[ibm-acpi-devel] [PATCH 13/32] acpi-video: Fix acpi_video _register vs _unregister_backlight race

[Hans de Goede]

It is possible for a native backlight driver to load while
acpi_video_register is running, which may lead to
acpi_video_unregister_backlight being called while acpi_video_register
is running and the 2 racing against eachother.

The register_count variable protects against this, but not in a thread
safe manner, this commit adds locking to make this thread safe.

Signed-off-by: Hans de Goede <hdego...@redhat.com>
---
 drivers/acpi/video.c | 43 +++++++++++++++++++++----------------------
 1 file changed, 21 insertions(+), 22 deletions(-)

diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index b8053a8..fcc7c2e 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -79,6 +79,7 @@ static bool allow_duplicates;
 module_param(allow_duplicates, bool, 0644);
 
 static int register_count;
+static DEFINE_MUTEX(register_count_mutex);
 static struct mutex video_list_lock;
 static struct list_head video_bus_head;
 static int acpi_video_bus_add(struct acpi_device *device);
@@ -1931,14 +1932,15 @@ static int __init intel_opregion_present(void)
 
 int acpi_video_register(void)
 {
-       int ret;
+       int ret = 0;
 
+       mutex_lock(&register_count_mutex);
        if (register_count) {
                /*
                 * if the function of acpi_video_register is already called,
                 * don't register the acpi_vide_bus again and return no error.
                 */
-               return 0;
+               goto leave;
        }
 
        mutex_init(&video_list_lock);
@@ -1948,7 +1950,7 @@ int acpi_video_register(void)
 
        ret = acpi_bus_register_driver(&acpi_video_bus);
        if (ret)
-               return ret;
+               goto leave;
 
        /*
         * When the acpi_video_bus is loaded successfully, increase
@@ -1956,24 +1958,20 @@ int acpi_video_register(void)
         */
        register_count = 1;
 
-       return 0;
+leave:
+       mutex_unlock(&register_count_mutex);
+       return ret;
 }
 EXPORT_SYMBOL(acpi_video_register);
 
 void acpi_video_unregister(void)
 {
-       if (!register_count) {
-               /*
-                * If the acpi video bus is already unloaded, don't
-                * unload it again and return directly.
-                */
-               return;
+       mutex_lock(&register_count_mutex);
+       if (register_count) {
+               acpi_bus_unregister_driver(&acpi_video_bus);
+               register_count = 0;
        }
-       acpi_bus_unregister_driver(&acpi_video_bus);
-
-       register_count = 0;
-
-       return;
+       mutex_unlock(&register_count_mutex);
 }
 EXPORT_SYMBOL(acpi_video_unregister);
 
@@ -1981,13 +1979,14 @@ void acpi_video_unregister_backlight(void)
 {
        struct acpi_video_bus *video;
 
-       if (!register_count)
-               return;
-
-       mutex_lock(&video_list_lock);
-       list_for_each_entry(video, &video_bus_head, entry)
-               acpi_video_bus_unregister_backlight(video);
-       mutex_unlock(&video_list_lock);
+       mutex_lock(&register_count_mutex);
+       if (register_count) {
+               mutex_lock(&video_list_lock);
+               list_for_each_entry(video, &video_bus_head, entry)
+                       acpi_video_bus_unregister_backlight(video);
+               mutex_unlock(&video_list_lock);
+       }
+       mutex_unlock(&register_count_mutex);
 }
 EXPORT_SYMBOL(acpi_video_unregister_backlight);
 
-- 
2.4.2


------------------------------------------------------------------------------
_______________________________________________
ibm-acpi-devel mailing list
ibm-acpi-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/ibm-acpi-devel