback releases the sw_sync fence, that will trigger a +deadlock as the timeline_fence_release recurses onto the fence->lock +(used both for signaling and the the timeline tree). + +To avoid that, temporarily hold an extra reference to the signalled +fences until after we drop the lock. + +(This is an alternative implementation of https://patchwork.kernel.org/patch/11664717/ +which avoids some potential UAF issues with the original patch.) + +v2: Remove now obsolete comment, use list_move_tail() and + list_del_init() + +Reported-by: Bas Nieuwenhuizen +Fixes: d3c6dd1fb30d ("dma-buf/sw_sync: Synchronize signal vs syncpt free") +Signed-off-by: Rob Clark +Link: https://patchwork.freedesktop.org/patch/msgid/20230818145939.39697-1-robdclark@gmail.com +Reviewed-by: Christian König +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/sw_sync.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c +index 348b3a9170fa4..7f5ed1aa7a9f8 100644 +--- a/drivers/dma-buf/sw_sync.c ++++ b/drivers/dma-buf/sw_sync.c +@@ -191,6 +191,7 @@ static const struct dma_fence_ops timeline_fence_ops = { + */ + static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc) + { ++ LIST_HEAD(signalled); + struct sync_pt *pt, *next; + + trace_sync_timeline(obj); +@@ -203,21 +204,20 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc) + if (!timeline_fence_signaled(&pt->base)) + break; + +- list_del_init(&pt->link); ++ dma_fence_get(&pt->base); ++ ++ list_move_tail(&pt->link, &signalled); + rb_erase(&pt->node, &obj->pt_tree); + +- /* +- * A signal callback may release the last reference to this +- * fence, causing it to be freed. That operation has to be +- * last to avoid a use after free inside this loop, and must +- * be after we remove the fence from the timeline in order to +- * prevent deadlocking on timeline->lock inside +- * timeline_fence_release(). +- */ + dma_fence_signal_locked(&pt->base); + } + + spin_unlock_irq(&obj->lock); ++ ++ list_for_each_entry_safe(pt, next, &signalled, link) { ++ list_del_init(&pt->link); ++ dma_fence_put(&pt->base); ++ } + } + + /** +-- +2.40.1 + diff --git a/queue-5.10/mm-fix-page-reference-leak-in-soft_offline_page.patch b/queue-5.10/mm-fix-page-reference-leak-in-soft_offline_page.patch new file mode 100644 index 00000000000..72dddd35095 --- /dev/null +++ b/queue-5.10/mm-fix-page-reference-leak-in-soft_offline_page.patch @@ -0,0 +1,87 @@ +From bf84cd0c490086b98cd0a7f26e86c44077b40ab2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Jan 2021 21:01:52 -0800 +Subject: mm: fix page reference leak in soft_offline_page() + +From: Dan Williams + +[ Upstream commit dad4e5b390866ca902653df0daa864ae4b8d4147 ] + +The conversion to move pfn_to_online_page() internal to +soft_offline_page() missed that the get_user_pages() reference taken by +the madvise() path needs to be dropped when pfn_to_online_page() fails. + +Note the direct sysfs-path to soft_offline_page() does not perform a +get_user_pages() lookup. + +When soft_offline_page() is handed a pfn_valid() && !pfn_to_online_page() +pfn the kernel hangs at dax-device shutdown due to a leaked reference. + +Link: https://lkml.kernel.org/r/161058501210.1840162.8108917599181157327.stgit@dwillia2-desk3.amr.corp.intel.com +Fixes: feec24a6139d ("mm, soft-offline: convert parameter to pfn") +Signed-off-by: Dan Williams +Reviewed-by: David Hildenbrand +Reviewed-by: Oscar Salvador +Reviewed-by: Naoya Horiguchi +Cc: Michal Hocko +Cc: Qian Cai +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: e2c1ab070fdc ("mm: memory-failure: fix unexpected return value in soft_offline_page()") +Signed-off-by: Sasha Levin +--- + mm/memory-failure.