Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ac557ef authored by Lv Zheng's avatar Lv Zheng Committed by Rafael J. Wysocki
Browse files

ACPI / IPMI: Fix race caused by the unprotected ACPI IPMI transfers 



This patch fixes races caused by unprotected ACPI IPMI transfers.

We can see that the following crashes may occur:
 1. There is no tx_msg_lock held for iterating tx_msg_list in
    ipmi_flush_tx_msg() while it may be unlinked on failure in
    parallel in acpi_ipmi_space_handler() under tx_msg_lock.
 2. There is no lock held for freeing tx_msg in acpi_ipmi_space_handler()
    while it may be accessed in parallel in ipmi_flush_tx_msg() and
    ipmi_msg_handler().

This patch enhances tx_msg_lock to protect all tx_msg accesses to solve
this issue.  Then tx_msg_lock is always held around complete() and tx_msg
accesses.

Signed-off-by: default avatarLv Zheng <lv.zheng@intel.com>
Reviewed-by: default avatarHuang Ying <ying.huang@intel.com>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
parent 6b68f03f

drivers/acpi/acpi_ipmi.c

+6 −2
Original line number Diff line number Diff line
@@ -228,11 +228,14 @@ static void ipmi_flush_tx_msg(struct acpi_ipmi_device *ipmi) 
	struct acpi_ipmi_msg *tx_msg, *temp;

	int count = HZ / 10;

	struct pnp_dev *pnp_dev = ipmi->pnp_dev;

	unsigned long flags;



	spin_lock_irqsave(&ipmi->tx_msg_lock, flags);

	list_for_each_entry_safe(tx_msg, temp, &ipmi->tx_msg_list, head) {

		/* wake up the sleep thread on the Tx msg */

		complete(&tx_msg->tx_complete);

	}

	spin_unlock_irqrestore(&ipmi->tx_msg_lock, flags);



	/* wait for about 100ms to flush the tx message list */

	while (count--) {
@@ -266,11 +269,10 @@ static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data) 
		}

	}



	spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);

	if (!msg_found) {

		dev_warn(&pnp_dev->dev, "Unexpected response (msg id %ld) is "

			"returned.\n", msg->msgid);

		goto out_msg;

		goto out_lock;

	}



	/* copy the response data to Rx_data buffer */
@@ -284,6 +286,8 @@ static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data) 
		tx_msg->msg_done = 1;

	}

	complete(&tx_msg->tx_complete);

out_lock:

	spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);

out_msg:

	ipmi_free_recv_msg(msg);

};