[PATCH AUTOSEL 4.9 22/90] ACPI: EC: Reference count query handlers under lock

[Sasha Levin]

From: "Rafael J. Wysocki" <rafael.j.wyso...@intel.com>

[ Upstream commit 3df663a147fe077a6ee8444ec626738946e65547 ]

There is a race condition in acpi_ec_get_query_handler()
theoretically allowing query handlers to go away before refernce
counting them.

In order to avoid it, call kref_get() on query handlers under
ec->mutex.

Also simplify the code a bit while at it.

Signed-off-by: Rafael J. Wysocki <rafael.j.wyso...@intel.com>
Signed-off-by: Sasha Levin <sas...@kernel.org>
---
 drivers/acpi/ec.c | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 307b3e28f34ce..8781b5dc97f1c 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1049,29 +1049,21 @@ void acpi_ec_unblock_transactions(void)
 /* --------------------------------------------------------------------------
                                 Event Management
    -------------------------------------------------------------------------- 
*/
-static struct acpi_ec_query_handler *
-acpi_ec_get_query_handler(struct acpi_ec_query_handler *handler)
-{
-       if (handler)
-               kref_get(&handler->kref);
-       return handler;
-}
-
 static struct acpi_ec_query_handler *
 acpi_ec_get_query_handler_by_value(struct acpi_ec *ec, u8 value)
 {
        struct acpi_ec_query_handler *handler;
-       bool found = false;
 
        mutex_lock(&ec->mutex);
        list_for_each_entry(handler, &ec->list, node) {
                if (value == handler->query_bit) {
-                       found = true;
-                       break;
+                       kref_get(&handler->kref);
+                       mutex_unlock(&ec->mutex);
+                       return handler;
                }
        }
        mutex_unlock(&ec->mutex);
-       return found ? acpi_ec_get_query_handler(handler) : NULL;
+       return NULL;
 }
 
 static void acpi_ec_query_handler_release(struct kref *kref)
-- 
2.25.1