cpufreq: use cpufreq_cpu_get to avoid cpufreq_get race conditions
PATCH 1/1 cpufreq: use cpufreq_cpu_get to avoid cpufreq_get race conditions
If a module calls cpufreq_get while cpufreq is initializing, it's possible for it to be called after cpufreq_driver is set but before cpufreq_cpu_data is written during subsys_interface_register. This happens because cpufreq_get doesn't take the cpufreq_driver_lock around its use of cpufreq_cpu_data.
Fix this by using cpufreq_cpu_get(cpu) to look up the policy rather than reading it out of cpufreq_cpu_data directly. cpufreq_cpu_get takes the appropriate locks to prevent this race from happening.
Since it's possible for policy to be NULL if the caller passes in an invalid CPU number or calls the function before cpufreq is initialized, delete the BUG_ON(!policy) and simply return 0. Don't try to return -ENOENT because that's negative and the function returns an unsigned integer.
--- drivers/cpufreq/cpufreq.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-)
drivers/cpufreq/cpufreq.c +7 -14
@@ -1447,23 +1447,16 @@ static unsigned int __cpufreq_get(unsigned int cpu)*/ unsigned int cpufreq_get (unsigned int cpu) { -struct cpufreq_policy *policy =per_cpu (cpufreq_cpu_data, cpu); +struct cpufreq_policy *policy =cpufreq_cpu_get (cpu);unsigned int ret_freq =0 ; -if (cpufreq_disabled () || !cpufreq_driver) -return -ENOENT ; - -BUG_ON (!policy); - -if (!down_read_trylock (&cpufreq_rwsem)) -return 0 ; - -down_read (&policy->rwsem); - - ret_freq =__cpufreq_get (cpu); +if (policy) { +down_read (&policy->rwsem); + ret_freq =__cpufreq_get (cpu); +up_read (&policy->rwsem); -up_read (&policy->rwsem); -up_read (&cpufreq_rwsem); +cpufreq_cpu_put (policy); + }return ret_freq; }
Signature · 1 line
1.9.0
Quoted 4 lines · Aaron Plattner
If a module calls
cpufreq_getwhile cpufreq is initializing, it's possible for it to be called aftercpufreq_driveris set but beforecpufreq_cpu_datais written duringsubsys_interface_register. This happens becausecpufreq_getdoesn't take thecpufreq_driver_lockaround its use ofcpufreq_cpu_data.
Is this a theoretical race, or can you actually reproduce it? If so, on what system/driver? Or are there any bug reports related to this you can point me to?
Quoted 10 lines
Fix this by using
cpufreq_cpu_get(cpu)to look up the policy rather than reading it out ofcpufreq_cpu_datadirectly.cpufreq_cpu_gettakes the appropriate locks to prevent this race from happening.Since it's possible for policy to be NULL if the caller passes in an invalid CPU number or calls the function before cpufreq is initialized, delete the
BUG_ON(!policy)and simply return 0. Don't try to return-ENOENTbecause that's negative and the function returns an unsigned integer.Signed-off-by Aaron Plattner <[email protected]>
Viresh, have you seen this?
Quoted 40 lines
--- drivers/cpufreq/cpufreq.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-)drivers/cpufreq/cpufreq.c +7
-14@@ -1447,23 +1447,16 @@ static unsigned int __cpufreq_get(unsigned int cpu)*/ unsigned int cpufreq_get (unsigned int cpu) { -struct cpufreq_policy *policy =per_cpu (cpufreq_cpu_data, cpu); +struct cpufreq_policy *policy =cpufreq_cpu_get (cpu);unsigned int ret_freq =0 ; -if (cpufreq_disabled () || !cpufreq_driver) -return -ENOENT ; - -BUG_ON (!policy); - -if (!down_read_trylock (&cpufreq_rwsem)) -return 0 ; - -down_read (&policy->rwsem); - - ret_freq =__cpufreq_get (cpu); +if (policy) { +down_read (&policy->rwsem); + ret_freq =__cpufreq_get (cpu); +up_read (&policy->rwsem); -up_read (&policy->rwsem); -up_read (&cpufreq_rwsem); +cpufreq_cpu_put (policy); + }return ret_freq; }
Signature · 2 lines
I speak only for myself. Rafael J. Wysocki, Intel Open Source Technology Center.
Aaron Plattner
Tested-byQuoted 9 lines · Rafael J. Wysocki
Quoted 4 lines · Aaron Plattner
If a module calls
cpufreq_getwhile cpufreq is initializing, it's possible for it to be called aftercpufreq_driveris set but beforecpufreq_cpu_datais written duringsubsys_interface_register. This happens becausecpufreq_getdoesn't take thecpufreq_driver_lockaround its use ofcpufreq_cpu_data.Is this a theoretical race, or can you actually reproduce it? If so, on what system/driver? Or are there any bug reports related to this you can point me to?
