From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, Clemens Ladisch <clemens@ladisch.de>
Subject: [29/42] usb: fix number of mapped SG DMA entries
Date: Tue, 10 Jan 2012 13:48:39 -0800 [thread overview]
Message-ID: <20120110215023.398725744@clark.kroah.org> (raw)
In-Reply-To: <20120110215031.GA19398@kroah.com>
3.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Ladisch <clemens@ladisch.de>
commit bc677d5b64644c399cd3db6a905453e611f402ab upstream.
Add a new field num_mapped_sgs to struct urb so that we have a place to
store the number of mapped entries and can also retain the original
value of entries in num_sgs. Previously, usb_hcd_map_urb_for_dma()
would overwrite this with the number of mapped entries, which would
break dma_unmap_sg() because it requires the original number of entries.
This fixes warnings like the following when using USB storage devices:
------------[ cut here ]------------
WARNING: at lib/dma-debug.c:902 check_unmap+0x4e4/0x695()
ehci_hcd 0000:00:12.2: DMA-API: device driver frees DMA sg list with different entry count [map count=4] [unmap count=1]
Modules linked in: ohci_hcd ehci_hcd
Pid: 0, comm: kworker/0:1 Not tainted 3.2.0-rc2+ #319
Call Trace:
<IRQ> [<ffffffff81036d3b>] warn_slowpath_common+0x80/0x98
[<ffffffff81036de7>] warn_slowpath_fmt+0x41/0x43
[<ffffffff811fa5ae>] check_unmap+0x4e4/0x695
[<ffffffff8105e92c>] ? trace_hardirqs_off+0xd/0xf
[<ffffffff8147208b>] ? _raw_spin_unlock_irqrestore+0x33/0x50
[<ffffffff811fa84a>] debug_dma_unmap_sg+0xeb/0x117
[<ffffffff8137b02f>] usb_hcd_unmap_urb_for_dma+0x71/0x188
[<ffffffff8137b166>] unmap_urb_for_dma+0x20/0x22
[<ffffffff8137b1c5>] usb_hcd_giveback_urb+0x5d/0xc0
[<ffffffffa0000d02>] ehci_urb_done+0xf7/0x10c [ehci_hcd]
[<ffffffffa0001140>] qh_completions+0x429/0x4bd [ehci_hcd]
[<ffffffffa000340a>] ehci_work+0x95/0x9c0 [ehci_hcd]
...
---[ end trace f29ac88a5a48c580 ]---
Mapped at:
[<ffffffff811faac4>] debug_dma_map_sg+0x45/0x139
[<ffffffff8137bc0b>] usb_hcd_map_urb_for_dma+0x22e/0x478
[<ffffffff8137c494>] usb_hcd_submit_urb+0x63f/0x6fa
[<ffffffff8137d01c>] usb_submit_urb+0x2c7/0x2de
[<ffffffff8137dcd4>] usb_sg_wait+0x55/0x161
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/core/hcd.c | 5 ++---
drivers/usb/host/ehci-q.c | 2 +-
drivers/usb/host/uhci-q.c | 2 +-
drivers/usb/host/whci/qset.c | 4 ++--
drivers/usb/host/xhci-ring.c | 4 ++--
include/linux/usb.h | 1 +
6 files changed, 9 insertions(+), 9 deletions(-)
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1398,11 +1398,10 @@ int usb_hcd_map_urb_for_dma(struct usb_h
ret = -EAGAIN;
else
urb->transfer_flags |= URB_DMA_MAP_SG;
- if (n != urb->num_sgs) {
- urb->num_sgs = n;
+ urb->num_mapped_sgs = n;
+ if (n != urb->num_sgs)
urb->transfer_flags |=
URB_DMA_SG_COMBINED;
- }
} else if (urb->sg) {
struct scatterlist *sg = urb->sg;
urb->transfer_dma = dma_map_page(
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -649,7 +649,7 @@ qh_urb_transaction (
/*
* data transfer stage: buffer setup
*/
- i = urb->num_sgs;
+ i = urb->num_mapped_sgs;
if (len > 0 && i > 0) {
sg = urb->sg;
