ACPICA: Fix namespace race condition (5d3131f5) · Commits · e / devices / android_kernel_teracube_emerald

Fixes a race condition between method execution and namespace walks that can possibly fault. Problem was apparently introduced in version 20100528 as a result of a performance optimization that reduces the number of namespace walks upon method exit by using the delete_namespace_subtree function instead of the delete_namespace_by_owner function used previously. Bug is in the delete_namespace_subtree function. Signed-off-by:

Dana Myers <dana.myers@oracle.com> Signed-off-by:

Bob Moore <robert.moore@intel.com> Signed-off-by:

Lin Ming <ming.m.lin@intel.com> Reviewed-by:

Rafael Wysocki <rjw@sisk.pl> Signed-off-by:

Len Brown <len.brown@intel.com>

drivers/acpi/acpica/nsalloc.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -341,6 +341,7 @@ void acpi_ns_delete_namespace_subtree(struct acpi_namespace_node *parent_node)
		{
		struct acpi_namespace_node *child_node = NULL;
		u32 level = 1;
		acpi_status status;

		ACPI_FUNCTION_TRACE(ns_delete_namespace_subtree);

		@@ -348,6 +349,13 @@ void acpi_ns_delete_namespace_subtree(struct acpi_namespace_node *parent_node)
		return_VOID;
		}

		/* Lock namespace for possible update */

		status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
		if (ACPI_FAILURE(status)) {
		return_VOID;
		}

		/*
		* Traverse the tree of objects until we bubble back up
		* to where we started.
		@@ -397,6 +405,7 @@ void acpi_ns_delete_namespace_subtree(struct acpi_namespace_node *parent_node)
		}
		}

		(void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
		return_VOID;
		}