lkml.org 
[lkml]   [2007]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 21/26] i4l: fix random freezes with AVM B1 drivers

    2.6.22-stable review patch. If anyone has any objections, please let us
    know.

    ------------------
    From: Karsten Keil <kkeil@suse.de>

    patch 9713d9e650045f7f2afd81d58a068827be306993 in mainline.

    This fix the same issue which was debbuged for the C4 controller for the B1
    versions.

    The capilib_ function modify or traverse a linked list without locking.

    This patch extends the existing locking to the calls of these function to
    prevent access to a list which is in the middle of a modification.

    Signed-off-by: Karsten Keil <kkeil@suse.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/isdn/hardware/avm/b1.c | 28 +++++++++++++---------------
    1 file changed, 13 insertions(+), 15 deletions(-)

    --- a/drivers/isdn/hardware/avm/b1.c
    +++ b/drivers/isdn/hardware/avm/b1.c
    @@ -321,12 +321,15 @@ void b1_reset_ctr(struct capi_ctr *ctrl)
    avmctrl_info *cinfo = (avmctrl_info *)(ctrl->driverdata);
    avmcard *card = cinfo->card;
    unsigned int port = card->port;
    + unsigned long flags;

    b1_reset(port);
    b1_reset(port);

    memset(cinfo->version, 0, sizeof(cinfo->version));
    + spin_lock_irqsave(&card->lock, flags);
    capilib_release(&cinfo->ncci_head);
    + spin_unlock_irqrestore(&card->lock, flags);
    capi_ctr_reseted(ctrl);
    }

    @@ -361,9 +364,8 @@ void b1_release_appl(struct capi_ctr *ct
    unsigned int port = card->port;
    unsigned long flags;

    - capilib_release_appl(&cinfo->ncci_head, appl);
    -
    spin_lock_irqsave(&card->lock, flags);
    + capilib_release_appl(&cinfo->ncci_head, appl);
    b1_put_byte(port, SEND_RELEASE);
    b1_put_word(port, appl);
    spin_unlock_irqrestore(&card->lock, flags);
    @@ -380,27 +382,27 @@ u16 b1_send_message(struct capi_ctr *ctr
    u8 subcmd = CAPIMSG_SUBCOMMAND(skb->data);
    u16 dlen, retval;

    + spin_lock_irqsave(&card->lock, flags);
    if (CAPICMD(cmd, subcmd) == CAPI_DATA_B3_REQ) {
    retval = capilib_data_b3_req(&cinfo->ncci_head,
    CAPIMSG_APPID(skb->data),
    CAPIMSG_NCCI(skb->data),
    CAPIMSG_MSGID(skb->data));
    - if (retval != CAPI_NOERROR)
    + if (retval != CAPI_NOERROR) {
    + spin_unlock_irqrestore(&card->lock, flags);
    return retval;
    + }

    dlen = CAPIMSG_DATALEN(skb->data);

    - spin_lock_irqsave(&card->lock, flags);
    b1_put_byte(port, SEND_DATA_B3_REQ);
    b1_put_slice(port, skb->data, len);
    b1_put_slice(port, skb->data + len, dlen);
    - spin_unlock_irqrestore(&card->lock, flags);
    } else {
    - spin_lock_irqsave(&card->lock, flags);
    b1_put_byte(port, SEND_MESSAGE);
    b1_put_slice(port, skb->data, len);
    - spin_unlock_irqrestore(&card->lock, flags);
    }
    + spin_unlock_irqrestore(&card->lock, flags);

    dev_kfree_skb_any(skb);
    return CAPI_NOERROR;
    @@ -534,17 +536,17 @@ irqreturn_t b1_interrupt(int interrupt,

    ApplId = (unsigned) b1_get_word(card->port);
    MsgLen = b1_get_slice(card->port, card->msgbuf);
    - spin_unlock_irqrestore(&card->lock, flags);
    if (!(skb = alloc_skb(MsgLen, GFP_ATOMIC))) {
    printk(KERN_ERR "%s: incoming packet dropped\n",
    card->name);
    + spin_unlock_irqrestore(&card->lock, flags);
    } else {
    memcpy(skb_put(skb, MsgLen), card->msgbuf, MsgLen);
    if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_CONF)
    capilib_data_b3_conf(&cinfo->ncci_head, ApplId,
    CAPIMSG_NCCI(skb->data),
    CAPIMSG_MSGID(skb->data));
    -
    + spin_unlock_irqrestore(&card->lock, flags);
    capi_ctr_handle_message(ctrl, ApplId, skb);
    }
    break;
    @@ -554,21 +556,17 @@ irqreturn_t b1_interrupt(int interrupt,
    ApplId = b1_get_word(card->port);
    NCCI = b1_get_word(card->port);
    WindowSize = b1_get_word(card->port);
    - spin_unlock_irqrestore(&card->lock, flags);
    -
    capilib_new_ncci(&cinfo->ncci_head, ApplId, NCCI, WindowSize);
    -
    + spin_unlock_irqrestore(&card->lock, flags);
    break;

    case RECEIVE_FREE_NCCI:

    ApplId = b1_get_word(card->port);
    NCCI = b1_get_word(card->port);
    - spin_unlock_irqrestore(&card->lock, flags);
    -
    if (NCCI != 0xffffffff)
    capilib_free_ncci(&cinfo->ncci_head, ApplId, NCCI);
    -
    + spin_unlock_irqrestore(&card->lock, flags);
    break;

    case RECEIVE_START:
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-11-19 19:33    [W:0.029 / U:60.844 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site