From patchwork Mon Jan  4 20:48:47 2010
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: Alan Stern <stern@rowland.harvard.edu>
X-Patchwork-Id: 70712
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
	by demeter.kernel.org (8.14.3/8.14.2) with ESMTP id o04KmxmN021074
	for <patchwork-media@patchwork.kernel.org>;
	Mon, 4 Jan 2010 20:48:59 GMT
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1753741Ab0ADUsz (ORCPT
	<rfc822;patchwork-media@patchwork.kernel.org>);
	Mon, 4 Jan 2010 15:48:55 -0500
Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753740Ab0ADUsz
	(ORCPT <rfc822;linux-media-outgoing>);
	Mon, 4 Jan 2010 15:48:55 -0500
Received: from iolanthe.rowland.org ([192.131.102.54]:59921 "HELO
	iolanthe.rowland.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with SMTP id S1753587Ab0ADUsy (ORCPT
	<rfc822; linux-media@vger.kernel.org>); Mon, 4 Jan 2010 15:48:54 -0500
Received: (qmail 28645 invoked by uid 2102); 4 Jan 2010 15:48:47 -0500
Received: from localhost (sendmail-bs@127.0.0.1)
	by localhost with SMTP; 4 Jan 2010 15:48:47 -0500
Date: Mon, 4 Jan 2010 15:48:47 -0500 (EST)
From: Alan Stern <stern@rowland.harvard.edu>
X-X-Sender: stern@iolanthe.rowland.org
To: Sean <knife@toaster.net>
cc: Andrew Morton <akpm@linux-foundation.org>,
	<bugzilla-daemon@bugzilla.kernel.org>, <linux-media@vger.kernel.org>,
	USB list <linux-usb@vger.kernel.org>, Ingo Molnar <mingo@elte.hu>,
	Thomas Gleixner <tglx@linutronix.de>, "H. Peter Anvin" <hpa@zytor.com>
Subject: Re: [Bugme-new] [Bug 14564] New: capture-example sleeping function
	called from invalid context at arch/x86/mm/fault.c
In-Reply-To: <4B424963.5080902@toaster.net>
Message-ID: <Pine.LNX.4.44L0.1001041538140.3180-100000@iolanthe.rowland.org>
MIME-Version: 1.0
Sender: linux-media-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-media.vger.kernel.org>
X-Mailing-List: linux-media@vger.kernel.org


Index: usb-2.6/drivers/usb/host/ohci-q.c
===================================================================
--- usb-2.6.orig/drivers/usb/host/ohci-q.c
+++ usb-2.6/drivers/usb/host/ohci-q.c
@@ -505,6 +505,7 @@ td_fill (struct ohci_hcd *ohci, u32 info
 	struct urb_priv		*urb_priv = urb->hcpriv;
 	int			is_iso = info & TD_ISO;
 	int			hash;
+	volatile struct td	* volatile td1, * volatile td2;
 
 	// ASSERT (index < urb_priv->length);
 
@@ -558,11 +559,30 @@ td_fill (struct ohci_hcd *ohci, u32 info
 
 	/* hash it for later reverse mapping */
 	hash = TD_HASH_FUNC (td->td_dma);
+
+	td1 = ohci->td_hash[hash];
+	td2 = NULL;
+	if (td1) {
+		td2 = td1->td_hash;
+		if (td2 == td1 || td2 == td) {
+			ohci_err(ohci, "Circular hash: %d %p %p %p\n",
+					hash, td1, td2, td);
+			td2 = td1->td_hash = NULL;
+		}
+	}
+
 	td->td_hash = ohci->td_hash [hash];
 	ohci->td_hash [hash] = td;
 
 	/* HC might read the TD (or cachelines) right away ... */
 	wmb ();
+
+	if (td1 && td1->td_hash != td2) {
+		ohci_err(ohci, "Hash value changed: %d %p %p %p\n",
+					hash, td1, td2, td);
+		td1->td_hash = (struct td *) td2;
+	}
+
 	td->ed->hwTailP = td->hwNextTD;
 }