/* * m32r_sio_reg.h * * Copyright (C) 1992, 1994 by Theodore Ts'o. * Copyright (C) 2004 Hirokazu Takata * * Redistribution of this file is permitted under the terms of the GNU * Public License (GPL) * * These are the UART port assignments, expressed as offsets from the base * register. These assignments should hold for any serial port based on * a 8250, 16450, or 16550(A). */ #ifndef _M32R_SIO_REG_H #define _M32R_SIO_REG_H #ifdef CONFIG_SERIAL_M32R_PLDSIO #define SIOCR 0x000 #define SIOMOD0 0x002 #define SIOMOD1 0x004 #define SIOSTS 0x006 #define SIOTRCR 0x008 #define SIOBAUR 0x00a // #define SIORBAUR 0x018 #define SIOTXB 0x00c #define SIORXB 0x00e #define UART_RX ((unsigned long) PLD_ESIO0RXB) /* In: Receive buffer (DLAB=0) */ #define UART_TX ((unsigned long) PLD_ESIO0TXB) /* Out: Transmit buffer (DLAB=0) */ #define UART_DLL 0 /* Out: Divisor Latch Low (DLAB=1) */ #define UART_TRG 0 /* (LCR=BF) FCTR bit 7 selects Rx or Tx * In: Fifo count * Out: Fifo custom trigger levels * XR16C85x only */ #define UART_DLM 0 /* Out: Divisor Latch High (DLAB=1) */ #define UART_IER ((unsigned long) PLD_ESIO0INTCR) /* Out: Interrupt Enable Register */ #define UART_FCTR 0 /* (LCR=BF) Feature Control Register * XR16C85x only */ #define UART_IIR 0 /* In: Interrupt ID Register */ #define UART_FCR 0 /* Out: FIFO Control Register */ #define UART_EFR 0 /* I/O: Extended Features Register */ /* (DLAB=1, 16C660 only) */ #define UART_LCR 0 /* Out: Line Control Register */ #define UART_MCR 0 /* Out: Modem Control Register */ #define UART_LSR ((unsigned long) PLD_ESIO0STS) /* In: Line Status Register */ #define UART_MSR 0 /* In: Modem Status Register */ #define UART_SCR 0 /* I/O: Scratch Register */ #define UART_EMSR 0 /* (LCR=BF) Extended Mode Select Register * FCTR bit 6 selects SCR or EMSR * XR16c85x only */ #else /* not CONFIG_SERIAL_M32R_PLDSIO */ #define SIOCR 0x000 #define SIOMOD0 0x004 #define SIOMOD1 0x008 #define SIOSTS 0x00c #define SIOTRCR 0x010 #define SIOBAUR 0x014 #define SIORBAUR 0x018 #define SIOTXB 0x01c #define SIORXB 0x020 #define UART_RX M32R_SIO0_RXB_PORTL /* In: Receive buffer (DLAB=0) */ #define UART_TX M32R_SIO0_TXB_PORTL /* Out: Transmit buffer (DLAB=0) */ #define UART_DLL 0 /* Out: Divisor Latch Low (DLAB=1) */ #define UART_TRG 0 /* (LCR=BF) FCTR bit 7 selects Rx or Tx * In: Fifo count * Out: Fifo custom trigger levels * XR16C85x only */ #define UART_DLM 0 /* Out: Divisor Latch High (DLAB=1) */ #define UART_IER M32R_SIO0_TRCR_PORTL /* Out: Interrupt Enable Register */ #define UART_FCTR 0 /* (LCR=BF) Feature Control Register * XR16C85x only */ #define UART_IIR 0 /* In: Interrupt ID Register */ #define UART_FCR 0 /* Out: FIFO Control Register */ #define UART_EFR 0 /* I/O: Extended Features Register */ /* (DLAB=1, 16C660 only) */ #define UART_LCR 0 /* Out: Line Control Register */ #define UART_MCR 0 /* Out: Modem Control Register */ #define UART_LSR M32R_SIO0_STS_PORTL /* In: Line Status Register */ #define UART_MSR 0 /* In: Modem Status Register */ #define UART_SCR 0 /* I/O: Scratch Register */ #define UART_EMSR 0 /* (LCR=BF) Extended Mode Select Register * FCTR bit 6 selects SCR or EMSR * XR16c85x only */ #endif /* CONFIG_SERIAL_M32R_PLDSIO */ #define UART_EMPTY (UART_LSR_TEMT | UART_LSR_THRE) /* * These are the definitions for the Line Control Register * * Note: if the word length is 5 bits (UART_LCR_WLEN5), then setting * UART_LCR_STOP will select 1.5 stop bits, not 2 stop bits. */ #define UART_LCR_DLAB 0x80 /* Divisor latch access bit */ #define UART_LCR_SBC 0x40 /* Set break control */ #define UART_LCR_SPAR 0x20 /* Stick parity (?) */ #define UART_LCR_EPAR 0x10 /* Even parity select */ #define UART_LCR_PARITY 0x08 /* Parity Enable */ #define UART_LCR_STOP 0x04 /* Stop bits: 0=1 stop bit, 1= 2 stop bits */ #define UART_LCR_WLEN5 0x00 /* Wordlength: 5 bits */ #define UART_LCR_WLEN6 0x01 /* Wordlength: 6 bits */ #define UART_LCR_WLEN7 0x02 /* Wordlength: 7 bits */ #define UART_LCR_WLEN8 0x03 /* Wordlength: 8 bits */ /* * These are the definitions for the Line Status Register */ #define UART_LSR_TEMT 0x02 /* Transmitter empty */ #define UART_LSR_THRE 0x01 /* Transmit-hold-register empty */ #define UART_LSR_BI 0x00 /* Break interrupt indicator */ #define UART_LSR_FE 0x80 /* Frame error indicator */ #define UART_LSR_PE 0x40 /* Parity error indicator */ #define UART_LSR_OE 0x20 /* Overrun error indicator */ #define UART_LSR_DR 0x04 /* Receiver data ready */ /* * These are the definitions for the Interrupt Identification Register */ #define UART_IIR_NO_INT 0x01 /* No interrupts pending */ #define UART_IIR_ID 0x06 /* Mask for the interrupt ID */ #define UART_IIR_MSI 0x00 /* Modem status interrupt */ #define UART_IIR_THRI 0x02 /* Transmitter holding register empty */ #define UART_IIR_RDI 0x04 /* Receiver data interrupt */ #define UART_IIR_RLSI 0x06 /* Receiver line status interrupt */ /* * These are the definitions for the Interrupt Enable Register */ #define UART_IER_MSI 0x00 /* Enable Modem status interrupt */ #define UART_IER_RLSI 0x08 /* Enable receiver line status interrupt */ #define UART_IER_THRI 0x03 /* Enable Transmitter holding register int. */ #define UART_IER_RDI 0x04 /* Enable receiver data interrupt */ #endif /* _M32R_SIO_REG_H */ git/tree/?id=966d2b04e070bc040319aaebfec09e0144dc3341'>4b96156e3d1dd4dfd6039b7c219c9dc4616da52d /net/sunrpc/xprtrdma/svc_rdma.c parent1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'net/sunrpc/xprtrdma/svc_rdma.c')