#ifndef __SOUND_EMU8000_H #define __SOUND_EMU8000_H /* * Defines for the emu8000 (AWE32/64) * * Copyright (C) 1999 Steve Ratcliffe * Copyright (C) 1999-2000 Takashi Iwai * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #include #include /* * Hardware parameters. */ #define EMU8000_MAX_DRAM (28 * 1024 * 1024) /* Max on-board mem is 28Mb ???*/ #define EMU8000_DRAM_OFFSET 0x200000 /* Beginning of on board ram */ #define EMU8000_CHANNELS 32 /* Number of hardware channels */ #define EMU8000_DRAM_VOICES 30 /* number of normal voices */ /* Flags to set a dma channel to read or write */ #define EMU8000_RAM_READ 0 #define EMU8000_RAM_WRITE 1 #define EMU8000_RAM_CLOSE 2 #define EMU8000_RAM_MODE_MASK 0x03 #define EMU8000_RAM_RIGHT 0x10 /* use 'right' DMA channel */ enum { EMU8000_CONTROL_BASS = 0, EMU8000_CONTROL_TREBLE, EMU8000_CONTROL_CHORUS_MODE, EMU8000_CONTROL_REVERB_MODE, EMU8000_CONTROL_FM_CHORUS_DEPTH, EMU8000_CONTROL_FM_REVERB_DEPTH, EMU8000_NUM_CONTROLS, }; /* * Structure to hold all state information for the emu8000 driver. * * Note 1: The chip supports 32 channels in hardware this is max_channels * some of the channels may be used for other things so max_channels is * the number in use for wave voices. */ struct snd_emu8000 { struct snd_emux *emu; int index; /* sequencer client index */ int seq_ports; /* number of sequencer ports */ int fm_chorus_depth; /* FM OPL3 chorus depth */ int fm_reverb_depth; /* FM OPL3 reverb depth */ int mem_size; /* memory size */ unsigned long port1; /* Port usually base+0 */ unsigned long port2; /* Port usually at base+0x400 */ unsigned long port3; /* Port usually at base+0x800 */ struct resource *res_port1; struct resource *res_port2; struct resource *res_port3; unsigned short last_reg;/* Last register command */ spinlock_t reg_lock; int dram_checked; struct snd_card *card; /* The card that this belongs to */ int chorus_mode; int reverb_mode; int bass_level; int treble_level; struct snd_util_memhdr *memhdr; spinlock_t control_lock; struct snd_kcontrol *controls[EMU8000_NUM_CONTROLS]; struct snd_pcm *pcm; /* pcm on emu8000 wavetable */ }; /* sequencer device id */ #define SNDRV_SEQ_DEV_ID_EMU8000 "emu8000-synth" /* exported functions */ int snd_emu8000_new(struct snd_card *card, int device, long port, int seq_ports, struct snd_seq_device **ret); void snd_emu8000_poke(struct snd_emu8000 *emu, unsigned int port, unsigned int reg, unsigned int val); unsigned short snd_emu8000_peek(struct snd_emu8000 *emu, unsigned int port, unsigned int reg); void snd_emu8000_poke_dw(struct snd_emu8000 *emu, unsigned int port, unsigned int reg, unsigned int val); unsigned int snd_emu8000_peek_dw(struct snd_emu8000 *emu, unsigned int port, unsigned int reg); void snd_emu8000_dma_chan(struct snd_emu8000 *emu, int ch, int mode); void snd_emu8000_init_fm(struct snd_emu8000 *emu); void snd_emu8000_update_chorus_mode(struct snd_emu8000 *emu); void snd_emu8000_update_reverb_mode(struct snd_emu8000 *emu); void snd_emu8000_update_equalizer(struct snd_emu8000 *emu); int snd_emu8000_load_chorus_fx(struct snd_emu8000 *emu, int mode, const void __user *buf, long len); int snd_emu8000_load_reverb_fx(struct snd_emu8000 *emu, int mode, const void __user *buf, long len); #endif /* __SOUND_EMU8000_H */ >mode:
authorMaarten Lankhorst <maarten.lankhorst@linux.intel.com>2017-01-31 10:25:25 +0100
committerDaniel Vetter <daniel.vetter@ffwll.ch>2017-01-31 13:41:46 +0100
commit92c715fca907686f5298220ece53423e38ba3aed (patch)
tree286158fdad04c9b54955350abb95d4f1c0dc860a /net/ipv6/xfrm6_mode_transport.c
parente6e7b48b295afa5a5ab440de0a94d9ad8b3ce2d0 (diff)
