CPU hotplug notification handler acpi_cpu_soft_notify() and driver unbind method acpi_processor_remove() may be concurrently called. acpi_cpu_soft_notify() will access device->driver_data, but that data structure may be destroyed by acpi_processor_remove(). On the other hand, acpi_cpu_soft_notify() is always called under protection of get_online_cpus(), so use get_online_cpus() to serialize all accesses and modifications to device->driver_data. Signed-off-by: Jiang Liu <jiang.liu@xxxxxxxxxx> --- drivers/acpi/processor_driver.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c index 28add34..7d6d794 100644 --- a/drivers/acpi/processor_driver.c +++ b/drivers/acpi/processor_driver.c @@ -616,6 +616,8 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device) return 0; BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0)); + /* block CPU online/offline operations */ + get_online_cpus(); result = acpi_processor_link(device, pr); if (result) goto err_unlock; @@ -624,6 +626,7 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device) if (result) goto err_unlink; } + put_online_cpus(); return 0; @@ -654,8 +657,10 @@ static int acpi_processor_remove(struct acpi_device *device, int type) return -EINVAL; } + get_online_cpus(); acpi_processor_stop(device, pr); acpi_processor_unlink(device, pr); + put_online_cpus(); free: device->driver_data = NULL; -- 1.7.9.5 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>