buf = sg_dma_address(sg);
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -943,7 +943,7 @@ static int uhci_submit_common(struct uhc
if (usb_pipein(urb->pipe))
status |= TD_CTRL_SPD;
- i = urb->num_sgs;
+ i = urb->num_mapped_sgs;
if (len > 0 && i > 0) {
sg = urb->sg;
data = sg_dma_address(sg);
--- a/drivers/usb/host/whci/qset.c
+++ b/drivers/usb/host/whci/qset.c
@@ -443,7 +443,7 @@ static int qset_add_urb_sg(struct whc *w
remaining = urb->transfer_buffer_length;
- for_each_sg(urb->sg, sg, urb->num_sgs, i) {
+ for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
dma_addr_t dma_addr;
size_t dma_remaining;
dma_addr_t sp, ep;
@@ -561,7 +561,7 @@ static int qset_add_urb_sg_linearize(str
remaining = urb->transfer_buffer_length;
- for_each_sg(urb->sg, sg, urb->num_sgs, i) {
+ for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
size_t len;
size_t sg_remaining;
void *orig;
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2562,7 +2562,7 @@ static unsigned int count_sg_trbs_needed
struct scatterlist *sg;
sg = NULL;
- num_sgs = urb->num_sgs;
+ num_sgs = urb->num_mapped_sgs;
temp = urb->transfer_buffer_length;
xhci_dbg(xhci, "count sg list trbs: \n");
@@ -2746,7 +2746,7 @@ static int queue_bulk_sg_tx(struct xhci_
return -EINVAL;
num_trbs = count_sg_trbs_needed(xhci, urb);
- num_sgs = urb->num_sgs;
+ num_sgs = urb->num_mapped_sgs;
total_packet_count = roundup(urb->transfer_buffer_length,
le16_to_cpu(urb->ep->desc.wMaxPacketSize));
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1202,6 +1202,7 @@ struct urb {
void *transfer_buffer; /* (in) associated data buffer */
dma_addr_t transfer_dma; /* (in) dma addr for transfer_buffer */
struct scatterlist *sg; /* (in) scatter gather buffer list */
+ int num_mapped_sgs; /* (internal) mapped sg entries */
int num_sgs; /* (in) number of entries in the sg list */
u32 transfer_buffer_length; /* (in) data buffer length */
u32 actual_length; /* (return) actual transfer length */
next prev parent reply other threads:[~2012-01-10 23:19 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-10 21:50 [00/42] 3.1.9-stable review Greg KH
2012-01-10 21:48 ` [01/42] MAINTAINERS: stable: Update address Greg KH
2012-01-10 21:48 ` [02/42] Documentation: Update stable address Greg KH
2012-01-10 21:48 ` [03/42] firmware: Fix an oops on reading fw_priv->fw in sysfs loading file Greg KH
2012-01-10 21:48 ` [04/42] rt2800usb: Move ID out of unknown Greg KH
2012-01-10 21:48 ` [05/42] offb: Fix setting of the pseudo-palette for >8bpp Greg KH
2012-01-10 21:48 ` [06/42] offb: Fix bug in calculating requested vram size Greg KH
2012-01-10 21:48 ` [07/42] wl12xx: Validate FEM index from ini file and FW Greg KH
2012-01-10 21:48 ` [08/42] wl12xx: Check buffer bound when processing nvs data Greg KH
2012-01-10 21:48 ` [09/42] wl12xx: Restore testmode ABI Greg KH
2012-01-10 21:48 ` [10/42] powerpc/time: Handle wrapping of decrementer Greg KH
2012-01-10 21:48 ` [11/42] powerpc: Fix unpaired probe_hcall_entry and probe_hcall_exit Greg KH
2012-01-10 21:48 ` [12/42] asix: new device id Greg KH
2012-01-10 21:48 ` [13/42] IB/qib: Fix a possible data corruption when receiving packets Greg KH
2012-01-10 21:48 ` [14/42] perf: Fix parsing of __print_flags() in TP_printk() Greg KH
2012-01-10 21:48 ` [15/42] reiserfs: Fix quota mount option parsing Greg KH
2012-01-10 21:48 ` [16/42] reiserfs: Force inode evictions before umount to avoid crash Greg KH
2012-01-10 21:48 ` [17/42] ext3: Dont warn from writepage when readonly inode is spotted after error Greg KH
2012-01-10 21:48 ` [18/42] USB: update documentation for usbmon Greg KH
2012-01-10 21:48 ` [19/42] atmel_serial: fix spinlock lockup in RS485 code Greg KH
2012-01-10 21:48 ` [20/42] cgroup: fix to allow mounting a hierarchy by name Greg KH
2012-01-10 21:48 ` [21/42] udf: Fix deadlock when converting file from in-ICB one to normal one Greg KH
2012-01-10 21:48 ` [22/42] drivers/usb/class/cdc-acm.c: clear dangling pointer Greg KH
2012-01-10 21:48 ` [23/42] USB: isight: fix kernel bug when loading firmware Greg KH
2012-01-10 21:48 ` [24/42] usb: usb-storage doesnt support dynamic id currently, the patch disables the feature to fix an oops Greg KH
2012-01-10 21:48 ` [25/42] USB: add quirk for another camera Greg KH
2012-01-10 21:48 ` [26/42] usb: musb: fix pm_runtime mismatch Greg KH
2012-01-10 21:48 ` [27/42] USB: omninet: fix write_room Greg KH
2012-01-10 21:48 ` [28/42] USB: Add USB-ID for Multiplex RC serial adapter to cp210x.c Greg KH
2012-01-10 21:48 ` Greg KH [this message]
2012-01-10 21:48 ` [30/42] xhci: Properly handle COMP_2ND_BW_ERR Greg KH
2012-01-10 21:48 ` [31/42] USB: option: add id for 3G dongle Model VT1000 of Viettel Greg KH
2012-01-10 21:48 ` [32/42] usb: option: add ZD Incorporated HSPA modem Greg KH
2012-01-10 21:48 ` [33/42] usb: ch9: fix up MaxStreams helper Greg KH
2012-01-10 21:48 ` [34/42] OHCI: final fix for NVIDIA problems (I hope) Greg KH
2012-01-10 21:48 ` [35/42] igmp: Avoid zero delay when receiving odd mixture of IGMP queries Greg KH
2012-01-10 21:48 ` [36/42] asix: fix infinite loop in rx_fixup() Greg KH
2012-01-10 21:48 ` [37/42] bonding: fix error handling if slave is busy (v2) Greg KH
2012-01-10 21:48 ` [38/42] PM / Sleep: Fix race between CPU hotplug and freezer Greg KH
2012-01-10 21:48 ` [39/42] SCSI: mpt2sas: Added missing mpt2sas_base_detach call from scsih_remove context Greg KH
2012-01-10 21:48 ` [40/42] usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close() race Greg KH
2012-01-10 21:48 ` [41/42] xfs: validate acl count Greg KH
2012-01-11 7:41 ` Christoph Hellwig
2012-01-11 15:00 ` Greg KH
2012-01-11 15:05 ` Ben Myers
2012-01-13 16:17 ` Ben Myers
2012-01-13 18:19 ` Greg KH
2012-01-13 19:42 ` Ben Myers
2012-01-13 19:52 ` Greg KH
2012-01-16 15:53 ` Ben Myers
2012-01-16 16:48 ` Greg KH
2012-01-24 16:33 ` Christoph Hellwig
2012-01-24 17:43 ` Ben Myers
2012-01-10 21:48 ` [42/42] xfs: fix acl count validation in xfs_acl_from_disk() Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120110215023.398725744@clark.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=clemens@ladisch.de \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).