/*
 * Linux driver for TerraTec DMX 6Fire USB
 *
 * Author:	Torsten Schenk <torsten.schenk@zoho.com>
 * Created:	Jan 01, 2011
 * Copyright:	(C) Torsten Schenk
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 */

#ifndef USB6FIRE_CONTROL_H
#define USB6FIRE_CONTROL_H

#include "common.h"

enum {
	CONTROL_MAX_ELEMENTS = 32
};

enum {
	CONTROL_RATE_44KHZ,
	CONTROL_RATE_48KHZ,
	CONTROL_RATE_88KHZ,
	CONTROL_RATE_96KHZ,
	CONTROL_RATE_176KHZ,
	CONTROL_RATE_192KHZ,
	CONTROL_N_RATES
};

struct control_runtime {
	int (*update_streaming)(struct control_runtime *rt);
	int (*set_rate)(struct control_runtime *rt, int rate);
	int (*set_channels)(struct control_runtime *rt, int n_analog_out,
		int n_analog_in, bool spdif_out, bool spdif_in);

	struct sfire_chip *chip;

	struct snd_kcontrol *element[CONTROL_MAX_ELEMENTS];
	bool opt_coax_switch;
	bool line_phono_switch;
	bool digital_thru_switch;
	bool usb_streaming;
	u8 output_vol[6];
	u8 ovol_updated;
	u8 output_mute;
	s8 input_vol[2];
	u8 ivol_updated;
};

int usb6fire_control_init(struct sfire_chip *chip);
void usb6fire_control_abort(struct sfire_chip *chip);
void usb6fire_control_destroy(struct sfire_chip *chip);
#endif /* USB6FIRE_CONTROL_H */

td class='sub'>net-next plumbings</td><td class='sub right'>Tobias Klauser</td></tr></table>
<table class='tabs'><tr><td>
<a href='/cgit.cgi/linux/net-next.git/'>summary</a><a href='/cgit.cgi/linux/net-next.git/refs/?id=889711a03e0fba427fb85317900e93c74e3be02a'>refs</a><a class='active' href='/cgit.cgi/linux/net-next.git/log/tools/perf/pmu-events/arch/x86/nehalemex/pipeline.json'>log</a><a href='/cgit.cgi/linux/net-next.git/tree/tools/perf/pmu-events/arch/x86/nehalemex/pipeline.json?id=889711a03e0fba427fb85317900e93c74e3be02a'>tree</a><a href='/cgit.cgi/linux/net-next.git/commit/tools/perf/pmu-events/arch/x86/nehalemex/pipeline.json?id=889711a03e0fba427fb85317900e93c74e3be02a'>commit</a><a href='/cgit.cgi/linux/net-next.git/diff/tools/perf/pmu-events/arch/x86/nehalemex/pipeline.json?id=889711a03e0fba427fb85317900e93c74e3be02a'>diff</a></td><td class='form'><form class='right' method='get' action='/cgit.cgi/linux/net-next.git/log/tools/perf/pmu-events/arch/x86/nehalemex/pipeline.json'>
<input type='hidden' name='id' value='889711a03e0fba427fb85317900e93c74e3be02a'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/cgit.cgi/linux/net-next.git/log/?id=889711a03e0fba427fb85317900e93c74e3be02a'>root</a>/<a href='/cgit.cgi/linux/net-next.git/log/tools?id=889711a03e0fba427fb85317900e93c74e3be02a'>tools</a>/<a href='/cgit.cgi/linux/net-next.git/log/tools/perf?id=889711a03e0fba427fb85317900e93c74e3be02a'>perf</a>/<a href='/cgit.cgi/linux/net-next.git/log/tools/perf/pmu-events?id=889711a03e0fba427fb85317900e93c74e3be02a'>pmu-events</a>/<a href='/cgit.cgi/linux/net-next.git/log/tools/perf/pmu-events/arch?id=889711a03e0fba427fb85317900e93c74e3be02a'>arch</a>/<a href='/cgit.cgi/linux/net-next.git/log/tools/perf/pmu-events/arch/x86?id=889711a03e0fba427fb85317900e93c74e3be02a'>x86</a>/<a href='/cgit.cgi/linux/net-next.git/log/tools/perf/pmu-events/arch/x86/nehalemex?id=889711a03e0fba427fb85317900e93c74e3be02a'>nehalemex</a>/<a href='/cgit.cgi/linux/net-next.git/log/tools/perf/pmu-events/arch/x86/nehalemex/pipeline.json?id=889711a03e0fba427fb85317900e93c74e3be02a'>pipeline.json</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/cgit.cgi/linux/net-next.git/log/tools/perf/pmu-events/arch/x86/nehalemex/pipeline.json?id=889711a03e0fba427fb85317900e93c74e3be02a&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th><th class='left'>Files</th><th class='left'>Lines</th></tr>
r own ops-&gt;destroy(), assuming their caller
would not.

