/* * tmon.h contains data structures and constants used by TMON * * Copyright (C) 2012 Intel Corporation. All rights reserved. * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License version * 2 or later as published by the Free Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * Author Name Jacob Pan * */ #ifndef TMON_H #define TMON_H #define MAX_DISP_TEMP 125 #define MAX_CTRL_TEMP 105 #define MIN_CTRL_TEMP 40 #define MAX_NR_TZONE 16 #define MAX_NR_CDEV 32 #define MAX_NR_TRIP 16 #define MAX_NR_CDEV_TRIP 12 /* number of cooling devices that can bind * to a thermal zone trip. */ #define MAX_TEMP_KC 140000 /* starting char position to draw sensor data, such as tz names * trip point list, etc. */ #define DATA_LEFT_ALIGN 10 #define NR_LINES_TZDATA 1 #define TMON_LOG_FILE "/var/tmp/tmon.log" extern unsigned long ticktime; extern double time_elapsed; extern unsigned long target_temp_user; extern int dialogue_on; extern char ctrl_cdev[]; extern pthread_mutex_t input_lock; extern int tmon_exit; extern int target_thermal_zone; /* use fixed size record to simplify data processing and transfer * TBD: more info to be added, e.g. programmable trip point data. */ struct thermal_data_record { struct timeval tv; unsigned long temp[MAX_NR_TZONE]; double pid_out_pct; }; struct cdev_info { char type[64]; int instance; unsigned long max_state; unsigned long cur_state; unsigned long flag; }; enum trip_type { THERMAL_TRIP_CRITICAL, THERMAL_TRIP_HOT, THERMAL_TRIP_PASSIVE, THERMAL_TRIP_ACTIVE, NR_THERMAL_TRIP_TYPE, }; struct trip_point { enum trip_type type; unsigned long temp; unsigned long hysteresis; int attribute; /* programmability etc. */ }; /* thermal zone configuration information, binding with cooling devices could * change at runtime. */ struct tz_info { char type[256]; /* e.g. acpitz */ int instance; int passive; /* active zone has passive node to force passive mode */ int nr_cdev; /* number of cooling device binded */ int nr_trip_pts; struct trip_point tp[MAX_NR_TRIP]; unsigned long cdev_binding; /* bitmap for attached cdevs */ /* cdev bind trip points, allow one cdev bind to multiple trips */ unsigned long trip_binding[MAX_NR_CDEV]; }; struct tmon_platform_data { int nr_tz_sensor; int nr_cooling_dev; /* keep track of instance ids since there might be gaps */ int max_tz_instance; int max_cdev_instance; struct tz_info *tzi; struct cdev_info *cdi; }; struct control_ops { void (*set_ratio)(unsigned long ratio); unsigned long (*get_ratio)(unsigned long ratio); }; enum cdev_types { CDEV_TYPE_PROC, CDEV_TYPE_FAN, CDEV_TYPE_MEM, CDEV_TYPE_NR, }; /* REVISIT: the idea is to group sensors if possible, e.g. on intel mid * we have "skin0", "skin1", "sys", "msicdie" * on DPTF enabled systems, we might have PCH, TSKN, TAMB, etc. */ enum tzone_types { TZONE_TYPE_ACPI, TZONE_TYPE_PCH, TZONE_TYPE_NR, }; /* limit the output of PID controller adjustment */ #define LIMIT_HIGH (95) #define LIMIT_LOW (2) struct pid_params { double kp; /* Controller gain from Dialog Box */ double ki; /* Time-constant for I action from Dialog Box */ double kd; /* Time-constant for D action from Dialog Box */ double ts; double k_lpf; double t_target; double y_k; }; extern int init_thermal_controller(void); extern void controller_handler(const double xk, double *yk); extern struct tmon_platform_data ptdata; extern struct pid_params p_param; extern FILE *tmon_log; extern int cur_thermal_record; /* index to the trec array */ extern struct thermal_data_record trec[]; extern const char *trip_type_name[]; extern unsigned long no_control; extern void initialize_curses(void); extern void show_controller_stats(char *line); extern void show_title_bar(void); extern void setup_windows(void); extern void disable_tui(void); extern void show_sensors_w(void); extern void show_data_w(void); extern void write_status_bar(int x, char *line); extern void show_control_w(); extern void show_cooling_device(void); extern void show_dialogue(void); extern int update_thermal_data(void); extern int probe_thermal_sysfs(void); extern void free_thermal_data(void); extern void resize_handler(int sig); extern void set_ctrl_state(unsigned long state); extern void get_ctrl_state(unsigned long *state); extern void *handle_tui_events(void *arg); extern int sysfs_set_ulong(char *path, char *filename, unsigned long val); extern int zone_instance_to_index(int zone_inst); extern void close_windows(void); #define PT_COLOR_DEFAULT 1 #define PT_COLOR_HEADER_BAR 