• L
    ACPI / IPMI: Fix race caused by the unprotected ACPI IPMI transfers · 5ac557ef
    Lv Zheng 提交于
    This patch fixes races caused by unprotected ACPI IPMI transfers.
    
    We can see that the following crashes may occur:
     1. There is no tx_msg_lock held for iterating tx_msg_list in
        ipmi_flush_tx_msg() while it may be unlinked on failure in
        parallel in acpi_ipmi_space_handler() under tx_msg_lock.
     2. There is no lock held for freeing tx_msg in acpi_ipmi_space_handler()
        while it may be accessed in parallel in ipmi_flush_tx_msg() and
        ipmi_msg_handler().
    
    This patch enhances tx_msg_lock to protect all tx_msg accesses to solve
    this issue.  Then tx_msg_lock is always held around complete() and tx_msg
    accesses.
    Signed-off-by: NLv Zheng <lv.zheng@intel.com>
    Reviewed-by: NHuang Ying <ying.huang@intel.com>
    Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
    5ac557ef
acpi_ipmi.c 15.2 KB