| Age | Commit message (Collapse) | Author |
|---|
|
memtimings is a valid pointer here, the intent was to test for
kcalloc() failure.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Christoph Bumiller <e0425955@student.tuwien.ac.at>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Confirmed to fix random hangs while running all Unegine demos on NV86.
Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Fence lock needs to be initialized before any call to nouveau_channel_put
because it calls nouveau_channel_idle->nouveau_fence_update which uses
fence lock.
BUG: spinlock bad magic on CPU#0, test/24134
lock: ffff88019f90dba8, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
Pid: 24134, comm: test Not tainted 3.0.0-nv+ #800
Call Trace:
spin_bug+0x9c/0xa3
do_raw_spin_lock+0x29/0x13c
_raw_spin_lock+0x1e/0x22
nouveau_fence_update+0x2d/0xf1
nouveau_channel_idle+0x22/0xa0
nouveau_channel_put_unlocked+0x84/0x1bd
nouveau_channel_put+0x20/0x24
nouveau_channel_alloc+0x4ec/0x585
nouveau_ioctl_fifo_alloc+0x50/0x130
drm_ioctl+0x289/0x361
do_vfs_ioctl+0x4dd/0x52c
sys_ioctl+0x42/0x65
system_call_fastpath+0x16/0x1b
It's easily triggerable from userspace.
Additionally remove double initialization of chan->fence.pending.
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
NVA3+ has an extra bit here compared to NV50:NVA3 chipsets.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Reportedly this has been causing stability and corruption issues after
resuming from suspend for a few people.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
|
|
Commit ff5a3b509e ("hippi: Move the HIPPI driver") moved the HIPPI
driver into drivers/net/hippi. It didn't source
drivers/net/hippi/Kconfig though, so it didn't make all necessary
Kconfig changes. So let drivers/net/kconfig source HIPPI's Kconfig file.
[ Fix syntax error at the end of HIPP's Kconfig file. -DaveM ]
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
While tracing down a connectivity problem on the temac I connected a
probe to the Cross bar irq, and it was triggered when doing
ifdown->ifup.
This is fixed once waiting for the indirect write to end. Since it is
not on the hot path there is no performance loss.
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
Do not enable the irq until the scatter gather registers are ready to
handle the data. Otherwise an irq from a packet send/received before
last close can lead to an access to an invalid memory region on the irq
handler.
Also, stop the dma engine on close.
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
use get_unaligned_le64() to get timestamp
Signed-off-by: Steven Miao <realmz6@gmail.com>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
|
|
ssh://ra.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
|
|
When we tear down a device we try to flush all outstanding
commands in scsi_free_queue(). However the check in
scsi_request_fn() is imperfect as it only signals that
we _might start_ aborting commands, not that we've actually
aborted some.
So move the printk inside the scsi_kill_request function,
this will also give us a hint about which commands are aborted.
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
|
|
On Mon, 2011-11-07 at 17:24 +1100, Stephen Rothwell wrote:
> Hi all,
>
> Starting some time last week I am getting the following during boot on
> our PPC970 blade:
>
> calling .ipr_init+0x0/0x68 @ 1
> ipr: IBM Power RAID SCSI Device Driver version: 2.5.2 (April 27, 2011)
> ipr 0000:01:01.0: Found IOA with IRQ: 26
> ipr 0000:01:01.0: Starting IOA initialization sequence.
> ipr 0000:01:01.0: Adapter firmware version: 06160039
> ipr 0000:01:01.0: IOA initialized.
