From f3239837637376765f6fef3e0f86a903bdd5a546 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 27 Aug 2023 21:51:23 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...d-reference-to-clk_rate_exclusive_-g.patch | 146 ++++++++++++++++++ ...avoid-recursive-lock-during-fence-si.patch | 81 ++++++++++ ...e-fix-unexpected-return-value-in-sof.patch | 53 +++++++ ...-failure-kill-soft_offline_free_page.patch | 56 +++++++ ...rza2-add-lock-around-pinctrl_generic.patch | 91 +++++++++++ queue-5.15/series | 5 + 6 files changed, 432 insertions(+) create mode 100644 queue-5.15/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch create mode 100644 queue-5.15/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch create mode 100644 queue-5.15/mm-memory-failure-fix-unexpected-return-value-in-sof.patch create mode 100644 queue-5.15/mm-memory-failure-kill-soft_offline_free_page.patch create mode 100644 queue-5.15/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch diff --git a/queue-5.15/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch b/queue-5.15/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch new file mode 100644 index 00000000000..8d094470ba7 --- /dev/null +++ b/queue-5.15/clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch @@ -0,0 +1,146 @@ +From afb789a76635caa7b54ae192cb0b09cbcdf05636 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 18:51:40 +0100 +Subject: clk: Fix undefined reference to `clk_rate_exclusive_{get,put}' + +From: Biju Das + +[ Upstream commit 2746f13f6f1df7999001d6595b16f789ecc28ad1 ] + +The COMMON_CLK config is not enabled in some of the architectures. +This causes below build issues: + +pwm-rz-mtu3.c:(.text+0x114): +undefined reference to `clk_rate_exclusive_put' +pwm-rz-mtu3.c:(.text+0x32c): +undefined reference to `clk_rate_exclusive_get' + +Fix these issues by moving clk_rate_exclusive_{get,put} inside COMMON_CLK +code block, as clk.c is enabled by COMMON_CLK. + +Fixes: 55e9b8b7b806 ("clk: add clk_rate_exclusive api") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/all/202307251752.vLfmmhYm-lkp@intel.com/ +Signed-off-by: Biju Das +Link: https://lore.kernel.org/r/20230725175140.361479-1-biju.das.jz@bp.renesas.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + include/linux/clk.h | 80 ++++++++++++++++++++++----------------------- + 1 file changed, 40 insertions(+), 40 deletions(-) + +diff --git a/include/linux/clk.h b/include/linux/clk.h +index e280e0acb55c6..05ab315aa84bc 100644 +--- a/include/linux/clk.h ++++ b/include/linux/clk.h +@@ -183,6 +183,39 @@ int clk_get_scaled_duty_cycle(struct clk *clk, unsigned int scale); + */ + bool clk_is_match(const struct clk *p, const struct clk *q); + ++/** ++ * clk_rate_exclusive_get - get exclusivity over the rate control of a ++ * producer ++ * @clk: clock source ++ * ++ * This function allows drivers to get exclusive control over the rate of a ++ * provider. It prevents any other consumer to execute, even indirectly, ++ * opereation which could alter the rate of the provider or cause glitches ++ * ++ * If exlusivity is claimed more than once on clock, even by the same driver, ++ * the rate effectively gets locked as exclusivity can't be preempted. ++ * ++ * Must not be called from within atomic context. ++ * ++ * Returns success (0) or negative errno. ++ */ ++int clk_rate_exclusive_get(struct clk *clk); ++ ++/** ++ * clk_rate_exclusive_put - release exclusivity over the rate control of a ++ * producer ++ * @clk: clock source ++ * ++ * This function allows drivers to release the exclusivity it previously got ++ * from clk_rate_exclusive_get() ++ * ++ * The caller must balance the number of clk_rate_exclusive_get() and ++ * clk_rate_exclusive_put() calls. ++ * ++ * Must not be called from within atomic context. ++ */ ++void clk_rate_exclusive_put(struct clk *clk); ++ + #else + + static inline int clk_notifier_register(struct clk *clk, +@@ -236,6 +269,13 @@ static inline bool clk_is_match(const