Commit 999976e0 authored Mar 04, 2014 by Aaron Plattner Committed by Rafael J. Wysocki Mar 06, 2014

cpufreq: use cpufreq_cpu_get() to avoid cpufreq_get() race conditions

If a module calls cpufreq_get while cpufreq is initializing, it's
possible for it to be called after cpufreq_driver is set but before
cpufreq_cpu_data is written during subsys_interface_register.  This
happens because cpufreq_get doesn't take the cpufreq_driver_lock
around its use of cpufreq_cpu_data.

Fix this by using cpufreq_cpu_get(cpu) to look up the policy rather
than reading it out of cpufreq_cpu_data directly.  cpufreq_cpu_get()
takes the appropriate locks to prevent this race from happening.

Since it's possible for policy to be NULL if the caller passes in an
invalid CPU number or calls the function before cpufreq is initialized,
delete the BUG_ON(!policy) and simply return 0.  Don't try to return
-ENOENT because that's negative and the function returns an unsigned
integer.

References: https://bbs.archlinux.org/viewtopic.php?id=177934


Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Cc: 3.13+ <stable@vger.kernel.org> # 3.13+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

parent 0414855f

drivers/cpufreq/cpufreq.c

+7 −14

Original line number	Diff line number	Diff line
		@@ -1546,23 +1546,16 @@ static unsigned int __cpufreq_get(unsigned int cpu)
		*/
		unsigned int cpufreq_get(unsigned int cpu)
		{
		struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
		struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
		unsigned int ret_freq = 0;

		if (cpufreq_disabled() \|\| !cpufreq_driver)
		return -ENOENT;

		BUG_ON(!policy);

		if (!down_read_trylock(&cpufreq_rwsem))
		return 0;

		if (policy) {
		down_read(&policy->rwsem);

		ret_freq = __cpufreq_get(cpu);

		up_read(&policy->rwsem);
		up_read(&cpufreq_rwsem);

		cpufreq_cpu_put(policy);
		}

		return ret_freq;
		}

Admin message