> scsi0 : IBM 572E Storage Adapter
> ------------[ cut here ]------------
> WARNING: at drivers/scsi/scsi_lib.c:1704
> Modules linked in:
> NIP: c00000000053b3d4 LR: c00000000053e5b0 CTR: c000000000541d70
> REGS: c0000000783c2f60 TRAP: 0700 Not tainted (3.1.0-autokern1)
> MSR: 8000000000029032 <EE,ME,CE,IR,DR> CR: 24002024 XER: 20000002
> TASK = c0000000783b8000[1] 'swapper' THREAD: c0000000783c0000 CPU: 0
> GPR00: 0000000000000001 c0000000783c31e0 c000000000cf38b0 c00000000239a9d0
> GPR04: c000000000cbe8f8 0000000000000000 c0000000783c3040 0000000000000000
> GPR08: c000000075daf488 c000000078a3b7ff c000000000bcacc8 0000000000000000
> GPR12: 0000000044002028 c000000007ffb000 0000000002e40000 000000000099b800
> GPR16: 0000000000000000 c000000000bba5fc c000000000a61db8 0000000000000000
> GPR20: 0000000001b77200 0000000000000000 c000000078990000 0000000000000001
> GPR24: c000000002396828 0000000000000000 0000000000000000 c000000078a3b938
> GPR28: fffffffffffffffa c0000000008ad2c0 c000000000c7faa8 c00000000239a9d0
> NIP [c00000000053b3d4] .scsi_free_queue+0x24/0x90
> LR [c00000000053e5b0] .scsi_alloc_sdev+0x280/0x2e0
> Call Trace:
> [c0000000783c31e0] [c000000000c7faa8] wireless_seq_fops+0x278d0/0x2eb88 (unreliable)
> [c0000000783c3270] [c00000000053e5b0] .scsi_alloc_sdev+0x280/0x2e0
> [c0000000783c3330] [c00000000053eba0] .scsi_probe_and_add_lun+0x390/0xb40
> [c0000000783c34a0] [c00000000053f7ec] .__scsi_scan_target+0x16c/0x650
> [c0000000783c35f0] [c00000000053fd90] .scsi_scan_channel+0xc0/0x100
> [c0000000783c36a0] [c00000000053fefc] .scsi_scan_host_selected+0x12c/0x1c0
> [c0000000783c3750] [c00000000083dcb4] .ipr_probe+0x2c0/0x390
> [c0000000783c3830] [c0000000003f50b4] .local_pci_probe+0x34/0x50
> [c0000000783c38a0] [c0000000003f5f78] .pci_device_probe+0x148/0x150
> [c0000000783c3950] [c0000000004e1e8c] .driver_probe_device+0xdc/0x210
> [c0000000783c39f0] [c0000000004e20cc] .__driver_attach+0x10c/0x110
> [c0000000783c3a80] [c0000000004e1228] .bus_for_each_dev+0x98/0xf0
> [c0000000783c3b30] [c0000000004e1bf8] .driver_attach+0x28/0x40
> [c0000000783c3bb0] [c0000000004e07d8] .bus_add_driver+0x218/0x340
> [c0000000783c3c60] [c0000000004e2a2c] .driver_register+0x9c/0x1b0
> [c0000000783c3d00] [c0000000003f62d4] .__pci_register_driver+0x64/0x140
> [c0000000783c3da0] [c000000000b99f88] .ipr_init+0x4c/0x68
> [c0000000783c3e20] [c00000000000ad24] .do_one_initcall+0x1a4/0x1e0
> [c0000000783c3ee0] [c000000000b512d0] .kernel_init+0x14c/0x1fc
> [c0000000783c3f90] [c000000000022468] .kernel_thread+0x54/0x70
> Instruction dump:
> ebe1fff8 7c0803a6 4e800020 7c0802a6 fba1ffe8 fbe1fff8 7c7f1b78 f8010010
> f821ff71 e8030398 3120ffff 7c090110 <0b000000> e86303b0 482de065 60000000
> ---[ end trace 759bed76a85e8dec ]---
> scsi 0:0:1:0: Direct-Access IBM-ESXS MAY2036RC T106 PQ: 0 ANSI: 5
> ------------[ cut here ]------------
>
> I get lots more of these. The obvious commit to point the finger at
> is 3308511c93e6 ("[SCSI] Make scsi_free_queue() kill pending SCSI
> commands") but the root cause may be something different.