It reproduces on my Arch Linux system at home with the nvidia driver, and there has been at least one bug report that looks like the same thing:
https://bbs.archlinux.org/viewtopic.php?id=177934
I reproduced the problem with v3.13.5, then applied this change and was able to boot successfully 10/10 times. So I guess that means you can add
to the commit.
-- Aaron
Quoted 54 lines
Quoted 10 lines
Fix this by using
cpufreq_cpu_get(cpu)to look up the policy rather than reading it out ofcpufreq_cpu_datadirectly.cpufreq_cpu_gettakes the appropriate locks to prevent this race from happening.Since it's possible for policy to be NULL if the caller passes in an invalid CPU number or calls the function before cpufreq is initialized, delete the
BUG_ON(!policy)and simply return 0. Don't try to return-ENOENTbecause that's negative and the function returns an unsigned integer.Signed-off-by Aaron Plattner <[email protected]>Viresh, have you seen this?
Quoted 40 lines
--- drivers/cpufreq/cpufreq.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-)drivers/cpufreq/cpufreq.c +7
-14@@ -1447,23 +1447,16 @@ static unsigned int __cpufreq_get(unsigned int cpu)*/ unsigned int cpufreq_get (unsigned int cpu) { -struct cpufreq_policy *policy =per_cpu (cpufreq_cpu_data, cpu); +struct cpufreq_policy *policy =cpufreq_cpu_get (cpu);unsigned int ret_freq =0 ; -if (cpufreq_disabled () || !cpufreq_driver) -return -ENOENT ; - -BUG_ON (!policy); - -if (!down_read_trylock (&cpufreq_rwsem)) -return 0 ; - -down_read (&policy->rwsem); - - ret_freq =__cpufreq_get (cpu); +if (policy) { +down_read (&policy->rwsem); + ret_freq =__cpufreq_get (cpu); +up_read (&policy->rwsem); -up_read (&policy->rwsem); -up_read (&cpufreq_rwsem); +cpufreq_cpu_put (policy); + }return ret_freq; }
Quoted 14 lines · Aaron Plattner
Quoted 9 lines · Rafael J. Wysocki
Quoted 4 lines · Aaron Plattner
If a module calls
cpufreq_getwhile cpufreq is initializing, it's possible for it to be called aftercpufreq_driveris set but beforecpufreq_cpu_datais written duringsubsys_interface_register. This happens becausecpufreq_getdoesn't take thecpufreq_driver_lockaround its use ofcpufreq_cpu_data.Is this a theoretical race, or can you actually reproduce it? If so, on what system/driver? Or are there any bug reports related to this you can point me to?
It reproduces on my Arch Linux system at home with the nvidia driver, and there has been at least one bug report that looks like the same thing:
Quoted 6 lines
https://bbs.archlinux.org/viewtopic.php?id=177934
I reproduced the problem with v3.13.5, then applied this change and was able to boot successfully 10/10 times. So I guess that means you can add
Tested-by Aaron Plattner <[email protected]>
Tested-by is not needed if you're the author.
Everybody should test their patches, right? ;-)
I'll mark it for 3.13-stable and add the link above to the changelog.
Thanks!
Signature · 2 lines
I speak only for myself. Rafael J. Wysocki, Intel Open Source Technology Center.
Quoted 14 lines · Rafael J. Wysocki
Quoted 4 lines · Aaron Plattner
If a module calls
cpufreq_getwhile cpufreq is initializing, it's possible for it to be called aftercpufreq_driveris set but beforecpufreq_cpu_datais written duringsubsys_interface_register. This happens becausecpufreq_getdoesn't take thecpufreq_driver_lockaround its use ofcpufreq_cpu_data.Is this a theoretical race, or can you actually reproduce it? If so, on what system/driver? Or are there any bug reports related to this you can point me to?
Quoted 4 lines
Fix this by using
cpufreq_cpu_get(cpu)to look up the policy rather than reading it out ofcpufreq_cpu_datadirectly.cpufreq_cpu_gettakes the appropriate locks to prevent this race from happening.
Quoted 8 lines
Quoted 6 lines
Since it's possible for policy to be NULL if the caller passes in an invalid CPU number or calls the function before cpufreq is initialized, delete the
BUG_ON(!policy)and simply return 0. Don't try to return-ENOENTbecause that's negative and the function returns an unsigned integer.Signed-off-by Aaron Plattner <[email protected]>Viresh, have you seen this?
Sorry for being late. Though I see you have already applied this one, I will still add this for records :)