driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID6IAP CVE: NA ---------------------------------------------------------------------- When "poweroff -f" is call in virt, if there are accelerator services that have not yet completed, a situation may arise where uacce_fops_release and uacce_remove are executed concurrently. This can lead to the uacce_put_queue operation in uacce_fops_release accessing an empty ops pointer. Fixes: 642aa7325494 ("uacce: add stop_queue to replace put_queue in ioctl") Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: JiangShui Yang <yangjiangshui@h-partners.com> --- drivers/misc/uacce/uacce.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index 04f2658712da..4dcf3bff4c8f 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -47,10 +47,13 @@ static int uacce_stop_queue(struct uacce_queue *q) { struct uacce_device *uacce = q->uacce; - if ((q->state == UACCE_Q_STARTED) && uacce->ops->stop_queue) + if (q->state != UACCE_Q_STARTED) + return 0; + + if (uacce->ops->stop_queue) uacce->ops->stop_queue(q); - q->state = UACCE_Q_ZOMBIE; + q->state = UACCE_Q_INIT; return 0; } @@ -61,8 +64,13 @@ static void uacce_put_queue(struct uacce_queue *q) uacce_stop_queue(q); + if (q->state != UACCE_Q_INIT) + return; + if (uacce->ops->put_queue) uacce->ops->put_queue(q); + + q->state = UACCE_Q_ZOMBIE; } static long uacce_get_ss_dma(struct uacce_queue *q, void __user *arg) -- 2.43.0