Unverified Commit ef5d1e35 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12665 v2 CVE-2024-49955 

Merge Pull Request from: @ci-robot 
 
PR sync from: liwei <liwei728@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/NDU53XJOYFZHTGEQISBNQVDSMPVGVYPI/ 
Armin Wolf (2):
  ACPI: battery: Simplify battery hook locking
  ACPI: battery: Fix possible crash when unregistering a battery hook


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/IAYRCN 
 
Link:https://gitee.com/openeuler/kernel/pulls/12665

 

Reviewed-by: default avatarXiongfeng Wang <wangxiongfeng2@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 9ef5a47c 817ea23e

drivers/acpi/battery.c

+17 −11
Original line number Diff line number Diff line
@@ -689,27 +689,34 @@ static LIST_HEAD(acpi_battery_list); 
static LIST_HEAD(battery_hook_list);

static DEFINE_MUTEX(hook_mutex);



static void __battery_hook_unregister(struct acpi_battery_hook *hook, int lock)

static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook)

{

	struct acpi_battery *battery;



	/*

	 * In order to remove a hook, we first need to

	 * de-register all the batteries that are registered.

	 */

	if (lock)

		mutex_lock(&hook_mutex);

	list_for_each_entry(battery, &acpi_battery_list, list) {

		hook->remove_battery(battery->bat);

	}

	list_del(&hook->list);

	if (lock)

		mutex_unlock(&hook_mutex);

	list_del_init(&hook->list);



	pr_info("extension unregistered: %s\n", hook->name);

}



void battery_hook_unregister(struct acpi_battery_hook *hook)

{

	__battery_hook_unregister(hook, 1);

	mutex_lock(&hook_mutex);

	/*

	 * Ignore already unregistered battery hooks. This might happen

	 * if a battery hook was previously unloaded due to an error when

	 * adding a new battery.

	 */

	if (!list_empty(&hook->list))

		battery_hook_unregister_unlocked(hook);



	mutex_unlock(&hook_mutex);

}

EXPORT_SYMBOL_GPL(battery_hook_unregister);
@@ -718,7 +725,6 @@ void battery_hook_register(struct acpi_battery_hook *hook) 
	struct acpi_battery *battery;



	mutex_lock(&hook_mutex);

	INIT_LIST_HEAD(&hook->list);

	list_add(&hook->list, &battery_hook_list);

	/*

	 * Now that the driver is registered, we need
@@ -735,7 +741,7 @@ void battery_hook_register(struct acpi_battery_hook *hook) 
			 * hooks.

			 */

			pr_err("extension failed to load: %s", hook->name);

			__battery_hook_unregister(hook, 0);

			battery_hook_unregister_unlocked(hook);

			goto end;

		}

	}
@@ -772,7 +778,7 @@ static void battery_hook_add_battery(struct acpi_battery *battery) 
			 */

			pr_err("error in extension, unloading: %s",

					hook_node->name);

			__battery_hook_unregister(hook_node, 0);

			battery_hook_unregister_unlocked(hook_node);

		}

	}

	mutex_unlock(&hook_mutex);
@@ -805,7 +811,7 @@ static void __exit battery_hook_exit(void) 
	 * need to remove the hooks.

	 */

	list_for_each_entry_safe(hook, ptr, &battery_hook_list, list) {

		__battery_hook_unregister(hook, 1);

		battery_hook_unregister(hook);

	}

	mutex_destroy(&hook_mutex);

}