/* * kirkwood.h * * (c) 2010 Arnaud Patard * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the * Free Software Foundation; either version 2 of the License, or (at your * option) any later version. */ #ifndef _KIRKWOOD_AUDIO_H #define _KIRKWOOD_AUDIO_H #define KIRKWOOD_RECORD_WIN 0 #define KIRKWOOD_PLAYBACK_WIN 1 #define KIRKWOOD_MAX_AUDIO_WIN 2 #define KIRKWOOD_AUDIO_WIN_BASE_REG(win) (0xA00 + ((win)<<3)) #define KIRKWOOD_AUDIO_WIN_CTRL_REG(win) (0xA04 + ((win)<<3)) #define KIRKWOOD_RECCTL 0x1000 #define KIRKWOOD_RECCTL_SPDIF_EN (1<<11) #define KIRKWOOD_RECCTL_I2S_EN (1<<10) #define KIRKWOOD_RECCTL_PAUSE (1<<9) #define KIRKWOOD_RECCTL_MUTE (1<<8) #define KIRKWOOD_RECCTL_BURST_MASK (3<<5) #define KIRKWOOD_RECCTL_BURST_128 (2<<5) #define KIRKWOOD_RECCTL_BURST_32 (1<<5) #define KIRKWOOD_RECCTL_MONO (1<<4) #define KIRKWOOD_RECCTL_MONO_CHAN_RIGHT (1<<3) #define KIRKWOOD_RECCTL_MONO_CHAN_LEFT (0<<3) #define KIRKWOOD_RECCTL_SIZE_MASK (7<<0) #define KIRKWOOD_RECCTL_SIZE_16 (7<<0) #define KIRKWOOD_RECCTL_SIZE_16_C (3<<0) #define KIRKWOOD_RECCTL_SIZE_20 (2<<0) #define KIRKWOOD_RECCTL_SIZE_24 (1<<0) #define KIRKWOOD_RECCTL_SIZE_32 (0<<0) #define KIRKWOOD_RECCTL_ENABLE_MASK (KIRKWOOD_RECCTL_SPDIF_EN | \ KIRKWOOD_RECCTL_I2S_EN) #define KIRKWOOD_REC_BUF_ADDR 0x1004 #define KIRKWOOD_REC_BUF_SIZE 0x1008 #define KIRKWOOD_REC_BYTE_COUNT 0x100C #define KIRKWOOD_PLAYCTL 0x1100 #define KIRKWOOD_PLAYCTL_PLAY_BUSY (1<<16) #define KIRKWOOD_PLAYCTL_BURST_MASK (3<<11) #define KIRKWOOD_PLAYCTL_BURST_128 (2<<11) #define KIRKWOOD_PLAYCTL_BURST_32 (1<<11) #define KIRKWOOD_PLAYCTL_PAUSE (1<<9) #define KIRKWOOD_PLAYCTL_SPDIF_MUTE (1<<8) #define KIRKWOOD_PLAYCTL_MONO_MASK (3<<5) #define KIRKWOOD_PLAYCTL_MONO_BOTH (3<<5) #define KIRKWOOD_PLAYCTL_MONO_OFF (0<<5) #define KIRKWOOD_PLAYCTL_I2S_MUTE (1<<7) #define KIRKWOOD_PLAYCTL_SPDIF_EN (1<<4) #define KIRKWOOD_PLAYCTL_I2S_EN (1<<3) #define KIRKWOOD_PLAYCTL_SIZE_MASK (7<<0) #define KIRKWOOD_PLAYCTL_SIZE_16 (7<<0) #define KIRKWOOD_PLAYCTL_SIZE_16_C (3<<0) #define KIRKWOOD_PLAYCTL_SIZE_20 (2<<0) #define KIRKWOOD_PLAYCTL_SIZE_24 (1<<0) #define KIRKWOOD_PLAYCTL_SIZE_32 (0<<0) #define KIRKWOOD_PLAYCTL_ENABLE_MASK (KIRKWOOD_PLAYCTL_SPDIF_EN | \ KIRKWOOD_PLAYCTL_I2S_EN) #define KIRKWOOD_PLAY_BUF_ADDR 0x1104 #define KIRKWOOD_PLAY_BUF_SIZE 0x1108 #define KIRKWOOD_PLAY_BYTE_COUNT 0x110C #define KIRKWOOD_DCO_CTL 0x1204 #define KIRKWOOD_DCO_CTL_OFFSET_MASK (0xFFF<<2) #define KIRKWOOD_DCO_CTL_OFFSET_0 (0x800<<2) #define KIRKWOOD_DCO_CTL_FREQ_MASK (3<<0) #define KIRKWOOD_DCO_CTL_FREQ_11 (0<<0) #define KIRKWOOD_DCO_CTL_FREQ_12 (1<<0) #define KIRKWOOD_DCO_CTL_FREQ_24 (2<<0) #define KIRKWOOD_DCO_SPCR_STATUS 0x120c #define KIRKWOOD_DCO_SPCR_STATUS_DCO_LOCK (1<<16) #define KIRKWOOD_CLOCKS_CTRL 0x1230 #define KIRKWOOD_MCLK_SOURCE_MASK (3<<0) #define KIRKWOOD_MCLK_SOURCE_DCO (0<<0) #define