/* * OMAP OTG controller driver * * Based on code from tahvo-usb.c and isp1301_omap.c drivers. * * Copyright (C) 2005-2006 Nokia Corporation * Copyright (C) 2004 Texas Instruments * Copyright (C) 2004 David Brownell * * This file is subject to the terms and conditions of the GNU General * Public License. See the file "COPYING" in the main directory of this * archive for more details. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. */ #include #include #include #include #include #include #include #include struct otg_device { void __iomem *base; bool id; bool vbus; struct extcon_dev *extcon; struct notifier_block vbus_nb; struct notifier_block id_nb; }; #define OMAP_OTG_CTRL 0x0c #define OMAP_OTG_ASESSVLD (1 << 20) #define OMAP_OTG_BSESSEND (1 << 19) #define OMAP_OTG_BSESSVLD (1 << 18) #define OMAP_OTG_VBUSVLD (1 << 17) #define OMAP_OTG_ID (1 << 16) #define OMAP_OTG_XCEIV_OUTPUTS \ (OMAP_OTG_ASESSVLD | OMAP_OTG_BSESSEND | OMAP_OTG_BSESSVLD | \ OMAP_OTG_VBUSVLD | OMAP_OTG_ID) static void omap_otg_ctrl(struct otg_device *otg_dev, u32 outputs) { u32 l; l = readl(otg_dev->base + OMAP_OTG_CTRL); l &= ~OMAP_OTG_XCEIV_OUTPUTS; l |= outputs; writel(l, otg_dev->base + OMAP_OTG_CTRL); } static void omap_otg_set_mode(struct otg_device *otg_dev) { if (!otg_dev->id && otg_dev->vbus) /* Set B-session valid. */ omap_otg_ctrl(otg_dev, OMAP_OTG_ID | OMAP_OTG_BSESSVLD); else if (otg_dev->vbus) /* Set A-session valid. */ omap_otg_ctrl(otg_dev, OMAP_OTG_ASESSVLD); else if (!otg_dev->id) /* Set B-session end to indicate no VBUS. */ omap_otg_ctrl(otg_dev, OMAP_OTG_ID | OMAP_OTG_BSESSEND); } static int omap_otg_id_notifier(struct notifier_block *nb, unsigned long event, void *ptr) { struct otg_device *otg_dev = container_of(nb, struct otg_device, id_nb); otg_dev->id = event; omap_otg_set_mode(otg_dev); return NOTIFY_DONE; } static int omap_otg_vbus_notifier(struct notifier_block *nb, unsigned long event, void *ptr) { struct otg_device *otg_dev = container_of(nb, struct otg_device, vbus_nb); otg_dev->vbus = event; omap_otg_set_mode(otg_dev); return NOTIFY_DONE; } static int omap_otg_probe(struct platform_device *pdev) { const struct omap_usb_config *config = pdev->dev.platform_data; struct otg_device *otg_dev; struct extcon_dev *extcon; int ret; u32 rev; if (!config || !config->extcon) return -ENODEV; extcon = extcon_get_extcon_dev(config->extcon); if (!extcon) return -EPROBE_DEFER; otg_dev = devm_kzalloc(&pdev->dev, sizeof(*otg_dev), GFP_KERNEL); if (!otg_dev) return -ENOMEM; otg_dev->base = devm_ioremap_resource(&pdev->dev, &pdev->resource[0]); if (IS_ERR(otg_dev->base)) return PTR_ERR(otg_dev->base); otg_dev->extcon = extcon; otg_dev->id_nb.notifier_call = omap_otg_id_notifier; otg_dev->vbus_nb.notifier_call = omap_otg_vbus_notifier; ret = extcon_register_notifier(extcon, EXTCON_USB_HOST, &otg_dev->id_nb); if (ret) return ret; ret = extcon_register_notifier(extcon, EXTCON_USB, &otg_dev->vbus_nb); if (ret) { extcon_unregister_notifier(extcon, EXTCON_USB_HOST, &otg_dev->id_nb); return ret; } otg_dev->id = extcon_get_cable_state_(extcon, EXTCON_USB_HOST); otg_dev->vbus = extcon_get_cable_state_(extcon, EXTCON_USB); omap_otg_set_mode(otg_dev); rev = readl(otg_dev->base); dev_info(&pdev->dev, "OMAP USB OTG controller rev %d.