提交 98b3569a 编写于 作者: Y Yu'an Wang 提交者: Laibin Qiu

uacce: add the reference counter protection

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I5VVP6
CVE: NA

--------------------------------

The device driver pointer will be set null during hot plugging.
So should use the device driver null check to pretect put queue.
Otherwise the null pointer may cause the oom ops as doing hot plugging.
Signed-off-by: NYu'an Wang <wangyuan46@huawei.com>
Reviewed-by: NKai Ye <yekai13@huawei.com>
Reviewed-by: NLongfang Liu <liulongfang@huawei.com>
Reviewed-by: Nli yongxin <liyongxin1@huawei.com>
Signed-off-by: NLaibin Qiu <qiulaibin@huawei.com>
上级 1260ac5c
...@@ -229,10 +229,8 @@ static void uacce_free_dma_buffers(struct uacce_queue *q) ...@@ -229,10 +229,8 @@ static void uacce_free_dma_buffers(struct uacce_queue *q)
return; return;
while (i < qfr->dma_list[0].total_num) { while (i < qfr->dma_list[0].total_num) {
WARN_ON(!qfr->dma_list[i].size || !qfr->dma_list[i].dma); WARN_ON(!qfr->dma_list[i].size || !qfr->dma_list[i].dma);
dev_dbg(uacce->pdev, "free dma qfr %s (kaddr=%lx, dma=%llx)\n", dev_dbg(uacce->pdev, "free dma qfr %s (index = %d)\n",
uacce_qfrt_str(qfr), uacce_qfrt_str(qfr), i);
(unsigned long)qfr->dma_list[i].kaddr,
qfr->dma_list[i].dma);
dma_free_coherent(uacce->pdev, qfr->dma_list[i].size, dma_free_coherent(uacce->pdev, qfr->dma_list[i].size,
qfr->dma_list[i].kaddr, qfr->dma_list[i].kaddr,
qfr->dma_list[i].dma); qfr->dma_list[i].dma);
...@@ -383,8 +381,8 @@ static int uacce_mmap_dma_buffers(struct uacce_queue *q, ...@@ -383,8 +381,8 @@ static int uacce_mmap_dma_buffers(struct uacce_queue *q,
slice[i].size); slice[i].size);
if (ret) { if (ret) {
dev_err(uacce->pdev, dev_err(uacce->pdev,
"mmap dma buf fail(dma=0x%llx,size=0x%x)!\n", "mmap dma buf fail(dma index=%d,size=0x%x)!\n",
slice[i].dma, slice[i].size); i, slice[i].size);
goto DMA_MMAP_FAIL; goto DMA_MMAP_FAIL;
} }
...@@ -736,6 +734,12 @@ static void uacce_put_queue(struct uacce_queue *q) ...@@ -736,6 +734,12 @@ static void uacce_put_queue(struct uacce_queue *q)
q->state = UACCE_Q_ZOMBIE; q->state = UACCE_Q_ZOMBIE;
q->filep->private_data = NULL; q->filep->private_data = NULL;
uacce_queue_drain(q); uacce_queue_drain(q);
if (!uacce->pdev->driver) {
dev_warn(uacce->pdev, "the parent device is hot plugged!\n");
return;
}
if (module_refcount(uacce->pdev->driver->owner) > 0) if (module_refcount(uacce->pdev->driver->owner) > 0)
module_put(uacce->pdev->driver->owner); module_put(uacce->pdev->driver->owner);
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册