mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 18:09:57 +00:00
Char/misc driver fixes for 4.10-rc7
Here are two bugfixes that resolve some reported issues. One in the firmware loader, that should fix the much-reported problem of crashes with it. The other is a hyperv fix for a reported regression. Both have been in linux-next for a week or so with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCWJWsGA8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ylWmwCgjvg9SImQDY2FKYNAOhQnBh9gtXUAn0Gux/KD yzqEsG5BOmjD3YcYGsx6 =VzHo -----END PGP SIGNATURE----- Merge tag 'char-misc-4.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are two bugfixes that resolve some reported issues. One in the firmware loader, that should fix the much-reported problem of crashes with it. The other is a hyperv fix for a reported regression. Both have been in linux-next for a week or so with no reported issues" * tag 'char-misc-4.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: Drivers: hv: vmbus: finally fix hv_need_to_signal_on_read() firmware: fix NULL pointer dereference in __fw_load_abort()
This commit is contained in:
commit
412e6d3fec
4 changed files with 38 additions and 6 deletions
|
@ -558,9 +558,6 @@ static void fw_load_abort(struct firmware_priv *fw_priv)
|
||||||
struct firmware_buf *buf = fw_priv->buf;
|
struct firmware_buf *buf = fw_priv->buf;
|
||||||
|
|
||||||
__fw_load_abort(buf);
|
__fw_load_abort(buf);
|
||||||
|
|
||||||
/* avoid user action after loading abort */
|
|
||||||
fw_priv->buf = NULL;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static LIST_HEAD(pending_fw_head);
|
static LIST_HEAD(pending_fw_head);
|
||||||
|
@ -713,7 +710,7 @@ static ssize_t firmware_loading_store(struct device *dev,
|
||||||
|
|
||||||
mutex_lock(&fw_lock);
|
mutex_lock(&fw_lock);
|
||||||
fw_buf = fw_priv->buf;
|
fw_buf = fw_priv->buf;
|
||||||
if (!fw_buf)
|
if (fw_state_is_aborted(&fw_buf->fw_st))
|
||||||
goto out;
|
goto out;
|
||||||
|
|
||||||
switch (loading) {
|
switch (loading) {
|
||||||
|
|
|
@ -383,6 +383,7 @@ int hv_ringbuffer_read(struct vmbus_channel *channel,
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
init_cached_read_index(channel);
|
||||||
next_read_location = hv_get_next_read_location(inring_info);
|
next_read_location = hv_get_next_read_location(inring_info);
|
||||||
next_read_location = hv_copyfrom_ringbuffer(inring_info, &desc,
|
next_read_location = hv_copyfrom_ringbuffer(inring_info, &desc,
|
||||||
sizeof(desc),
|
sizeof(desc),
|
||||||
|
|
|
@ -1295,6 +1295,9 @@ void netvsc_channel_cb(void *context)
|
||||||
ndev = hv_get_drvdata(device);
|
ndev = hv_get_drvdata(device);
|
||||||
buffer = get_per_channel_state(channel);
|
buffer = get_per_channel_state(channel);
|
||||||
|
|
||||||
|
/* commit_rd_index() -> hv_signal_on_read() needs this. */
|
||||||
|
init_cached_read_index(channel);
|
||||||
|
|
||||||
do {
|
do {
|
||||||
desc = get_next_pkt_raw(channel);
|
desc = get_next_pkt_raw(channel);
|
||||||
if (desc != NULL) {
|
if (desc != NULL) {
|
||||||
|
@ -1347,6 +1350,9 @@ void netvsc_channel_cb(void *context)
|
||||||
|
|
||||||
bufferlen = bytes_recvd;
|
bufferlen = bytes_recvd;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
init_cached_read_index(channel);
|
||||||
|
|
||||||
} while (1);
|
} while (1);
|
||||||
|
|
||||||
if (bufferlen > NETVSC_PACKET_SIZE)
|
if (bufferlen > NETVSC_PACKET_SIZE)
