[PATCH 0/4] cpufreq: Cleanups and governor module removal race fix

[PATCH 0/4] cpufreq: Cleanups and governor module removal race fix

[Rafael J. Wysocki]

Hi,

This series contains cleanup patches related to governor management,
mostly for cpufreq_parse_governor(), and a fix for a governor module
removal race.

Thanks,
Rafael

[PATCH 1/4] cpufreq: Clean up cpufreq_parse_governor()

[Rafael J. Wysocki]

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Drop an unnecessary local variable from cpufreq_parse_governor()
and rearrange the code in there to make it easier to follow.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
---
 drivers/cpufreq/cpufreq.c |   32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

Index: linux-pm/drivers/cpufreq/cpufreq.c
===================================================================
--- linux-pm.orig/drivers/cpufreq/cpufreq.c
+++ linux-pm/drivers/cpufreq/cpufreq.c
@@ -604,16 +604,15 @@ static struct cpufreq_governor *find_gov
 static int cpufreq_parse_governor(char *str_governor, unsigned int *policy,
 				struct cpufreq_governor **governor)
 {
-	int err = -EINVAL;
-
 	if (cpufreq_driver->setpolicy) {
 		if (!strncasecmp(str_governor, "performance", CPUFREQ_NAME_LEN)) {
 			*policy = CPUFREQ_POLICY_PERFORMANCE;
-			err = 0;
-		} else if (!strncasecmp(str_governor, "powersave",
-						CPUFREQ_NAME_LEN)) {
+			return 0;
+		}
+
+		if (!strncasecmp(str_governor, "powersave", CPUFREQ_NAME_LEN)) {
 			*policy = CPUFREQ_POLICY_POWERSAVE;
-			err = 0;
+			return 0;
 		}
 	} else {
 		struct cpufreq_governor *t;
@@ -621,26 +620,29 @@ static int cpufreq_parse_governor(char *
 		mutex_lock(&cpufreq_governor_mutex);
 
 		t = find_governor(str_governor);
-
-		if (t == NULL) {
+		if (!t) {
 			int ret;
 
 			mutex_unlock(&cpufreq_governor_mutex);
+
 			ret = request_module("cpufreq_%s", str_governor);
+			if (ret)
+				return -EINVAL;
+
 			mutex_lock(&cpufreq_governor_mutex);
 
-			if (ret == 0)
-				t = find_governor(str_governor);
+			t = find_governor(str_governor);
 		}
 
-		if (t != NULL) {
+		mutex_unlock(&cpufreq_governor_mutex);
+
+		if (t) {
 			*governor = t;
-			err = 0;
+			return 0;
 		}
-
-		mutex_unlock(&cpufreq_governor_mutex);
 	}
-	return err;
+
+	return -EINVAL;
 }
 
 /**

[PATCH 2/4] cpufreq: Pass policy pointer to cpufreq_parse_governor()

[Rafael J. Wysocki]

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Pass policy pointer to cpufreq_parse_governor() instead of passing
pointers to two members of it so as to make the code slightly more
straightforward.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
---
 drivers/cpufreq/cpufreq.c |   16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

Index: linux-pm/drivers/cpufreq/cpufreq.c
===================================================================
--- linux-pm.orig/drivers/cpufreq/cpufreq.c
+++ linux-pm/drivers/cpufreq/cpufreq.c
@@ -601,17 +601,17 @@ static struct cpufreq_governor *find_gov
 /**
  * cpufreq_parse_governor - parse a governor string
  */
-static int cpufreq_parse_governor(char *str_governor, unsigned int *policy,
-				struct cpufreq_governor **governor)
+static int cpufreq_parse_governor(char *str_governor,
+				  struct cpufreq_policy *policy)
 {
 	if (cpufreq_driver->setpolicy) {
 		if (!strncasecmp(str_governor, "performance", CPUFREQ_NAME_LEN)) {
-			*policy = CPUFREQ_POLICY_PERFORMANCE;
+			policy->policy = CPUFREQ_POLICY_PERFORMANCE;
 			return 0;
 		}
 
 		if (!strncasecmp(str_governor, "powersave", CPUFREQ_NAME_LEN)) {
-			*policy = CPUFREQ_POLICY_POWERSAVE;
+			policy->policy = CPUFREQ_POLICY_POWERSAVE;
 			return 0;
 		}
 	} else {
@@ -637,7 +637,7 @@ static int cpufreq_parse_governor(char *
 		mutex_unlock(&cpufreq_governor_mutex);
 
 		if (t) {
-			*governor = t;
+			policy->governor = t;
 			return 0;
 		}
 	}
@@ -762,8 +762,7 @@ static ssize_t store_scaling_governor(st
 	if (ret != 1)
 		return -EINVAL;
 
