/* * v4l2-fh.h * * V4L2 file handle. Store per file handle data for the V4L2 * framework. Using file handles is optional for the drivers. * * Copyright (C) 2009--2010 Nokia Corporation. * * Contact: Sakari Ailus * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * version 2 as published by the Free Software Foundation. * * This program is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * 02110-1301 USA */ #ifndef V4L2_FH_H #define V4L2_FH_H #include #include #include struct video_device; struct v4l2_ctrl_handler; /** * struct v4l2_fh - Describes a V4L2 file handler * * @list: list of file handlers * @vdev: pointer to &struct video_device * @ctrl_handler: pointer to &struct v4l2_ctrl_handler * @prio: priority of the file handler, as defined by &enum v4l2_priority * * @wait: event' s wait queue * @subscribed: list of subscribed events * @available: list of events waiting to be dequeued * @navailable: number of available events at @available list * @sequence: event sequence number * @m2m_ctx: pointer to &struct v4l2_m2m_ctx */ struct v4l2_fh { struct list_head list; struct video_device *vdev; struct v4l2_ctrl_handler *ctrl_handler; enum v4l2_priority prio; /* Events */ wait_queue_head_t wait; struct list_head subscribed; struct list_head available; unsigned int navailable; u32 sequence; #if IS_ENABLED(CONFIG_V4L2_MEM2MEM_DEV) struct v4l2_m2m_ctx *m2m_ctx; #endif }; /** * v4l2_fh_init - Initialise the file handle. * * @fh: pointer to &struct v4l2_fh * @vdev: pointer to &struct video_device * * Parts of the V4L2 framework using the * file handles should be initialised in this function. Must be called * from driver's v4l2_file_operations->open\(\) handler if the driver * uses &struct v4l2_fh. */ void v4l2_fh_init(struct v4l2_fh *fh, struct video_device *vdev); /** * v4l2_fh_add - Add the fh to the list of file handles on a video_device. * * @fh: pointer to &struct v4l2_fh * * .. note:: * The @fh file handle must be initialised first. */ void v4l2_fh_add(struct v4l2_fh *fh); /** * v4l2_fh_open - Ancillary routine that can be used as the open\(\) op * of v4l2_file_operations. * * @filp: pointer to struct file * * It allocates a v4l2_fh and inits and adds it to the &struct video_device * associated with the file pointer. */ int v4l2_fh_open(struct file *filp); /** * v4l2_fh_del - Remove file handle from the list of file handles. * * @fh: pointer to &struct v4l2_fh * * On error filp->private_data will be %NULL, otherwise it will point to * the &struct v4l2_fh. * * .. note:: * Must be called in v4l2_file_operations->release\(\) handler if the driver * uses &struct v4l2_fh. */ void v4l2_fh_del(struct v4l2_fh *fh); /** * v4l2_fh_exit - Release resources related to a file handle. * * @fh: pointer to &struct v4l2_fh * * Parts of the V4L2 framework using the v4l2_fh must release their * resources here, too. * * .. note:: * Must be called in v4l2_file_operations->release\(\) handler if the * driver uses &struct v4l2_fh. */ void v4l2_fh_exit(struct v4l2_fh *fh); /** * v4l2_fh_release - Ancillary routine that can be used as the release\(\) op * of v4l2_file_operations. * * @filp: pointer to struct file * * It deletes and exits the v4l2_fh associated with the file pointer and * frees it. It will do nothing if filp->private_data (the pointer to the * v4l2_fh struct) is %NULL. * * This function always returns 0. */ int v4l2_fh_release(struct file *filp); /** * v4l2_fh_is_singular - Returns 1 if this filehandle is the only filehandle * opened for the associated video_device. * * @fh: pointer to &struct v4l2_fh * * If @fh is NULL, then it returns 0. */ int v4l2_fh_is_singular(struct v4l2_fh *fh); /** * v4l2_fh_is_singular_file - Returns 1 if this filehandle is the only * filehandle opened for the associated video_device. * * @filp: pointer to struct file * * This is a helper function variant of v4l2_fh_is_singular() with uses * struct file as argument. * * If filp->private_data is %NULL, then it will return 0. */ static inline int v4l2_fh_is_singular_file(struct file *filp) { return v4l2_fh_is_singular(filp->private_data); } #endif /* V4L2_EVENT_H */ <torvalds@linux-foundation.org>2017-01-29 13:50:06 -0800 committerLinus Torvalds <torvalds@linux-foundation.org>2017-01-29 13:50:06 -0800 commit39cb2c9a316e77f6dfba96c543e55b6672d5a37e (patch) tree98fe974ee4e20121253de7f61fc8d01bdb3821c1 /drivers/usb/storage/option_ms.h parent2c5d9555d6d937966d79d4c6529a5f7b9206e405 (diff)
drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()
I've seen this trigger twice now, where the i915_gem_object_to_ggtt() call in intel_unpin_fb_obj() returns NULL, resulting in an oops immediately afterwards as the (inlined) call to i915_vma_unpin_fence() tries to dereference it. It seems to be some race condition where the object is going away at shutdown time, since both times happened when shutting down the X server. The call chains were different: - VT ioctl(KDSETMODE, KD_TEXT): intel_cleanup_plane_fb+0x5b/0xa0 [i915] drm_atomic_helper_cleanup_planes+0x6f/0x90 [drm_kms_helper] intel_atomic_commit_tail+0x749/0xfe0 [i915] intel_atomic_commit+0x3cb/0x4f0 [i915] drm_atomic_commit+0x4b/0x50 [drm] restore_fbdev_mode+0x14c/0x2a0 [drm_kms_helper] drm_fb_helper_restore_fbdev_mode_unlocked+0x34/0x80 [drm_kms_helper] drm_fb_helper_set_par+0x2d/0x60 [drm_kms_helper] intel_fbdev_set_par+0x18/0x70 [i915] fb_set_var+0x236/0x460 fbcon_blank+0x30f/0x350 do_unblank_screen+0xd2/0x1a0 vt_ioctl+0x507/0x12a0 tty_ioctl+0x355/0xc30 do_vfs_ioctl+0xa3/0x5e0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x13/0x94 - i915 unpin_work workqueue: intel_unpin_work_fn+0x58/0x140 [i915] process_one_work+0x1f1/0x480 worker_thread+0x48/0x4d0 kthread+0x101/0x140 and this patch purely papers over the issue by adding a NULL pointer check and a WARN_ON_ONCE() to avoid the oops that would then generally make the machine unresponsive. Other callers of i915_gem_object_to_ggtt() seem to also check for the returned pointer being NULL and warn about it, so this clearly has happened before in other places. [ Reported it originally to the i915 developers on Jan 8, applying the ugly workaround on my own now after triggering the problem for the second time with no feedback. This is likely to be the same bug reported as https://bugs.freedesktop.org/show_bug.cgi?id=98829 https://bugs.freedesktop.org/show_bug.cgi?id=99134 which has a patch for the underlying problem, but it hasn't gotten to me, so I'm applying the workaround. ] Cc: Daniel Vetter <daniel.vetter@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Imre Deak <imre.deak@intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/usb/storage/option_ms.h')