From: Kai Ye <yekai13@huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7B0UW CVE: NA ---------------------------------------------------------------------- Due to the process change of the lock, A thread invokes the 'put_queue' twice. The value of uacce reference counting becomes a negative number. The 'fops_open' and 'fops_release' are symmetrical. So move the process of decrement to 'fops_release' from 'put_queue'. fixes: 92e58150845a ("uacce: add UACCE_MODE_NOIOMMU for warpdrive") Signed-off-by: Kai Ye <yekai13@huawei.com> Signed-off-by: JiangShui Yang <yangjiangshui@h-partners.com> --- drivers/misc/uacce/uacce.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index 6d2961676a54..9cb94ffc78f3 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -88,7 +88,6 @@ static int uacce_put_queue(struct uacce_queue *q) uacce->ops->put_queue(q); q->state = UACCE_Q_ZOMBIE; - atomic_dec(&uacce->ref); return 0; } @@ -378,6 +377,7 @@ static int uacce_fops_release(struct inode *inode, struct file *filep) struct uacce_device *uacce = q->uacce; mutex_lock(&uacce->mutex); + atomic_dec(&uacce->ref); uacce_put_queue(q); uacce_unbind_queue(q); list_del(&q->list); -- 2.30.0