Re: [PATCH] acpi: close race in toshiba_acpi driver

[Len Brown <lenb@kernel.org>]

applied.

thanks,
-Len

On Fri, 28 Nov 2008, Arjan van de Ven wrote:

> 
> From 5d8af90c16de14f5d27c9d0b63118277941ebb4e Mon Sep 17 00:00:00 2001
> From: Arjan van de Ven <arjan@linux.intel.com>
> Date: Fri, 28 Nov 2008 08:14:14 -0800
> Subject: [PATCH] acpi: close race in toshiba_acpi driver
> 
> the toshiba ACPI driver will, in a failure case, free the rfkill state
> before stopping the polling timer that would use this state. More interesting,
> in the same failure case handling, it calls the exit function, which also
> frees the rfkill state, but after stopping the polling.
> 
> If the race happens, a NULL pointer is passed to rfkill_force_state()
> which then causes a nice dereference.
> 
> Fix the race by just not doing the too-early freeing of the rfkill state.
> 
> This appears to be the cause of a hot issue on kerneloops.org; while I
> have no solid evidence of that this patch will fix the issue, the race
> appears rather real.
> 
> Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
> ---
>  drivers/acpi/toshiba_acpi.c |    2 --
>  1 files changed, 0 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/acpi/toshiba_acpi.c b/drivers/acpi/toshiba_acpi.c
> index 66aac06..25f531d 100644
> --- a/drivers/acpi/toshiba_acpi.c
> +++ b/drivers/acpi/toshiba_acpi.c
> @@ -848,8 +848,6 @@ static int __init toshiba_acpi_init(void)
>  	ret = input_register_polled_device(toshiba_acpi.poll_dev);
>  	if (ret) {
>  		printk(MY_ERR "unable to register kill-switch input device\n");
> -		rfkill_free(toshiba_acpi.rfk_dev);
> -		toshiba_acpi.rfk_dev = NULL;
>  		toshiba_acpi_exit();
>  		return ret;
>  	}
> -- 
> 1.6.0.4
> 
> 
> -- 
> Arjan van de Ven 	Intel Open Source Technology Centre
> For development, discussion and tips for power savings, 
> visit http://www.lesswatts.org
>