-	if (cpufreq_parse_governor(str_governor, &new_policy.policy,
-						&new_policy.governor))
+	if (cpufreq_parse_governor(str_governor, &new_policy))
 		return -EINVAL;
 
 	ret = cpufreq_set_policy(policy, &new_policy);
@@ -1046,8 +1045,7 @@ static int cpufreq_init_policy(struct cp
 		if (policy->last_policy)
 			new_policy.policy = policy->last_policy;
 		else
-			cpufreq_parse_governor(gov->name, &new_policy.policy,
-					       NULL);
+			cpufreq_parse_governor(gov->name, &new_policy);
 	}
 	/* set default policy */
 	return cpufreq_set_policy(policy, &new_policy);

[PATCH 3/4] cpufreq: Fix governor module removal race

[Rafael J. Wysocki]

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

It is possible to remove a cpufreq governor module after
cpufreq_parse_governor() has returned success in
store_scaling_governor() and before cpufreq_set_policy()
acquires a reference to it, because the governor list is
not protected during that period and nothing prevents the
governor from being unregistered then.  The pointer to the
governor structure coming from cpufreq_parse_governor() may
become stale as a result of that.

Prevent that from happening by acquiring an extra reference
to the governor module temporarily in cpufreq_parse_governor(),
under cpufreq_governor_mutex, and dropping it in
store_scaling_governor(), when cpufreq_set_policy() returns.

Note that the second cpufreq_parse_governor() call site is fine,
because it only cares about the policy member of new_policy.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
---
 drivers/cpufreq/cpufreq.c |    8 ++++++++
 1 file changed, 8 insertions(+)

Index: linux-pm/drivers/cpufreq/cpufreq.c
===================================================================
--- linux-pm.orig/drivers/cpufreq/cpufreq.c
+++ linux-pm/drivers/cpufreq/cpufreq.c
@@ -607,11 +607,13 @@ static int cpufreq_parse_governor(char *
 	if (cpufreq_driver->setpolicy) {
 		if (!strncasecmp(str_governor, "performance", CPUFREQ_NAME_LEN)) {
 			policy->policy = CPUFREQ_POLICY_PERFORMANCE;
+			policy->governor = NULL;
 			return 0;
 		}
 
 		if (!strncasecmp(str_governor, "powersave", CPUFREQ_NAME_LEN)) {
 			policy->policy = CPUFREQ_POLICY_POWERSAVE;
+			policy->governor = NULL;
 			return 0;
 		}
 	} else {
@@ -633,6 +635,8 @@ static int cpufreq_parse_governor(char *
 
 			t = find_governor(str_governor);
 		}
+		if (t && !try_module_get(t->owner))
+			t = NULL;
 
 		mutex_unlock(&cpufreq_governor_mutex);
 
@@ -766,6 +770,10 @@ static ssize_t store_scaling_governor(st
 		return -EINVAL;
 
 	ret = cpufreq_set_policy(policy, &new_policy);
+
+	if (new_policy.governor)
+		module_put(new_policy.governor->owner);
+
 	return ret ? ret : count;
 }
 

[PATCH 4/4] cpufreq: Drop pointless return statement

[Rafael J. Wysocki]

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Drop a pointless return statement from cpufreq_unregister_governor().

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
---
 drivers/cpufreq/cpufreq.c |    1 -
 1 file changed, 1 deletion(-)

Index: linux-pm/drivers/cpufreq/cpufreq.c
===================================================================
--- linux-pm.orig/drivers/cpufreq/cpufreq.c
+++ linux-pm/drivers/cpufreq/cpufreq.c
@@ -2168,7 +2168,6 @@ void cpufreq_unregister_governor(struct
 	mutex_lock(&cpufreq_governor_mutex);
 	list_del(&governor->governor_list);
 	mutex_unlock(&cpufreq_governor_mutex);
-	return;
 }
 EXPORT_SYMBOL_GPL(cpufreq_unregister_governor);
 

Re: [PATCH 1/4] cpufreq: Clean up cpufreq_parse_governor()

[Viresh Kumar]

On 23-11-17, 01:23, Rafael J. Wysocki wrote:
> From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> 
> Drop an unnecessary local variable from cpufreq_parse_governor()
> and rearrange the code in there to make it easier to follow.
> 
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> ---
>  drivers/cpufreq/cpufreq.c |   32 +++++++++++++++++---------------
>  1 file changed, 17 insertions(+), 15 deletions(-)