Caused by
commit f7c9c6bb14f3104608a3a83cadea10a6943d2804
Author: Anton Blanchard <anton@samba.org>
Date: Thu Nov 3 08:56:22 2011 +1100
[SCSI] Fix block queue and elevator memory leak in scsi_alloc_sdev
Doesn't completely do the teardown. The true fix is to do a proper
teardown instead of hand rolling it
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Tested-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: stable@kernel.org #2.6.38+
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
|
|
Evidently the definition of struct skb_frag_struct has changed, so we
need to change to match it.
Signed-off-by: David Daney <david.daney@cavium.com>
To: netdev@vger.kernel.org
To: gregkh@suse.de
To: devel@driverdev.osuosl.org
Patchwork: https://patchwork.linux-mips.org/patch/2909/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
|
|
Commit 940ab889 "drivercore: Add helper macro for platform_driver boilerplate"
converted this driver to use module_platform_driver, but due to the use
of platform_driver_probe(), this resulted in the call to atmel_spi_probe being
lost. Place the call to this function into the driver structure.
fix section missmatch
atmel_spi_probe is marked __init where it's supposed to be __devinit
atmel_spi_remove is marked __exit where it's supposed to be __devexit
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Cc: Grant Likely <grant.likely@secretlab.ca>
Cc: Russell King - ARM Linux <linux@arm.linux.org.uk>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
|
|
Signed-off-by: Keng-Yu Lin <kengyu@canonical.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
|
|
Reenable sending SRST to devices connected behind a Sil3726 PMP.
This allow staggered spinups and handles drives that spins up slowly.
While the drives spin up, the PMP will not accept SRST.
Most controller reissues the reset until the drive is ready, while
some [Sil3124] returns an error.
In ata_eh_error, wait 10s before reset the ATA port and try again.
Signed-off-by: Gwendal Grignou <gwendal@google.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
|
|
Trivial spelling fix.
Signed-off-by: Chris Dunlop <chris@onthe.net.au>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
|
|
Use dev_get_platdata() to retrieve the struct ahci_platform_data data
from the platform.
Signed-off-by: JiSheng Zhang <jszhang3@gmail.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
|
|
Add the documentation of parameters of ata_change_queue_depth to silence the warning of make xmldocs
Signed-off-by: Marcos paulo de Souza <marcos.mage@gmail.com>
Acked-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux:
drivers/media: video/a5k6aa is a module and so needs module.h
mfd: fix build failures in recently added ab5500 code
hwspinlock/u8500: include linux/module.h
MTD: MAPS: bcm963xx-flash.c: explicitly include module.h
|
|
* 'for-linus' of git://neil.brown.name/md:
md/raid5: STRIPE_ACTIVE has lock semantics, add barriers
md/raid5: abort any pending parity operations when array fails.
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rdunlap/linux-docs
* 'docs-move' of git://git.kernel.org/pub/scm/linux/kernel/git/rdunlap/linux-docs: (45 commits)
DocBook/drm: Clean up a todo-note
DocBook/drm: `device aware' -> `device-aware'
DocBook/drm: `(device|driver) specific' -> `(device|driver)-specific'
DocBook/drm: Clean up the paragraph on framebuffer objects
DocBook/drm: Use `; otherwise,'
DocBook/drm: Better flow with `, and then'
DocBook/drm: Refer to the domain-setting function as a device-specific ioctl
DocBook/drm: Improve flow of GPU/CPU coherence sentence
DocBook/drm: Use an <itemizelist> for fundamental GEM operations
DocBook/drm: Insert a comma
DocBook/drm: Use a <variablelist> for vblank ioctls
DocBook/drm: Use an itemizedlist for what an encoder needs to provide
DocBook/drm: Insert `the' for readability, and change `set' to `setting'
DocBook/drm: Remove extraneous commas
DocBook/drm: Use a colon
DocBook/drm: Clarify `final initialization' via better formatting
DocBook/drm: Remove redundancy
DocBook/drm: Insert `it' for smooth reading
DocBook/drm: The word `so-called'; I do not think it connotes what you think it connotes
DocBook/drm: Use a singular subject for grammatical cleanliness
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
* 'pm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
PM / OPP: Use ERR_CAST instead of ERR_PTR(PTR_ERR())
PM / devfreq: fix private_data
Documentation: Fix typo in freezer-subsystem.txt
PM / QoS: Set cpu_dma_pm_qos->name
|
|
The m68k core irq code stopped honoring these flags during the irq
restructuring in 2006.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
|
|
The top of <linux/irq.h> has this comment:
* Please do not include this file in generic code. There is currently
* no requirement for any architecture to implement anything held
* within this file.
