/* * digi00x-midi.h - a part of driver for Digidesign Digi 002/003 family * * Copyright (c) 2014-2015 Takashi Sakamoto * * Licensed under the terms of the GNU General Public License, version 2. */ #include "digi00x.h" static int midi_phys_open(struct snd_rawmidi_substream *substream) { struct snd_dg00x *dg00x = substream->rmidi->private_data; int err; err = snd_dg00x_stream_lock_try(dg00x); if (err < 0) return err; mutex_lock(&dg00x->mutex); dg00x->substreams_counter++; err = snd_dg00x_stream_start_duplex(dg00x, 0); mutex_unlock(&dg00x->mutex); if (err < 0) snd_dg00x_stream_lock_release(dg00x); return err; } static int midi_phys_close(struct snd_rawmidi_substream *substream) { struct snd_dg00x *dg00x = substream->rmidi->private_data; mutex_lock(&dg00x->mutex); dg00x->substreams_counter--; snd_dg00x_stream_stop_duplex(dg00x); mutex_unlock(&dg00x->mutex); snd_dg00x_stream_lock_release(dg00x); return 0; } static void midi_phys_capture_trigger(struct snd_rawmidi_substream *substream, int up) { struct snd_dg00x *dg00x = substream->rmidi->private_data; unsigned long flags; spin_lock_irqsave(&dg00x->lock, flags); if (up) amdtp_dot_midi_trigger(&dg00x->tx_stream, substream->number, substream); else amdtp_dot_midi_trigger(&dg00x->tx_stream, substream->number, NULL); spin_unlock_irqrestore(&dg00x->lock, flags); } static void midi_phys_playback_trigger(struct snd_rawmidi_substream *substream, int up) { struct snd_dg00x *dg00x = substream->rmidi->private_data; unsigned long flags; spin_lock_irqsave(&dg00x->lock, flags); if (up) amdtp_dot_midi_trigger(&dg00x->rx_stream, substream->number, substream); else amdtp_dot_midi_trigger(&dg00x->rx_stream, substream->number, NULL); spin_unlock_irqrestore(&dg00x->lock, flags); } static struct snd_rawmidi_ops midi_phys_capture_ops = { .open = midi_phys_open, .close = midi_phys_close, .trigger = midi_phys_capture_trigger, }; static struct snd_rawmidi_ops midi_phys_playback_ops = { .open = midi_phys_open, .close = midi_phys_close, .trigger = midi_phys_playback_trigger, }; static int midi_ctl_open(struct snd_rawmidi_substream *substream) { /* Do nothing. */ return 0; } static int midi_ctl_capture_close(struct snd_rawmidi_substream *substream) { /* Do nothing. */ return 0; } static int midi_ctl_playback_close(struct snd_rawmidi_substream *substream) { struct snd_dg00x *dg00x = substream->rmidi->private_data; snd_fw_async_midi_port_finish(&dg00x->out_control); return 0; } static void midi_ctl_capture_trigger(struct snd_rawmidi_substream *substream, int up) { struct snd_dg00x *dg00x = substream->rmidi->private_data; unsigned long flags; spin_lock_irqsave(&dg00x->lock, flags); if (up) dg00x->in_control = substream; else dg00x->in_control = NULL; spin_unlock_irqrestore(&dg00x->lock, flags); } static void midi_ctl_playback_trigger(struct snd_rawmidi_substream *substream, int up) { struct snd_dg00x *dg00x = substream->rmidi->private_data; unsigned long flags; spin_lock_irqsave(&dg00x->lock, flags); if (up) snd_fw_async_midi_port_run(&dg00x->out_control, substream); spin_unlock_irqrestore(&dg00x->lock, flags); } static struct snd_rawmidi_ops midi_ctl_capture_ops = { .open = midi_ctl_open, .close = midi_ctl_capture_close, .trigger = midi_ctl_capture_trigger, }; static struct snd_rawmidi_ops midi_ctl_playback_ops = { .open = midi_ctl_open, .close = midi_ctl_playback_close, .trigger = midi_ctl_playback_trigger, }; static void set_midi_substream_names(struct snd_dg00x *dg00x, struct snd_rawmidi_str *str, bool is_ctl) { struct snd_rawmidi_substream *subs; list_for_each_entry(subs, &str->substreams, list) { if (!is_ctl) snprintf(subs->name, sizeof(subs->name), "%s MIDI %d", dg00x->card->shortname, subs->number + 1); else /* This port is for asynchronous transaction. */ snprintf(subs->name, sizeof(subs->name), "%s control", dg00x->card->shortname); } } int snd_dg00x_create_midi_devices(struct snd_dg00x *dg00x) { struct snd_rawmidi *rmidi[2]; struct snd_rawmidi_str *str; unsigned int i; int err; /* Add physical midi ports. */ err = snd_rawmidi_new(dg00x->card, dg00x->card->driver, 0, DOT_MIDI_OUT_PORTS, DOT_MIDI_IN_PORTS, &rmidi[0]); if (err < 0) return err; snprintf(rmidi[0]->name, sizeof(rmidi[0]->name), "%s MIDI", dg00x->card->shortname); snd_rawmidi_set_ops(rmidi[0], SNDRV_RAWMIDI_STREAM_INPUT, &midi_phys_capture_ops); snd_rawmidi_set_ops(rmidi[0], SNDRV_RAWMIDI_STREAM_OUTPUT, &midi_phys_playback_ops); /* Add a pair of control midi ports. */ err = snd_rawmidi_new(dg00x->card, dg00x->card->driver, 1, 1, 1, &rmidi[1]); if (err < 0) return err; snprintf(rmidi[1]->name, sizeof(rmidi[1]->name), "%s control", dg00x->card->shortname); snd_rawmidi_set_ops(rmidi[1], SNDRV_RAWMIDI_STREAM_INPUT, &midi_ctl_capture_ops); snd_rawmidi_set_ops(rmidi[1], SNDRV_RAWMIDI_STREAM_OUTPUT, &midi_ctl_playback_ops); for (i = 0; i < ARRAY_SIZE(rmidi); i++) { rmidi[i]->private_data = dg00x; rmidi[i]->info_flags |= SNDRV_RAWMIDI_INFO_INPUT; str = &rmidi[i]->streams[SNDRV_RAWMIDI_STREAM_INPUT]; set_midi_substream_names(dg00x, str, i); rmidi[i]->info_flags |= SNDRV_RAWMIDI_INFO_OUTPUT; str = &rmidi[i]->streams[SNDRV_RAWMIDI_STREAM_OUTPUT]; set_midi_substream_names(dg00x, str, i); rmidi[i]->info_flags |= SNDRV_RAWMIDI_INFO_DUPLEX; } return 0; } arm64/util/dwarf-regs.c?id=966d2b04e070bc040319aaebfec09e0144dc3341'>patch) tree4b96156e3d1dd4dfd6039b7c219c9dc4616da52d /tools/perf/arch/arm64/util/dwarf-regs.c parent1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'tools/perf/arch/arm64/util/dwarf-regs.c')