Acked-by: Viresh Kumar <viresh.kumar@linaro.org>

-- 
viresh

Re: [PATCH 2/4] cpufreq: Pass policy pointer to cpufreq_parse_governor()

[Viresh Kumar]

On 23-11-17, 01:24, Rafael J. Wysocki wrote:
> From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> 
> Pass policy pointer to cpufreq_parse_governor() instead of passing
> pointers to two members of it so as to make the code slightly more
> straightforward.
> 
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> ---
>  drivers/cpufreq/cpufreq.c |   16 +++++++---------
>  1 file changed, 7 insertions(+), 9 deletions(-)

Acked-by: Viresh Kumar <viresh.kumar@linaro.org>

-- 
viresh

Re: [PATCH 3/4] cpufreq: Fix governor module removal race

[Viresh Kumar]

On 23-11-17, 01:29, Rafael J. Wysocki wrote:
> From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> 
> It is possible to remove a cpufreq governor module after
> cpufreq_parse_governor() has returned success in
> store_scaling_governor() and before cpufreq_set_policy()
> acquires a reference to it, because the governor list is
> not protected during that period and nothing prevents the
> governor from being unregistered then.  The pointer to the
> governor structure coming from cpufreq_parse_governor() may
> become stale as a result of that.
> 
> Prevent that from happening by acquiring an extra reference
> to the governor module temporarily in cpufreq_parse_governor(),
> under cpufreq_governor_mutex, and dropping it in
> store_scaling_governor(), when cpufreq_set_policy() returns.
> 
> Note that the second cpufreq_parse_governor() call site is fine,
> because it only cares about the policy member of new_policy.
> 
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> ---
>  drivers/cpufreq/cpufreq.c |    8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> Index: linux-pm/drivers/cpufreq/cpufreq.c
> ===================================================================
> --- linux-pm.orig/drivers/cpufreq/cpufreq.c
> +++ linux-pm/drivers/cpufreq/cpufreq.c
> @@ -607,11 +607,13 @@ static int cpufreq_parse_governor(char *
>  	if (cpufreq_driver->setpolicy) {
>  		if (!strncasecmp(str_governor, "performance", CPUFREQ_NAME_LEN)) {
>  			policy->policy = CPUFREQ_POLICY_PERFORMANCE;
> +			policy->governor = NULL;
>  			return 0;
>  		}
>  
>  		if (!strncasecmp(str_governor, "powersave", CPUFREQ_NAME_LEN)) {
>  			policy->policy = CPUFREQ_POLICY_POWERSAVE;
> +			policy->governor = NULL;

Why are the above two changes required? policy->governor should always be NULL
for setpolicy drivers anyway.

-- 
viresh

Re: [PATCH 4/4] cpufreq: Drop pointless return statement

[Viresh Kumar]

On 23-11-17, 01:30, Rafael J. Wysocki wrote:
> From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> 
> Drop a pointless return statement from cpufreq_unregister_governor().
> 
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> ---
>  drivers/cpufreq/cpufreq.c |    1 -
>  1 file changed, 1 deletion(-)
> 
> Index: linux-pm/drivers/cpufreq/cpufreq.c
> ===================================================================
> --- linux-pm.orig/drivers/cpufreq/cpufreq.c
> +++ linux-pm/drivers/cpufreq/cpufreq.c
> @@ -2168,7 +2168,6 @@ void cpufreq_unregister_governor(struct
>  	mutex_lock(&cpufreq_governor_mutex);
>  	list_del(&governor->governor_list);
>  	mutex_unlock(&cpufreq_governor_mutex);
> -	return;
>  }
>  EXPORT_SYMBOL_GPL(cpufreq_unregister_governor);

Acked-by: Viresh Kumar <viresh.kumar@linaro.org>

-- 
viresh

Re: [PATCH 3/4] cpufreq: Fix governor module removal race

[Rafael J. Wysocki]