|
||||||
|
|
|
@ -128,6 +128,7 @@ struct hv_ring_buffer_info {
|
||||||
u32 ring_data_startoffset;
|
u32 ring_data_startoffset;
|
||||||
u32 priv_write_index;
|
u32 priv_write_index;
|
||||||
u32 priv_read_index;
|
u32 priv_read_index;
|
||||||
|
u32 cached_read_index;
|
||||||
};
|
};
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -180,6 +181,19 @@ static inline u32 hv_get_bytes_to_write(struct hv_ring_buffer_info *rbi)
|
||||||
return write;
|
return write;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static inline u32 hv_get_cached_bytes_to_write(
|
||||||
|
const struct hv_ring_buffer_info *rbi)
|
||||||
|
{
|
||||||
|
u32 read_loc, write_loc, dsize, write;
|
||||||
|
|
||||||
|
dsize = rbi->ring_datasize;
|
||||||
|
read_loc = rbi->cached_read_index;
|
||||||
|
write_loc = rbi->ring_buffer->write_index;
|
||||||
|
|
||||||
|
write = write_loc >= read_loc ? dsize - (write_loc - read_loc) :
|
||||||
|
read_loc - write_loc;
|
||||||
|
return write;
|
||||||
|
}
|
||||||
/*
|
/*
|
||||||
* VMBUS version is 32 bit entity broken up into
|
* VMBUS version is 32 bit entity broken up into
|
||||||
* two 16 bit quantities: major_number. minor_number.
|
* two 16 bit quantities: major_number. minor_number.
|
||||||
|
@ -1488,7 +1502,7 @@ hv_get_ring_buffer(struct hv_ring_buffer_info *ring_info)
|
||||||
|
|
||||||
static inline void hv_signal_on_read(struct vmbus_channel *channel)
|
static inline void hv_signal_on_read(struct vmbus_channel *channel)
|
||||||
{
|
{
|
||||||
u32 cur_write_sz;
|
u32 cur_write_sz, cached_write_sz;
|
||||||
u32 pending_sz;
|
u32 pending_sz;
|
||||||
struct hv_ring_buffer_info *rbi = &channel->inbound;
|
struct hv_ring_buffer_info *rbi = &channel->inbound;
|
||||||
|
|
||||||
|
@ -1512,12 +1526,24 @@ static inline void hv_signal_on_read(struct vmbus_channel *channel)
|
||||||
|
|
||||||
cur_write_sz = hv_get_bytes_to_write(rbi);
|
cur_write_sz = hv_get_bytes_to_write(rbi);
|
||||||
|
|
||||||
if (cur_write_sz >= pending_sz)
|
if (cur_write_sz < pending_sz)
|
||||||
|
return;
|
||||||
|
|
||||||
|
cached_write_sz = hv_get_cached_bytes_to_write(rbi);
|
||||||
|
if (cached_write_sz < pending_sz)
|
||||||
vmbus_setevent(channel);
|
vmbus_setevent(channel);
|
||||||
|
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
init_cached_read_index(struct vmbus_channel *channel)
|
||||||
|
{
|
||||||
|
struct hv_ring_buffer_info *rbi = &channel->inbound;
|
||||||
|
|
||||||
|
rbi->cached_read_index = rbi->ring_buffer->read_index;
|
||||||
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* An API to support in-place processing of incoming VMBUS packets.
|
* An API to support in-place processing of incoming VMBUS packets.
|
||||||
*/
|
*/
|
||||||
|
@ -1569,6 +1595,8 @@ static inline void put_pkt_raw(struct vmbus_channel *channel,
|
||||||
* This call commits the read index and potentially signals the host.
|
* This call commits the read index and potentially signals the host.
|
||||||
* Here is the pattern for using the "in-place" consumption APIs:
|
* Here is the pattern for using the "in-place" consumption APIs:
|
||||||
*
|
*
|
||||||
|
* init_cached_read_index();
|
||||||
|
*
|
||||||
* while (get_next_pkt_raw() {
|
* while (get_next_pkt_raw() {
|
||||||
* process the packet "in-place";
|
* process the packet "in-place";
|
||||||
* put_pkt_raw();
|
* put_pkt_raw();
|
||||||
|
|
Loading…
Reference in a new issue