struct clk *p, const struct clk *q) + return p == q; + } + ++static inline int clk_rate_exclusive_get(struct clk *clk) ++{ ++ return 0; ++} ++ ++static inline void clk_rate_exclusive_put(struct clk *clk) {} ++ + #endif + + #ifdef CONFIG_HAVE_CLK_PREPARE +@@ -570,38 +610,6 @@ struct clk *devm_clk_get_optional_enabled(struct device *dev, const char *id); + */ + struct clk *devm_get_clk_from_child(struct device *dev, + struct device_node *np, const char *con_id); +-/** +- * clk_rate_exclusive_get - get exclusivity over the rate control of a +- * producer +- * @clk: clock source +- * +- * This function allows drivers to get exclusive control over the rate of a +- * provider. It prevents any other consumer to execute, even indirectly, +- * opereation which could alter the rate of the provider or cause glitches +- * +- * If exlusivity is claimed more than once on clock, even by the same driver, +- * the rate effectively gets locked as exclusivity can't be preempted. +- * +- * Must not be called from within atomic context. +- * +- * Returns success (0) or negative errno. +- */ +-int clk_rate_exclusive_get(struct clk *clk); +- +-/** +- * clk_rate_exclusive_put - release exclusivity over the rate control of a +- * producer +- * @clk: clock source +- * +- * This function allows drivers to release the exclusivity it previously got +- * from clk_rate_exclusive_get() +- * +- * The caller must balance the number of clk_rate_exclusive_get() and +- * clk_rate_exclusive_put() calls. +- * +- * Must not be called from within atomic context. +- */ +-void clk_rate_exclusive_put(struct clk *clk); + + /** + * clk_enable - inform the system when the clock source should be running. +@@ -961,14 +969,6 @@ static inline void clk_bulk_put_all(int num_clks, struct clk_bulk_data *clks) {} + + static inline void devm_clk_put(struct device *dev, struct clk *clk) {} + +- +-static inline int clk_rate_exclusive_get(struct clk *clk) +-{ +- return 0; +-} +- +-static inline void clk_rate_exclusive_put(struct clk *clk) {} +- + static inline int clk_enable(struct clk *clk) + { + return 0; +-- +2.40.1 + diff --git a/queue-5.15/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch b/queue-5.15/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch new file mode 100644 index 00000000000..886b8953da2 --- /dev/null +++ b/queue-5.15/dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch @@ -0,0 +1,81 @@ +From e4133779b47aee7aca761f2cb8871eeb8203f723 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 07:59:38 -0700 +Subject: dma-buf/sw_sync: Avoid recursive lock during fence signal +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rob Clark + +[ Upstream commit e531fdb5cd5ee2564b7fe10c8a9219e2b2fac61e ] + +If a signal callback releases the sw_sync fence, that will trigger a +deadlock as the timeline_fence_release recurses onto the fence->lock +(used both for signaling and the the timeline tree). + +To avoid that, temporarily hold an extra reference to the signalled +fences until after we drop the lock. + +(This is an alternative implementation of https://patchwork.kernel.org/patch/11664717/ +which avoids some potential UAF issues with the original patch.) + +v2: Remove now obsolete comment, use list_move_tail() and + list_del_init() + +Reported-by: Bas Nieuwenhuizen +Fixes: d3c6dd1fb30d ("dma-buf/sw_sync: Synchronize signal vs syncpt free") +Signed-off-by: Rob Clark +Link: https://patchwork.freedesktop.org/patch/msgid/20230818145939.39697-1-robdclark@gmail.com +Reviewed-by: Christian König +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/sw_sync.