From nobody Wed Dec 17 07:38:14 2025 Received: from canpmsgout03.his.huawei.com (canpmsgout03.his.huawei.com [113.46.200.218]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B5A153009E3; Tue, 2 Dec 2025 06:13:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.218 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764655991; cv=none; b=ORjD2pb1RD9KGxLfpZzUq4mD3gSgv8k2Xj8kAy9oq6gsGhVt8RP8gwywR8qYLAxMFdXcfk2lxi0QKvynL6SBgx54nksa+RUj2GDWnEFKpkxFP9aOBcEKgG6fkT1wa/3OQsoNunJSUQVhQkyiP89IXLR1yHP/Gb/LJvvnoeUSMl4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764655991; c=relaxed/simple; bh=oUvMlSGPUklubX7pMUj2K6ocNCj4Fmrys3oZaGVyZCk=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=NxJ0tkCwib2mT8sxRB0W4PiJOYQJpgn7Tdats/jn/DN0D/Y88+iBEkHkvrQm6+tDSBghaZOyBEsq752TJ4q4hAjTDJB/6OMw+YhaEr8RwmY9dG0CKhl5ANgK3stv+DluvXguC3Y273gd3XerEe0V3E0OCkUqB/ZmlZsdwBARzd4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=gJx9SrP1; arc=none smtp.client-ip=113.46.200.218 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="gJx9SrP1" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=Z7G9BQ0ydyqiKjKK1XkGiJiClH35zTRc/fZlSb5dsLg=; b=gJx9SrP17sqywA88CW1kzCAg3wzlNDtsAIKSTFaEUBDHZWNKNYyfHIrQvuhRIK6XFUgsucoQL 5Wt7dDF8a6zES8x+MbcRdfypw6VqXChIAwNgqdxwUHmLH+cDs4xaqjm+HseYk9xBuLvfth2eerJ Vbn3zjzlcetWtnrKUe0XYZM= Received: from mail.maildlp.com (unknown [172.19.163.252]) by canpmsgout03.his.huawei.com (SkyGuard) with ESMTPS id 4dL9PJ3y3MzpSwb; Tue, 2 Dec 2025 14:10:44 +0800 (CST) Received: from dggemv706-chm.china.huawei.com (unknown [10.3.19.33]) by mail.maildlp.com (Postfix) with ESMTPS id 0037C180BD2; Tue, 2 Dec 2025 14:13:02 +0800 (CST) Received: from kwepemq200001.china.huawei.com (7.202.195.16) by dggemv706-chm.china.huawei.com (10.3.19.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 2 Dec 2025 14:12:58 +0800 Received: from localhost.huawei.com (10.90.31.46) by kwepemq200001.china.huawei.com (7.202.195.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 2 Dec 2025 14:12:57 +0800 From: Chenghai Huang To: , , CC: , , , , , , Subject: [PATCH v6 1/4] uacce: fix cdev handling in the cleanup path Date: Tue, 2 Dec 2025 14:12:53 +0800 Message-ID: <20251202061256.4158641-2-huangchenghai2@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20251202061256.4158641-1-huangchenghai2@huawei.com> References: <20251202061256.4158641-1-huangchenghai2@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems500002.china.huawei.com (7.221.188.17) To kwepemq200001.china.huawei.com (7.202.195.16) Content-Type: text/plain; charset="utf-8" From: Wenkai Lin When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove. Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Wenkai Lin Signed-off-by: Chenghai Huang Acked-by: Zhangfei Gao --- drivers/misc/uacce/uacce.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index 42e7d2a2a90c..43d215fb8c73 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -519,6 +519,8 @@ EXPORT_SYMBOL_GPL(uacce_alloc); */ int uacce_register(struct uacce_device *uacce) { + int ret; + if (!uacce) return -ENODEV; =20 @@ -529,7 +531,11 @@ int uacce_register(struct uacce_device *uacce) uacce->cdev->ops =3D &uacce_fops; uacce->cdev->owner =3D THIS_MODULE; =20 - return cdev_device_add(uacce->cdev, &uacce->dev); + ret =3D cdev_device_add(uacce->cdev, &uacce->dev); + if (ret) + uacce->cdev =3D NULL; + + return ret; } EXPORT_SYMBOL_GPL(uacce_register); =20 --=20 2.33.0 From nobody Wed Dec 17 07:38:14 2025 Received: from canpmsgout08.his.huawei.com (canpmsgout08.his.huawei.com [113.46.200.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D28A32FF664; Tue, 2 Dec 2025 06:13:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.223 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764655985; cv=none; b=PqvhR7Dn9yOGbLXKUpXXFylItbnJvGtbue38lmCyHcofXO3Iq1ECIg2SnyPKpHZCvEB1fVQGjCTGhnjCPdQATTr0QFVyM+DBDlX1aLcWooQEqxdP+OSeRv/GUCh6Sh0T/GoCyC02oZUSkMMRQGpjy7J8VO2iLEiwCLHKNeP1AWs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764655985; c=relaxed/simple; bh=gnrhT/h0A8AV79o6VCRZ1fL2+CeNshbrYlrotkJIksI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=oZkV00QaPJABLoNYQWf+jjRDNSgScDJ/83XeYLCTrhiNlkLY6F8aHW1OuiEXy0VQ9EMLOGQuRdxtDjbzaX1mugO1Pml1m21HABh80uoSbZmrA9gL5w4Jf53laCkSXtTWqg6lVGPizqQ27SBZtvVFhRserpxiGyOttx0xRx1n+QY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=IMapymeC; arc=none smtp.client-ip=113.46.200.223 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="IMapymeC" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=1Dm9bT+p9g52NqnB8W1+F9hfCBHyPZRbf4WhOd2TC04=; b=IMapymeCniJqdB6LlgTw/Xyky4elwfmYgSbJpl0YYVLjKZAoH6rCMPS8Fa2pja319hIz5bxXI 6vf6ZP6GFoSxKDyFc0jejYrYqOyCmGN/BMwC9ExSxZMDfBBZr79aaDlqSolw2a4KpwoS0dlZ3TZ MkyVWG9movvDrNIw3KfEZlM= Received: from mail.maildlp.com (unknown [172.19.163.44]) by canpmsgout08.his.huawei.com (SkyGuard) with ESMTPS id 4dL9Pl2ljXzmV7L; Tue, 2 Dec 2025 14:11:07 +0800 (CST) Received: from dggemv712-chm.china.huawei.com (unknown [10.1.198.32]) by mail.maildlp.com (Postfix) with ESMTPS id 08A22140143; Tue, 2 Dec 2025 14:12:59 +0800 (CST) Received: from kwepemq200001.china.huawei.com (7.202.195.16) by dggemv712-chm.china.huawei.com (10.1.198.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 2 Dec 2025 14:12:58 +0800 Received: from localhost.huawei.com (10.90.31.46) by kwepemq200001.china.huawei.com (7.202.195.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 2 Dec 2025 14:12:58 +0800 From: Chenghai Huang To: , , CC: , , , , , , Subject: [PATCH v6 2/4] uacce: fix isolate sysfs check condition Date: Tue, 2 Dec 2025 14:12:54 +0800 Message-ID: <20251202061256.4158641-3-huangchenghai2@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20251202061256.4158641-1-huangchenghai2@huawei.com> References: <20251202061256.4158641-1-huangchenghai2@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems500002.china.huawei.com (7.221.188.17) To kwepemq200001.china.huawei.com (7.202.195.16) Content-Type: text/plain; charset="utf-8" uacce supports the device isolation feature. If the driver implements the isolate_err_threshold_read and isolate_err_threshold_write callback functions, uacce will create sysfs files now. Users can read and configure the isolation policy through sysfs. Currently, sysfs files are created as long as either isolate_err_threshold_read or isolate_err_threshold_write callback functions are present. However, accessing a non-existent callback function may cause the system to crash. Therefore, intercept the creation of sysfs if neither read nor write exists; create sysfs if either is supported, but intercept unsupported operations at the call site. Fixes: e3e289fbc0b5 ("uacce: supports device isolation feature") Cc: stable@vger.kernel.org Signed-off-by: Chenghai Huang Acked-by: Zhangfei Gao --- drivers/misc/uacce/uacce.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index 43d215fb8c73..b0b3c1562d52 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -382,6 +382,9 @@ static ssize_t isolate_strategy_show(struct device *dev= , struct device_attribute struct uacce_device *uacce =3D to_uacce_device(dev); u32 val; =20 + if (!uacce->ops->isolate_err_threshold_read) + return -ENOENT; + val =3D uacce->ops->isolate_err_threshold_read(uacce); =20 return sysfs_emit(buf, "%u\n", val); @@ -394,6 +397,9 @@ static ssize_t isolate_strategy_store(struct device *de= v, struct device_attribut unsigned long val; int ret; =20 + if (!uacce->ops->isolate_err_threshold_write) + return -ENOENT; + if (kstrtoul(buf, 0, &val) < 0) return -EINVAL; =20 --=20 2.33.0 From nobody Wed Dec 17 07:38:14 2025 Received: from canpmsgout10.his.huawei.com (canpmsgout10.his.huawei.com [113.46.200.