Unverified Commit 289f1b38 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14024 iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count 

Merge Pull Request from: @ci-robot 
 
PR sync from: Tirui Yin <yintirui@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/XF54GAVZ5CYO3D3KRVLQIKXVSVLVUWXQ/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYRAV 
 
Link:https://gitee.com/openeuler/kernel/pulls/14024

 

Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents a27e64de 7d6b67d6

drivers/iommu/intel/dmar.c

+11 −5
Original line number Diff line number Diff line
@@ -1204,9 +1204,7 @@ static void free_iommu(struct intel_iommu *iommu) 
 */

static inline void reclaim_free_desc(struct q_inval *qi)

{

	while (qi->desc_status[qi->free_tail] == QI_DONE ||

	       qi->desc_status[qi->free_tail] == QI_ABORT) {

		qi->desc_status[qi->free_tail] = QI_FREE;

	while (qi->desc_status[qi->free_tail] == QI_FREE && qi->free_tail != qi->free_head) {

		qi->free_tail = (qi->free_tail + 1) % QI_LENGTH;

		qi->free_cnt++;

	}
@@ -1361,8 +1359,16 @@ int qi_submit_sync(struct intel_iommu *iommu, struct qi_desc *desc, 
		raw_spin_lock(&qi->q_lock);

	}



	for (i = 0; i < count; i++)

		qi->desc_status[(index + i) % QI_LENGTH] = QI_DONE;

	/*

	 * The reclaim code can free descriptors from multiple submissions

	 * starting from the tail of the queue. When count == 0, the

	 * status of the standalone wait descriptor at the tail of the queue

	 * must be set to QI_FREE to allow the reclaim code to proceed.

	 * It is also possible that descriptors from one of the previous

	 * submissions has to be reclaimed by a subsequent submission.

	 */

	for (i = 0; i <= count; i++)

		qi->desc_status[(index + i) % QI_LENGTH] = QI_FREE;



	reclaim_free_desc(qi);

	raw_spin_unlock_irqrestore(&qi->q_lock, flags);