firewire: avoid memleak after phy config transmit failure
Use only statically allocated data for PHY config packet transmission. With the previous incarnation, some data wouldn't be freed if the packet transmit callback was never called. A theoretical drawback now is that, in PCs with more than one card, card A may complete() for a waiter on card B. But this is highly unlikely and its impact not serious. Bus manager B may reset bus B before the PHY config went out, but the next phy config on B should be fine. However, with a timeout of 100ms, this situation is close to impossible. Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
This commit is contained in:
parent
95984f62c9
commit
c0220d686b
|
@ -22,6 +22,7 @@
|
||||||
#include <linux/kernel.h>
|
#include <linux/kernel.h>
|
||||||
#include <linux/kref.h>
|
#include <linux/kref.h>
|
||||||
#include <linux/module.h>
|
#include <linux/module.h>
|
||||||
|
#include <linux/mutex.h>
|
||||||
#include <linux/init.h>
|
#include <linux/init.h>
|
||||||
#include <linux/interrupt.h>
|
#include <linux/interrupt.h>
|
||||||
#include <linux/pci.h>
|
#include <linux/pci.h>
|
||||||
|
@ -295,58 +296,41 @@ fw_send_request(struct fw_card *card, struct fw_transaction *t,
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL(fw_send_request);
|
EXPORT_SYMBOL(fw_send_request);
|
||||||
|
|
||||||
struct fw_phy_packet {
|
static DEFINE_MUTEX(phy_config_mutex);
|
||||||
struct fw_packet packet;
|
static DECLARE_COMPLETION(phy_config_done);
|
||||||
struct completion done;
|
|
||||||
struct kref kref;
|
|
||||||
};
|
|
||||||
|
|
||||||
static void phy_packet_release(struct kref *kref)
|
|
||||||
{
|
|
||||||
struct fw_phy_packet *p =
|
|
||||||
container_of(kref, struct fw_phy_packet, kref);
|
|
||||||
kfree(p);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void transmit_phy_packet_callback(struct fw_packet *packet,
|
static void transmit_phy_packet_callback(struct fw_packet *packet,
|
||||||
struct fw_card *card, int status)
|
struct fw_card *card, int status)
|
||||||
{
|
{
|
||||||
struct fw_phy_packet *p =
|
complete(&phy_config_done);
|
||||||
container_of(packet, struct fw_phy_packet, packet);
|
|
||||||
|
|
||||||
complete(&p->done);
|
|
||||||
kref_put(&p->kref, phy_packet_release);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static struct fw_packet phy_config_packet = {
|
||||||
|
.header_length = 8,
|
||||||
|
.payload_length = 0,
|
||||||
|
.speed = SCODE_100,
|
||||||
|
.callback = transmit_phy_packet_callback,
|
||||||
|
};
|
||||||
|
|
||||||
void fw_send_phy_config(struct fw_card *card,
|
void fw_send_phy_config(struct fw_card *card,
|
||||||
int node_id, int generation, int gap_count)
|
int node_id, int generation, int gap_count)
|
||||||
{
|
{
|
||||||
struct fw_phy_packet *p;
|
|
||||||
long timeout = DIV_ROUND_UP(HZ, 10);
|
long timeout = DIV_ROUND_UP(HZ, 10);
|
||||||
u32 data = PHY_IDENTIFIER(PHY_PACKET_CONFIG) |
|
u32 data = PHY_IDENTIFIER(PHY_PACKET_CONFIG) |
|
||||||
PHY_CONFIG_ROOT_ID(node_id) |
|
PHY_CONFIG_ROOT_ID(node_id) |
|
||||||
PHY_CONFIG_GAP_COUNT(gap_count);
|
PHY_CONFIG_GAP_COUNT(gap_count);
|
||||||
|
|
||||||
p = kmalloc(sizeof(*p), GFP_KERNEL);
|
mutex_lock(&phy_config_mutex);
|
||||||
if (p == NULL)
|
|
||||||
return;
|
|
||||||
|
|
||||||
p->packet.header[0] = data;
|
phy_config_packet.header[0] = data;
|
||||||
p->packet.header[1] = ~data;
|
phy_config_packet.header[1] = ~data;
|
||||||
p->packet.header_length = 8;
|
phy_config_packet.generation = generation;
|
||||||
p->packet.payload_length = 0;
|
INIT_COMPLETION(phy_config_done);
|
||||||
p->packet.speed = SCODE_100;
|
|
||||||
p->packet.generation = generation;
|
|
||||||
p->packet.callback = transmit_phy_packet_callback;
|
|
||||||
init_completion(&p->done);
|
|
||||||
kref_set(&p->kref, 2);
|
|
||||||
|
|
||||||
card->driver->send_request(card, &p->packet);
|
card->driver->send_request(card, &phy_config_packet);
|
||||||
timeout = wait_for_completion_timeout(&p->done, timeout);
|
wait_for_completion_timeout(&phy_config_done, timeout);
|
||||||
kref_put(&p->kref, phy_packet_release);
|
|
||||||
|
|
||||||
/* will leak p if the callback is never executed */
|
mutex_unlock(&phy_config_mutex);
|
||||||
WARN_ON(timeout == 0);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
void fw_flush_transactions(struct fw_card *card)
|
void fw_flush_transactions(struct fw_card *card)
|
||||||
|
|
Loading…
Reference in New Issue