diff options
| author | Ronald Tschalär <ronald@innovation.ch> | 2018-09-30 19:53:13 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-11-24 08:23:19 +0100 |
| commit | 4b9d1ab7112cfe9c3011acb661d98bad6c15a6dd (patch) | |
| tree | 407d6da11bd3d4a3ea0a34d2f2750b8b01343e1c /drivers/acpi | |
| parent | 3dc925644961b2e71ee5c6a8f10c11bd5443290e (diff) | |
ACPI / SBS: Fix rare oops when removing modules
[ Upstream commit 757c968c442397f1249bb775a7c8c03842e3e0c7 ]
There was a small race when removing the sbshc module where
smbus_alarm() had queued acpi_smbus_callback() for deferred execution
but it hadn't been run yet, so that when it did run hc had been freed
and the module unloaded, resulting in an invalid paging request.
A similar race existed when removing the sbs module with regards to
acpi_sbs_callback() (which is called from acpi_smbus_callback()).
We therefore need to ensure no callbacks are pending or executing before
the cleanups are done and the modules are removed.
Signed-off-by: Ronald Tschalär <ronald@innovation.ch>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/acpi')
| -rw-r--r-- | drivers/acpi/osl.c | 1 | ||||
| -rw-r--r-- | drivers/acpi/sbshc.c | 2 |
2 files changed, 3 insertions, 0 deletions
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c index 191e86c62037..9da7e7d874bd 100644 --- a/drivers/acpi/osl.c +++ b/drivers/acpi/osl.c @@ -1116,6 +1116,7 @@ void acpi_os_wait_events_complete(void) flush_workqueue(kacpid_wq); flush_workqueue(kacpi_notify_wq); } +EXPORT_SYMBOL(acpi_os_wait_events_complete); struct acpi_hp_work { struct work_struct work; diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c index 7a3431018e0a..5008ead4609a 100644 --- a/drivers/acpi/sbshc.c +++ b/drivers/acpi/sbshc.c @@ -196,6 +196,7 @@ int acpi_smbus_unregister_callback(struct acpi_smb_hc *hc) hc->callback = NULL; hc->context = NULL; mutex_unlock(&hc->lock); + acpi_os_wait_events_complete(); return 0; } @@ -292,6 +293,7 @@ static int acpi_smbus_hc_remove(struct acpi_device *device) hc = acpi_driver_data(device); acpi_ec_remove_query_handler(hc->ec, hc->query_bit); + acpi_os_wait_events_complete(); kfree(hc); device->driver_data = NULL; return 0; |