leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[PATCH] s390: fix sclp memory corruption in tty pages list

Browse Source 
When the sclp interface takes very long to serve a request, the sclp core
driver will report a failed request to the sclp tty driver even though the
request is still being processed by the sclp interface.  Eventually the sclp
interface completes the request and updates some fields in the request buffer
which leads to a corrupted tty pages list.  The next time function
sclp_tty_write_room is called, the corrupted list will be traversed, resulting
in an oops.

To avoid this remove the busy retry limit and increase retry intervals.

Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Peter Oberparleiter 2006-02-11 17:55:59 -08:00 committed by Linus Torvalds
parent e6f3601a72
commit 25fab9ebac
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/s390/char/sclp.c
View File

@ -85,11 +85,10 @@ static volatile enum sclp_mask_state_t {
/* Maximum retry counts */
#define SCLP_INIT_RETRY 3
#define SCLP_MASK_RETRY 3
#define SCLP_REQUEST_RETRY 3
/* Timeout intervals in seconds.*/
#define SCLP_BUSY_INTERVAL 2
#define SCLP_RETRY_INTERVAL 5
#define SCLP_BUSY_INTERVAL 10
#define SCLP_RETRY_INTERVAL 15
static void sclp_process_queue(void);
static int sclp_init_mask(int calculate);
@ -153,11 +152,9 @@ __sclp_start_request(struct sclp_req *req)
if (sclp_running_state != sclp_running_state_idle)
return 0;
del_timer(&sclp_request_timer);
if (req->start_count <= SCLP_REQUEST_RETRY) {
rc = service_call(req->command, req->sccb);
req->start_count++;
} else
rc = -EIO;
rc = service_call(req->command, req->sccb);
req->start_count++;
if (rc == 0) {
/* Sucessfully started request */
req->status = SCLP_REQ_RUNNING;