ACPI / IPMI: Fix race caused by the unprotected ACPI IPMI transfers (5ac557ef) · Commits · 戴 / test

This patch fixes races caused by unprotected ACPI IPMI transfers. We can see that the following crashes may occur: 1. There is no tx_msg_lock held for iterating tx_msg_list in ipmi_flush_tx_msg() while it may be unlinked on failure in parallel in acpi_ipmi_space_handler() under tx_msg_lock. 2. There is no lock held for freeing tx_msg in acpi_ipmi_space_handler() while it may be accessed in parallel in ipmi_flush_tx_msg() and ipmi_msg_handler(). This patch enhances tx_msg_lock to protect all tx_msg accesses to solve this issue. Then tx_msg_lock is always held around complete() and tx_msg accesses. Signed-off-by:

Lv Zheng <lv.zheng@intel.com> Reviewed-by:

Huang Ying <ying.huang@intel.com> Signed-off-by:

Rafael J. Wysocki <rafael.j.wysocki@intel.com>

drivers/acpi/acpi_ipmi.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -228,11 +228,14 @@ static void ipmi_flush_tx_msg(struct acpi_ipmi_device *ipmi)
		struct acpi_ipmi_msg tx_msg, temp;
		int count = HZ / 10;
		struct pnp_dev *pnp_dev = ipmi->pnp_dev;
		unsigned long flags;

		spin_lock_irqsave(&ipmi->tx_msg_lock, flags);
		list_for_each_entry_safe(tx_msg, temp, &ipmi->tx_msg_list, head) {
		/* wake up the sleep thread on the Tx msg */
		complete(&tx_msg->tx_complete);
		}
		spin_unlock_irqrestore(&ipmi->tx_msg_lock, flags);

		/* wait for about 100ms to flush the tx message list */
		while (count--) {
		@@ -266,11 +269,10 @@ static void ipmi_msg_handler(struct ipmi_recv_msg msg, void user_msg_data)
		}
		}

		spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
		if (!msg_found) {
		dev_warn(&pnp_dev->dev, "Unexpected response (msg id %ld) is "
		"returned.\n", msg->msgid);
		goto out_msg;
		goto out_lock;
		}

		/* copy the response data to Rx_data buffer */
		@@ -284,6 +286,8 @@ static void ipmi_msg_handler(struct ipmi_recv_msg msg, void user_msg_data)
		tx_msg->msg_done = 1;
		}
		complete(&tx_msg->tx_complete);
		out_lock:
		spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
		out_msg:
		ipmi_free_recv_msg(msg);
		};

Admin message