The functions battery_hook_add_battery(), battery_hook_remove_battery(), and sysfs_remove_battery() already acquire locks, so their internal accesses are safe.
acpi_battery_refresh() does check battery->bat, but its child functions (sysfs_add_battery() and sysfs_remove_battery()) already handle locking.
In acpi_battery_notify(), battery->bat has no lock. However, the check of battery->bat is at the very end of the function. During earlier calls, battery->bat has already been protected by locks, so re-entry will not cause issues.