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2D1B2FFDC0; Tue, 2 Dec 2025 06:13:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.225 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764655987; cv=none; b=SRZytWuBX0H+zEQHgXsNJRYut/mud5GecAXXglwVFUGT8xFNwsA+0CCkt6B4Hmc1WkS4ul+qyey+p6fvaBI0PbkJ4c4BAMEs6CvP/51zQDNskVepW15mSXUS6HzVy6OFZ+vQJswAKXdF4R2LeewXvxsZOn5i9zCajItKmfZYmls= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764655987; c=relaxed/simple; bh=8cz4FYVv7Tul+2qaKdfUaDELxdy1lI7cezs0+cLfksM=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=XgA+hIJjBqakuBb9QydBGLEjOBA16QZxLP8ucJlGakX0z57BUZDjmax1IE239SJXztU0n5tmIt7OhVNEPCD3TeJIU8E9vEbzRttC+wLbjphHTMZjVyRkXo6R6gpH60O0wcuMnUJYhxnNo8Ejam3YRKEDL0PU+7yPgKARvMcciDA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=2i1SZOYb; arc=none smtp.client-ip=113.46.200.225 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="2i1SZOYb" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=zSNlfVRPlkcIXMnglekNZTymcG2mDkauZswbS9rUu5Y=; b=2i1SZOYbvHNxzmM9PD4UH014FqoRwVyld04sC9y6iqz4sG3cgvwRcyrtP/T8mLoAvHUCJItni yZYwBMoZLzfV7F4I7UFpwHtymGe619Bbkkg1svKlTcVUpbFApLiYpfX02NhwvyQhzHTBVudWKUk R8PudPSg2bGaVZIFF1i/1r8= Received: from mail.maildlp.com (unknown [172.19.88.234]) by canpmsgout10.his.huawei.com (SkyGuard) with ESMTPS id 4dL9Pn4CYqz1K9Ck; Tue, 2 Dec 2025 14:11:09 +0800 (CST) Received: from dggemv705-chm.china.huawei.com (unknown [10.3.19.32]) by mail.maildlp.com (Postfix) with ESMTPS id 6E41B14025A; Tue, 2 Dec 2025 14:12:59 +0800 (CST) Received: from kwepemq200001.china.huawei.com (7.202.195.16) by dggemv705-chm.china.huawei.com (10.3.19.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 2 Dec 2025 14:12:59 +0800 Received: from localhost.huawei.com (10.90.31.46) by kwepemq200001.china.huawei.com (7.202.195.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 2 Dec 2025 14:12:58 +0800 From: Chenghai Huang To: , , CC: , , , , , , Subject: [PATCH v6 3/4] uacce: implement mremap in uacce_vm_ops to return -EPERM Date: Tue, 2 Dec 2025 14:12:55 +0800 Message-ID: <20251202061256.4158641-4-huangchenghai2@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20251202061256.4158641-1-huangchenghai2@huawei.com> References: <20251202061256.4158641-1-huangchenghai2@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems500002.china.huawei.com (7.221.188.17) To kwepemq200001.china.huawei.com (7.202.195.16) Content-Type: text/plain; charset="utf-8" From: Yang Shen The current uacce_vm_ops does not support the mremap operation of vm_operations_struct. Implement .mremap to return -EPERM to remind users. The reason we need to explicitly disable mremap is that when the driver does not implement .mremap, it uses the default mremap method. This could lead to a risk scenario: An application might first mmap address p1, then mremap to p2, followed by munmap(p1), and finally munmap(p2). Since the default mremap copies the original vma's vm_private_data (i.e., q) to the new vma, both munmap operations would trigger vma_close, causing q->qfr to be freed twice(qfr will be set to null here, so repeated release is ok). Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Yang Shen Signed-off-by: Chenghai Huang Acked-by: Zhangfei Gao --- drivers/misc/uacce/uacce.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index b0b3c1562d52..c061c6fa1c5e 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -214,8 +214,14 @@ static void uacce_vma_close(struct vm_area_struct *vma) } } =20 +static int uacce_vma_mremap(struct vm_area_struct *area) +{ + return -EPERM; +} + static const struct vm_operations_struct uacce_vm_ops =3D { .close =3D uacce_vma_close, + .mremap =3D uacce_vma_mremap, }; =20 static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma) --=20 2.33.0 From nobody Wed Dec 17 07:38:14 2025 Received: from canpmsgout12.his.huawei.com (canpmsgout12.his.huawei.com [113.46.200.