On Thursday, November 23, 2017 5:01:17 AM CET Viresh Kumar wrote:
> On 23-11-17, 01:29, Rafael J. Wysocki wrote:
> > From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> > 
> > It is possible to remove a cpufreq governor module after
> > cpufreq_parse_governor() has returned success in
> > store_scaling_governor() and before cpufreq_set_policy()
> > acquires a reference to it, because the governor list is
> > not protected during that period and nothing prevents the
> > governor from being unregistered then.  The pointer to the
> > governor structure coming from cpufreq_parse_governor() may
> > become stale as a result of that.
> > 
> > Prevent that from happening by acquiring an extra reference
> > to the governor module temporarily in cpufreq_parse_governor(),
> > under cpufreq_governor_mutex, and dropping it in
> > store_scaling_governor(), when cpufreq_set_policy() returns.
> > 
> > Note that the second cpufreq_parse_governor() call site is fine,
> > because it only cares about the policy member of new_policy.
> > 
> > Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> > ---
> >  drivers/cpufreq/cpufreq.c |    8 ++++++++
> >  1 file changed, 8 insertions(+)
> > 
> > Index: linux-pm/drivers/cpufreq/cpufreq.c
> > ===================================================================
> > --- linux-pm.orig/drivers/cpufreq/cpufreq.c
> > +++ linux-pm/drivers/cpufreq/cpufreq.c
> > @@ -607,11 +607,13 @@ static int cpufreq_parse_governor(char *
> >  	if (cpufreq_driver->setpolicy) {
> >  		if (!strncasecmp(str_governor, "performance", CPUFREQ_NAME_LEN)) {
> >  			policy->policy = CPUFREQ_POLICY_PERFORMANCE;
> > +			policy->governor = NULL;
> >  			return 0;
> >  		}
> >  
> >  		if (!strncasecmp(str_governor, "powersave", CPUFREQ_NAME_LEN)) {
> >  			policy->policy = CPUFREQ_POLICY_POWERSAVE;
> > +			policy->governor = NULL;
> 
> Why are the above two changes required? policy->governor should always be NULL
> for setpolicy drivers anyway.

OK, I'll drop them.

Thanks,
Rafael

[PATCH v2 3/4] cpufreq: Fix governor module removal race

[Rafael J. Wysocki]

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

It is possible to remove a cpufreq governor module after
cpufreq_parse_governor() has returned success in
store_scaling_governor() and before cpufreq_set_policy()
acquires a reference to it, because the governor list is
not protected during that period and nothing prevents the
governor from being unregistered then.

Prevent that from happening by acquiring an extra reference
to the governor module temporarily in cpufreq_parse_governor(),
under cpufreq_governor_mutex, and dropping it in
store_scaling_governor(), when cpufreq_set_policy() returns.

Note that the second cpufreq_parse_governor() call site is fine,
because it only cares about the policy member of new_policy.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
---

-> v2: Drop changes to clear policy->governor in
       cpufreq_parse_governor() in the cpufreq_driver->setpolicy set
       case, as that field should always be NULL then.

---
 drivers/cpufreq/cpufreq.c |    6 ++++++
 1 file changed, 6 insertions(+)

Index: linux-pm/drivers/cpufreq/cpufreq.c
===================================================================
--- linux-pm.orig/drivers/cpufreq/cpufreq.c
+++ linux-pm/drivers/cpufreq/cpufreq.c
@@ -633,6 +633,8 @@ static int cpufreq_parse_governor(char *
 
 			t = find_governor(str_governor);
 		}
+		if (t && !try_module_get(t->owner))
+			t = NULL;
 
 		mutex_unlock(&cpufreq_governor_mutex);
 
@@ -766,6 +768,10 @@ static ssize_t store_scaling_governor(st
 		return -EINVAL;
 
 	ret = cpufreq_set_policy(policy, &new_policy);
+
+	if (new_policy.governor)
+		module_put(new_policy.governor->owner);
+
 	return ret ? ret : count;
 }
 

Re: [PATCH v2 3/4] cpufreq: Fix governor module removal race

[Viresh Kumar]

On 23-11-17, 14:27, Rafael J. Wysocki wrote:
> From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> 
> It is possible to remove a cpufreq governor module after
> cpufreq_parse_governor() has returned success in
> store_scaling_governor() and before cpufreq_set_policy()
> acquires a reference to it, because the governor list is
> not protected during that period and nothing prevents the
> governor from being unregistered then.
> 
> Prevent that from happening by acquiring an extra reference
> to the governor module temporarily in cpufreq_parse_governor(),
> under cpufreq_governor_mutex, and dropping it in
> store_scaling_governor(), when cpufreq_set_policy() returns.
> 
> Note that the second cpufreq_parse_governor() call site is fine,
> because it only cares about the policy member of new_policy.
> 
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> ---
> 
> -> v2: Drop changes to clear policy->governor in
>        cpufreq_parse_governor() in the cpufreq_driver->setpolicy set
>        case, as that field should always be NULL then.
> 
> ---
>  drivers/cpufreq/cpufreq.c |    6 ++++++
>  1 file changed, 6 insertions(+)

Acked-by: Viresh Kumar <viresh.kumar@linaro.org>

-- 
viresh