From: qiwuchen55@gmail.com To: mmayer@broadcom.com, rjw@rjwysocki.net, viresh.kumar@linaro.org, f.fainelli@gmail.com Cc: bcm-kernel-feedback-list@broadcom.com, linux-pm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, chenqiwu <chenqiwu@xiaomi.com> Subject: [PATCH v3] cpufreq: brcmstb-avs: fix imbalance of cpufreq policy refcount Date: Sun, 19 Jan 2020 15:09:10 +0800 [thread overview] Message-ID: <1579417750-21984-1-git-send-email-qiwuchen55@gmail.com> (raw) From: chenqiwu <chenqiwu@xiaomi.com> brcm_avs_cpufreq_get() calls cpufreq_cpu_get() to get the cpufreq policy, meanwhile, it also increments the kobject reference count to mark it busy. However, a corresponding call of cpufreq_cpu_put() is ignored to decrement the kobject reference count back, which may lead to a potential stuck risk that the cpuhp thread deadly waits for dropping of kobject refcount when cpufreq policy free. For fixing this bug, cpufreq_get_policy() is referenced to do a proper cpufreq_cpu_get()/cpufreq_cpu_put() and fill a policy copy for the user. If the policy return NULL, we just return 0 to hit the code path of cpufreq_driver->get. Signed-off-by: chenqiwu <chenqiwu@xiaomi.com> --- drivers/cpufreq/brcmstb-avs-cpufreq.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c index 77b0e5d..ee0d404 100644 --- a/drivers/cpufreq/brcmstb-avs-cpufreq.c +++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c @@ -452,8 +452,16 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv) static unsigned int brcm_avs_cpufreq_get(unsigned int cpu) { - struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); - struct private_data *priv = policy->driver_data; + struct cpufreq_policy policy; + struct private_data *priv; + + /* + * In case cpufreq policy has been released, just return 0. + */ + if (cpufreq_get_policy(&policy, cpu)) + return 0; + + priv = policy.driver_data; return brcm_avs_get_frequency(priv->base); } -- 1.9.1
WARNING: multiple messages have this Message-ID (diff)
From: qiwuchen55@gmail.com To: mmayer@broadcom.com, rjw@rjwysocki.net, viresh.kumar@linaro.org, f.fainelli@gmail.com Cc: chenqiwu <chenqiwu@xiaomi.com>, bcm-kernel-feedback-list@broadcom.com, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-pm@vger.kernel.org Subject: [PATCH v3] cpufreq: brcmstb-avs: fix imbalance of cpufreq policy refcount Date: Sun, 19 Jan 2020 15:09:10 +0800 [thread overview] Message-ID: <1579417750-21984-1-git-send-email-qiwuchen55@gmail.com> (raw) From: chenqiwu <chenqiwu@xiaomi.com> brcm_avs_cpufreq_get() calls cpufreq_cpu_get() to get the cpufreq policy, meanwhile, it also increments the kobject reference count to mark it busy. However, a corresponding call of cpufreq_cpu_put() is ignored to decrement the kobject reference count back, which may lead to a potential stuck risk that the cpuhp thread deadly waits for dropping of kobject refcount when cpufreq policy free. For fixing this bug, cpufreq_get_policy() is referenced to do a proper cpufreq_cpu_get()/cpufreq_cpu_put() and fill a policy copy for the user. If the policy return NULL, we just return 0 to hit the code path of cpufreq_driver->get. Signed-off-by: chenqiwu <chenqiwu@xiaomi.com> --- drivers/cpufreq/brcmstb-avs-cpufreq.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c index 77b0e5d..ee0d404 100644 --- a/drivers/cpufreq/brcmstb-avs-cpufreq.c +++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c @@ -452,8 +452,16 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv) static unsigned int brcm_avs_cpufreq_get(unsigned int cpu) { - struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); - struct private_data *priv = policy->driver_data; + struct cpufreq_policy policy; + struct private_data *priv; + + /* + * In case cpufreq policy has been released, just return 0. + */ + if (cpufreq_get_policy(&policy, cpu)) + return 0; + + priv = policy.driver_data; return brcm_avs_get_frequency(priv->base); } -- 1.9.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2020-01-19 7:09 UTC|newest] Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-01-19 7:09 qiwuchen55 [this message] 2020-01-19 7:09 ` [PATCH v3] cpufreq: brcmstb-avs: fix imbalance of cpufreq policy refcount qiwuchen55 2020-01-20 5:32 ` Viresh Kumar 2020-01-20 5:32 ` Viresh Kumar 2020-01-20 5:58 ` chenqiwu 2020-01-20 5:58 ` chenqiwu 2020-01-20 6:01 ` Viresh Kumar 2020-01-20 6:01 ` Viresh Kumar 2020-01-20 6:13 ` chenqiwu 2020-01-20 6:13 ` chenqiwu 2020-01-20 6:21 ` Viresh Kumar 2020-01-20 6:21 ` Viresh Kumar 2020-01-20 6:27 ` chenqiwu 2020-01-20 6:27 ` chenqiwu 2020-01-20 6:30 ` Viresh Kumar 2020-01-20 6:30 ` Viresh Kumar 2020-01-20 6:50 ` chenqiwu 2020-01-20 6:50 ` chenqiwu
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1579417750-21984-1-git-send-email-qiwuchen55@gmail.com \ --to=qiwuchen55@gmail.com \ --cc=bcm-kernel-feedback-list@broadcom.com \ --cc=chenqiwu@xiaomi.com \ --cc=f.fainelli@gmail.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-pm@vger.kernel.org \ --cc=mmayer@broadcom.com \ --cc=rjw@rjwysocki.net \ --cc=viresh.kumar@linaro.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.