*
* Thanks. --rmk
Remove inclusion of <linux/irq.h>, to prevent the following compile error
from happening soon:
| include/linux/irq.h:132: error: redefinition of ‘struct irq_data’
| include/linux/irq.h:286: error: redefinition of ‘struct irq_chip’
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: linux-ide@vger.kernel.org
|
|
Use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(...))
[The semantic patch that makes this change is available
in scripts/coccinelle/api/err_cast.cocci.
More information about semantic patching is available at
http://coccinelle.lip6.fr/]
Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ohad/hwspinlock
* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/hwspinlock:
hwspinlock/u8500: fix build error due to undefined label
hwspinlock: Don't return a value in __hwspin_unlock
|
|
The Kconfig loop detection goes crazy without this.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Otherwise we get compile errors like this:
ERROR: "led_classdev_unregister" [drivers/platform/x86/dell-laptop.ko] undefined!
ERROR: "led_classdev_register" [drivers/platform/x86/dell-laptop.ko] undefined!
make[1]: *** [__modpost] Error 1
make: *** [modules] Error 2
when the dell-laptop support is enabled without the necessary LED
support being enabled.
Reported-by: Alessandro Suardi <alessandro.suardi@gmail.com>
Acked-by: Matthew Garrett <mjg59@srcf.ucam.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
are in filters
A minor fix for the check that verifies that all given SSIDs (in req) exist
in the filters (the match sets)
Signed-off-by: Eyal Shapira <eyal@wizery.com>
Acked-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
|
|
This happens with devices using a regulatory domain 0x68 that are only
5Ghz capable because ath_reg_apply_active_scan_flags assumes that we
always have a 2,4Ghz band.
CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 82cd838c, ra == 82cd8384
Oops[#1]:
Cpu 0
$ 0 : 00000000 00000061 00000003 00000024
$ 4 : 00000003 000016c1 82f900ac 00000024
$ 8 : 00000000 82cda304 0058bad8 00000005
$12 : 005908f8 001e8481 00000003 1dcd6500
$16 : 00000002 00000000 82c700c0 82c700c0
$20 : 82d415e4 82c70d64 82c70200 82c715bc
$24 : 00000000 11e1a300
$28 : 82ce2000 82ce3c70 82c715a8 82cd8384
Hi : 00000000
Lo : 0000001e
epc : 82cd838c ath_reg_apply_world_flags+0x78/0x17c [ath]
Not tainted
ra : 82cd8384 ath_reg_apply_world_flags+0x70/0x17c [ath]
Status: 1000d403 KERNEL EXL IE
Cause : 80800008
BadVA : 00000000
PrId : 00019374 (MIPS 24Kc)
Modules linked in: ath9k(+) ath9k_common ath9k_hw ath mac80211 cfg80211
compat_firmware_class compat arc4 aes_generic deflate ecb cbc
leds_gpio button_hotplug gpio_buttons input_polldev ie
Process insmod (pid: 464, threadinfo=82ce2000, task=838b31d8, tls=00000000)
Stack : 00000000 00000002 82f900ac 82c700c0 82d415e4 82c70d64 00000000 00000068
82f900ac 82cd88f4 82c700c0 82cda304 00000001 000020f0 82f90000 82c70d40
00000002 82f90000 82f900ac 82d4207c 82d518a0 00000002 7fee6118 8017c0d8
00000008 8397ba00 82c70d40 00000000 82c70200 83813000 83813058 b0010000
82d518a0 00000002 7fee6118 82d4b8c8 83445cc0 80120dc0 83804000 800eeda0
...
