From: Viresh Kumar <viresh.kumar@linaro.org>
To: Beata Michalska <beata.michalska@arm.com>
Cc: linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org,
vireshk@kernel.org, nm@ti.com, sboyd@kernel.org
Subject: Re: [PATCH] opp: Invalidate current opp when draining the opp list
Date: Fri, 5 Mar 2021 09:54:01 +0530 [thread overview]
Message-ID: <20210305042401.gktrgach4dzxp7on@vireshk-i7> (raw)
In-Reply-To: <1614870454-18709-1-git-send-email-beata.michalska@arm.com>
On 04-03-21, 15:07, Beata Michalska wrote:
> The current_opp when set, grabs additional reference on the opp,
> which is then supposed to be dropped upon releasing the opp table.
> Still both dev_pm_opp_remove_table and dev_pm_opp_remove_all_dynamic
> will completely drain the OPPs list, including dropping the additional
> reference on current_opp. This may lead to an attempt to access
> memory that has already been released. Make sure that while draining
> the list (in both dynamic and static cases) the current_opp gets
> actually invalidated.
>
> Fixes: 81c4d8a3c414 ("opp: Keep track of currently programmed OPP")
>
> Signed-off-by: Beata Michalska <beata.michalska@arm.com>
> ---
> drivers/opp/core.c | 49 ++++++++++++++++++++++++++++++++-----------------
> 1 file changed, 32 insertions(+), 17 deletions(-)
>
> diff --git a/drivers/opp/core.c b/drivers/opp/core.c
> index c268938..10e65c4 100644
> --- a/drivers/opp/core.c
> +++ b/drivers/opp/core.c
> @@ -1502,10 +1502,39 @@ static struct dev_pm_opp *_opp_get_next(struct opp_table *opp_table,
> return opp;
> }
>
> -bool _opp_remove_all_static(struct opp_table *opp_table)
> +static int __opp_drain_list(struct opp_table *opp_table, bool dynamic)
> {
> struct dev_pm_opp *opp;
> + int count = 0;
> +
> + /*
> + * Can't remove the OPP from under the lock, debugfs removal needs to
> + * happen lock less to avoid circular dependency issues.
> + */
> + while ((opp = _opp_get_next(opp_table, dynamic))) {
> + /*
> + * The current_opp has extra hold on the ref count,
> + * still the draining here will result in all of them
> + * being dropped completely, so make
> + * sure no one will try to access the current_opp
> + * afterwords
> + */
> + if (opp_table->current_opp == opp &&
> + !(kref_read(&opp->kref) - 1))
> + opp_table->current_opp = NULL;
Did you miss looking at:
static void _opp_table_kref_release(struct kref *kref)
{
...
if (opp_table->current_opp)
dev_pm_opp_put(opp_table->current_opp);
...
}
?
This is the place where the last reference to the current_opp is released and so
we shouldn't have any invalid access to it anywhere else.
Or am I missing some context here ?
--
viresh
next prev parent reply other threads:[~2021-03-05 4:24 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-04 15:07 [PATCH] opp: Invalidate current opp when draining the opp list Beata Michalska
2021-03-04 17:27 ` Lukasz Luba
2021-03-05 4:24 ` Viresh Kumar [this message]
2021-03-05 13:55 ` Beata Michalska
2021-03-08 11:50 ` Viresh Kumar
2021-03-08 18:14 ` Beata Michalska
2021-03-09 4:31 ` Viresh Kumar
2021-03-09 12:14 ` Beata Michalska
2021-03-10 8:47 ` Viresh Kumar
2021-03-10 23:03 ` Beata Michalska
2021-03-12 3:49 ` Viresh Kumar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210305042401.gktrgach4dzxp7on@vireshk-i7 \
--to=viresh.kumar@linaro.org \
--cc=beata.michalska@arm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=nm@ti.com \
--cc=sboyd@kernel.org \
--cc=vireshk@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).