Commit d43b7b99 authored Sep 30, 2018 by Ronald Tschalär Committed by Greg Kroah-Hartman Nov 24, 2019

ACPI / SBS: Fix rare oops when removing modules



[ Upstream commit 757c968c442397f1249bb775a7c8c03842e3e0c7 ]

There was a small race when removing the sbshc module where
smbus_alarm() had queued acpi_smbus_callback() for deferred execution
but it hadn't been run yet, so that when it did run hc had been freed
and the module unloaded, resulting in an invalid paging request.

A similar race existed when removing the sbs module with regards to
acpi_sbs_callback() (which is called from acpi_smbus_callback()).

We therefore need to ensure no callbacks are pending or executing before
the cleanups are done and the modules are removed.

Signed-off-by: Ronald TschalÃ¤r <ronald@innovation.ch>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 7f026063

drivers/acpi/osl.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -1132,6 +1132,7 @@ void acpi_os_wait_events_complete(void)
		flush_workqueue(kacpid_wq);
		flush_workqueue(kacpi_notify_wq);
		}
		EXPORT_SYMBOL(acpi_os_wait_events_complete);

		struct acpi_hp_work {
		struct work_struct work;

drivers/acpi/sbshc.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -196,6 +196,7 @@ int acpi_smbus_unregister_callback(struct acpi_smb_hc *hc)
		hc->callback = NULL;
		hc->context = NULL;
		mutex_unlock(&hc->lock);
		acpi_os_wait_events_complete();
		return 0;
		}

		@@ -292,6 +293,7 @@ static int acpi_smbus_hc_remove(struct acpi_device *device)

		hc = acpi_driver_data(device);
		acpi_ec_remove_query_handler(hc->ec, hc->query_bit);
		acpi_os_wait_events_complete();
		kfree(hc);
		device->driver_data = NULL;
		return 0;