Call Trace:
[<82cd838c>] ath_reg_apply_world_flags+0x78/0x17c [ath]
[<82cd88f4>] ath_regd_init+0x464/0x488 [ath]
[<82d4207c>] ath9k_init_device+0x6a4/0x6b4 [ath9k]
[<82d4b8c8>] ath_pci_probe+0x27c/0x358 [ath9k]
[<80181de0>] pci_device_probe+0x64/0xa4
[<8019e874>] driver_probe_device+0xb8/0x190
[<8019e9b8>] __driver_attach+0x6c/0xa4
[<8019dfc0>] bus_for_each_dev+0x60/0xb0
[<8019d744>] bus_add_driver+0xc4/0x25c
[<8019ed6c>] driver_register+0xe0/0x198
[<8018206c>] __pci_register_driver+0x50/0xe0
[<82dd0010>] ath9k_init+0x10/0x54 [ath9k]
[<8006b4a0>] do_one_initcall+0x68/0x1ec
[<800a901c>] sys_init_module+0xec/0x23c
[<80062544>] stack_done+0x20/0x3c
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth
|
|
This file uses core functions like module_init() and module_exit()
and so it explicitly needs to include the module.h header.
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
|
|
git://gitorious.org/khilman/linux-omap-pm into gpio/merge
|
|
To prevent the SBus driver for Sun Happy Meal cards from being loaded for
PCI cards utilizing the same chipset, a filter was added to the probe
function in commit 0b492fce3d72d982a7981905f85484a1e1ba7fde.
The filter was implemented by checking the name of the parent node in
the OF tree. This patch extends this filter, so that the driver will
load on SBus systems that are based upon SBI SBus Bridges.
Signed-off-by: Kjetil Oftedal <oftedal@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
It was mistakenly introduced by dde05cbdf8b1 ("IB/qib: Hold links
until tuning data is available").
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@qlogic.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
|
|
Make sure we enable the clock before leaving probe.
Signed-off-by: Ulf Hansson <ulf.hansson@stericsson.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
|
|
Alek Du reported that the code erroneously applies time to jiffies
conversions twice to the t1 and t2 values. In normal use on a modem link
this cases no visible problem but on a slower link it will break as with
HZ=1000 as is typical we are running t1/t2 ten times too fast.
Alek's original patch removed the conversion from the timer setting but we
in fact have to be more careful as the contents of t1/t2 are visible via
the device API and we thus need to correct the constants.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
The driver used NET_IP_ALIGN to remove some additional padding inside of
the rx_fixup function. On many architectures NET_IP_ALIGN defaults to 2
which removed the correct amount of bytes.
On MCORE2-machines commit ea812ca1b06113597adcd8e70c0f84a413d97544
introduces a change which sets NET_IP_ALIGN to 0 by default. Which
triggered the bug on these machines.
This fix introduces a new RXW_PADDING define and uses this instead of
NET_IP_ALIGN. The name was taken from the original SMSC7500 driver which
is provided by SMSC.
Signed-off-by: Nico Erfurth <ne@erfurth.eu>
Tested-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
The link down would occur when reseting PHY. And it would take about 2 ~ 5 seconds
from link down to link up. If the delay of pm_schedule_suspend is not long enough,
the device would enter runtime_suspend before link up. After link up, the device
would wake up and reset PHY again. Then, you would find the driver keep in a loop
of runtime_suspend and rumtime_resume.
