diff options
| author | Steven Hartland <smh@FreeBSD.org> | 2014-11-21 21:01:24 +0000 |
|---|---|---|
| committer | Steven Hartland <smh@FreeBSD.org> | 2014-11-21 21:01:24 +0000 |
| commit | 85c9dd9d895261632d58cf98da6608b93dd5d7f8 (patch) | |
| tree | 5ebdafcf9900ec8ee871257dadfca8fdc7f4aa95 /sys/dev/firewire | |
| parent | 7db6c5cde6083b3cf76f1f85225c19052722dfd5 (diff) | |
| download | src-85c9dd9d895261632d58cf98da6608b93dd5d7f8.tar.gz src-85c9dd9d895261632d58cf98da6608b93dd5d7f8.zip | |
Prevent overflow issues in timeout processing
Previously, any timeout value for which (timeout * hz) will overflow the
signed integer, will give weird results, since callout(9) routines will
convert negative values of ticks to '1'. For unsigned integer overflow we
will get sufficiently smaller timeout values than expected.
Switch from callout_reset, which requires conversion to int based ticks
to callout_reset_sbt to avoid this.
Also correct isci to correctly resolve ccb timeout.
This was based on the original work done by Eygene Ryabinkin
<rea@freebsd.org> back in 5 Aug 2011 which used a macro to help avoid
the overlow.
Differential Revision: https://reviews.freebsd.org/D1157
Reviewed by: mav, davide
MFC after: 1 month
Sponsored by: Multiplay
Notes
Notes:
svn path=/head/; revision=274819
Diffstat (limited to 'sys/dev/firewire')
| -rw-r--r-- | sys/dev/firewire/sbp.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/sys/dev/firewire/sbp.c b/sys/dev/firewire/sbp.c index 69e83c4690d5..0d8fc54dc67e 100644 --- a/sys/dev/firewire/sbp.c +++ b/sys/dev/firewire/sbp.c @@ -1028,8 +1028,8 @@ static __inline void sbp_scan_dev(struct sbp_dev *sdev) { sdev->status = SBP_DEV_PROBE; - callout_reset(&sdev->target->scan_callout, scan_delay * hz / 1000, - sbp_cam_scan_target, (void *)sdev->target); + callout_reset_sbt(&sdev->target->scan_callout, SBT_1MS * scan_delay, 0, + sbp_cam_scan_target, (void *)sdev->target, 0); } static void @@ -1397,7 +1397,7 @@ END_DEBUG start: target->mgm_ocb_cur = ocb; - callout_reset(&target->mgm_ocb_timeout, 5*hz, + callout_reset(&target->mgm_ocb_timeout, 5 * hz, sbp_mgm_timeout, (caddr_t)ocb); xfer = sbp_write_cmd(sdev, FWTCODE_WREQB, 0); if (xfer == NULL) { @@ -2699,9 +2699,11 @@ END_DEBUG prev2 = prev = STAILQ_LAST(&sdev->ocbs, sbp_ocb, ocb); STAILQ_INSERT_TAIL(&sdev->ocbs, ocb, ocb); - if (ocb->ccb != NULL) - callout_reset(&ocb->timer, (ocb->ccb->ccb_h.timeout * hz) / 1000, - sbp_timeout, ocb); + if (ocb->ccb != NULL) { + callout_reset_sbt(&ocb->timer, + SBT_1MS * ocb->ccb->ccb_h.timeout, 0, sbp_timeout, + ocb, 0); + } if (use_doorbell && prev == NULL) prev2 = sdev->last_ocb; |