diff options
| author | Lv Zheng <[email protected]> | 2013-09-13 13:13:39 +0800 |
|---|---|---|
| committer | Rafael J. Wysocki <[email protected]> | 2013-09-30 19:46:11 +0200 |
| commit | 5ac557ef4951ea4b131ae45b08434546cb386ac5 (patch) | |
| tree | d8da98834adf86a8debf62e26405694dd69fc2e1 /net/lapb/lapb_iface.c | |
| parent | 6b68f03f95e3f0aeea0c47799aecb296276a7cd6 (diff) | |
ACPI / IPMI: Fix race caused by the unprotected ACPI IPMI transfers
This patch fixes races caused by unprotected ACPI IPMI transfers.
We can see that the following crashes may occur:
1. There is no tx_msg_lock held for iterating tx_msg_list in
ipmi_flush_tx_msg() while it may be unlinked on failure in
parallel in acpi_ipmi_space_handler() under tx_msg_lock.
2. There is no lock held for freeing tx_msg in acpi_ipmi_space_handler()
while it may be accessed in parallel in ipmi_flush_tx_msg() and
ipmi_msg_handler().
This patch enhances tx_msg_lock to protect all tx_msg accesses to solve
this issue. Then tx_msg_lock is always held around complete() and tx_msg
accesses.
Signed-off-by: Lv Zheng <[email protected]>
Reviewed-by: Huang Ying <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
Diffstat (limited to 'net/lapb/lapb_iface.c')
0 files changed, 0 insertions, 0 deletions