From 98b3569ae76ac987c49f7b68c4d6bc7982c32be6 Mon Sep 17 00:00:00 2001 From: Yu'an Wang Date: Wed, 2 Nov 2022 14:57:59 +0800 Subject: [PATCH] uacce: add the reference counter protection driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5VVP6 CVE: NA -------------------------------- The device driver pointer will be set null during hot plugging. So should use the device driver null check to pretect put queue. Otherwise the null pointer may cause the oom ops as doing hot plugging. Signed-off-by: Yu'an Wang Reviewed-by: Kai Ye Reviewed-by: Longfang Liu Reviewed-by: li yongxin Signed-off-by: Laibin Qiu --- drivers/misc/uacce/uacce.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index b0cdc244e882..dc3aaae30752 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -229,10 +229,8 @@ static void uacce_free_dma_buffers(struct uacce_queue *q) return; while (i < qfr->dma_list[0].total_num) { WARN_ON(!qfr->dma_list[i].size || !qfr->dma_list[i].dma); - dev_dbg(uacce->pdev, "free dma qfr %s (kaddr=%lx, dma=%llx)\n", - uacce_qfrt_str(qfr), - (unsigned long)qfr->dma_list[i].kaddr, - qfr->dma_list[i].dma); + dev_dbg(uacce->pdev, "free dma qfr %s (index = %d)\n", + uacce_qfrt_str(qfr), i); dma_free_coherent(uacce->pdev, qfr->dma_list[i].size, qfr->dma_list[i].kaddr, qfr->dma_list[i].dma); @@ -383,8 +381,8 @@ static int uacce_mmap_dma_buffers(struct uacce_queue *q, slice[i].size); if (ret) { dev_err(uacce->pdev, - "mmap dma buf fail(dma=0x%llx,size=0x%x)!\n", - slice[i].dma, slice[i].size); + "mmap dma buf fail(dma index=%d,size=0x%x)!\n", + i, slice[i].size); goto DMA_MMAP_FAIL; } @@ -736,6 +734,12 @@ static void uacce_put_queue(struct uacce_queue *q) q->state = UACCE_Q_ZOMBIE; q->filep->private_data = NULL; uacce_queue_drain(q); + + if (!uacce->pdev->driver) { + dev_warn(uacce->pdev, "the parent device is hot plugged!\n"); + return; + } + if (module_refcount(uacce->pdev->driver->owner) > 0) module_put(uacce->pdev->driver->owner); } -- GitLab