Skip to content

Commit 994b384

Browse files
torvaldstorvalds
committed
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: firewire: ohci: work around VIA and NEC PHY packet reception bug firewire: core: do not use del_timer_sync() in interrupt context firewire: net: fix unicast reception RCODE in failure paths firewire: sbp2: fix stall with "Unsolicited response" firewire: sbp2: fix memory leak in sbp2_cancel_orbs or at send error ieee1394: Adjust confusing if indentation
2 parents 29cfcdd + a4dc090 commit 994b384

File tree

5 files changed

+50
-26
lines changed

5 files changed

+50
-26
lines changed

‎drivers/firewire/core-transaction.c

+10-3
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,10 @@ static int close_transaction(struct fw_transaction *transaction,
8181
spin_lock_irqsave(&card->lock, flags);
8282
list_for_each_entry(t, &card->transaction_list, link) {
8383
if (t == transaction) {
84+
if (!del_timer(&t->split_timeout_timer)) {
85+
spin_unlock_irqrestore(&card->lock, flags);
86+
goto timed_out;
87+
}
8488
list_del_init(&t->link);
8589
card->tlabel_mask &= ~(1ULL << t->tlabel);
8690
break;
@@ -89,11 +93,11 @@ static int close_transaction(struct fw_transaction *transaction,
8993
spin_unlock_irqrestore(&card->lock, flags);
9094

9195
if (&t->link != &card->transaction_list) {
92-
del_timer_sync(&t->split_timeout_timer);
9396
t->callback(card, rcode, NULL, 0, t->callback_data);
9497
return 0;
9598
}
9699

100+
timed_out:
97101
return -ENOENT;
98102
}
99103

@@ -921,6 +925,10 @@ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
921925
spin_lock_irqsave(&card->lock, flags);
922926
list_for_each_entry(t, &card->transaction_list, link) {
923927
if (t->node_id == source && t->tlabel == tlabel) {
928+
if (!del_timer(&t->split_timeout_timer)) {
929+
spin_unlock_irqrestore(&card->lock, flags);
930+
goto timed_out;
931+
}
924932
list_del_init(&t->link);
925933
card->tlabel_mask &= ~(1ULL << t->tlabel);
926934
break;
@@ -929,6 +937,7 @@ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
929937
spin_unlock_irqrestore(&card->lock, flags);
930938

931939
if (&t->link == &card->transaction_list) {
940+
timed_out:
932941
fw_notify("Unsolicited response (source %x, tlabel %x)\n",
933942
source, tlabel);
934943
return;
@@ -963,8 +972,6 @@ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
963972
break;
964973
}
965974

966-
del_timer_sync(&t->split_timeout_timer);
967-
968975
/*
969976
* The response handler may be executed while the request handler
970977
* is still pending. Cancel the request handler.

‎drivers/firewire/net.c

+15-13
Original file line numberDiff line numberDiff line change
@@ -579,7 +579,7 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
579579
if (!peer) {
580580
fw_notify("No peer for ARP packet from %016llx\n",
581581
(unsigned long long)peer_guid);
582-
goto failed_proto;
582+
goto no_peer;
583583
}
584584

585585
/*
@@ -656,15 +656,15 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
656656

657657
return 0;
658658

659-
failed_proto:
659+
no_peer:
660660
net->stats.rx_errors++;
661661
net->stats.rx_dropped++;
662662

663663
dev_kfree_skb_any(skb);
664664
if (netif_queue_stopped(net))
665665
netif_wake_queue(net);
666666

667-
return 0;
667+
return -ENOENT;
668668
}
669669

670670
static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
@@ -701,7 +701,7 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
701701
fw_error("out of memory\n");
702702
net->stats.rx_dropped++;
703703

704-
return -1;
704+
return -ENOMEM;
705705
}
706706
skb_reserve(skb, (net->hard_header_len + 15) & ~15);
707707
memcpy(skb_put(skb, len), buf, len);
@@ -726,8 +726,10 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
726726
spin_lock_irqsave(&dev->lock, flags);
727727

728728
peer = fwnet_peer_find_by_node_id(dev, source_node_id, generation);
729-
if (!peer)
730-
goto bad_proto;
729+
if (!peer) {
730+
retval = -ENOENT;
731+
goto fail;
732+
}
731733

732734
pd = fwnet_pd_find(peer, datagram_label);
733735
if (pd == NULL) {
@@ -741,7 +743,7 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
741743
dg_size, buf, fg_off, len);
742744
if (pd == NULL) {
743745
retval = -ENOMEM;
744-
goto bad_proto;
746+
goto fail;
745747
}
746748
peer->pdg_size++;
747749
} else {
@@ -755,9 +757,9 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
755757
pd = fwnet_pd_new(net, peer, datagram_label,
756758
dg_size, buf, fg_off, len);
757759
if (pd == NULL) {
758-
retval = -ENOMEM;
759760
peer->pdg_size--;
760-
goto bad_proto;
761+
retval = -ENOMEM;
762+
goto fail;
761763
}
762764
} else {
763765
if (!fwnet_pd_update(peer, pd, buf, fg_off, len)) {
@@ -768,7 +770,8 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
768770
*/
769771
fwnet_pd_delete(pd);
770772
peer->pdg_size--;
771-
goto bad_proto;
773+
retval = -ENOMEM;
774+
goto fail;
772775
}
773776
}
774777
} /* new datagram or add to existing one */
@@ -794,14 +797,13 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
794797
spin_unlock_irqrestore(&dev->lock, flags);
795798

