/* * Copyright (C) 2015 - 2016 ZTE Corporation. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. */ #ifndef __DT_BINDINGS_CLOCK_ZX296718_H #define __DT_BINDINGS_CLOCK_ZX296718_H /* PLL */ #define ZX296718_PLL_CPU 1 #define ZX296718_PLL_MAC 2 #define ZX296718_PLL_MM0 3 #define ZX296718_PLL_MM1 4 #define ZX296718_PLL_VGA 5 #define ZX296718_PLL_DDR 6 #define ZX296718_PLL_AUDIO 7 #define ZX296718_PLL_HSIC 8 #define CPU_DBG_GATE 9 #define A72_GATE 10 #define CPU_PERI_GATE 11 #define A53_GATE 12 #define DDR1_GATE 13 #define DDR0_GATE 14 #define SD1_WCLK 15 #define SD1_AHB 16 #define SD0_WCLK 17 #define SD0_AHB 18 #define EMMC_WCLK 19 #define EMMC_NAND_AXI 20 #define NAND_WCLK 21 #define EMMC_NAND_AHB 22 #define LSP1_148M5 23 #define LSP1_99M 24 #define LSP1_24M 25 #define LSP0_74M25 26 #define LSP0_32K 27 #define LSP0_148M5 28 #define LSP0_99M 29 #define LSP0_24M 30 #define DEMUX_AXI 31 #define DEMUX_APB 32 #define DEMUX_148M5 33 #define DEMUX_108M 34 #define AUDIO_APB 35 #define AUDIO_99M 36 #define AUDIO_24M 37 #define AUDIO_16M384 38 #define AUDIO_32K 39 #define WDT_WCLK 40 #define TIMER_WCLK 41 #define VDE_ACLK 42 #define VCE_ACLK 43 #define HDE_ACLK 44 #define GPU_ACLK 45 #define SAPPU_ACLK 46 #define SAPPU_WCLK 47 #define VOU_ACLK 48 #define VOU_MAIN_WCLK 49 #define VOU_AUX_WCLK 50 #define VOU_PPU_WCLK 51 #define MIPI_CFG_CLK 52 #define VGA_I2C_WCLK 53 #define MIPI_REF_CLK 54 #define HDMI_OSC_CEC 55 #define HDMI_OSC_CLK 56 #define HDMI_XCLK 57 #define VIU_M0_ACLK 58 #define VIU_M1_ACLK 59 #define VIU_WCLK 60 #define VIU_JPEG_WCLK 61 #define VIU_CFG_CLK 62 #define TS_SYS_WCLK 63 #define TS_SYS_108M 64 #define USB20_HCLK 65 #define USB20_PHY_CLK 66 #define USB21_HCLK 67 #define USB21_PHY_CLK 68 #define GMAC_RMIICLK 69 #define GMAC_PCLK 70 #define GMAC_ACLK 71 #define GMAC_RFCLK 72 #define TEMPSENSOR_GATE 73 #define TOP_NR_CLKS 74 #define LSP0_TIMER3_PCLK 1 #define LSP0_TIMER3_WCLK 2 #define LSP0_TIMER4_PCLK 3 #define LSP0_TIMER4_WCLK 4 #define LSP0_TIMER5_PCLK 5 #define LSP0_TIMER5_WCLK 6 #define LSP0_UART3_PCLK 7 #define LSP0_UART3_WCLK 8 #define LSP0_UART1_PCLK 9 #define LSP0_UART1_WCLK 10 #define LSP0_UART2_PCLK 11 #define LSP0_UART2_WCLK 12 #define LSP0_SPIFC0_PCLK 13 #define LSP0_SPIFC0_WCLK 14 #define LSP0_I2C4_PCLK 15 #define LSP0_I2C4_WCLK 16 #define LSP0_I2C5_PCLK 17 #define LSP0_I2C5_WCLK 18 #define LSP0_SSP0_PCLK 19 #define LSP0_SSP0_WCLK 20 #define LSP0_SSP1_PCLK 21 #define LSP0_SSP1_WCLK 22 #define LSP0_USIM_PCLK 23 #define LSP0_USIM_WCLK 24 #define LSP0_GPIO_PCLK 25 #define LSP0_GPIO_WCLK 26 #define LSP0_I2C3_PCLK 27 #define LSP0_I2C3_WCLK 28 #define LSP0_NR_CLKS 29 #define LSP1_UART4_PCLK 1 #define LSP1_UART4_WCLK 2 #define LSP1_UART5_PCLK 3 #define LSP1_UART5_WCLK 4 #define LSP1_PWM_PCLK 5 #define LSP1_PWM_WCLK 6 #define LSP1_I2C2_PCLK 7 #define LSP1_I2C2_WCLK 8 #define LSP1_SSP2_PCLK 9 #define LSP1_SSP2_WCLK 10 #define LSP1_SSP3_PCLK 11 #define LSP1_SSP3_WCLK 12 #define LSP1_SSP4_PCLK 13 #define LSP1_SSP4_WCLK 14 #define LSP1_USIM1_PCLK 15 #define LSP1_USIM1_WCLK 16 #define LSP1_NR_CLKS 17 #define AUDIO_I2S0_WCLK 1 #define AUDIO_I2S0_PCLK 2 #define AUDIO_I2S1_WCLK 3 #define AUDIO_I2S1_PCLK 4 #define AUDIO_I2S2_WCLK 5 #define AUDIO_I2S2_PCLK 6 #define AUDIO_I2S3_WCLK 7 #define AUDIO_I2S3_PCLK 8 #define AUDIO_I2C0_WCLK 9 #define AUDIO_I2C0_PCLK 10 #define AUDIO_SPDIF0_WCLK 11 #define AUDIO_SPDIF0_PCLK 12 #define AUDIO_SPDIF1_WCLK 13 #define AUDIO_SPDIF1_PCLK 14 #define AUDIO_TIMER_WCLK 15 #define AUDIO_TIMER_PCLK 16 #define AUDIO_TDM_WCLK 17 #define AUDIO_TDM_PCLK 18 #define AUDIO_TS_PCLK 19 #define AUDIO_NR_CLKS 20 #endif td>mode:
authorMaarten Lankhorst <maarten.lankhorst@linux.intel.com>2017-01-31 10:25:25 +0100
committerDaniel Vetter <daniel.vetter@ffwll.ch>2017-01-31 13:41:46 +0100
