/* * INT3406 thermal driver for display participant device * * Copyright (C) 2016, Intel Corporation * Authors: Aaron Lu * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. * */ #include #include #include #include #include #include #define INT3406_BRIGHTNESS_LIMITS_CHANGED 0x80 struct int3406_thermal_data { int upper_limit; int upper_limit_index; int lower_limit; int lower_limit_index; acpi_handle handle; struct acpi_video_device_brightness *br; struct backlight_device *raw_bd; struct thermal_cooling_device *cooling_dev; }; static int int3406_thermal_to_raw(int level, struct int3406_thermal_data *d) { int max_level = d->br->levels[d->br->count - 1]; int raw_max = d->raw_bd->props.max_brightness; return level * raw_max / max_level; } static int int3406_thermal_to_acpi(int level, struct int3406_thermal_data *d) { int raw_max = d->raw_bd->props.max_brightness; int max_level = d->br->levels[d->br->count - 1]; return level * max_level / raw_max; } static int int3406_thermal_get_max_state(struct thermal_cooling_device *cooling_dev, unsigned long *state) { struct int3406_thermal_data *d = cooling_dev->devdata; int index = d->lower_limit_index ? d->lower_limit_index : 2; *state = d->br->count - 1 - index; return 0; } static int int3406_thermal_set_cur_state(struct thermal_cooling_device *cooling_dev, unsigned long state) { struct int3406_thermal_data *d = cooling_dev->devdata; int level, raw_level; if (state > d->br->count - 3) return -EINVAL; state = d->br->count - 1 - state; level = d->br->levels[state]; if ((d->upper_limit && level > d->upper_limit) || (d->lower_limit && level < d->lower_limit)) return -EINVAL; raw_level = int3406_thermal_to_raw(level, d); return backlight_device_set_brightness(d->raw_bd, raw_level); } static int int3406_thermal_get_cur_state(struct thermal_cooling_device *cooling_dev, unsigned long *state) { struct int3406_thermal_data *d = cooling_dev->devdata; int raw_level, level, i; int *levels = d->br->levels; raw_level = d->raw_bd->props.brightness; level = int3406_thermal_to_acpi(raw_level, d); /* * There is no 1:1 mapping between the firmware interface level with the * raw interface level, we will have to find one that is close enough. */ for (i = 2; i < d->br->count; i++) { if (level < levels[i]) { if (i == 2) break; if ((level - levels[i - 1]) < (levels[i] - level)) i--; break; } } *state = d->br->count - 1 - i; return 0; } static const struct thermal_cooling_device_ops video_cooling_ops = { .get_max_state = int3406_thermal_get_max_state, .get_cur_state = int3406_thermal_get_cur_state, .set_cur_state = int3406_thermal_set_cur_state, }; static int int3406_thermal_get_index(int *array, int nr, int value) { int i; for (i = 0; i < nr; i++) { if (array[i] == value) break; } return i == nr ? -ENOENT : i; } static void int3406_thermal_get_limit(struct int3406_thermal_data *d) { acpi_status status; unsigned long long lower_limit, upper_limit; int index; status = acpi_evaluate_integer(d->handle, "DDDL", NULL, &lower_limit); if (ACPI_SUCCESS(status)) { index = int3406_thermal_get_index(d->br->levels, d->br->count, lower_limit); if (index > 0) { d->lower_limit = (int)lower_limit; d->lower_limit_index = index; } } status = acpi_evaluate_integer(d->handle, "DDPC", NULL, &upper_limit); if (ACPI_SUCCESS(status)) { index = int3406_thermal_get_index(d->br->levels, d->br->count, upper_limit); if (index > 0) { d->upper_limit = (int)upper_limit; d->upper_limit_index = index; } } } static void int3406_notify(acpi_handle handle, u32 event, void *data) { if (event == INT3406_BRIGHTNESS_LIMITS_CHANGED) int3406_thermal_get_limit(data); } static int int3406_thermal_probe(struct platform_device *pdev) { struct acpi_device *adev = ACPI_COMPANION(&pdev->dev); struct int3406_thermal_data *d; struct backlight_device *bd; int ret; if (!ACPI_HANDLE(&pdev->dev)) return -ENODEV; d = devm_kzalloc(&pdev->dev, sizeof(*d), GFP_KERNEL); if (!d) return -ENOMEM; d->handle = ACPI_HANDLE(&pdev->dev); bd = backlight_device_get_by_type(BACKLIGHT_RAW); if (!bd) return -ENODEV; d->raw_bd = bd; ret = acpi_video_get_levels(ACPI_COMPANION(&pdev->dev), &d->br, NULL); if (ret) return ret; int3406_thermal_get_limit(d); d->cooling_dev = thermal_cooling_device_register(acpi_device_bid(adev), d, &video_cooling_ops); if (IS_ERR(d->cooling_dev)) goto err; ret = acpi_install_notify_handler(adev->handle, ACPI_DEVICE_NOTIFY, int3406_notify, d); if (ret) goto err_cdev; platform_set_drvdata(pdev, d); return 0; err_cdev: thermal_cooling_device_unregister(d->cooling_dev); err: kfree(d->br); return -ENODEV; } static int int3406_thermal_remove(struct platform_device *pdev) { struct int3406_thermal_data *d = platform_get_drvdata(pdev); thermal_cooling_device_unregister(d->cooling_dev); kfree(d->br); return 0; } static const struct acpi_device_id int3406_thermal_match[] = { {"INT3406", 0}, {} }; MODULE_DEVICE_TABLE(acpi, int3406_thermal_match); static struct platform_driver int3406_thermal_driver = { .probe = int3406_thermal_probe, .remove = int3406_thermal_remove, .driver = { .name = "int3406 thermal", .acpi_match_table = int3406_thermal_match, }, }; module_platform_driver(int3406_thermal_driver); MODULE_DESCRIPTION("INT3406 Thermal driver"); MODULE_LICENSE("GPL v2"); adget/functions.c?id=1b1bc42c1692e9b62756323c675a44cb1a1f9dbd'>1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'drivers/usb/gadget/functions.c')