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 277C82FFFA3; Tue, 2 Dec 2025 06:13:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.227 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764655990; cv=none; b=eb8YdzgsfGAUdmriy3mXow5Vh+Hjqd2hDl1yLXoAUXt24A6BWXww8OddgDalEX0JslA+fwcp+RMl8195ddKb+SU4WPBAWSSbeCQb5dgOgujgzk1LCjdXlFaXDcc8dyHXFZHCZfbdgF+drho2IK+t/aH8y2G2kTq3BYPzxLaL5Ec= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764655990; c=relaxed/simple; bh=pua1amQvV9fCow0RBdrdv99qmahXdFL4paOWtrQkMFs=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=h65XAnday8mYtjyKcImyOJUvbhAAXFhLuvGOcQYXYAz6AjSaoGi51ur/b6j5Gd18DKHg0Fy//8c2qWyY6tyxpUJqlLwVxxg485ffRfsEXhvYTFfMcTUIFW9hdeD44vKFyGEV7ZEyMeGaEkbwVeh2SF1wveNofmL3vvI49MCcog0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=NtvX5/gt; arc=none smtp.client-ip=113.46.200.227 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="NtvX5/gt" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=jhA8g0wHjWM0boaunGsWLeE7SRcYqrx99SvDaAeBx+0=; b=NtvX5/gtfa/vLlxGaBC6VmEvYl3r8wjwIkX5ZdjIn6hIKpjKr1Zv1L6kgN1aJzmDxIk30dGsr f9TjdXv1aZqxyo1R2c0IlV4ipQp2MbcYgDSV9jGaLHR1Xv4gHyNjMF0TJxJDAtPDVDsUqJwFqgW HvxIYaJnL6EohLHiTOxBcQc= Received: from mail.maildlp.com (unknown [172.19.88.214]) by canpmsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4dL9P93ZQNznTXp; Tue, 2 Dec 2025 14:10:37 +0800 (CST) Received: from dggemv705-chm.china.huawei.com (unknown [10.3.19.32]) by mail.maildlp.com (Postfix) with ESMTPS id A23BF1A016C; Tue, 2 Dec 2025 14:12:59 +0800 (CST) Received: from kwepemq200001.china.huawei.com (7.202.195.16) by dggemv705-chm.china.huawei.com (10.3.19.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 2 Dec 2025 14:12:59 +0800 Received: from localhost.huawei.com (10.90.31.46) by kwepemq200001.china.huawei.com (7.202.195.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 2 Dec 2025 14:12:59 +0800 From: Chenghai Huang To: , , CC: , , , , , , Subject: [PATCH v6 4/4] uacce: ensure safe queue release with state management Date: Tue, 2 Dec 2025 14:12:56 +0800 Message-ID: <20251202061256.4158641-5-huangchenghai2@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20251202061256.4158641-1-huangchenghai2@huawei.com> References: <20251202061256.4158641-1-huangchenghai2@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems500002.china.huawei.com (7.221.188.17) To kwepemq200001.china.huawei.com (7.202.195.16) Content-Type: text/plain; charset="utf-8" Directly calling `put_queue` carries risks since it cannot guarantee that resources of `uacce_queue` have been fully released beforehand. So adding a `stop_queue` operation for the UACCE_CMD_PUT_Q command and leaving the `put_queue` operation to the final resource release ensures safety. Queue states are defined as follows: - UACCE_Q_ZOMBIE: Initial state - UACCE_Q_INIT: After opening `uacce` - UACCE_Q_STARTED: After `start` is issued via `ioctl` When executing `poweroff -f` in virt while accelerator are still working, `uacce_fops_release` and `uacce_remove` may execute concurrently. This can cause `uacce_put_queue` within `uacce_fops_release` to access a NULL `ops` pointer. Therefore, add state checks to prevent accessing freed pointers. Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Chenghai Huang Signed-off-by: Yang Shen Acked-by: Zhangfei Gao --- drivers/misc/uacce/uacce.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index c061c6fa1c5e..6d71355528d3 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -40,20 +40,34 @@ static int uacce_start_queue(struct uacce_queue *q) return 0; } =20 -static int uacce_put_queue(struct uacce_queue *q) +static int uacce_stop_queue(struct uacce_queue *q) { struct uacce_device *uacce =3D q->uacce; =20 - if ((q->state =3D=3D UACCE_Q_STARTED) && uacce->ops->stop_queue) + if (q->state !=3D UACCE_Q_STARTED) + return 0; + + if (uacce->ops->stop_queue) uacce->ops->stop_queue(q); =20 - if ((q->state =3D=3D UACCE_Q_INIT || q->state =3D=3D UACCE_Q_STARTED) && - uacce->ops->put_queue) + q->state =3D UACCE_Q_INIT; + + return 0; +} + +static void uacce_put_queue(struct uacce_queue *q) +{ + struct uacce_device *uacce =3D q->uacce; + + uacce_stop_queue(q); + + if (q->state !=3D UACCE_Q_INIT) + return; + + if (uacce->ops->put_queue) uacce->ops->put_queue(q); =20 q->state =3D UACCE_Q_ZOMBIE; - - return 0; } =20 static long uacce_fops_unl_ioctl(struct file *filep, @@ -80,7 +94,7 @@ static long uacce_fops_unl_ioctl(struct file *filep, ret =3D uacce_start_queue(q); break; case UACCE_CMD_PUT_Q: - ret =3D uacce_put_queue(q); + ret =3D uacce_stop_queue(q); break; default: if (uacce->ops->ioctl) --=20 2.33.0