From: Kai Ye yekai13@huawei.com
driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7B0UW CVE: NA
----------------------------------------------------------------------
Due to the process change of the lock, A thread invokes the 'put_queue' twice. The value of uacce reference counting becomes a negative number. The 'fops_open' and 'fops_release' are symmetrical. So move the process of decrement to 'fops_release' from 'put_queue'.
fixes: 92e58150845a ("uacce: add UACCE_MODE_NOIOMMU for warpdrive") Signed-off-by: Kai Ye yekai13@huawei.com Signed-off-by: JiangShui Yang yangjiangshui@h-partners.com --- drivers/misc/uacce/uacce.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index 6d2961676a54..9cb94ffc78f3 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -88,7 +88,6 @@ static int uacce_put_queue(struct uacce_queue *q) uacce->ops->put_queue(q);
q->state = UACCE_Q_ZOMBIE; - atomic_dec(&uacce->ref);
return 0; } @@ -378,6 +377,7 @@ static int uacce_fops_release(struct inode *inode, struct file *filep) struct uacce_device *uacce = q->uacce;
mutex_lock(&uacce->mutex); + atomic_dec(&uacce->ref); uacce_put_queue(q); uacce_unbind_queue(q); list_del(&q->list);