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Acked-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
Fix compile failure in drivers/iommu/omap-iommu-debug.c
because of missing module.h include.
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
|
|
Since this device declares itself as vendor specific, must add
a new entry to device ID table to support it.
usb-device output of this device:
T: Bus=01 Lev=02 Prnt=02 Port=03 Cnt=01 Dev#= 3 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=413c ProdID=8197 Rev=01.12
S: Manufacturer=Broadcom Corp
S: Product=BCM20702A0
S: SerialNumber=D0DF9AA9C9F1
C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
Signed-off-by: Wen-chien Jesse Sung <jesse.sung@canonical.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
|
|
Otherwise the fh changing the master control won't get the inactive state
change event for the slave controls.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
Setting sev->fh to NULL causes problems for the del op added in the next
patch of this series, since this op needs a way to get to its own data
structures, and typically this will be done by using container_of on an
embedded v4l2_fh struct.
The reason the original code is setting sev->fh to NULL is to signal
to users of the event framework that the unsubscription has happened,
but since their is no shared lock between the event framework and users
of it, this is inherently racy, and it also turns out to be unnecessary
as long as both the event framework and the user of the framework do their
own locking properly and the user guarantees that it holds no references
to the subcribed_event structure after its del operation has been called.
This is best explained by looking at the only code currently checking for
sev->fh being set to NULL on unsubscribe, which is the v4l2-ctrls.c send_event
function. Here is the relevant code from v4l2-ctrls: send_event():
if (sev->fh && (sev->fh != fh ||
(sev->flags & V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK)))
v4l2_event_queue_fh(sev->fh, &ev);
Now lets say that v4l2_event_unsubscribe and v4l2-ctrls: send_event() race
on the same sev, then the following could happens:
1) send_event checks sev->fh, finds it is not NULL
<thread switch>
2) v4l2_event_unsubscribe sets sev->fh NULL
3) v4l2_event_unsubscribe calls v4l2_ctrls del_event function, this blocks
as the thread calling send_event holds the ctrl_lock
<thread switch>
4) send_event calls v4l2_event_queue_fh(sev->fh, &ev) which not is equivalent
to calling: v4l2_event_queue_fh(NULL, &ev)
5) oops, NULL pointer deref.
Now again without setting sev->fh to NULL in v4l2_event_unsubscribe and
without the (now senseless since always true) sev->fh != NULL check in
1) send_event is about to call v4l2_event_queue_fh(sev->fh, &ev)
<thread switch>
2) v4l2_event_unsubscribe removes sev->list from the fh->subscribed list
<thread switch>
3) send_event calls v4l2_event_queue_fh(sev->fh, &ev)
4) v4l2_event_queue_fh blocks on the fh_lock spinlock
<thread switch>
5) v4l2_event_unsubscribe unlocks the fh_lock spinlock
6) v4l2_event_unsubscribe calls v4l2_ctrls del_event function, this blocks
as the thread calling send_event holds the ctrl_lock
<thread switch>
8) v4l2_event_queue_fh takes the fh_lock
7) v4l2_event_queue_fh calls v4l2_event_subscribed, does not find it since
sev->list has been removed from fh->subscribed already -> does nothing
9) v4l2_event_queue_fh releases the fh_lock
10) the caller of send_event releases the ctrl lock (mutex)
<thread switch>
11) v4l2_ctrls del_event takes the ctrl lock
12) v4l2_ctrls del_event removes sev->node from the ev_subs list
13) v4l2_ctrls del_event releases the ctrl lock
14) v4l2_event_unsubscribe frees the sev, to which no references are being
held anymore
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
The kev pointers inside the pending events queue (the available queue) of the
fh point to data inside the sev, unsubscribing frees the sev, thus making these
pointers point to freed memory!
This patch fixes these dangling pointers in the available queue by removing
all matching pending events on unsubscription.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
