UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

ACPI: OSL: only free map once in osl.c 

acpi_os_map_cleanup checks map->refcount outside of acpi_ioremap_lock
before freeing the map. This creates a race condition the can result
in the map being freed more than once.
A panic can be caused by running

for ((i=0; i<10; i++))
do
        for ((j=0; j<100000; j++))
        do
                cat /sys/firmware/acpi/tables/data/BERT >/dev/null
        done &
done

This patch makes sure that only the process that drops the reference
to 0 does the freeing.

Fixes: b7c1fadd6c ("ACPI: Do not use krefs under a mutex in osl.c")
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
Francesco Ruggeri 2019-11-19 21:47:27 -08:00 committed by Rafael J. Wysocki
parent 6e9f879684
commit 833a426cc4
1 changed files with 17 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/acpi/osl.c
View File

@ -374,19 +374,21 @@ void *__ref acpi_os_map_memory(acpi_physical_address phys, acpi_size size)
} }
EXPORT_SYMBOL_GPL(acpi_os_map_memory); EXPORT_SYMBOL_GPL(acpi_os_map_memory);
static void acpi_os_drop_map_ref(struct acpi_ioremap *map) /* Must be called with mutex_lock(&acpi_ioremap_lock) */
static unsigned long acpi_os_drop_map_ref(struct acpi_ioremap *map)
{ {
if (!--map->refcount) unsigned long refcount = --map->refcount;
if (!refcount)
list_del_rcu(&map->list); list_del_rcu(&map->list);
return refcount;
} }
static void acpi_os_map_cleanup(struct acpi_ioremap *map) static void acpi_os_map_cleanup(struct acpi_ioremap *map)
{ {
if (!map->refcount) { synchronize_rcu_expedited();
synchronize_rcu_expedited(); acpi_unmap(map->phys, map->virt);
acpi_unmap(map->phys, map->virt); kfree(map);
kfree(map);
}
} }
/** /**
@ -406,6 +408,7 @@ static void acpi_os_map_cleanup(struct acpi_ioremap *map)
void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size)
{ {
struct acpi_ioremap *map; struct acpi_ioremap *map;
unsigned long refcount;
if (!acpi_permanent_mmap) { if (!acpi_permanent_mmap) {
__acpi_unmap_table(virt, size); __acpi_unmap_table(virt, size);
@ -419,10 +422,11 @@ void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size)
WARN(true, PREFIX "%s: bad address %p\n", __func__, virt); WARN(true, PREFIX "%s: bad address %p\n", __func__, virt);
return; return;
} }
acpi_os_drop_map_ref(map); refcount = acpi_os_drop_map_ref(map);
mutex_unlock(&acpi_ioremap_lock); mutex_unlock(&acpi_ioremap_lock);
acpi_os_map_cleanup(map); if (!refcount)
acpi_os_map_cleanup(map);
} }
EXPORT_SYMBOL_GPL(acpi_os_unmap_iomem); EXPORT_SYMBOL_GPL(acpi_os_unmap_iomem);
@ -457,6 +461,7 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas)
{ {
u64 addr; u64 addr;
struct acpi_ioremap *map; struct acpi_ioremap *map;
unsigned long refcount;
if (gas->space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY) if (gas->space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY)
return; return;
@ -472,10 +477,11 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas)
mutex_unlock(&acpi_ioremap_lock); mutex_unlock(&acpi_ioremap_lock);
return; return;
} }
acpi_os_drop_map_ref(map); refcount = acpi_os_drop_map_ref(map);
mutex_unlock(&acpi_ioremap_lock); mutex_unlock(&acpi_ioremap_lock);
acpi_os_map_cleanup(map); if (!refcount)
acpi_os_map_cleanup(map);
} }
EXPORT_SYMBOL(acpi_os_unmap_generic_address); EXPORT_SYMBOL(acpi_os_unmap_generic_address);