summaryrefslogtreecommitdiffstats
path: root/drivers/acpi
diff options
context:
space:
mode:
authorArjan van de Ven <arjan@linux.intel.com>2008-11-28 08:19:09 -0800
committerLen Brown <len.brown@intel.com>2008-11-28 14:21:53 -0500
commit23d0a65cf229acd273b6f5a325c34d758a90d592 (patch)
tree1aa4d01e2cb47718228e042ce600ebbbaba02aea /drivers/acpi
parente899b6485c332aa2d7510739507ab5e5d7b28e59 (diff)
downloadlinux-23d0a65cf229acd273b6f5a325c34d758a90d592.tar.gz
linux-23d0a65cf229acd273b6f5a325c34d758a90d592.tar.bz2
linux-23d0a65cf229acd273b6f5a325c34d758a90d592.zip
toshiba_acpi: close race in toshiba_acpi driver
the toshiba ACPI driver will, in a failure case, free the rfkill state before stopping the polling timer that would use this state. More interesting, in the same failure case handling, it calls the exit function, which also frees the rfkill state, but after stopping the polling. If the race happens, a NULL pointer is passed to rfkill_force_state() which then causes a nice dereference. Fix the race by just not doing the too-early freeing of the rfkill state. This appears to be the cause of a hot issue on kerneloops.org; while I have no solid evidence of that this patch will fix the issue, the race appears rather real. Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers/acpi')
-rw-r--r--drivers/acpi/toshiba_acpi.c2
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/acpi/toshiba_acpi.c b/drivers/acpi/toshiba_acpi.c
index 66aac06f2ac5..25f531d892de 100644
--- a/drivers/acpi/toshiba_acpi.c
+++ b/drivers/acpi/toshiba_acpi.c
@@ -848,8 +848,6 @@ static int __init toshiba_acpi_init(void)
ret = input_register_polled_device(toshiba_acpi.poll_dev);
if (ret) {
printk(MY_ERR "unable to register kill-switch input device\n");
- rfkill_free(toshiba_acpi.rfk_dev);
- toshiba_acpi.rfk_dev = NULL;
toshiba_acpi_exit();
return ret;
}