1. 01 12月, 2008 38 次提交
  2. 29 11月, 2008 1 次提交
    • A
      toshiba_acpi: close race in toshiba_acpi driver · 23d0a65c
      Arjan van de Ven 提交于
      the toshiba ACPI driver will, in a failure case, free the rfkill state
      before stopping the polling timer that would use this state. More interesting,
      in the same failure case handling, it calls the exit function, which also
      frees the rfkill state, but after stopping the polling.
      
      If the race happens, a NULL pointer is passed to rfkill_force_state()
      which then causes a nice dereference.
      
      Fix the race by just not doing the too-early freeing of the rfkill state.
      
      This appears to be the cause of a hot issue on kerneloops.org; while I
      have no solid evidence of that this patch will fix the issue, the race
      appears rather real.
      Signed-off-by: NArjan van de Ven <arjan@linux.intel.com>
      Signed-off-by: NLen Brown <len.brown@intel.com>
      23d0a65c
  3. 27 11月, 2008 1 次提交