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 71fd546dbdc37..e3c0fa2464ff8 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1867,6 +1867,12 @@ static int soft_offline_free_page(struct page *page) + return rc; + } + ++static void put_ref_page(struct page *page) ++{ ++ if (page) ++ put_page(page); ++} ++ + /** + * soft_offline_page - Soft offline a page. + * @pfn: pfn to soft-offline +@@ -1892,20 +1898,26 @@ static int soft_offline_free_page(struct page *page) + int soft_offline_page(unsigned long pfn, int flags) + { + int ret; +- struct page *page; + bool try_again = true; ++ struct page *page, *ref_page = NULL; ++ ++ WARN_ON_ONCE(!pfn_valid(pfn) && (flags & MF_COUNT_INCREASED)); + + if (!pfn_valid(pfn)) + return -ENXIO; ++ if (flags & MF_COUNT_INCREASED) ++ ref_page = pfn_to_page(pfn); ++ + /* Only online pages can be soft-offlined (esp., not ZONE_DEVICE). */ + page = pfn_to_online_page(pfn); +- if (!page) ++ if (!page) { ++ put_ref_page(ref_page); + return -EIO; ++ } + + if (PageHWPoison(page)) { + pr_info("%s: %#lx page already poisoned\n", __func__, pfn); +- if (flags & MF_COUNT_INCREASED) +- put_page(page); ++ put_ref_page(ref_page); + return 0; + } + +-- +2.40.1 + diff --git a/queue-5.10/mm-hwpoison-refactor-get_any_page.patch b/queue-5.10/mm-hwpoison-refactor-get_any_page.patch new file mode 100644 index 00000000000..b3b9affc890 --- /dev/null +++ b/queue-5.10/mm-hwpoison-refactor-get_any_page.patch @@ -0,0 +1,189 @@ +From 87ba88fa0fd07fcc978c8afab4099f16d9dd71e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 19:11:38 -0800 +Subject: mm,hwpoison: refactor get_any_page + +From: Oscar Salvador + +[ Upstream commit 8295d535e2aa198bdf65a4045d622df38955ffe2 ] + +Patch series "HWPoison: Refactor get page interface", v2. + +This patch (of 3): + +When we want to grab a refcount via get_any_page, we call __get_any_page +that calls get_hwpoison_page to get the actual refcount. + +get_any_page() is only there because we have a sort of retry mechanism in +case the page we met is unknown to us or if we raced with an allocation. + +Also __get_any_page() prints some messages about the page type in case the +page was a free page or the page type was unknown, but if anything, we +only need to print a message in case the pagetype was unknown, as that is +reporting an error down the chain. + +Let us merge get_any_page() and __get_any_page(), and let the message be +printed in soft_offline_page. While we are it, we can also remove the +'pfn' parameter as it is no longer used. + +Link: https://lkml.kernel.org/r/20201204102558.31607-1-osalvador@suse.de +Link: https://lkml.kernel.org/r/20201204102558.31607-2-osalvador@suse.de +Signed-off-by: Oscar Salvador +Acked-by: Naoya Horiguchi +Acked-by: Vlastimil Babka +Cc: Qian Cai +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: e2c1ab070fdc ("mm: memory-failure: fix unexpected return value in soft_offline_page()") +Signed-off-by: Sasha Levin +--- + mm/memory-failure.c | 101 +++++++++++++++++++------------------------- + 1 file changed, 43 insertions(+), 58 deletions(-) + +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index b21dd4a793926..71fd546dbdc37 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1690,70 +1690,51 @@ EXPORT_SYMBOL(unpoison_memory); + + /* + * Safely get reference count of an arbitrary page. +- * Returns 0 for a free page, -EIO for a zero refcount page +- * that is not free, and 1 for any other page type. +- * For 1 the page is returned with