drm/atomic: Fix double free in drm_atomic_state_default_clear
drm_atomic_helper_page_flip and drm_atomic_ioctl set their own events in crtc_state->event. But when it's set the event is freed in 2 places. Solve this by only freeing the event in the atomic ioctl when it allocated its own event. This has been broken twice. The first time when the code was introduced, but only in the corner case when an event is allocated, but more crtc's were included by atomic check and then failing. This can mostly happen when you do an atomic modeset in i915 and the display clock is changed, which forces all crtc's to be included to the state. This has been broken worse by adding in-fences support, which caused the double free to be done unconditionally. [IGT] kms_rotation_crc: starting subtest primary-rotation-180 ============================================================================= BUG kmalloc-128 (Tainted: G U ): Object already free ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper] age=0 cpu=3 pid=1529 ___slab_alloc+0x308/0x3b0 __slab_alloc+0xd/0x20 kmem_cache_alloc_trace+0x92/0x1c0 drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper] intel_atomic_commit+0x35/0x4f0 [i915] drm_atomic_commit+0x46/0x50 [drm] drm_mode_atomic_ioctl+0x7d4/0xab0 [drm] drm_ioctl+0x2b3/0x490 [drm] do_vfs_ioctl+0x69c/0x700 SyS_ioctl+0x4e/0x80 entry_SYSCALL_64_fastpath+0x13/0x94 INFO: Freed in drm_event_cancel_free+0xa3/0xb0 [drm] age=0 cpu=3 pid=1529 __slab_free+0x48/0x2e0 kfree+0x159/0x1a0 drm_event_cancel_free+0xa3/0xb0 [drm] drm_mode_atomic_ioctl+0x86d/0xab0 [drm] drm_ioctl+0x2b3/0x490 [drm] do_vfs_ioctl+0x69c/0x700 SyS_ioctl+0x4e/0x80 entry_SYSCALL_64_fastpath+0x13/0x94 INFO: Slab 0xffffde1f0997b080 objects=17 used=2 fp=0xffff92fb65ec2578 flags=0x200000000008101 INFO: Object 0xffff92fb65ec2578 @offset=1400 fp=0xffff92fb65ec2ae8 Redzone ffff92fb65ec2570: bb bb bb bb bb bb bb bb ........ Object ffff92fb65ec2578: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec2588: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec2598: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25a8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk. Redzone ffff92fb65ec25f8: bb bb bb bb bb bb bb bb ........ Padding ffff92fb65ec2738: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ CPU: 3 PID: 180 Comm: kworker/3:2 Tainted: G BU 4.10.0-rc6-patser+ #5039 Hardware name: /NUC5PPYB, BIOS PYBSWCEL.86A.0031.2015.0601.1712 06/01/2015 Workqueue: events intel_atomic_helper_free_state [i915] Call Trace: dump_stack+0x4d/0x6d print_trailer+0x20c/0x220 free_debug_processing+0x1c6/0x330 ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm] __slab_free+0x48/0x2e0 ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm] kfree+0x159/0x1a0 drm_atomic_state_default_clear+0xf7/0x1c0 [drm] ? drm_atomic_state_clear+0x30/0x30 [drm] intel_atomic_state_clear+0xd/0x20 [i915] drm_atomic_state_clear+0x1a/0x30 [drm] __drm_atomic_state_free+0x13/0x60 [drm] intel_atomic_helper_free_state+0x5d/0x70 [i915] process_one_work+0x260/0x4a0 worker_thread+0x2d1/0x4f0 kthread+0x127/0x130 ? process_one_work+0x4a0/0x4a0 ? kthread_stop+0x120/0x120 ret_from_fork+0x29/0x40 FIX kmalloc-128: Object at 0xffff92fb65ec2578 not freed Fixes: 3b24f7d67581 ("drm/atomic: Add struct drm_crtc_commit to track async updates") Fixes: 9626014258a5 ("drm/fence: add in-fences support") Cc: <stable@vger.kernel.org> # v4.8+ Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/1485854725-27640-1-git-send-email-maarten.lankhorst@linux.intel.com
Diffstat (limited to 'net/ipv6/xfrm6_mode_transport.c')