K 10
svn:author
V 3
avg
K 8
svn:date
V 27
2013-07-25T08:05:25.345402Z
K 7
svn:log
V 1296
protect acpi_battery_ioctl with Giant

This is a direct commit to stable/9.

There is a bug in the ACPICA version 20110527 that is used in stable/9.
The bug can lead to unprotected reference counting on ACPI objects
and eventually to a crash or a memory corruption.  The bug has been fixed
upstream and imported to head as of ACPICA version 20130328.
Unfortunately, ACPICA version in stable has not been updated,
so merging all past ACPICA versions or cherry-picking parts of 20130328
would be a big change with a risk of potential regressions.

During debugging it was determined that the most probable vector for the
bug was through concurrent calls to ACPI battery sysctls and ioctls.
The sysctls are already guarded by Giant (not MPSAFE), but ioctls could
execute in parallel to a sysctl call and to each other. All the calls
go through acpi_battery_ioctl function, which makes the actual calls
into ACPICA and those are the calls that lack necessary protection.
Thus preventing concurrency in acpi_battery_ioctl should prevent the
conditions that triggered the ACPICA bug.

Some additional details can be found in this thread:
http://thread.gmane.org/gmane.os.freebsd.devel.acpi/7707/focus=7774

Tested by:	kron24@gmail.com,
		David Demelier <demelier.david@gmail.com>
Approved by:	re (kib)

END