ACPI: OSL: only free map once in osl.c
authorFrancesco Ruggeri <fruggeri@arista.com>
Wed, 20 Nov 2019 05:47:27 +0000 (21:47 -0800)
committerRafael J. Wysocki <rafael.j.wysocki@intel.com>
Fri, 29 Nov 2019 09:31:12 +0000 (10:31 +0100)
commit833a426cc471b6088011b3d67f1dc4e147614647
tree3ee114c6786b4cb9e9e908c185d4ca42faea0fc9
parent6e9f879684b46331f51d0c76ebee981c788417db
ACPI: OSL: only free map once in osl.c

acpi_os_map_cleanup checks map->refcount outside of acpi_ioremap_lock
before freeing the map. This creates a race condition the can result
in the map being freed more than once.
A panic can be caused by running

for ((i=0; i<10; i++))
do
        for ((j=0; j<100000; j++))
        do
                cat /sys/firmware/acpi/tables/data/BERT >/dev/null
        done &
done

This patch makes sure that only the process that drops the reference
to 0 does the freeing.

Fixes: b7c1fadd6c2e ("ACPI: Do not use krefs under a mutex in osl.c")
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
drivers/acpi/osl.c