2 #define PT_COLOR_ERROR 3 #define PT_COLOR_RED 4 #define PT_COLOR_YELLOW 5 #define PT_COLOR_GREEN 6 #define PT_COLOR_BRIGHT 7 #define PT_COLOR_BLUE 8 /* each thermal zone uses 12 chars, 8 for name, 2 for instance, 2 space * also used to list trip points in forms of AAAC, which represents * A: Active * C: Critical */ #define TZONE_RECORD_SIZE 12 #define TZ_LEFT_ALIGN 32 #define CDEV_NAME_SIZE 20 #define CDEV_FLAG_IN_CONTROL (1 << 0) /* dialogue box starts */ #define DIAG_X 48 #define DIAG_Y 8 #define THERMAL_SYSFS "/sys/class/thermal" #define CDEV "cooling_device" #define TZONE "thermal_zone" #define TDATA_LEFT 16 #endif /* TMON_H */ ca907686f5298220ece53423e38ba3aed (patch) tree286158fdad04c9b54955350abb95d4f1c0dc860a /sound/pci/oxygen/cs2000.h parente6e7b48b295afa5a5ab440de0a94d9ad8b3ce2d0 (diff)
drm/atomic: Fix double free in drm_atomic_state_default_clear
drm_atomic_helper_page_flip and drm_atomic_ioctl set their own events in crtc_state->event. But when it's set the event is freed in 2 places. Solve this by only freeing the event in the atomic ioctl when it allocated its own event. This has been broken twice. The first time when the code was introduced, but only in the corner case when an event is allocated, but more crtc's were included by atomic check and then failing. This can mostly happen when you do an atomic modeset in i915 and the display clock is changed, which forces all crtc's to be included to the state. This has been broken worse by adding in-fences support, which caused the double free to be done unconditionally. [IGT] kms_rotation_crc: starting subtest primary-rotation-180 ============================================================================= BUG kmalloc-128 (Tainted: G U ): Object already free ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper] age=0 cpu=3 pid=1529 ___slab_alloc+0x308/0x3b0 __slab_alloc+0xd/0x20 kmem_cache_alloc_trace+0x92/0x1c0 drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper] intel_atomic_commit+0x35/0x4f0 [i915] drm_atomic_commit+0x46/0x50 [drm] drm_mode_atomic_ioctl+0x7d4/0xab0 [drm] drm_ioctl+0x2b3/0x490 [drm] do_vfs_ioctl+0x69c/0x700 SyS_ioctl+0x4e/0x80 entry_SYSCALL_64_fastpath+0x13/0x94 INFO: Freed in drm_event_cancel_free+0xa3/0xb0 [drm] age=0 cpu=3 pid=1529 __slab_free+0x48/0x2e0 kfree+0x159/0x1a0 drm_event_cancel_free+0xa3/0xb0 [drm] drm_mode_atomic_ioctl+0x86d/0xab0 [drm] drm_ioctl+0x2b3/0x490 [drm] do_vfs_ioctl+0x69c/0x700 SyS_ioctl+0x4e/0x80 entry_SYSCALL_64_fastpath+0x13/0x94 INFO: Slab 0xffffde1f0997b080 objects=17 used=2 fp=0xffff92fb65ec2578 flags=0x200000000008101 INFO: Object 0xffff92fb65ec2578 @offset=1400 fp=0xffff92fb65ec2ae8 Redzone ffff92fb65ec2570: bb bb bb bb bb bb bb bb ........ Object ffff92fb65ec2578: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec2588: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec2598: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25a8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object ffff92fb65ec25e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk. Redzone ffff92fb65ec25f8: bb bb bb bb bb bb bb bb ........ Padding ffff92fb65ec2738: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ CPU: 3 PID: 180 Comm: kworker/3:2 Tainted: G BU 4.10.0-rc6-patser+ #5039 Hardware name: /NUC5PPYB, BIOS PYBSWCEL.86A.0031.2015.0601.1712 06/01/2015 Workqueue: events intel_atomic_helper_free_state [i915] Call Trace: dump_stack+0x4d/0x6d print_trailer+0x20c/0x220 free_debug_processing+0x1c6/0x330 ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm] __slab_free+0x48/0x2e0 ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm] kfree+0x159/0x1a0 drm_atomic_state_default_clear+0xf7/0x1c0 [drm] ? drm_atomic_state_clear+0x30/0x30 [drm] intel_atomic_state_clear+0xd/0x20 [i915] drm_atomic_state_clear+0x1a/0x30 [drm] __drm_atomic_state_free+0x13/0x60 [drm] intel_atomic_helper_free_state+0x5d/0x70 [i915] process_one_work+0x260/0x4a0 worker_thread+0x2d1/0x4f0 kthread+0x127/0x130 ? process_one_work+0x4a0/0x4a0 ? kthread_stop+0x120/0x120 ret_from_fork+0x29/0x40 FIX kmalloc-128: Object at 0xffff92fb65ec2578 not freed Fixes: 3b24f7d67581 ("drm/atomic: Add struct drm_crtc_commit to track async updates") Fixes: 9626014258a5 ("drm/fence: add in-fences support") Cc: <stable@vger.kernel.org> # v4.8+ Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/1485854725-27640-1-git-send-email-maarten.lankhorst@linux.intel.com
Diffstat (limited to 'sound/pci/oxygen/cs2000.h')