* [PATCH] ACPI/sbshc: Fix rare oops when removing modules.
@ 2018-10-01 2:53 Ronald Tschalär
2018-10-03 9:26 ` Rafael J. Wysocki
0 siblings, 1 reply; 2+ messages in thread
From: Ronald Tschalär @ 2018-10-01 2:53 UTC (permalink / raw)
To: Rafael J. Wysocki, Len Brown; +Cc: Zhang Rui, linux-acpi, linux-kernel
There was a small race when removing the sbshc module where
smbus_alarm() had queued acpi_smbus_callback() for deferred execution
but it hadn't been run yet, so that when it did run hc had been freed
and the module unloaded, resulting in an invalid paging request.
A similar race existed when removing the sbs module with regards to
acpi_sbs_callback() (which is called from acpi_smbus_callback()).
We therefore need to ensure no callbacks are pending or executing before
the cleanups are done and the modules are removed.
Signed-off-by: Ronald Tschalär <ronald@innovation.ch>
---
drivers/acpi/osl.c | 1 +
drivers/acpi/sbshc.c | 2 ++
2 files changed, 3 insertions(+)
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 8df9abfa947b..9d139727f164 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -1129,6 +1129,7 @@ void acpi_os_wait_events_complete(void)
flush_workqueue(kacpid_wq);
flush_workqueue(kacpi_notify_wq);
}
+EXPORT_SYMBOL(acpi_os_wait_events_complete);
struct acpi_hp_work {
struct work_struct work;
diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
index 7a3431018e0a..5008ead4609a 100644
--- a/drivers/acpi/sbshc.c
+++ b/drivers/acpi/sbshc.c
@@ -196,6 +196,7 @@ int acpi_smbus_unregister_callback(struct acpi_smb_hc *hc)
hc->callback = NULL;
hc->context = NULL;
mutex_unlock(&hc->lock);
+ acpi_os_wait_events_complete();
return 0;
}
@@ -292,6 +293,7 @@ static int acpi_smbus_hc_remove(struct acpi_device *device)
hc = acpi_driver_data(device);
acpi_ec_remove_query_handler(hc->ec, hc->query_bit);
+ acpi_os_wait_events_complete();
kfree(hc);
device->driver_data = NULL;
return 0;
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ACPI/sbshc: Fix rare oops when removing modules.
2018-10-01 2:53 [PATCH] ACPI/sbshc: Fix rare oops when removing modules Ronald Tschalär
@ 2018-10-03 9:26 ` Rafael J. Wysocki
0 siblings, 0 replies; 2+ messages in thread
From: Rafael J. Wysocki @ 2018-10-03 9:26 UTC (permalink / raw)
To: Ronald Tschalär; +Cc: Len Brown, Zhang Rui, linux-acpi, linux-kernel
On Monday, October 1, 2018 4:53:13 AM CEST Ronald Tschalär wrote:
> There was a small race when removing the sbshc module where
> smbus_alarm() had queued acpi_smbus_callback() for deferred execution
> but it hadn't been run yet, so that when it did run hc had been freed
> and the module unloaded, resulting in an invalid paging request.
>
> A similar race existed when removing the sbs module with regards to
> acpi_sbs_callback() (which is called from acpi_smbus_callback()).
>
> We therefore need to ensure no callbacks are pending or executing before
> the cleanups are done and the modules are removed.
>
> Signed-off-by: Ronald Tschalär <ronald@innovation.ch>
> ---
> drivers/acpi/osl.c | 1 +
> drivers/acpi/sbshc.c | 2 ++
> 2 files changed, 3 insertions(+)
>
> diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
> index 8df9abfa947b..9d139727f164 100644
> --- a/drivers/acpi/osl.c
> +++ b/drivers/acpi/osl.c
> @@ -1129,6 +1129,7 @@ void acpi_os_wait_events_complete(void)
> flush_workqueue(kacpid_wq);
> flush_workqueue(kacpi_notify_wq);
> }
> +EXPORT_SYMBOL(acpi_os_wait_events_complete);
>
> struct acpi_hp_work {
> struct work_struct work;
> diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
> index 7a3431018e0a..5008ead4609a 100644
> --- a/drivers/acpi/sbshc.c
> +++ b/drivers/acpi/sbshc.c
> @@ -196,6 +196,7 @@ int acpi_smbus_unregister_callback(struct acpi_smb_hc *hc)
> hc->callback = NULL;
> hc->context = NULL;
> mutex_unlock(&hc->lock);
> + acpi_os_wait_events_complete();
> return 0;
> }
>
> @@ -292,6 +293,7 @@ static int acpi_smbus_hc_remove(struct acpi_device *device)
>
> hc = acpi_driver_data(device);
> acpi_ec_remove_query_handler(hc->ec, hc->query_bit);
> + acpi_os_wait_events_complete();
> kfree(hc);
> device->driver_data = NULL;
> return 0;
>
Applied, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-10-03 9:29 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-10-01 2:53 [PATCH] ACPI/sbshc: Fix rare oops when removing modules Ronald Tschalär
2018-10-03 9:26 ` Rafael J. Wysocki
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).