ACPI / Battery: Resolve the race condition in the sysfs_remove_battery()

Use battery->lock in sysfs_remove_battery() to make
checking, removing, and clearing bat.dev atomic.
This is necessary because sysfs_remove_battery() may
be invoked concurrently from different paths.

    https://bugzilla.kernel.org/show_bug.cgi?id=35642

Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>

1 files changed, 6 insertions, 1 deletions

diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 4ba339d0ea1..40bf01d42cc 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -573,11 +573,16 @@ static int sysfs_add_battery(struct acpi_battery *battery)
 
 static void sysfs_remove_battery(struct acpi_battery *battery)
 {
-        if (!battery->bat.dev)
+        mutex_lock(&battery->lock);
+        if (!battery->bat.dev) {
+                mutex_unlock(&battery->lock);
                 return;
+        }
+
         device_remove_file(battery->bat.dev, &alarm_attr);
         power_supply_unregister(&battery->bat);
         battery->bat.dev = NULL;
+        mutex_unlock(&battery->lock);
 }
 
 /*