Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b81b6f35 authored by Francesco Ruggeri's avatar Francesco Ruggeri Committed by Greg Kroah-Hartman
Browse files

ACPI: OSL: only free map once in osl.c 



commit 833a426cc471b6088011b3d67f1dc4e147614647 upstream.

acpi_os_map_cleanup checks map->refcount outside of acpi_ioremap_lock
before freeing the map. This creates a race condition the can result
in the map being freed more than once.
A panic can be caused by running

for ((i=0; i<10; i++))
do
        for ((j=0; j<100000; j++))
        do
                cat /sys/firmware/acpi/tables/data/BERT >/dev/null
        done &
done

This patch makes sure that only the process that drops the reference
to 0 does the freeing.

Fixes: b7c1fadd ("ACPI: Do not use krefs under a mutex in osl.c")
Signed-off-by: default avatarFrancesco Ruggeri <fruggeri@arista.com>
Reviewed-by: default avatarDmitry Safonov <0x7f454c46@gmail.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9f5ee706

drivers/acpi/osl.c

+17 −11
Original line number Diff line number Diff line
@@ -374,20 +374,22 @@ void *__ref acpi_os_map_memory(acpi_physical_address phys, acpi_size size) 
}

EXPORT_SYMBOL_GPL(acpi_os_map_memory);



static void acpi_os_drop_map_ref(struct acpi_ioremap *map)

/* Must be called with mutex_lock(&acpi_ioremap_lock) */

static unsigned long acpi_os_drop_map_ref(struct acpi_ioremap *map)

{

	if (!--map->refcount)

	unsigned long refcount = --map->refcount;



	if (!refcount)

		list_del_rcu(&map->list);

	return refcount;

}



static void acpi_os_map_cleanup(struct acpi_ioremap *map)

{

	if (!map->refcount) {

	synchronize_rcu_expedited();

	acpi_unmap(map->phys, map->virt);

	kfree(map);

}

}



/**

 * acpi_os_unmap_iomem - Drop a memory mapping reference.
@@ -406,6 +408,7 @@ static void acpi_os_map_cleanup(struct acpi_ioremap *map) 
void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size)

{

	struct acpi_ioremap *map;

	unsigned long refcount;



	if (!acpi_permanent_mmap) {

		__acpi_unmap_table(virt, size);
@@ -419,9 +422,10 @@ void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) 
		WARN(true, PREFIX "%s: bad address %p\n", __func__, virt);

		return;

	}

	acpi_os_drop_map_ref(map);

	refcount = acpi_os_drop_map_ref(map);

	mutex_unlock(&acpi_ioremap_lock);



	if (!refcount)

		acpi_os_map_cleanup(map);

}

EXPORT_SYMBOL_GPL(acpi_os_unmap_iomem);
@@ -457,6 +461,7 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas) 
{

	u64 addr;

	struct acpi_ioremap *map;

	unsigned long refcount;



	if (gas->space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY)

		return;
@@ -472,9 +477,10 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas) 
		mutex_unlock(&acpi_ioremap_lock);

		return;

	}

	acpi_os_drop_map_ref(map);

	refcount = acpi_os_drop_map_ref(map);

	mutex_unlock(&acpi_ioremap_lock);



	if (!refcount)

		acpi_os_map_cleanup(map);

}

EXPORT_SYMBOL(acpi_os_unmap_generic_address);