%d (%s, id=%d, vbus=%d)\n", (rev >> 4) & 0xf, rev & 0xf, config->extcon, otg_dev->id, otg_dev->vbus); platform_set_drvdata(pdev, otg_dev); return 0; } static int omap_otg_remove(struct platform_device *pdev) { struct otg_device *otg_dev = platform_get_drvdata(pdev); struct extcon_dev *edev = otg_dev->extcon; extcon_unregister_notifier(edev, EXTCON_USB_HOST, &otg_dev->id_nb); extcon_unregister_notifier(edev, EXTCON_USB, &otg_dev->vbus_nb); return 0; } static struct platform_driver omap_otg_driver = { .probe = omap_otg_probe, .remove = omap_otg_remove, .driver = { .name = "omap_otg", }, }; module_platform_driver(omap_otg_driver); MODULE_DESCRIPTION("OMAP USB OTG controller driver"); MODULE_LICENSE("GPL"); MODULE_AUTHOR("Aaro Koskinen "); ubmit();'>mode:
authorEric Dumazet <edumazet@google.com>2017-01-27 08:11:44 -0800
committerDavid S. Miller <davem@davemloft.net>2017-01-29 18:30:56 -0500
commitf1712c73714088a7252d276a57126d56c7d37e64 (patch)
tree962ee49daf8d1cba8403fcf03b315d4a142ec944 /include/net/irda/wrapper.h
parentdc97a89e726c4e1830320d1db8215ef77ecebae0 (diff)
can: Fix kernel panic at security_sock_rcv_skb
Zhang Yanmin reported crashes [1] and provided a patch adding a synchronize_rcu() call in can_rx_unregister() The main problem seems that the sockets themselves are not RCU protected. If CAN uses RCU for delivery, then sockets should be freed only after one RCU grace period. Recent kernels could use sock_set_flag(sk, SOCK_RCU_FREE), but let's ease stable backports with the following fix instead. [1] BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff81495e25>] selinux_socket_sock_rcv_skb+0x65/0x2a0 Call Trace: <IRQ> [<ffffffff81485d8c>] security_sock_rcv_skb+0x4c/0x60 [<ffffffff81d55771>] sk_filter+0x41/0x210 [<ffffffff81d12913>] sock_queue_rcv_skb+0x53/0x3a0 [<ffffffff81f0a2b3>] raw_rcv+0x2a3/0x3c0 [<ffffffff81f06eab>] can_rcv_filter+0x12b/0x370 [<ffffffff81f07af9>] can_receive+0xd9/0x120 [<ffffffff81f07beb>] can_rcv+0xab/0x100 [<ffffffff81d362ac>] __netif_receive_skb_core+0xd8c/0x11f0 [<ffffffff81d36734>] __netif_receive_skb+0x24/0xb0 [<ffffffff81d37f67>] process_backlog+0x127/0x280 [<ffffffff81d36f7b>] net_rx_action+0x33b/0x4f0 [<ffffffff810c88d4>] __do_softirq+0x184/0x440 [<ffffffff81f9e86c>] do_softirq_own_stack+0x1c/0x30 <EOI> [<ffffffff810c76fb>] do_softirq.part.18+0x3b/0x40 [<ffffffff810c8bed>] do_softirq+0x1d/0x20 [<ffffffff81d30085>] netif_rx_ni+0xe5/0x110 [<ffffffff8199cc87>] slcan_receive_buf+0x507/0x520 [<ffffffff8167ef7c>] flush_to_ldisc+0x21c/0x230 [<ffffffff810e3baf>] process_one_work+0x24f/0x670 [<ffffffff810e44ed>] worker_thread+0x9d/0x6f0 [<ffffffff810e4450>] ? rescuer_thread+0x480/0x480 [<ffffffff810ebafc>] kthread+0x12c/0x150 [<ffffffff81f9ccef>] ret_from_fork+0x3f/0x70 Reported-by: Zhang Yanmin <yanmin.zhang@intel.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net/irda/wrapper.h')