From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> mainline inclusion from mainline-v6.4-rc1 commit faae443738c6f0dac9b0d3d11d108f6911a989a9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NZ3E CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Currently, acpi_device_remove_notify_handler() may return while the notify handler being removed is still running which may allow the module holding that handler to be torn down prematurely. Address this issue by making acpi_device_remove_notify_handler() wait for the handling of all the ACPI events in progress to complete before returning. Fixes: 5894b0c46e49 ("ACPI / scan: Move bus operations and notification routines to bus.c") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Conflicts: drivers/acpi/bus.c Signed-off-by: liwei <liwei728@huawei.com> --- drivers/acpi/bus.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c index d8086d49ce6b..538f13dde5d9 100644 --- a/drivers/acpi/bus.c +++ b/drivers/acpi/bus.c @@ -477,6 +477,8 @@ static void acpi_device_remove_notify_handler(struct acpi_device *device) else acpi_remove_notify_handler(device->handle, ACPI_DEVICE_NOTIFY, acpi_device_notify); + + acpi_os_wait_events_complete(); } /* Handle events targeting \_SB device (at present only graceful shutdown) */ -- 2.25.1