• Kenji Kaneshige's avatar
    PCI/ACPI: fix wrong ref count handling in acpi_pci_bind() · dacd2549
    Kenji Kaneshige authored
    The 'dev' field of struct acpi_pci_data is having a pointer to struct
    pci_dev without incrementing the reference counter. Because of this, I
    got the following kernel oops when I was doing some pci hotplug
    operations. This patch fixes this bug by replacing wrong hand-made
    pci_find_slot() with pci_get_slot() in acpi_pci_bind().
    
     BUG: unable to handle kernel NULL pointer dereference at 00000000000000e8
     IP: [<ffffffff803f0e9b>] acpi_pci_unbind+0xb1/0xdd
    
     Call Trace:
      [<ffffffff803ecee4>] acpi_bus_remove+0x54/0x68
      [<ffffffff803ecf6d>] acpi_bus_trim+0x75/0xe3
      [<ffffffffa0345ddd>] acpiphp_disable_slot+0x16d/0x1e0 [acpiphp]
      [<ffffffffa03441f0>] disable_slot+0x20/0x60 [acpiphp]
      [<ffffffff803cfc18>] power_write_file+0xc8/0x110
      [<ffffffff803c6a54>] pci_slot_attr_store+0x24/0x30
      [<ffffffff803469ce>] sysfs_write_file+0xce/0x140
      [<ffffffff802e94e7>] vfs_write+0xc7/0x170
      [<ffffffff802e9aa0>] sys_write+0x50/0x90
      [<ffffffff8020bd6b>] system_call_fastpath+0x16/0x1b
    Signed-off-by: default avatarKenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
    Reviewed-by: default avatarBjorn Helgaas <bjorn.helgaas@hp.com>
    Reviewed-by: default avatarAlex Chiang <achiang@hp.com>
    Tested-by: default avatarAlex Chiang <achiang@hp.com>
    Signed-off-by: default avatarLen Brown <len.brown@intel.com>
    dacd2549
pci_bind.c 9.08 KB