/* * Copyright (C) 2015 Mans Rullgard * SMP86xx/SMP87xx Watchdog driver * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the * Free Software Foundation; either version 2 of the License, or (at your * option) any later version. */ #include #include #include #include #include #include #include #include #include #include #include #define DEFAULT_TIMEOUT 30 static bool nowayout = WATCHDOG_NOWAYOUT; module_param(nowayout, bool, 0); MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")"); static unsigned int timeout; module_param(timeout, int, 0); MODULE_PARM_DESC(timeout, "Watchdog timeout"); /* * Counter counts down from programmed value. Reset asserts when * the counter reaches 1. */ #define WD_COUNTER 0 #define WD_CONFIG 4 #define WD_CONFIG_XTAL_IN BIT(0) #define WD_CONFIG_DISABLE BIT(31) struct tangox_wdt_device { struct watchdog_device wdt; void __iomem *base; unsigned long clk_rate; struct clk *clk; struct notifier_block restart; }; static int tangox_wdt_set_timeout(struct watchdog_device *wdt, unsigned int new_timeout) { wdt->timeout = new_timeout; return 0; } static int tangox_wdt_start(struct watchdog_device *wdt) { struct tangox_wdt_device *dev = watchdog_get_drvdata(wdt); u32 ticks; ticks = 1 + wdt->timeout * dev->clk_rate; writel(ticks, dev->base + WD_COUNTER); return 0; } static int tangox_wdt_stop(struct watchdog_device *wdt) { struct tangox_wdt_device *dev = watchdog_get_drvdata(wdt); writel(0, dev->base + WD_COUNTER); return 0; } static unsigned int tangox_wdt_get_timeleft(struct watchdog_device *wdt) { struct tangox_wdt_device *dev = watchdog_get_drvdata(wdt); u32 count; count = readl(dev->base + WD_COUNTER); if (!count) return 0; return (count - 1) / dev->clk_rate; } static const struct watchdog_info tangox_wdt_info = { .options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING | WDIOF_MAGICCLOSE, .identity = "tangox watchdog", }; static const struct watchdog_ops tangox_wdt_ops = { .start = tangox_wdt_start, .stop = tangox_wdt_stop, .set_timeout = tangox_wdt_set_timeout, .get_timeleft = tangox_wdt_get_timeleft, }; static int tangox_wdt_restart(struct notifier_block *nb, unsigned long action, void *data) { struct tangox_wdt_device *dev = container_of(nb, struct tangox_wdt_device, restart); writel(1, dev->base + WD_COUNTER); return NOTIFY_DONE; } static int tangox_wdt_probe(struct platform_device *pdev) { struct tangox_wdt_device *dev; struct resource *res; u32 config; int err; dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL); if (!dev) return -ENOMEM; res = platform_get_resource(pdev, IORESOURCE_MEM, 0); dev->base = devm_ioremap_resource(&pdev->dev, res); if (IS_ERR(dev->base)) return PTR_ERR(dev->base); dev->clk = devm_clk_get(&pdev->dev, NULL); if (IS_ERR(dev->clk)) return PTR_ERR(dev->clk); err = clk_prepare_enable(dev->clk); if (err) return err; dev->clk_rate = clk_get_rate(dev->clk); if (!dev->clk_rate) { err = -EINVAL; goto err; } dev->wdt.parent = &pdev->dev; dev->wdt.info = &tangox_wdt_info; dev->wdt.ops = &tangox_wdt_ops; dev->wdt.timeout = DEFAULT_TIMEOUT; dev->wdt.min_timeout = 1; dev->wdt.max_hw_heartbeat_ms = (U32_MAX - 1) / dev->clk_rate; watchdog_init_timeout(&dev->wdt, timeout, &pdev->dev); watchdog_set_nowayout(&dev->wdt, nowayout); watchdog_set_drvdata(&dev->wdt, dev); /* * Deactivate counter if disable bit is set to avoid * accidental reset. */ config = readl(dev->base + WD_CONFIG); if (config & WD_CONFIG_DISABLE) writel(0, dev->base + WD_COUNTER); writel(WD_CONFIG_XTAL_IN, dev->base + WD_CONFIG); /* * Mark as active and restart with configured timeout if * already running. */ if (readl(dev->base + WD_COUNTER)) { set_bit(WDOG_HW_RUNNING, &dev->wdt.status); tangox_wdt_start(&dev->wdt); } err = watchdog_register_device(&dev->wdt); if (err) goto err; platform_set_drvdata(pdev, dev); dev->restart.notifier_call = tangox_wdt_restart; dev->restart.priority = 128; err = register_restart_handler(&dev->restart); if (err) dev_warn(&pdev->dev, "failed to register restart handler\n"); dev_info(&pdev->dev, "SMP86xx/SMP87xx watchdog registered\n"); return 0; err: clk_disable_unprepare(dev->clk); return err; } static int tangox_wdt_remove(struct platform_device *pdev) { struct tangox_wdt_device *dev = platform_get_drvdata(pdev); tangox_wdt_stop(&dev->wdt); clk_disable_unprepare(dev->clk); unregister_restart_handler(&dev->restart); watchdog_unregister_device(&dev->wdt); return 0; } static const struct of_device_id tangox_wdt_dt_ids[] = { { .compatible = "sigma,smp8642-wdt" }, { .compatible = "sigma,smp8759-wdt" }, { } }; MODULE_DEVICE_TABLE(of, tangox_wdt_dt_ids); static struct platform_driver tangox_wdt_driver = { .probe = tangox_wdt_probe, .remove = tangox_wdt_remove, .driver = { .name = "tangox-wdt", .of_match_table = tangox_wdt_dt_ids, }, }; module_platform_driver(tangox_wdt_driver); MODULE_AUTHOR("Mans Rullgard "); MODULE_DESCRIPTION("SMP86xx/SMP87xx Watchdog driver"); MODULE_LICENSE("GPL"); e4b96156e3d1dd4dfd6039b7c219c9dc4616da52d /include/net/sock.h parent1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'include/net/sock.h')
ffstat (limited to 'include/trace/events/sched.h')