KIRKWOOD_MCLK_SOURCE_EXTCLK (3<<0) #define KIRKWOOD_ERR_CAUSE 0x1300 #define KIRKWOOD_ERR_MASK 0x1304 #define KIRKWOOD_INT_CAUSE 0x1308 #define KIRKWOOD_INT_MASK 0x130C #define KIRKWOOD_INT_CAUSE_PLAY_BYTES (1<<14) #define KIRKWOOD_INT_CAUSE_REC_BYTES (1<<13) #define KIRKWOOD_INT_CAUSE_DMA_PLAY_END (1<<7) #define KIRKWOOD_INT_CAUSE_DMA_PLAY_3Q (1<<6) #define KIRKWOOD_INT_CAUSE_DMA_PLAY_HALF (1<<5) #define KIRKWOOD_INT_CAUSE_DMA_PLAY_1Q (1<<4) #define KIRKWOOD_INT_CAUSE_DMA_REC_END (1<<3) #define KIRKWOOD_INT_CAUSE_DMA_REC_3Q (1<<2) #define KIRKWOOD_INT_CAUSE_DMA_REC_HALF (1<<1) #define KIRKWOOD_INT_CAUSE_DMA_REC_1Q (1<<0) #define KIRKWOOD_REC_BYTE_INT_COUNT 0x1310 #define KIRKWOOD_PLAY_BYTE_INT_COUNT 0x1314 #define KIRKWOOD_BYTE_INT_COUNT_MASK 0xffffff #define KIRKWOOD_I2S_PLAYCTL 0x2508 #define KIRKWOOD_I2S_RECCTL 0x2408 #define KIRKWOOD_I2S_CTL_JUST_MASK (0xf<<26) #define KIRKWOOD_I2S_CTL_LJ (0<<26) #define KIRKWOOD_I2S_CTL_I2S (5<<26) #define KIRKWOOD_I2S_CTL_RJ (8<<26) #define KIRKWOOD_I2S_CTL_SIZE_MASK (3<<30) #define KIRKWOOD_I2S_CTL_SIZE_16 (3<<30) #define KIRKWOOD_I2S_CTL_SIZE_20 (2<<30) #define KIRKWOOD_I2S_CTL_SIZE_24 (1<<30) #define KIRKWOOD_I2S_CTL_SIZE_32 (0<<30) #define KIRKWOOD_AUDIO_BUF_MAX (16*1024*1024) /* Theses values come from the marvell alsa driver */ /* need to find where they come from */ #define KIRKWOOD_SND_MIN_PERIODS 2 #define KIRKWOOD_SND_MAX_PERIODS 16 #define KIRKWOOD_SND_MIN_PERIOD_BYTES 256 #define KIRKWOOD_SND_MAX_PERIOD_BYTES 0x8000 #define KIRKWOOD_SND_MAX_BUFFER_BYTES (KIRKWOOD_SND_MAX_PERIOD_BYTES \ * KIRKWOOD_SND_MAX_PERIODS) struct kirkwood_dma_data { void __iomem *io; struct clk *clk; struct clk *extclk; uint32_t ctl_play; uint32_t ctl_rec; struct snd_pcm_substream *substream_play; struct snd_pcm_substream *substream_rec; int irq; int burst; }; extern struct snd_soc_platform_driver kirkwood_soc_platform; #endif i/linux/net-next.git/patch/sound/soc/soc-utils.c?id=92c715fca907686f5298220ece53423e38ba3aed'>patch) tree286158fdad04c9b54955350abb95d4f1c0dc860a /sound/soc/soc-utils.c parente6e7b48b295afa5a5ab440de0a94d9ad8b3ce2d0 (diff)
drm/atomic: Fix double free in drm_atomic_state_default_clear
drm_atomic_helper_page_flip and drm_atomic_ioctl set their own events in crtc_state->event. But when it's set the event is freed in 2 places. Solve this by only freeing the event in the atomic ioctl when it allocated its own event. This has been broken twice. The first time when the code was introduced, but only in the corner case when an event is allocated, but more crtc's were included by atomic check and then failing. This can mostly happen when you do an atomic modeset in i915 and the display clock is changed, which forces all crtc's to be included to the state. This has been broken worse by adding in-fences support, which caused the double free to be