Unverified Commit a795c870 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12346 CVE-2024-35990 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongqiang Liu <liuyongqiang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/WWZYNN52G7CSI2LIYEPYIB3MSUMNSF32/ 
Sean Anderson (1):
  dma: xilinx_dpdma: Fix locking


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I9QR9R 
 
Link:https://gitee.com/openeuler/kernel/pulls/12346

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 77f5b866 550550f3

drivers/dma/xilinx/xilinx_dpdma.c

+10 −3
Original line number Diff line number Diff line
@@ -213,7 +213,8 @@ struct xilinx_dpdma_tx_desc { 
 * @running: true if the channel is running

 * @first_frame: flag for the first frame of stream

 * @video_group: flag if multi-channel operation is needed for video channels

 * @lock: lock to access struct xilinx_dpdma_chan

 * @lock: lock to access struct xilinx_dpdma_chan. Must be taken before

 *        @vchan.lock, if both are to be held.

 * @desc_pool: descriptor allocation pool

 * @err_task: error IRQ bottom half handler

 * @desc: References to descriptors being processed
@@ -1101,12 +1102,14 @@ static void xilinx_dpdma_chan_vsync_irq(struct xilinx_dpdma_chan *chan) 
	 * Complete the active descriptor, if any, promote the pending

	 * descriptor to active, and queue the next transfer, if any.

	 */

	spin_lock(&chan->vchan.lock);

	if (chan->desc.active)

		vchan_cookie_complete(&chan->desc.active->vdesc);

	chan->desc.active = pending;

	chan->desc.pending = NULL;



	xilinx_dpdma_chan_queue_transfer(chan);

	spin_unlock(&chan->vchan.lock);



out:

	spin_unlock_irqrestore(&chan->lock, flags);
@@ -1264,10 +1267,12 @@ static void xilinx_dpdma_issue_pending(struct dma_chan *dchan) 
	struct xilinx_dpdma_chan *chan = to_xilinx_chan(dchan);

	unsigned long flags;



	spin_lock_irqsave(&chan->vchan.lock, flags);

	spin_lock_irqsave(&chan->lock, flags);

	spin_lock(&chan->vchan.lock);

	if (vchan_issue_pending(&chan->vchan))

		xilinx_dpdma_chan_queue_transfer(chan);

	spin_unlock_irqrestore(&chan->vchan.lock, flags);

	spin_unlock(&chan->vchan.lock);

	spin_unlock_irqrestore(&chan->lock, flags);

}



static int xilinx_dpdma_config(struct dma_chan *dchan,
@@ -1491,7 +1496,9 @@ static void xilinx_dpdma_chan_err_task(struct tasklet_struct *t) 
		    XILINX_DPDMA_EINTR_CHAN_ERR_MASK << chan->id);



	spin_lock_irqsave(&chan->lock, flags);

	spin_lock(&chan->vchan.lock);

	xilinx_dpdma_chan_queue_transfer(chan);

	spin_unlock(&chan->vchan.lock);

	spin_unlock_irqrestore(&chan->lock, flags);

}