cpufreq: qcom-cpufreq-hw: Avoid stack buffer for IRQ name

Registering an IRQ requires the string buffer containing the name to remain allocated, as the name is not copied into another buffer.

So let's add a irq_name field to the data struct instead, which is guaranteed to have the appropriate lifetime.

Cc Thara Gopinath <[email protected]>

Cc Bjorn Andersson <[email protected]>

Cc Andy Gross <[email protected]>

Cc [email protected]

Signed-off-by Ard Biesheuvel <[email protected]>

---
I'm not following msm development closely, so apologies if this was already fixed, or if this is not based on the right tree.

This fixes a crash on my Yoga C630 when reading /proc/interrupts.

 drivers/cpufreq/qcom-cpufreq-hw.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

drivers/cpufreq/qcom-cpufreq-hw.c +1 -2

index 3cc27d9e2ed1..6613228fe68c 100644
@@ -44,6 +44,7 @@ struct qcom_cpufreq_data {
 	/* Lock to synchronize between de-init sequence and re-starting LMh polling/interrupts */
 	spinlock_t throttle_lock;
 	int throttle_irq;
+	char irq_name[15];
 	bool cancel_throttle;
 };
 

@@ -371,7 +372,6 @@ static int qcom_cpufreq_hw_lmh_init(struct cpufreq_policy *policy, int index)
 {
 	struct qcom_cpufreq_data *data = policy->driver_data;
 	struct platform_device *pdev = cpufreq_get_driver_data();
-	char irq_name[15];
 	int ret;
 
 	/*

@@ -388,11 +388,11 @@ static int qcom_cpufreq_hw_lmh_init(struct cpufreq_policy *policy, int index)
 	spin_lock_init(&data->throttle_lock);
 	INIT_DEFERRABLE_WORK(&data->throttle_work, qcom_lmh_dcvs_poll);
 
-	snprintf(irq_name, sizeof(irq_name), "dcvsh-irq-%u", policy->cpu);

Registering an IRQ requires the string buffer containing the name to remain allocated, as the name is not copied into another buffer.

So let's add a irq_name field to the data struct instead, which is guaranteed to have the appropriate lifetime.

Cc Thara Gopinath <[email protected]>

Cc Bjorn Andersson <[email protected]>

Cc Andy Gross <[email protected]>

Cc [email protected]

Signed-off-by Ard Biesheuvel <[email protected]>

---
I'm not following msm development closely, so apologies if this was already fixed, or if this is not based on the right tree.

This fixes a crash on my Yoga C630 when reading /proc/interrupts.

  drivers/cpufreq/qcom-cpufreq-hw.c | 8 ++++----
  1 file changed, 4 insertions(+), 4 deletions(-)

drivers/cpufreq/qcom-cpufreq-hw.c +4 -4

index 3cc27d9e2ed1..6613228fe68c 100644
@@ -44,6 +44,7 @@ struct qcom_cpufreq_data {
  	/* Lock to synchronize between de-init sequence and re-starting LMh polling/interrupts */
  	spinlock_t throttle_lock;
  	int throttle_irq;
+	char irq_name[15];
  	bool cancel_throttle;
  };
 

@@ -371,7 +372,6 @@ static int qcom_cpufreq_hw_lmh_init(struct cpufreq_policy *policy, int index)
  {
  	struct qcom_cpufreq_data *data = policy->driver_data;
  	struct platform_device *pdev = cpufreq_get_driver_data();
-	char irq_name[15];
  	int ret;
 
  	/*

@@ -388,11 +388,11 @@ static int qcom_cpufreq_hw_lmh_init(struct cpufreq_policy *policy, int index)
  	spin_lock_init(&data->throttle_lock);
  	INIT_DEFERRABLE_WORK(&data->throttle_work, qcom_lmh_dcvs_poll);
 
-	snprintf(irq_name, sizeof(irq_name), "dcvsh-irq-%u", policy->cpu);
+	snprintf(data->irq_name, sizeof(data->irq_name), "dcvsh-irq-%u", policy->cpu);
  	ret = request_threaded_irq(data->throttle_irq, NULL, qcom_lmh_dcvs_handle_irq,
-				   IRQF_ONESHOT, irq_name, data);
+				   IRQF_ONESHOT, data->irq_name, data);
  	if (ret) {
-		dev_err(&pdev->dev, "Error registering %s: %d\n", irq_name, ret);
+		dev_err(&pdev->dev, "Error registering %s: %d\n", data->irq_name, ret);
  		return 0;
  	}
 

Quoted 11 lines

Registering an IRQ requires the string buffer containing the name to remain allocated, as the name is not copied into another buffer.

So let's add a irq_name field to the data struct instead, which is guaranteed to have the appropriate lifetime.

Cc Thara Gopinath <[email protected]>

Cc Bjorn Andersson <[email protected]>

Cc Andy Gross <[email protected]>

Cc [email protected]

Signed-off-by Ard Biesheuvel <[email protected]>

Thanks for the fix.

Reviewed-by Thara Gopinath <[email protected]>

Quoted 13 lines · Ard Biesheuvel

Quoted 11 lines

Registering an IRQ requires the string buffer containing the name to remain allocated, as the name is not copied into another buffer.

So let's add a irq_name field to the data struct instead, which is guaranteed to have the appropriate lifetime.

Cc Thara Gopinath <[email protected]>

Cc Bjorn Andersson <[email protected]>

Cc Andy Gross <[email protected]>

Cc [email protected]

Signed-off-by Ard Biesheuvel <[email protected]>

Quoted 3 lines

Thanks for the fix.

Reviewed-by Thara Gopinath <[email protected]>

Seems this patch has been overlooked. Would it be possible to resubmit it with a 'Fixes' tag?