From: "Rafael J. Wysocki" rafael.j.wysocki@intel.com

mainline inclusion from mainline-v6.4-rc1 commit faae443738c6f0dac9b0d3d11d108f6911a989a9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NZ3E CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

--------------------------------

Currently, acpi_device_remove_notify_handler() may return while the notify handler being removed is still running which may allow the module holding that handler to be torn down prematurely.

Address this issue by making acpi_device_remove_notify_handler() wait for the handling of all the ACPI events in progress to complete before returning.

Fixes: 5894b0c46e49 ("ACPI / scan: Move bus operations and notification routines to bus.c") Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com

Conflicts: drivers/acpi/bus.c Signed-off-by: liwei liwei728@huawei.com --- drivers/acpi/bus.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c index d8086d49ce6b..538f13dde5d9 100644 --- a/drivers/acpi/bus.c +++ b/drivers/acpi/bus.c @@ -477,6 +477,8 @@ static void acpi_device_remove_notify_handler(struct acpi_device *device) else acpi_remove_notify_handler(device->handle, ACPI_DEVICE_NOTIFY, acpi_device_notify); + + acpi_os_wait_events_complete(); }

/* Handle events targeting _SB device (at present only graceful shutdown) */