Commit 0244f57302f7e8bebd2f1ab58767eac2e9f678a6
1 parent
08bd34c98d
Exists in
master
and in
7 other branches
firewire: cdev: count references of cards during inbound transactions
If a request comes in to an address range managed by a userspace driver i.e. <linux/firewire-cdev.h> client, the card instance of request and response may differ from the card instance of the client device. Therefore we need to take a reference of the card until the response was sent. I thought about putting the reference counting into core-transaction.c, but the various high-level drivers besides cdev clients (firewire-net, firewire-sbp2, firedtv) use the card pointer in their fw_address_handler address_callback method only to look up devices of which they already hold the necessary references. So this seems to be a specific firewire-cdev issue which is better addressed locally. We do not need the reference - in case of FCP_REQUEST or FCP_RESPONSE requests because then the firewire-core will send the split transaction response for us already in the context of the request handler, - if it is the same card as the client device's because we hold a card reference indirectly via teh client->device reference. To keep things simple, we take the reference nevertheless. Jay Fenlason wrote: > there's no way for the core to tell cdev "this card is gone, > kill any inbound transactions on it", while cdev holds the transaction > open until userspace issues a SEND_RESPONSE ioctl, which may be a very, > very long time. But when it does, it calls fw_send_response(), which > will dereference the card... > > So how unhappy are we about userspace potentially holding a fw_card > open forever? While termination of inbound transcations at card removal could be implemented, it is IMO not worth the effort. Currently, the effect of holding a reference of a card that has been removed is to block the process that called the pci_remove of the card. This is - either a user process ran by root. Root can find and kill processes that have /dev/fw* open, if desired. - a kernel thread (which one?) in case of hot removal of a PCCard or ExpressCard. The latter case could be a problem indeed. firewire-core's card shutdown and card release should probably be improved not to block in shutdown, just to defer freeing of memory until release. This is not a new problem though; the same already always happens with the client->device->card without the need of inbound transactions or other special conditions involved, other than the client not closing the file. Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Showing 1 changed file with 8 additions and 0 deletions Side-by-side Diff
drivers/firewire/core-cdev.c
... | ... | @@ -627,6 +627,8 @@ |
627 | 627 | kfree(r->data); |
628 | 628 | else |
629 | 629 | fw_send_response(r->card, r->request, RCODE_CONFLICT_ERROR); |
630 | + | |
631 | + fw_card_put(r->card); | |
630 | 632 | kfree(r); |
631 | 633 | } |
632 | 634 | |
... | ... | @@ -641,6 +643,9 @@ |
641 | 643 | void *fcp_frame = NULL; |
642 | 644 | int ret; |
643 | 645 | |
646 | + /* card may be different from handler->client->device->card */ | |
647 | + fw_card_get(card); | |
648 | + | |
644 | 649 | r = kmalloc(sizeof(*r), GFP_ATOMIC); |
645 | 650 | e = kmalloc(sizeof(*e), GFP_ATOMIC); |
646 | 651 | if (r == NULL || e == NULL) |
... | ... | @@ -686,6 +691,8 @@ |
686 | 691 | |
687 | 692 | if (!is_fcp_request(request)) |
688 | 693 | fw_send_response(card, request, RCODE_CONFLICT_ERROR); |
694 | + | |
695 | + fw_card_put(card); | |
689 | 696 | } |
690 | 697 | |
691 | 698 | static void release_address_handler(struct client *client, |
... | ... | @@ -768,6 +775,7 @@ |
768 | 775 | } |
769 | 776 | fw_send_response(r->card, r->request, a->rcode); |
770 | 777 | out: |
778 | + fw_card_put(r->card); | |
771 | 779 | kfree(r); |
772 | 780 | |
773 | 781 | return ret; |