796799
return 0;
797-
798-
bad_proto:
800+
fail:
799801
spin_unlock_irqrestore(&dev->lock, flags);
800802

801803
if (netif_queue_stopped(net))
802804
netif_wake_queue(net);
803805

804-
return 0;
806+
return retval;
805807
}
806808

807809
static void fwnet_receive_packet(struct fw_card *card, struct fw_request *r,

‎drivers/firewire/ohci.c

+9-1
Original file line numberDiff line numberDiff line change
@@ -694,7 +694,15 @@ static __le32 *handle_ar_packet(struct ar_context *ctx, __le32 *buffer)
694694
log_ar_at_event('R', p.speed, p.header, evt);
695695

696696
/*
697-
* The OHCI bus reset handler synthesizes a phy packet with
697+
* Several controllers, notably from NEC and VIA, forget to
698+
* write ack_complete status at PHY packet reception.
699+
*/
700+
if (evt == OHCI1394_evt_no_status &&
701+
(p.header[0] & 0xff) == (OHCI1394_phy_tcode << 4))
702+
p.ack = ACK_COMPLETE;
703+
704+
/*
705+
* The OHCI bus reset handler synthesizes a PHY packet with
698706
* the new generation number when a bus reset happens (see
699707
* section 8.4.2.3). This helps us determine when a request
700708
* was received and make sure we send the response in the same

‎drivers/firewire/sbp2.c

+15-8
Original file line numberDiff line numberDiff line change
@@ -450,7 +450,7 @@ static void sbp2_status_write(struct fw_card *card, struct fw_request *request,
450450

451451
if (&orb->link != &lu->orb_list) {
452452
orb->callback(orb, &status);
453-
kref_put(&orb->kref, free_orb);
453+
kref_put(&orb->kref, free_orb); /* orb callback reference */
454454
} else {
455455
fw_error("status write for unknown orb\n");
456456
}
@@ -472,20 +472,28 @@ static void complete_transaction(struct fw_card *card, int rcode,
472472
* So this callback only sets the rcode if it hasn't already
473473
* been set and only does the cleanup if the transaction
474474
* failed and we didn't already get a status write.
475+
*
476+
* Here we treat RCODE_CANCELLED like RCODE_COMPLETE because some
477+
* OXUF936QSE firmwares occasionally respond after Split_Timeout and
478+
* complete the ORB just fine. Note, we also get RCODE_CANCELLED
479+
* from sbp2_cancel_orbs() if fw_cancel_transaction() == 0.
475480
*/
476481
spin_lock_irqsave(&card->lock, flags);
477482

478483
if (orb->rcode == -1)
479484
orb->rcode = rcode;
480-
if (orb->rcode != RCODE_COMPLETE) {
485+
486+
if (orb->rcode != RCODE_COMPLETE && orb->rcode != RCODE_CANCELLED) {
481487
list_del(&orb->link);
482488
spin_unlock_irqrestore(&card->lock, flags);
489+
483490
orb->callback(orb, NULL);
491+
kref_put(&orb->kref, free_orb); /* orb callback reference */
484492
} else {
485493
spin_unlock_irqrestore(&card->lock, flags);
486494
}
487495

488-
kref_put(&orb->kref, free_orb);
496+
kref_put(&orb->kref, free_orb); /* transaction callback reference */
489497
}
490498

491499
static void sbp2_send_orb(struct sbp2_orb *orb, struct sbp2_logical_unit *lu,
@@ -501,9 +509,8 @@ static void sbp2_send_orb(struct sbp2_orb *orb, struct sbp2_logical_unit *lu,
501509
list_add_tail(&orb->link, &lu->orb_list);
502510
spin_unlock_irqrestore(&device->card->lock, flags);
503511

504-
/* Take a ref for the orb list and for the transaction callback. */
505-
kref_get(&orb->kref);
506-
kref_get(&orb->kref);
512+
kref_get(&orb->kref); /* transaction callback reference */
513+
kref_get(&orb->kref); /* orb callback reference */
507514

508515
fw_send_request(device->card, &orb->t, TCODE_WRITE_BLOCK_REQUEST,
509516
node_id, generation, device->max_speed, offset,
@@ -525,11 +532,11 @@ static int sbp2_cancel_orbs(struct sbp2_logical_unit *lu)
525532

526533
list_for_each_entry_safe(orb, next, &list, link) {
527534
retval = 0;
528-
if (fw_cancel_transaction(device->card, &orb->t) == 0)
529-
continue;
535+
fw_cancel_transaction(device->card, &orb->t);
530536

531537
orb->rcode = RCODE_CANCELLED;
532538
orb->callback(orb, NULL);
539+
kref_put(&orb->kref, free_orb); /* orb callback reference */
533540
}
534541

535542
return retval;

‎drivers/ieee1394/ohci1394.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -1106,7 +1106,7 @@ static int ohci_iso_recv_init(struct hpsb_iso *iso)
11061106
if (recv->block_irq_interval * 4 > iso->buf_packets)
11071107
recv->block_irq_interval = iso->buf_packets / 4;
11081108
if (recv->block_irq_interval < 1)
1109-
recv->block_irq_interval = 1;
1109+
recv->block_irq_interval = 1;
11101110

11111111
/* choose a buffer stride */
11121112
/* must be a power of 2, and <= PAGE_SIZE */

0 commit comments

Comments
 (0)