/* * Copyright (C) ST-Ericsson AB 2010 * Author: Sjur Brendeland * License terms: GNU General Public License (GPL) version 2 */ #ifndef CFCTRL_H_ #define CFCTRL_H_ #include #include /* CAIF Control packet commands */ enum cfctrl_cmd { CFCTRL_CMD_LINK_SETUP = 0, CFCTRL_CMD_LINK_DESTROY = 1, CFCTRL_CMD_LINK_ERR = 2, CFCTRL_CMD_ENUM = 3, CFCTRL_CMD_SLEEP = 4, CFCTRL_CMD_WAKE = 5, CFCTRL_CMD_LINK_RECONF = 6, CFCTRL_CMD_START_REASON = 7, CFCTRL_CMD_RADIO_SET = 8, CFCTRL_CMD_MODEM_SET = 9, CFCTRL_CMD_MASK = 0xf }; /* Channel types */ enum cfctrl_srv { CFCTRL_SRV_DECM = 0, CFCTRL_SRV_VEI = 1, CFCTRL_SRV_VIDEO = 2, CFCTRL_SRV_DBG = 3, CFCTRL_SRV_DATAGRAM = 4, CFCTRL_SRV_RFM = 5, CFCTRL_SRV_UTIL = 6, CFCTRL_SRV_MASK = 0xf }; #define CFCTRL_RSP_BIT 0x20 #define CFCTRL_ERR_BIT 0x10 struct cfctrl_rsp { void (*linksetup_rsp)(struct cflayer *layer, u8 linkid, enum cfctrl_srv serv, u8 phyid, struct cflayer *adapt_layer); void (*linkdestroy_rsp)(struct cflayer *layer, u8 linkid); void (*linkerror_ind)(void); void (*enum_rsp)(void); void (*sleep_rsp)(void); void (*wake_rsp)(void); void (*restart_rsp)(void); void (*radioset_rsp)(void); void (*reject_rsp)(struct cflayer *layer, u8 linkid, struct cflayer *client_layer); }; /* Link Setup Parameters for CAIF-Links. */ struct cfctrl_link_param { enum cfctrl_srv linktype;/* (T3,T0) Type of Channel */ u8 priority; /* (P4,P0) Priority of the channel */ u8 phyid; /* (U2-U0) Physical interface to connect */ u8 endpoint; /* (E1,E0) Endpoint for data channels */ u8 chtype; /* (H1,H0) Channel-Type, applies to * VEI, DEBUG */ union { struct { u8 connid; /* (D7,D0) Video LinkId */ } video; struct { u32 connid; /* (N31,Ngit0) Connection ID used * for Datagram */ } datagram; struct { u32 connid; /* Connection ID used for RFM */ char volume[20]; /* Volume to mount for RFM */ } rfm; /* Configuration for RFM */ struct { u16 fifosize_kb; /* Psock FIFO size in KB */ u16 fifosize_bufs; /* Psock # signal buffers */ char name[16]; /* Name of the PSOCK service */ u8 params[255]; /* Link setup Parameters> */ u16 paramlen; /* Length of Link Setup * Parameters */ } utility; /* Configuration for Utility Links (Psock) */ } u; }; /* This structure is used internally in CFCTRL */ struct cfctrl_request_info { int sequence_no; enum cfctrl_cmd cmd; u8 channel_id; struct cfctrl_link_param param; struct cflayer *client_layer; struct list_head list; }; struct cfctrl { struct cfsrvl serv; struct cfctrl_rsp res; atomic_t req_seq_no; atomic_t rsp_seq_no; struct list_head list; /* Protects from simultaneous access to first_req list */ spinlock_t info_list_lock; #ifndef CAIF_NO_LOOP u8 loop_linkid; int loop_linkused[256]; /* Protects simultaneous access to loop_linkid and loop_linkused */ spinlock_t loop_linkid_lock; #endif }; void cfctrl_enum_req(struct cflayer *cfctrl, u8 physlinkid); int cfctrl_linkup_request(struct cflayer *cfctrl, struct cfctrl_link_param *param, struct cflayer *user_layer); int cfctrl_linkdown_req(struct cflayer *cfctrl, u8 linkid, struct cflayer *client); struct cflayer *cfctrl_create(void); struct cfctrl_rsp *cfctrl_get_respfuncs(struct cflayer *layer); int cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer); void cfctrl_remove(struct cflayer *layr); #endif /* CFCTRL_H_ */ /net-next.git/commit/sound/pci/cs46xx/Makefile?h=nds-private-remove&id=966d2b04e070bc040319aaebfec09e0144dc3341'>Makefile
diff options
context:
space:
mode:
authorDouglas Miller <dougmill@linux.vnet.ibm.com>2017-01-28 06:42:20 -0600
committerTejun Heo <tj@kernel.org>2017-01-28 07:49:42 -0500
commit966d2b04e070bc040319aaebfec09e0144dc3341 (patch)
tree4b96156e3d1dd4dfd6039b7c219c9dc4616da52d /sound/pci/cs46xx/Makefile
parent1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'sound/pci/cs46xx/Makefile')