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c +index 348b3a9170fa4..7f5ed1aa7a9f8 100644 +--- a/drivers/dma-buf/sw_sync.c ++++ b/drivers/dma-buf/sw_sync.c +@@ -191,6 +191,7 @@ static const struct dma_fence_ops timeline_fence_ops = { + */ + static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc) + { ++ LIST_HEAD(signalled); + struct sync_pt *pt, *next; + + trace_sync_timeline(obj); +@@ -203,21 +204,20 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc) + if (!timeline_fence_signaled(&pt->base)) + break; + +- list_del_init(&pt->link); ++ dma_fence_get(&pt->base); ++ ++ list_move_tail(&pt->link, &signalled); + rb_erase(&pt->node, &obj->pt_tree); + +- /* +- * A signal callback may release the last reference to this +- * fence, causing it to be freed. That operation has to be +- * last to avoid a use after free inside this loop, and must +- * be after we remove the fence from the timeline in order to +- * prevent deadlocking on timeline->lock inside +- * timeline_fence_release(). +- */ + dma_fence_signal_locked(&pt->base); + } + + spin_unlock_irq(&obj->lock); ++ ++ list_for_each_entry_safe(pt, next, &signalled, link) { ++ list_del_init(&pt->link); ++ dma_fence_put(&pt->base); ++ } + } + + /** +-- +2.40.1 + diff --git a/queue-5.15/mm-memory-failure-fix-unexpected-return-value-in-sof.patch b/queue-5.15/mm-memory-failure-fix-unexpected-return-value-in-sof.patch new file mode 100644 index 00000000000..0d62b67b91f --- /dev/null +++ b/queue-5.15/mm-memory-failure-fix-unexpected-return-value-in-sof.patch @@ -0,0 +1,53 @@ +From e877c821dcab90275d57877da3ad993985153081 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:28:08 +0800 +Subject: mm: memory-failure: fix unexpected return value in + soft_offline_page() + +From: Miaohe Lin + +[ Upstream commit e2c1ab070fdc81010ec44634838d24fce9ff9e53 ] + +When page_handle_poison() fails to handle the hugepage or free page in +retry path, soft_offline_page() will return 0 while -EBUSY is expected in +this case. + +Consequently the user will think soft_offline_page succeeds while it in +fact failed. So the user will not try again later in this case. + +Link: https://lkml.kernel.org/r/20230627112808.1275241-1-linmiaohe@huawei.com +Fixes: b94e02822deb ("mm,hwpoison: try to narrow window race for free pages") +Signed-off-by: Miaohe Lin +Acked-by: Naoya Horiguchi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/memory-failure.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 69d22af10adfc..bcd71d8736be5 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -2284,10 +2284,13 @@ int soft_offline_page(unsigned long pfn, int flags) + if (ret > 0) { + ret = soft_offline_in_use_page(page); + } else if (ret == 0) { +- if (!page_handle_poison(page, true, false) && try_again) { +- try_again = false; +- flags &= ~MF_COUNT_INCREASED; +- goto retry; ++ if (!page_handle_poison(page, true, false)) { ++ if (try_again) { ++ try_again = false; ++ flags &= ~MF_COUNT_INCREASED; ++ goto retry; ++ } ++ ret = -EBUSY; + } + } + +-- +2.40.1 + diff --git a/queue-5.15/mm-memory-failure-kill-soft_offline_free_page.patch b/queue-5.15/mm-memory-failure-kill-soft_offline_free_page.patch new file mode 100644 index 00000000000..4c151aff9ed --- /dev/null +++ b/queue-5.15/mm-memory-failure-kill-soft_offline_free_page.patch @@ -0,0 +1,56 @@ +From 36049f63cd1e7c8ed6840dce15ae3473718ac818 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Aug 2022 11:34:01 +0800 +Subject: mm: memory-failure: kill soft_offline_free_page() + +From: Kefeng Wang + +[ Upstream commit 7adb45887c8af88985c335b53d253654e9d2dd16 ] + +Open-code the page_handle_poison() into soft_offline_page() and kill +unneeded soft_offline_free_page(). + +Link: https://lkml.kernel.org/r/20220819033402.156519-1-wangkefeng.wang@huawei.com +Signed-off-by: Kefeng Wang +Reviewed-by: Miaohe Lin +Acked-by: Naoya Horiguchi +Signed-off-by: Andrew Morton +Stable-dep-of: e2c1ab070fdc ("mm: memory-failure: fix unexpected return value in soft_offline_page()") +Signed-off-by: Sasha Levin +--- + mm/memory-failure.