This patch makes sure qdisc_create() calls ops-&gt;destroy()
and fixes the four qdisc to avoid double free.

[1]
BUG: KASAN: use-after-free in mq_destroy+0x242/0x290 net/sched/sch_mq.c:33 at addr ffff8801d415d440
Read of size 8 by task syz-executor2/5030
CPU: 0 PID: 5030 Comm: syz-executor2 Not tainted 4.3.5-smp-DEV #119
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000046 ffff8801b435b870 ffffffff81bbbed4 ffff8801db000400
 ffff8801d415d440 ffff8801d415dc40 ffff8801c4988510 ffff8801b435b898
 ffffffff816682b1 ffff8801b435b928 ffff8801d415d440 ffff8801c49880c0
Call Trace:
 [&lt;ffffffff81bbbed4&gt;] __dump_stack lib/dump_stack.c:15 [inline]
 [&lt;ffffffff81bbbed4&gt;] dump_stack+0x6c/0x98 lib/dump_stack.c:51
 [&lt;ffffffff816682b1&gt;] kasan_object_err+0x21/0x70 mm/kasan/report.c:158
 [&lt;ffffffff81668524&gt;] print_address_description mm/kasan/report.c:196 [inline]
 [&lt;ffffffff81668524&gt;] kasan_report_error+0x1b4/0x4b0 mm/kasan/report.c:285
 [&lt;ffffffff81668953&gt;] kasan_report mm/kasan/report.c:305 [inline]
 [&lt;ffffffff81668953&gt;] __asan_report_load8_noabort+0x43/0x50 mm/kasan/report.c:326
 [&lt;ffffffff82527b02&gt;] mq_destroy+0x242/0x290 net/sched/sch_mq.c:33
 [&lt;ffffffff82524bdd&gt;] qdisc_destroy+0x12d/0x290 net/sched/sch_generic.c:953
 [&lt;ffffffff82524e30&gt;] qdisc_create_dflt+0xf0/0x120 net/sched/sch_generic.c:848
 [&lt;ffffffff8252550d&gt;] attach_default_qdiscs net/sched/sch_generic.c:1029 [inline]
 [&lt;ffffffff8252550d&gt;] dev_activate+0x6ad/0x880 net/sched/sch_generic.c:1064
 [&lt;ffffffff824b1db1&gt;] __dev_open+0x221/0x320 net/core/dev.c:1403
 [&lt;ffffffff824b24ce&gt;] __dev_change_flags+0x15e/0x3e0 net/core/dev.c:6858
 [&lt;ffffffff824b27de&gt;] dev_change_flags+0x8e/0x140 net/core/dev.c:6926
 [&lt;ffffffff824f5bf6&gt;] dev_ifsioc+0x446/0x890 net/core/dev_ioctl.c:260
 [&lt;ffffffff824f61fa&gt;] dev_ioctl+0x1ba/0xb80 net/core/dev_ioctl.c:546
 [&lt;ffffffff82430509&gt;] sock_do_ioctl+0x99/0xb0 net/socket.c:879
 [&lt;ffffffff82430d30&gt;] sock_ioctl+0x2a0/0x390 net/socket.c:958
 [&lt;ffffffff816f3b68&gt;] vfs_ioctl fs/ioctl.c:44 [inline]
 [&lt;ffffffff816f3b68&gt;] do_vfs_ioctl+0x8a8/0xe50 fs/ioctl.c:611
 [&lt;ffffffff816f41a4&gt;] SYSC_ioctl fs/ioctl.c:626 [inline]
 [&lt;ffffffff816f41a4&gt;] SyS_ioctl+0x94/0xc0 fs/ioctl.c:617
 [&lt;ffffffff8123e357&gt;] entry_SYSCALL_64_fastpath+0x12/0x17

Signed-off-by: Eric Dumazet &lt;edumazet@google.com&gt;
Reported-by: Dmitry Vyukov &lt;dvyukov@google.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>