done unconditionally. [IGT] kms_rotation_crc: starting subtest primary-rotation-180 ============================================================================= BUG kmalloc-128 (Tainted: G U ): Object already free ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper] age=0 cpu=3 pid=1529 ___slab_alloc+0x308/0x3b0 __slab_alloc+0xd/0x20 kmem_cache_alloc_trace+0x92/0x1c0 drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper] intel_atomic_commit+0x35/0x4f0 [i915] drm_atomic_commit+0x46/0x50 [drm] drm_mode_atomic_ioctl+0x7d4/0xab0 [drm] drm_ioctl+0x2b3/0x490 [drm] do_vfs_ioctl+0x69c/0x700 SyS_ioctl+0x4e/0x80 entry_SYSCALL_64_fastpath+0x13/0x94 INFO: Freed in drm_event_cancel_free+0xa3/0xb0 [drm] age=0 cpu=3 pid=1529 __slab_free+0x48/0x2e0 kfree+0x159/0x1a0 drm_event_cancel_free+0xa3/0xb0 [drm] drm_mode_atomic_ioctl+0x86d/0xab0 [drm] drm_ioctl+0x2b3/0x490 [drm] do_vfs_ioctl+0x69c/0x700 SyS_ioctl+0x4e/0x80 entry_SYSCALL_64_fastpath+0x13/0x94 INFO: Slab 0xffffde1f0997b080 objects=17 used=2 fp=0xffff92fb65ec2578 flags=0x200000000008101 INFO: Object 0xffff92fb65ec2578 @offset=1400 fp=0xffff92fb65ec2ae8 Redzone ffff92fb65ec2570: bb bb bb bb bb bb bb bb ........ Object ffff92fb65ec2578: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec2588: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec2598: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25a8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk. Redzone ffff92fb65ec25f8: bb bb bb bb bb bb bb bb ........ Padding ffff92fb65ec2738: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ CPU: 3 PID: 180 Comm: kworker/3:2 Tainted: G BU 4.10.0-rc6-patser+ #5039 Hardware name: /NUC5PPYB, BIOS PYBSWCEL.86A.0031.2015.0601.1712 06/01/2015 Workqueue: events intel_atomic_helper_free_state [i915] Call Trace: dump_stack+0x4d/0x6d print_trailer+0x20c/0x220 free_debug_processing+0x1c6/0x330 ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm] __slab_free+0x48/0x2e0 ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm] kfree+0x159/0x1a0 drm_atomic_state_default_clear+0xf7/0x1c0 [drm] ? drm_atomic_state_clear+0x30/0x30 [drm] intel_atomic_state_clear+0xd/0x20 [i915] drm_atomic_state_clear+0x1a/0x30 [drm] __drm_atomic_state_free+0x13/0x60 [drm] intel_atomic_helper_free_state+0x5d/0x70 [i915] process_one_work+0x260/0x4a0 worker_thread+0x2d1/0x4f0 kthread+0x127/0x130 ? process_one_work+0x4a0/0x4a0 ? kthread_stop+0x120/0x120 ret_from_fork+0x29/0x40 FIX kmalloc-128: Object at 0xffff92fb65ec2578 not freed Fixes: 3b24f7d67581 ("drm/atomic: Add struct drm_crtc_commit to track async updates") Fixes: 9626014258a5 ("drm/fence: add in-fences support") Cc: <stable@vger.kernel.org> # v4.8+ Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/1485854725-27640-1-git-send-email-maarten.lankhorst@linux.intel.com
Diffstat (limited to 'sound/soc/soc-utils.c')