increased page count, otherwise not. ++ * Returns 0 for a free page, 1 for an in-use page, -EIO for a page-type we ++ * cannot handle and -EBUSY if we raced with an allocation. ++ * We only incremented refcount in case the page was already in-use and it is ++ * a known type we can handle. + */ +-static int __get_any_page(struct page *p, unsigned long pfn, int flags) ++static int get_any_page(struct page *p, int flags) + { +- int ret; ++ int ret = 0, pass = 0; ++ bool count_increased = false; + + if (flags & MF_COUNT_INCREASED) +- return 1; +- +- /* +- * When the target page is a free hugepage, just remove it +- * from free hugepage list. +- */ +- if (!get_hwpoison_page(p)) { +- if (PageHuge(p)) { +- pr_info("%s: %#lx free huge page\n", __func__, pfn); +- ret = 0; +- } else if (is_free_buddy_page(p)) { +- pr_info("%s: %#lx free buddy page\n", __func__, pfn); +- ret = 0; +- } else if (page_count(p)) { +- /* raced with allocation */ ++ count_increased = true; ++ ++try_again: ++ if (!count_increased && !get_hwpoison_page(p)) { ++ if (page_count(p)) { ++ /* We raced with an allocation, retry. */ ++ if (pass++ < 3) ++ goto try_again; + ret = -EBUSY; +- } else { +- pr_info("%s: %#lx: unknown zero refcount page type %lx\n", +- __func__, pfn, p->flags); ++ } else if (!PageHuge(p) && !is_free_buddy_page(p)) { ++ /* We raced with put_page, retry. */ ++ if (pass++ < 3) ++ goto try_again; + ret = -EIO; + } + } else { +- /* Not a free page */ +- ret = 1; +- } +- return ret; +-} +- +-static int get_any_page(struct page *page, unsigned long pfn, int flags) +-{ +- int ret = __get_any_page(page, pfn, flags); +- +- if (ret == -EBUSY) +- ret = __get_any_page(page, pfn, flags); +- +- if (ret == 1 && !PageHuge(page) && +- !PageLRU(page) && !__PageMovable(page)) { +- /* +- * Try to free it. +- */ +- put_page(page); +- shake_page(page, 1); +- +- /* +- * Did it turn free? +- */ +- ret = __get_any_page(page, pfn, 0); +- if (ret == 1 && !PageLRU(page)) { +- /* Drop page reference which is from __get_any_page() */ +- put_page(page); +- pr_info("soft_offline: %#lx: unknown non LRU page type %lx (%pGp)\n", +- pfn, page->flags, &page->flags); +- return -EIO; ++ if (PageHuge(p) || PageLRU(p) || __PageMovable(p)) { ++ ret = 1; ++ } else { ++ /* ++ * A page we cannot handle. Check whether we can turn ++ * it into something we can handle. ++ */ ++ if (pass++ < 3) { ++ put_page(p); ++ shake_page(p, 1); ++ count_increased = false; ++ goto try_again; ++ } ++ put_page(p); ++ ret = -EIO; + } + } ++ + return ret; + } + +@@ -1922,7 +1903,7 @@ int soft_offline_page(unsigned long pfn, int flags) + return -EIO; + + if (PageHWPoison(page)) { +- pr_info("soft offline: %#lx page already poisoned\n", pfn); ++ pr_info("%s: %#lx page already poisoned\n", __func__, pfn); + if (flags & MF_COUNT_INCREASED) + put_page(page); + return 0; +@@ -1930,17 +1911,21 @@ int soft_offline_page(unsigned long pfn, int flags) + + retry: + get_online_mems(); +- ret = get_any_page(page, pfn, flags); ++ ret = get_any_page(page, flags); + put_online_mems(); + +- if (ret > 0) ++ if (ret > 0) { + ret = soft_offline_in_use_page(page); +- else if (ret == 0) ++ } else if (ret == 0) { + if (soft_offline_free_page(page) && try_again) { + try_again = false; + flags &= ~MF_COUNT_INCREASED; + goto retry; + } ++ } else if (ret == -EIO) { ++ pr_info("%s: %#lx: unknown page type: %lx (%pGP)\n", ++ __func__, pfn, page->flags, &page->flags); ++ } + + return ret; + } +-- +2.40.1 + diff --git a/queue-5.10/mm-memory-failure-fix-unexpected-return-value-in-sof.patch