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 9f9dd968fbe3c..69d22af10adfc 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -2219,16 +2219,6 @@ static int soft_offline_in_use_page(struct page *page) + return __soft_offline_page(page); + } + +-static int soft_offline_free_page(struct page *page) +-{ +- int rc = 0; +- +- if (!page_handle_poison(page, true, false)) +- rc = -EBUSY; +- +- return rc; +-} +- + static void put_ref_page(struct page *page) + { + if (page) +@@ -2294,7 +2284,7 @@ int soft_offline_page(unsigned long pfn, int flags) + if (ret > 0) { + ret = soft_offline_in_use_page(page); + } else if (ret == 0) { +- if (soft_offline_free_page(page) && try_again) { ++ if (!page_handle_poison(page, true, false) && try_again) { + try_again = false; + flags &= ~MF_COUNT_INCREASED; + goto retry; +-- +2.40.1 + diff --git a/queue-5.15/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch b/queue-5.15/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch new file mode 100644 index 00000000000..54dd095d3f0 --- /dev/null +++ b/queue-5.15/pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch @@ -0,0 +1,91 @@ +From f6c5c154e9baf00c64c8d789b85f624fa5e18a06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Aug 2023 14:15:58 +0100 +Subject: pinctrl: renesas: rza2: Add lock around + pinctrl_generic{{add,remove}_group,{add,remove}_function} + +From: Biju Das + +[ Upstream commit 8fcc1c40b747069644db6102c1d84c942c9d4d86 ] + +The pinctrl group and function creation/remove calls expect +caller to take care of locking. Add lock around these functions. + +Fixes: b59d0e782706 ("pinctrl: Add RZ/A2 pin and gpio controller") +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230815131558.33787-4-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl-rza2.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl-rza2.c b/drivers/pinctrl/renesas/pinctrl-rza2.c +index 32829eb9656c9..ddd8ee6b604ef 100644 +--- a/drivers/pinctrl/renesas/pinctrl-rza2.c ++++ b/drivers/pinctrl/renesas/pinctrl-rza2.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -46,6 +47,7 @@ struct rza2_pinctrl_priv { + struct pinctrl_dev *pctl; + struct pinctrl_gpio_range gpio_range; + int npins; ++ struct mutex mutex; /* serialize adding groups and functions */ + }; + + #define RZA2_PDR(port) (0x0000 + (port) * 2) /* Direction 16-bit */ +@@ -359,10 +361,14 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev, + psel_val[i] = MUX_FUNC(value); + } + ++ mutex_lock(&priv->mutex); ++ + /* Register a single pin group listing all the pins we read from DT */ + gsel = pinctrl_generic_add_group(pctldev, np->name, pins, npins, NULL); +- if (gsel < 0) +- return gsel; ++ if (gsel < 0) { ++ ret = gsel; ++ goto unlock; ++ } + + /* + * Register a single group function where the 'data' is an array PSEL +@@ -391,6 +397,8 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev, + (*map)->data.mux.function = np->name; + *num_maps = 1; + ++ mutex_unlock(&priv->mutex); ++ + return 0; + + remove_function: +@@ -399,6 +407,9 @@ static int rza2_dt_node_to_map(struct pinctrl_dev *pctldev, + remove_group: + pinctrl_generic_remove_group(pctldev, gsel); + ++unlock: ++ mutex_unlock(&priv->mutex); ++ + dev_err(priv->dev, "Unable to parse DT node %s\n", np->name); + + return ret; +@@ -474,6 +485,8 @@ static int rza2_pinctrl_probe(struct platform_device *pdev) + if (IS_ERR(priv->base)) + return PTR_ERR(priv->base); + ++ mutex_init(&priv->mutex); ++ + platform_set_drvdata(pdev, priv); + + priv->npins = (int)(uintptr_t)of_device_get_match_data(&pdev->dev) * +-- +2.40.1 + diff --git a/queue-5.15/series b/queue-5.15/series index 930ebb9bfd8..be63b98c032 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -81,3 +81,8 @@ sched-deadline-create-dl-bw-alloc-free-check-overflow-interface.patch cgroup-cpuset-free-dl-bw-in-case-can_attach-fails.patch drm-i915-fix-premature-release-of-request-s-reusable-memory.patch can-raw-add-missing-refcount-for-memory-leak-fix.patch +clk-fix-undefined-reference-to-clk_rate_exclusive_-g.patch +pinctrl-renesas-rza2-add-lock-around-pinctrl_generic.patch +dma-buf-sw_sync-avoid-recursive-lock-during-fence-si.patch +mm-memory-failure-kill-soft_offline_free_page.patch +mm-memory-failure-fix-unexpected-return-value-in-sof.patch -- 2.47.3