From: Hans de Goede <hdegoede@redhat.com>
To: Mark Gross <markgross@kernel.org>,
Andy Shevchenko <andy@infradead.org>,
Yauhen Kharuzhy <jekhor@gmail.com>
Cc: Hans de Goede <hdegoede@redhat.com>, platform-driver-x86@vger.kernel.org
Subject: [PATCH 2/5] platform/x86: wmi: Fix driver->notify() vs ->probe() race
Date: Sun, 28 Nov 2021 20:00:28 +0100 [thread overview]
Message-ID: <20211128190031.405620-2-hdegoede@redhat.com> (raw)
In-Reply-To: <20211128190031.405620-1-hdegoede@redhat.com>
The driver core sets struct device->driver before calling out
to the bus' probe() method, this leaves a window where an ACPI
notify may happen on the WMI object before the driver's
probe() method has completed running, causing e.g. the
driver's notify() callback to get called with drvdata
not yet being set leading to a NULL pointer deref.
At a check for this to the WMI core, ensuring that the notify()
callback is not called before the driver is ready.
Fixes: 1686f5444546 ("platform/x86: wmi: Incorporate acpi_install_notify_handler")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---
drivers/platform/x86/wmi.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 46178e03aeca..02aba274c4bc 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -59,6 +59,7 @@ static_assert(__alignof__(struct guid_block) == 1);
enum { /* wmi_block flags */
WMI_READ_TAKES_NO_ARGS,
+ WMI_PROBED,
};
struct wmi_block {
@@ -1008,6 +1009,7 @@ static int wmi_dev_probe(struct device *dev)
}
}
+ set_bit(WMI_PROBED, &wblock->flags);
return 0;
probe_misc_failure:
@@ -1025,6 +1027,8 @@ static void wmi_dev_remove(struct device *dev)
struct wmi_block *wblock = dev_to_wblock(dev);
struct wmi_driver *wdriver = drv_to_wdrv(dev->driver);
+ clear_bit(WMI_PROBED, &wblock->flags);
+
if (wdriver->filter_callback) {
misc_deregister(&wblock->char_dev);
kfree(wblock->char_dev.name);
@@ -1322,7 +1326,7 @@ static void acpi_wmi_notify_handler(acpi_handle handle, u32 event,
return;
/* If a driver is bound, then notify the driver. */
- if (wblock->dev.dev.driver) {
+ if (test_bit(WMI_PROBED, &wblock->flags) && wblock->dev.dev.driver) {
struct wmi_driver *driver = drv_to_wdrv(wblock->dev.dev.driver);
struct acpi_buffer evdata = { ACPI_ALLOCATE_BUFFER, NULL };
acpi_status status;
--
2.33.1
next prev parent reply other threads:[~2021-11-28 19:02 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-28 19:00 [PATCH 1/5] platform/x86: wmi: Replace read_takes_no_args with a flags field Hans de Goede
2021-11-28 19:00 ` Hans de Goede [this message]
2021-11-28 19:00 ` [PATCH 3/5] platform/x86: wmi: Add no_notify_data flag to struct wmi_driver Hans de Goede
2021-11-28 19:00 ` [PATCH 4/5] platform/x86: lenovo-yogabook-wmi: Add driver for Lenovo Yoga Book Hans de Goede
2021-11-28 19:07 ` Hans de Goede
2021-11-28 19:00 ` [PATCH 5/5] platform/x86: lenovo-yogabook-wmi: Add support for hall sensor on the back Hans de Goede
2021-11-28 21:09 ` Yauhen Kharuzhy
2021-11-29 8:28 ` Hans de Goede
2021-11-29 9:28 ` Andy Shevchenko
2021-11-29 9:47 ` Hans de Goede
2021-11-30 14:52 ` [PATCH 1/5] platform/x86: wmi: Replace read_takes_no_args with a flags field Andy Shevchenko
2021-12-06 21:36 ` Hans de Goede
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211128190031.405620-2-hdegoede@redhat.com \
--to=hdegoede@redhat.com \
--cc=andy@infradead.org \
--cc=jekhor@gmail.com \
--cc=markgross@kernel.org \
--cc=platform-driver-x86@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.