From 27600805e62f800bacf990354632eae4e487d34c Mon Sep 17 00:00:00 2001 From: Yazen Ghannam Date: Thu, 3 Sep 2026 10:43:25 -0500 Subject: x86/amd_node: Fix PCI device reference counting in amd_smn_init() The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the search is complete. Use the __free() cleanup macro to ensure the refcount is decremented when the temporary pointer goes out of scope. Additionally, increment the refcount when caching a root pointer. This ensures the in-use refcount is separate from the temporary search refcounting. Finally, drop the redundant "root = NULL" before the second search loop. The pci_get_class() iterator always decrements the refcount of its "from" argument, so the first loop can only fall through with "root" already NULL. Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching") Closes: https://sashiko.dev/#/patchset/20260806160159.230453-1-jason.andryuk%40amd.com Reported-by: Sashiko Assisted-by: LLM Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Mario Limonciello (AMD) Cc: Link: https://patch.msgid.link/20260903154325.74343-1-yazen.ghannam@amd.com --- drivers/accessibility/speakup/selection.c | 141 ++++++++++++++++++++++++++++++ 1 file changed, 141 insertions(+) create mode 100644 drivers/accessibility/speakup/selection.c (limited to 'drivers/accessibility/speakup/selection.c') diff --git a/drivers/accessibility/speakup/selection.c b/drivers/accessibility/speakup/selection.c new file mode 100644 index 000000000..1713ce4e0 --- /dev/null +++ b/drivers/accessibility/speakup/selection.c @@ -0,0 +1,141 @@ +// SPDX-License-Identifier: GPL-2.0 +#include /* for kmalloc */ +#include +#include +#include +#include /* for dev_warn */ +#include +#include +#include +#include +#include +#include + +#include "speakup.h" + +u16 spk_xs, spk_ys, spk_xe, spk_ye; /* our region points */ +struct vc_data *spk_sel_cons; + +struct speakup_selection_work { + struct work_struct work; + struct tiocl_selection sel; + struct tty_struct *tty; +}; + +static void __speakup_set_selection(struct work_struct *work) +{ + struct speakup_selection_work *ssw = + container_of(work, struct speakup_selection_work, work); + + struct tty_struct *tty; + struct tiocl_selection sel; + + sel = ssw->sel; + + /* this ensures we copy sel before releasing the lock below */ + rmb(); + + /* release the lock by setting tty of the struct to NULL */ + tty = xchg(&ssw->tty, NULL); + + if (spk_sel_cons != vc_cons[fg_console].d) { + spk_sel_cons = vc_cons[fg_console].d; + pr_warn("Selection: mark console not the same as cut\n"); + goto unref; + } + + console_lock(); + clear_selection(); + console_unlock(); + + set_selection_kernel(&sel, tty); + +unref: + tty_kref_put(tty); +} + +static struct speakup_selection_work speakup_sel_work = { + .work = __WORK_INITIALIZER(speakup_sel_work.work, + __speakup_set_selection) +}; + +int speakup_set_selection(struct tty_struct *tty) +{ + /* we get kref here first in order to avoid a subtle race when + * cancelling selection work. getting kref first establishes the + * invariant that if speakup_sel_work.tty is not NULL when + * speakup_cancel_selection() is called, it must be the case that a put + * kref is pending. + */ + tty_kref_get(tty); + if (cmpxchg(&speakup_sel_work.tty, NULL, tty)) { + tty_kref_put(tty); + return -EBUSY; + } + /* now we have the 'lock' by setting tty member of + * speakup_selection_work. wmb() ensures that writes to + * speakup_sel_work don't happen before cmpxchg() above. + */ + wmb(); + + speakup_sel_work.sel.xs = spk_xs + 1; + speakup_sel_work.sel.ys = spk_ys + 1; + speakup_sel_work.sel.xe = spk_xe + 1; + speakup_sel_work.sel.ye = spk_ye + 1; + speakup_sel_work.sel.sel_mode = TIOCL_SELCHAR; + + schedule_work_on(WORK_CPU_UNBOUND, &speakup_sel_work.work); + + return 0; +} + +void speakup_cancel_selection(void) +{ + struct tty_struct *tty; + + cancel_work_sync(&speakup_sel_work.work); + /* setting to null so that if work fails to run and we cancel it, + * we can run it again without getting EBUSY forever from there on. + * we need to use xchg here to avoid race with speakup_set_selection() + */ + tty = xchg(&speakup_sel_work.tty, NULL); + if (tty) + tty_kref_put(tty); +} + +static void __speakup_paste_selection(struct work_struct *work) +{ + struct speakup_selection_work *ssw = + container_of(work, struct speakup_selection_work, work); + struct tty_struct *tty = xchg(&ssw->tty, NULL); + + paste_selection(tty); + tty_kref_put(tty); +} + +static struct speakup_selection_work speakup_paste_work = { + .work = __WORK_INITIALIZER(speakup_paste_work.work, + __speakup_paste_selection) +}; + +int speakup_paste_selection(struct tty_struct *tty) +{ + tty_kref_get(tty); + if (cmpxchg(&speakup_paste_work.tty, NULL, tty)) { + tty_kref_put(tty); + return -EBUSY; + } + + schedule_work_on(WORK_CPU_UNBOUND, &speakup_paste_work.work); + return 0; +} + +void speakup_cancel_paste(void) +{ + struct tty_struct *tty; + + cancel_work_sync(&speakup_paste_work.work); + tty = xchg(&speakup_paste_work.tty, NULL); + if (tty) + tty_kref_put(tty); +} -- cgit v1.3.1