b/queue-5.10/mm-memory-failure-fix-unexpected-return-value-in-sof.patch new file mode 100644 index 00000000000..ab2ee9264c2 --- /dev/null +++ b/queue-5.10/mm-memory-failure-fix-unexpected-return-value-in-sof.patch @@ -0,0 +1,53 @@ +From 5c80bc50a4aa181f4f00448c6c90a7641c1a7a61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:28:08 +0800 +Subject: mm: memory-failure: fix unexpected return value in + soft_offline_page() + +From: Miaohe Lin + +[ Upstream commit e2c1ab070fdc81010ec44634838d24fce9ff9e53 ] + +When page_handle_poison() fails to handle the hugepage or free page in +retry path, soft_offline_page() will return 0 while -EBUSY is expected in +this case. + +Consequently the user will think soft_offline_page succeeds while it in +fact failed. So the user will not try again later in this case. + +Link: https://lkml.kernel.org/r/20230627112808.1275241-1-linmiaohe@huawei.com +Fixes: b94e02822deb ("mm,hwpoison: try to narrow window race for free pages") +Signed-off-by: Miaohe Lin +Acked-by: Naoya Horiguchi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/memory-failure.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 6375fe9be87b6..0c08e803ed42d 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1919,10 +1919,13 @@ int soft_offline_page(unsigned long pfn, int flags) + if (ret > 0) { + ret = soft_offline_in_use_page(page); + } else if (ret == 0) { +- if (!page_handle_poison(page, true, false) && try_again) { +- try_again = false; +- flags &= ~MF_COUNT_INCREASED; +- goto retry; ++ if (!page_handle_poison(page, true, false)) { ++ if (try_again) { ++ try_again = false; ++ flags &= ~MF_COUNT_INCREASED; ++ goto retry; ++ } ++ ret = -EBUSY; + } + } else if (ret == -EIO) { + pr_info("%s: %#lx: unknown page type: %lx (%pGP)\n", +-- +2.40.1 + diff --git a/queue-5.10/mm-memory-failure-kill-soft_offline_free_page.patch b/queue-5.10/mm-memory-failure-kill-soft_offline_free_page.patch new file mode 100644 index 00000000000..fe490028f83 --- /dev/null +++ b/queue-5.10/mm-memory-failure-kill-soft_offline_free_page.patch @@ -0,0 +1,56 @@ +From c55e54f3d00d41ca58f63e0d51db73a622b5d635 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Aug 2022 11:34:01 +0800 +Subject: mm: memory-failure: kill soft_offline_free_page() + +From: Kefeng Wang + +[ Upstream commit 7adb45887c8af88985c335b53d253654e9d2dd16 ] + +Open-code the page_handle_poison() into soft_offline_page() and kill +unneeded soft_offline_free_page(). + +Link: https://lkml.kernel.org/r/20220819033402.156519-1-wangkefeng.wang@huawei.com +Signed-off-by: Kefeng Wang +Reviewed-by: Miaohe Lin +Acked-by: Naoya Horiguchi +Signed-off-by: Andrew Morton +Stable-dep-of: e2c1ab070fdc ("mm: memory-failure: fix unexpected return value in soft_offline_page()") +Signed-off-by: Sasha Levin +--- + mm/memory-failure.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index e3c0fa2464ff8..6375fe9be87b6 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1857,16 +1857,6 @@ static int soft_offline_in_use_page(struct page *page) + return __soft_offline_page(page); + } + +-static int soft_offline_free_page(struct page *page) +-{ +- int rc = 0; +- +- if (!page_handle_poison(page, true, false)) +- rc = -EBUSY; +- +- return rc; +-} +- + static void put_ref_page(struct page *page) + { + if (page) +@@ -1929,7 +1919,7 @@ int soft_offline_page(unsigned long pfn, int flags) + if (ret > 0) { + ret = soft_offline_in_use_page(page); + } else if (ret == 0) { +- if (soft_offline_free_page(page) && try_again) { ++ if (!page_handle_poison(page, true, false) && try_again) { + try_again = false; + flags &= ~MF_COUNT_INCREASED; + goto retry; +-- +2.40.1 + diff --git a/queue-5.10/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch b/queue-5.10/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch new file mode 100644 index 00000000000..ae01e558303 --- /dev/null +++ b/queue-5.10/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch @@ -0,0 +1,91 @@ +From 333ed7ba2a2611fe39d648e3746adce72a67f1b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Aug 2023 14:15:58 +0100 +Subject: pinctrl: renesas: rza2: Add lock around + pinctrl_generic{{add,remove}_group,{add,remove}_function} + +From: Biju Das + +[ Upstream commit 8fcc1c40b747069644db6102c1d84c942c9d4d86 ] + +The pinctrl group and function creation/remove calls expect +caller to take care of locking. Add lock around these functions. + +Fixes: b59d0e782706 ("pinctrl: Add RZ/A2 pin and gpio controller") +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230815131558.33787-4-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl-rza2.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl-rza2.c b/drivers/pinctrl/renesas/pinctrl-rza2.c +index 32829eb9656c9..ddd8ee6b604ef 100644 +--- a/drivers/pinctrl/renesas/pinctrl-rza2.c ++++ b/drivers/pinctrl/renesas/pinctrl-rza2.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -46,6 +47,7 @@ struct rza2_pinctrl_priv { + struct pinctrl_dev *pctl; + struct pinctrl_gpio_range gpio_range; + int npins; ++ struct mutex mutex; /* serialize adding groups and functions */ + }; + + #define RZA2_PDR(port) (0x0000 + (port) * 2) /* Direction 16-bit */ +@@ -359,10 +361,14 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev, + psel_val[i] = MUX_FUNC(value); + } + ++ mutex_lock(&priv->mutex); ++ + /* Register a single pin group listing all the pins we read from DT */ + gsel = pinctrl_generic_add_group(pctldev, np->name, pins, npins, NULL); +- if (gsel < 0) +- return gsel; ++ if (gsel < 0) { ++ ret = gsel; ++ goto unlock; ++ } + + /* + * Register a single group function where the 'data' is an array PSEL +@@ -391,6 +397,8 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev, + (*map)->data.mux.function = np->name; + *num_maps = 1; + ++ mutex_unlock(&priv->mutex); ++ + return 0; + + remove_function: +@@ -399,6 +407,9 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev, + remove_group: + pinctrl_generic_remove_group(pctldev, gsel); + ++unlock: ++ mutex_unlock(&priv->mutex); ++ + dev_err(priv->dev, "Unable to parse DT node %s\n", np->name); + + return ret; +@@ -474,6 +485,8 @@ static int rza2_pinctrl_probe(struct platform_device *pdev) + if (IS_ERR(priv->base)) + return PTR_ERR(priv->base); + ++ mutex_init(&priv->mutex); ++ + platform_set_drvdata(pdev, priv); + + priv->npins = (int)(uintptr_t)of_device_get_match_data(&pdev->dev) * +-- +2.40.1 + diff --git a/queue-5.10/series b/queue-5.10/series index 0ab1903effc..62b474e1947 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -71,3 +71,10 @@ sched-deadline-create-dl-bw-alloc-free-check-overflow-interface.patch cgroup-cpuset-free-dl-bw-in-case-can_attach-fails.patch drm-i915-fix-premature-release-of-request-s-reusable-memory.patch asoc-rt711-add-two-jack-detection-modes.patch +clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch +pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch +dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch +mm-hwpoison-refactor-get_any_page.patch +mm-fix-page-reference-leak-in-soft_offline_page.patch +mm-memory-failure-kill-soft_offline_free_page.patch +mm-memory-failure-fix-unexpected-return-value-in-sof.patch -- 2.47.3