commit92c715fca907686f5298220ece53423e38ba3aed (patch)
tree286158fdad04c9b54955350abb95d4f1c0dc860a /net/qrtr/smd.c
parente6e7b48b295afa5a5ab440de0a94d9ad8b3ce2d0 (diff)
drm/atomic: Fix double free in drm_atomic_state_default_clear
drm_atomic_helper_page_flip and drm_atomic_ioctl set their own events in crtc_state->event. But when it's set the event is freed in 2 places. Solve this by only freeing the event in the atomic ioctl when it allocated its own event. This has been broken twice. The first time when the code was introduced, but only in the corner case when an event is allocated, but more crtc's were included by atomic check and then failing. This can mostly happen when you do an atomic modeset in i915 and the display clock is changed, which forces all crtc's to be included to the state. This has been broken worse by adding in-fences support, which caused the double free to be done unconditionally. [IGT] kms_rotation_crc: starting subtest primary-rotation-180 ============================================================================= BUG kmalloc-128 (Tainted: G U ): Object already free ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper] age=0 cpu=3 pid=1529 ___slab_alloc+0x308/0x3b0 __slab_alloc+0xd/0x20 kmem_cache_alloc_trace+0x92/0x1c0 drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper] intel_atomic_commit+0x35/0x4f0 [i915] drm_atomic_commit+0x46/0x50 [drm] drm_mode_atomic_ioctl+0x7d4/0xab0 [drm] drm_ioctl+0x2b3/0x490 [drm] do_vfs_ioctl+0x69c/0x700 SyS_ioctl+0x4e/0x80 entry_SYSCALL_64_fastpath+0x13/0x94 INFO: Freed in drm_event_cancel_free+0xa3/0xb0 [drm] age=0 cpu=3 pid=1529 __slab_free+0x48/0x2e0 kfree+0x159/0x1a0 drm_event_cancel_free+0xa3/0xb0 [drm] drm_mode_atomic_ioctl+0x86d/0xab0 [drm] drm_ioctl+0x2b3/0x490 [drm] do_vfs_ioctl+0x69c/0x700 SyS_ioctl+0x4e/0x80 entry_SYSCALL_64_fastpath+0x13/0x94 INFO: Slab 0xffffde1f0997b080 objects=17 used=2 fp=0xffff92fb65ec2578 flags=0x200000000008101 INFO: Object 0xffff92fb65ec2578 @offset=1400 fp=0xffff92fb65ec2ae8 Redzone ffff92fb65ec2570: bb bb bb bb bb bb bb bb ........ Object ffff92fb65ec2578: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec2588: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec2598: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25a8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk. Redzone ffff92fb65ec25f8: bb bb bb bb bb bb bb bb ........ Padding ffff92fb65ec2738: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ CPU: 3 PID: 180 Comm: kworker/3:2 Tainted: G BU 4.10.0-rc6-patser+ #5039 Hardware name: /NUC5PPYB, BIOS PYBSWCEL.86A.0031.2015.0601.1712 06/01/2015 Workqueue: events intel_atomic_helper_free_state [i915] Call Trace: dump_stack+0x4d/0x6d print_trailer+0x20c/0x220 free_debug_processing+0x1c6/0x330 ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm] __slab_free+0x48/0x2e0 ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm] kfree+0x159/0x1a0 drm_atomic_state_default_clear+0xf7/0x1c0 [drm] ? drm_atomic_state_clear+0x30/0x30 [drm] intel_atomic_state_clear+0xd/0x20 [i915] drm_atomic_state_clear+0x1a/0x30 [drm] __drm_atomic_state_free+0x13/0x60 [drm] intel_atomic_helper_free_state+0x5d/0x70 [i915] process_one_work+0x260/0x4a0 worker_thread+0x2d1/0x4f0 kthread+0x127/0x130 ? process_one_work+0x4a0/0x4a0 ? kthread_stop+0x120/0x120 ret_from_fork+0x29/0x40 FIX kmalloc-128: Object at 0xffff92fb65ec2578 not freed Fixes: 3b24f7d67581 ("drm/atomic: Add struct drm_crtc_commit to track async updates") Fixes: 9626014258a5 ("drm/fence: add in-fences support") Cc: <stable@vger.kernel.org> # v4.8+ Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/1485854725-27640-1-git-send-email-maarten.lankhorst@linux.intel.com
Diffstat (limited to 'net/qrtr/smd.c')