/* * Audio Codec driver supporting: * AD1835A, AD1836, AD1837A, AD1838A, AD1839A * * Copyright 2009-2011 Analog Devices Inc. * * Licensed under the GPL-2 or later. */ #ifndef __AD1836_H__ #define __AD1836_H__ #define AD1836_DAC_CTRL1 0 #define AD1836_DAC_POWERDOWN 2 #define AD1836_DAC_SERFMT_MASK 0xE0 #define AD1836_DAC_SERFMT_PCK256 (0x4 << 5) #define AD1836_DAC_SERFMT_PCK128 (0x5 << 5) #define AD1836_DAC_WORD_LEN_MASK 0x18 #define AD1836_DAC_WORD_LEN_OFFSET 3 #define AD1836_DAC_CTRL2 1 /* These macros are one-based. So AD183X_MUTE_LEFT(1) will return the mute bit * for the first ADC/DAC */ #define AD1836_MUTE_LEFT(x) (((x) * 2) - 2) #define AD1836_MUTE_RIGHT(x) (((x) * 2) - 1) #define AD1836_DAC_L_VOL(x) ((x) * 2) #define AD1836_DAC_R_VOL(x) (1 + ((x) * 2)) #define AD1836_ADC_CTRL1 12 #define AD1836_ADC_POWERDOWN 7 #define AD1836_ADC_HIGHPASS_FILTER 8 #define AD1836_ADC_CTRL2 13 #define AD1836_ADC_WORD_LEN_MASK 0x30 #define AD1836_ADC_WORD_OFFSET 4 #define AD1836_ADC_SERFMT_MASK (7 << 6) #define AD1836_ADC_SERFMT_PCK256 (0x4 << 6) #define AD1836_ADC_SERFMT_PCK128 (0x5 << 6) #define AD1836_ADC_AUX (0x6 << 6) #define AD1836_ADC_CTRL3 14 #define AD1836_NUM_REGS 16 #define AD1836_WORD_LEN_24 0x0 #define AD1836_WORD_LEN_20 0x1 #define AD1836_WORD_LEN_16 0x2 #endif td> summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPhilip Pettersson <philip.pettersson@gmail.com>2016-11-30 14:55:36 -0800
committerDavid S. Miller <davem@davemloft.net>2016-12-02 12:16:49 -0500
commit84ac7260236a49c79eede91617700174c2c19b0c (patch)
tree6f3e90bdd39cffbcdec28e6b84314b10e3dc2de3
parent2219d5ed77e8bdc2ef1f0b79f34d2cc0be802b25 (diff)
packet: fix race condition in packet_set_ring
When packet_set_ring creates a ring buffer it will initialize a struct timer_list if the packet version is TPACKET_V3. This value can then be raced by a different thread calling setsockopt to set the version to TPACKET_V1 before packet_set_ring has finished. This leads to a use-after-free on a function pointer in the struct timer_list when the socket is closed as the previously initialized timer will not be deleted. The bug is fixed by taking lock_sock(sk) in packet_setsockopt when changing the packet version while also taking the lock at the start of packet_set_ring. Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") Signed-off-by: Philip Pettersson <philip.pettersson@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat