Commit graph

18 commits

Author SHA1 Message Date
Stefan Richter
5cb84067d6 firewire: fill_bus_reset_event needs lock protection
Callers of fill_bus_reset_event() have to take card->lock.  Otherwise
access to node data may oops if node removal is in progress.

A lockless alternative would be

-	event->local_node_id = card->local_node->node_id;
+	tmp = fw_node_get(card->local_node);
+	event->local_node_id = tmp->node_id;
+	fw_node_put(tmp);

and ditto with the other node pointers which fill_bus_reset_event()
accesses.  But I went the locked route because one of the two callers
already holds the lock.  As a bonus, we don't need the memory barrier
anymore because device->generation and device->node_id are written in
a card->lock protected section.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Kristian Høgsberg <krh@redhat.com>
2008-06-19 00:12:35 +02:00
Jay Fenlason
551f4cb9de firewire: prevent userspace from accessing shut down devices
If userspace ignores the POLLERR bit from poll(), and only attempts to
read() the device when POLLIN is set, it can still make ioctl() calls on
a device that has been removed from the system.  The node_id and
generation returned by GET_INFO will be outdated, but INITIATE_BUS_RESET
would still cause a bus reset, and GET_CYCLE_TIMER will return data.
And if you guess the correct generation to use, you can send requests to
a different device on the bus, and get responses back.

This patch prevents open, ioctl, compat_ioctl, and mmap against shutdown
devices.

Signed-off-by: Jay Fenlason <fenlason@redhat.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2008-05-20 18:24:17 +02:00
Stefan Richter
c9755e14a0 firewire: reread config ROM when device reset the bus
When a device changes its configuration ROM, it announces this with a
bus reset.  firewire-core has to check which node initiated a bus reset
and whether any unit directories went away or were added on this node.

Tested with an IOI FWB-IDE01AB which has its link-on bit set if bus
power is available but does not respond to ROM read requests if self
power is off.  This implements
  - recognition of the units if self power is switched on after fw-core
    gave up the initial attempt to read the config ROM,
  - shutdown of the units when self power is switched off.

Also tested with a second PC running Linux/ieee1394.  When the eth1394
driver is inserted and removed on that node, fw-core now notices the
addition and removal of the IPv4 unit on the ieee1394 node.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2008-04-18 17:55:36 +02:00
Stefan Richter
fae6031214 firewire: fix NULL pointer deref. and resource leak
By supplying ioctl()s in the wrong order, a userspace client was able to
trigger NULL pointer dereferences.  Furthermore, by calling
ioctl_create_iso_context more than once, new contexts could be created
without ever freeing the previously created contexts.

Thanks to Anders Blomdell for the report.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2008-02-21 19:05:56 +01:00
Stefan Richter
96b19062e7 firewire: fix "kobject_add failed for fw* with -EEXIST"
There is a race between shutdown and creation of devices:  fw-core may
attempt to add a device with the same name of an already existing
device.  http://bugzilla.kernel.org/show_bug.cgi?id=9828

Impact of the bug:  Happens rarely (when shutdown of a device coincides
with creation of another), forces the user to unplug and replug the new
device to get it working.

The fix is obvious:  Free the minor number *after* instead of *before*
device_unregister().  This requires to take an additional reference of
the fw_device as long as the IDR tree points to it.

And while we are at it, we fix an additional race condition:
fw_device_op_open() took its reference of the fw_device a little bit too
late, hence was in danger to access an already invalid fw_device.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2008-02-16 15:40:33 +01:00
Stefan Richter
b5d2a5e04e firewire: enforce access order between generation and node ID, fix "giving up on config rom"
fw_device.node_id and fw_device.generation are accessed without mutexes.
We have to ensure that all readers will get to see node_id updates
before generation updates.

Fixes an inability to recognize devices after "giving up on config rom",
https://bugzilla.redhat.com/show_bug.cgi?id=429950

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

Reviewed by Nick Piggin <nickpiggin@yahoo.com.au>.

Verified to fix 'giving up on config rom' issues on multiple system and
drive combinations that were previously affected.

Signed-off-by: Jarod Wilson <jwilson@redhat.com>
Signed-off-by: Kristian Høgsberg <krh@redhat.com>
2008-01-30 22:22:27 +01:00
Stefan Richter
cf5a56ac80 firewire: fw-cdev: use device generation, not card generation
We have to use the fw_device.generation here, not the fw_card.generation,
because the generation must never be newer than the node ID when we emit
a transaction.  This cannot be guaranteed with fw_card.generation.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

Verified in concert with subsequent memory barriers patch to fix 'giving
up on config rom' issues on multiple system and drive combinations that
were previously affected.

Signed-off-by: Jarod Wilson <jwilson@redhat.com>
2008-01-30 22:22:27 +01:00
Jay Fenlason
83431cba3d firewire: fw-cdev: reorder wakeup vs. spinlock
Signed-off-by: Jay Fenlason <fenlason@redhat.com>

Prompted by https://bugzilla.redhat.com/show_bug.cgi?id=323411

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2007-10-17 00:00:10 +02:00
Stefan Richter
a64408b96b firewire: adopt read cycle timer ABI from raw1394
This duplicates the read cycle timer feature of raw1394 (added in Linux
2.6.21) in firewire-core's userspace ABI.  The argument to the ioctl is
reordered though to ensure 32/64 bit compatibility.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Kristian Høgsberg <krh@redhat.com>
2007-10-17 00:00:08 +02:00
Stefan Richter
930e4b7fe3 firewire: fw-core: local variable shadows a global one
Sparse warned about it although it was apparently harmless:

drivers/firewire/fw-cdev.c:624:23: warning: symbol 'interrupt' shadows an earlier one
include/asm/hw_irq.h:29:13: originally declared here

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2007-10-17 00:00:01 +02:00
Al Viro
1ccc9147f6 fw-cdev __user annotations
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-14 12:41:51 -07:00
Stefan Richter
f139749001 firewire: support S100B...S400B and link slower than PHY
Use a speed probe to determine the speed over 1394b buses and of nodes
which report a link speed less than their PHY speed.

Log the effective maximum speed of newly created nodes in dmesg.

Also, read the config ROM (except bus info block) at the maximum speed
rather than S100.  This isn't a real optimization though because we
still only use quadlet read requests for the entire ROM.

The patch also adds support for S1600 and S3200, although such hardware
does not exist yet.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Kristian Høgsberg <krh@redhat.com>
2007-07-10 00:07:43 +02:00
Kristian Høgsberg
24315c5e6f firewire: Only set client->iso_context if allocation was successful.
This patch fixes an OOPS on cdev release for an fd where iso context
creation failed.

Signed-off-by: Kristian Høgsberg <krh@redhat.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2007-06-21 00:09:41 +02:00
Kristian Høgsberg
1ca31ae7cf firewire: Change struct fw_cdev_iso_packet to not use bitfields.
The struct is part of the userspace interface and can not use
bitfields.  This patch replaces the bitfields with a __u32 'control'
word and provides access macros to set the bits.

Signed-off-by: Kristian Høgsberg <krh@redhat.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2007-05-31 21:40:15 +02:00
Jeff Garzik
350958f984 firewire: fix return code
Fix this warning on x86-64

drivers/firewire/fw-cdev.c:798: warning: initialization from incompatible pointer type

by making the return code of ioctl_send_request() the same as all the
other ioctl_xxx() return codes.

Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2007-05-27 23:21:01 +02:00
Kristian Høgsberg
2d826cc5c7 firewire: Always use parens with sizeof.
Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2007-05-10 18:24:14 +02:00
Kristian Høgsberg
c781c06d11 firewire: Clean up comment style.
Drop filenames from file preamble, drop editor annotations and
use standard indent style for block comments.

Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (fixed typo)
2007-05-10 18:24:13 +02:00
Kristian Høgsberg
9640d3d775 firewire: Rename fw-device-cdev.c to fw-cdev.c and move header to include/linux.
Signed-off-by: Kristian Høgsberg <krh@redhat.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2007-04-30 23:08:13 +02:00
Renamed from drivers/firewire/fw-device-cdev.c (Browse further)