• Rafael J. Wysocki's avatar
    cpufreq: governor: Close dbs_data update race condition · 574ef14d
    Rafael J. Wysocki authored
    It is possible for a dbs_data object to be updated after its
    usage counter has become 0.  That may happen if governor_store()
    runs (via a govenor tunable sysfs attribute write) in parallel
    with cpufreq_governor_exit() called for the last cpufreq policy
    associated with the dbs_data in question.  In that case, if
    governor_store() acquires dbs_data->mutex right after
    cpufreq_governor_exit() has released it, the ->store() callback
    invoked by it may operate on dbs_data with no users.  Although
    sysfs will cause the kobject_put() in cpufreq_governor_exit() to
    block until governor_store() has returned, that situation may
    lead to some unexpected results, depending on the implementation
    of the ->store callback, and therefore it should be avoided.
    
    To that end, modify governor_store() to check the dbs_data's
    usage count before invoking the ->store() callback and return
    an error if it is 0 at that point.
    Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
    Acked-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
    574ef14d
cpufreq_governor.c 17.5 KB