[PATCH] dmaengine: idxd: fix off by one on cdev dwq refcount

[PATCH] dmaengine: idxd: fix off by one on cdev dwq refcount

[Dave Jiang]

The refcount check for dedicuated workqueue (dwq) is off by one and allows
more than 1 user to open the char device. Fix check so only a single user
can open the device.

Fixes: 42d279f9137a ("dmaengine: idxd: add char driver to expose submission portal to userland")
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
---
 drivers/dma/idxd/cdev.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
index e4379ba04a9a..f5e43f65a5ed 100644
--- a/drivers/dma/idxd/cdev.c
+++ b/drivers/dma/idxd/cdev.c
@@ -84,9 +84,9 @@ static int idxd_cdev_open(struct inode *inode, struct file *filp)
 	dev = &idxd->pdev->dev;
 	idxd_cdev = &wq->idxd_cdev;
 
-	dev_dbg(dev, "%s called\n", __func__);
+	dev_dbg(dev, "%s called: %d\n", __func__, idxd_wq_refcount(wq));
 
-	if (idxd_wq_refcount(wq) > 1 && wq_dedicated(wq))
+	if (idxd_wq_refcount(wq) > 0 && wq_dedicated(wq))
 		return -EBUSY;
 
 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);

Re: [PATCH] dmaengine: idxd: fix off by one on cdev dwq refcount

[Vinod Koul]

On 10-03-20, 08:52, Dave Jiang wrote:
> The refcount check for dedicuated workqueue (dwq) is off by one and allows
                        
s/dedicuated/dedicated

> more than 1 user to open the char device. Fix check so only a single user
> can open the device.
> 
> Fixes: 42d279f9137a ("dmaengine: idxd: add char driver to expose submission portal to userland")
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> ---
>  drivers/dma/idxd/cdev.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
> index e4379ba04a9a..f5e43f65a5ed 100644
> --- a/drivers/dma/idxd/cdev.c
> +++ b/drivers/dma/idxd/cdev.c
> @@ -84,9 +84,9 @@ static int idxd_cdev_open(struct inode *inode, struct file *filp)
>  	dev = &idxd->pdev->dev;
>  	idxd_cdev = &wq->idxd_cdev;
>  
> -	dev_dbg(dev, "%s called\n", __func__);
> +	dev_dbg(dev, "%s called: %d\n", __func__, idxd_wq_refcount(wq));
>  
> -	if (idxd_wq_refcount(wq) > 1 && wq_dedicated(wq))
> +	if (idxd_wq_refcount(wq) > 0 && wq_dedicated(wq))
>  		return -EBUSY;
>  
>  	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);

-- 
~Vinod