hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

platform/x86: dell_rbu: fix lock imbalance in img_update_realloc 

We need to ensure rbu_data.lock is always held on return.

Fixes: 289790a3ea94 ("platform/x86: dell_rbu: stop abusing the DMA API")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Stuart Hayes <stuart.w.hayes@gmail.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
This commit is contained in:
Christoph Hellwig 2019-02-11 14:09:40 +01:00 committed by Darren Hart (VMware)
parent b753185973
commit f27e1d1826
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/platform/x86/dell_rbu.c
View File

@ -436,6 +436,7 @@ static int img_update_realloc(unsigned long size)
ordernum = get_order(size); ordernum = get_order(size);
image_update_buffer = image_update_buffer =
(unsigned char *)__get_free_pages(GFP_DMA32, ordernum); (unsigned char *)__get_free_pages(GFP_DMA32, ordernum);
spin_lock(&rbu_data.lock);
if (!image_update_buffer) { if (!image_update_buffer) {
pr_debug("Not enough memory for image update:" pr_debug("Not enough memory for image update:"
"size = %ld\n", size); "size = %ld\n", size);
@ -446,7 +447,6 @@ static int img_update_realloc(unsigned long size)
if (WARN_ON_ONCE(img_buf_phys_addr > BIOS_SCAN_LIMIT)) if (WARN_ON_ONCE(img_buf_phys_addr > BIOS_SCAN_LIMIT))
return -EINVAL; /* can't happen per definition */ return -EINVAL; /* can't happen per definition */
spin_lock(&rbu_data.lock);
rbu_data.image_update_buffer = image_update_buffer; rbu_data.image_update_buffer = image_update_buffer;
rbu_data.image_update_buffer_size = size; rbu_data.image_update_buffer_size = size;
rbu_data.bios_image_size = rbu_data.image_update_buffer_size; rbu_data.bios_image_size = rbu_data.image_update_buffer_size;