toshiba_acpi: close race in toshiba_acpi driver

the toshiba ACPI driver will, in a failure case, free the rfkill state
before stopping the polling timer that would use this state. More interesting,
in the same failure case handling, it calls the exit function, which also
frees the rfkill state, but after stopping the polling.

If the race happens, a NULL pointer is passed to rfkill_force_state()
which then causes a nice dereference.

Fix the race by just not doing the too-early freeing of the rfkill state.

This appears to be the cause of a hot issue on kerneloops.org; while I
have no solid evidence of that this patch will fix the issue, the race
appears rather real.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>

diff --git a/drivers/acpi/toshiba_acpi.c b/drivers/acpi/toshiba_acpi.c
index 66aac06f2ac5abd47ec7e5ecf7267f2b3c6e30aa..25f531d892deacbb5082b0696f0ba460c48a5494 100644 (file)
--- a/drivers/acpi/toshiba_acpi.c
+++ b/drivers/acpi/toshiba_acpi.c
@@ -848,8 +848,6 @@ static int __init toshiba_acpi_init(void)
        ret = input_register_polled_device(toshiba_acpi.poll_dev);
        if (ret) {
                printk(MY_ERR "unable to register kill-switch input device\n");
-               rfkill_free(toshiba_acpi.rfk_dev);
-               toshiba_acpi.rfk_dev = NULL;
                toshiba_acpi_exit();
                return ret;
        }