Commit 8112006f authored Jun 16, 2013 by Rafael J. Wysocki

ACPI / dock: Take ACPI scan lock in write_undock()



Since commit 3757b948 (ACPI / hotplug: Fix concurrency issues and
memory leaks) acpi_bus_scan() and acpi_bus_trim() must always be
called under acpi_scan_lock, but currently the following scenario
violating that requirement is possible:

 write_undock()
  handle_eject_request()
   hotplug_dock_devices()
    dock_remove_acpi_device()
     acpi_bus_trim()

Fix that by making write_undock() acquire acpi_scan_lock before
calling handle_eject_request() as appropriate (begin_undock() is
under the lock too in analogy with acpi_dock_deferred_cb()).

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: 3.9+ <stable@vger.kernel.org>
Acked-by: Toshi Kani <toshi.kani@hp.com>

parent 204ebc0a

drivers/acpi/dock.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -868,8 +868,10 @@ static ssize_t write_undock(struct device dev, struct device_attribute attr,
		if (!count)
		return -EINVAL;

		acpi_scan_lock_acquire();
		begin_undock(dock_station);
		ret = handle_eject_request(dock_station, ACPI_NOTIFY_EJECT_REQUEST);
		acpi_scan_lock_release();
		return ret ? ret: count;
		}
		static DEVICE_ATTR(undock, S_IWUSR, NULL, write_undock);

Admin message