/* * oxfw_command.c - a part of driver for OXFW970/971 based devices * * Copyright (c) 2014 Takashi Sakamoto * * Licensed under the terms of the GNU General Public License, version 2. */ #include "oxfw.h" int avc_stream_set_format(struct fw_unit *unit, enum avc_general_plug_dir dir, unsigned int pid, u8 *format, unsigned int len) { u8 *buf; int err; buf = kmalloc(len + 10, GFP_KERNEL); if (buf == NULL) return -ENOMEM; buf[0] = 0x00; /* CONTROL */ buf[1] = 0xff; /* UNIT */ buf[2] = 0xbf; /* EXTENDED STREAM FORMAT INFORMATION */ buf[3] = 0xc0; /* SINGLE subfunction */ buf[4] = dir; /* Plug Direction */ buf[5] = 0x00; /* UNIT */ buf[6] = 0x00; /* PCR (Isochronous Plug) */ buf[7] = 0xff & pid; /* Plug ID */ buf[8] = 0xff; /* Padding */ buf[9] = 0xff; /* Support status in response */ memcpy(buf + 10, format, len); /* do transaction and check buf[1-8] are the same against command */ err = fcp_avc_transaction(unit, buf, len + 10, buf, len + 10, BIT(1) | BIT(2) | BIT(3) | BIT(4) | BIT(5) | BIT(6) | BIT(7) | BIT(8)); if ((err > 0) && (err < len + 10)) err = -EIO; else if (buf[0] == 0x08) /* NOT IMPLEMENTED */ err = -ENOSYS; else if (buf[0] == 0x0a) /* REJECTED */ err = -EINVAL; else err = 0; kfree(buf); return err; } int avc_stream_get_format(struct fw_unit *unit, enum avc_general_plug_dir dir, unsigned int pid, u8 *buf, unsigned int *len, unsigned int eid) { unsigned int subfunc; int err; if (eid == 0xff) subfunc = 0xc0; /* SINGLE */ else subfunc = 0xc1; /* LIST */ buf[0] = 0x01; /* STATUS */ buf[1] = 0xff; /* UNIT */ buf[2] = 0xbf; /* EXTENDED STREAM FORMAT INFORMATION */ buf[3] = subfunc; /* SINGLE or LIST */ buf[4] = dir; /* Plug Direction */ buf[5] = 0x00; /* Unit */ buf[6] = 0x00; /* PCR (Isochronous Plug) */ buf[7] = 0xff & pid; /* Plug ID */ buf[8] = 0xff; /* Padding */ buf[9] = 0xff; /* support status in response */ buf[10] = 0xff & eid; /* entry ID for LIST subfunction */ buf[11] = 0xff; /* padding */ /* do transaction and check buf[1-7] are the same against command */ err = fcp_avc_transaction(unit, buf, 12, buf, *len, BIT(1) | BIT(2) | BIT(3) | BIT(4) | BIT(5) | BIT(6) | BIT(7)); if ((err > 0) && (err < 10)) err = -EIO; else if (buf[0] == 0x08) /* NOT IMPLEMENTED */ err = -ENOSYS; else if (buf[0] == 0x0a) /* REJECTED */ err = -EINVAL; else if (buf[0] == 0x0b) /* IN TRANSITION */ err = -EAGAIN; /* LIST subfunction has entry ID */ else if ((subfunc == 0xc1) && (buf[10] != eid)) err = -EIO; if (err < 0) goto end; /* keep just stream format information */ if (subfunc == 0xc0) { memmove(buf, buf + 10, err - 10); *len = err - 10; } else { memmove(buf, buf + 11, err - 11); *len = err - 11; } err = 0; end: return err; } int avc_general_inquiry_sig_fmt(struct fw_unit *unit, unsigned int rate, enum avc_general_plug_dir dir, unsigned short pid) { unsigned int sfc; u8 *buf; int err; for (sfc = 0; sfc < CIP_SFC_COUNT; sfc++) { if (amdtp_rate_table[sfc] == rate) break; } if (sfc == CIP_SFC_COUNT) return -EINVAL; buf = kzalloc(8, GFP_KERNEL); if (buf == NULL) return -ENOMEM; buf[0] = 0x02; /* SPECIFIC INQUIRY */ buf[1] = 0xff; /* UNIT */ if (dir == AVC_GENERAL_PLUG_DIR_IN) buf[2] = 0x19; /* INPUT PLUG SIGNAL FORMAT */ else buf[2] = 0x18; /* OUTPUT PLUG SIGNAL FORMAT */ buf[3] = 0xff & pid; /* plug id */ buf[4] = 0x90; /* EOH_1, Form_1, FMT. AM824 */ buf[5] = 0x07 & sfc; /* FDF-hi. AM824, frequency */ buf[6] = 0xff; /* FDF-mid. AM824, SYT hi (not used) */ buf[7] = 0xff; /* FDF-low. AM824, SYT lo (not used) */ /* do transaction and check buf[1-5] are the same against command */ err = fcp_avc_transaction(unit, buf, 8, buf, 8, BIT(1) | BIT(2) | BIT(3) | BIT(4) | BIT(5)); if ((err > 0) && (err < 8)) err = -EIO; else if (buf[0] == 0x08) /* NOT IMPLEMENTED */ err = -ENOSYS; if (err < 0) goto end; err = 0; end: kfree(buf); return err; } /option>space:mode:
authorDouglas Miller <dougmill@linux.vnet.ibm.com>2017-01-28 06:42:20 -0600
committerTejun Heo <tj@kernel.org>2017-01-28 07:49:42 -0500
commit966d2b04e070bc040319aaebfec09e0144dc3341 (patch)
tree4b96156e3d1dd4dfd6039b7c219c9dc4616da52d /sound/firewire/digi00x
parent1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'sound/firewire/digi00x')