Commit 3077f027 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'pm-5.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm 

Pull power management fixes from Rafael Wysocki:
 "These fix an operating performance point (OPP) reference counting
  issue and three issues in ARM cpufreq drivers.

  Specifics:

   - Add a flag to mark OPPs that are not referenced by he OPP core any
     more to prevent OPPs from being freed prematurely by mistake (Beata
     Michalska).

   - Add ARM Vexpress platforms to the cpufreq-dt-platdev blacklist
     since the actual scaling of them is handled elsewhere (Sudeep
     Holla).

   - Fix a function return value check and a possible use-after-free in
     the qcom-hw cpufreq driver (Shawn Guo, Wei Yongjun)"

* tag 'pm-5.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  opp: Don't drop extra references to OPPs accidentally
  cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev
  cpufreq: qcom-hw: Fix return value check in qcom_cpufreq_hw_cpu_init()
  cpufreq: qcom-hw: fix dereferencing freed memory 'data'
parents 34417833 71803232

drivers/cpufreq/cpufreq-dt-platdev.c

+2 −0
Original line number Diff line number Diff line
@@ -103,6 +103,8 @@ static const struct of_device_id whitelist[] __initconst = { 
static const struct of_device_id blacklist[] __initconst = {

	{ .compatible = "allwinner,sun50i-h6", },



	{ .compatible = "arm,vexpress", },



	{ .compatible = "calxeda,highbank", },

	{ .compatible = "calxeda,ecx-2000", },

drivers/cpufreq/qcom-cpufreq-hw.c

+3 −3
Original line number Diff line number Diff line
@@ -317,9 +317,9 @@ static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy) 
	}



	base = ioremap(res->start, resource_size(res));

	if (IS_ERR(base)) {

	if (!base) {

		dev_err(dev, "failed to map resource %pR\n", res);

		ret = PTR_ERR(base);

		ret = -ENOMEM;

		goto release_region;

	}
@@ -374,7 +374,7 @@ static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy) 
error:

	kfree(data);

unmap_base:

	iounmap(data->base);

	iounmap(base);

release_region:

	release_mem_region(res->start, resource_size(res));

	return ret;

drivers/opp/core.c

+25 −23
Original line number Diff line number Diff line
@@ -1492,7 +1492,11 @@ static struct dev_pm_opp *_opp_get_next(struct opp_table *opp_table, 


	mutex_lock(&opp_table->lock);

	list_for_each_entry(temp, &opp_table->opp_list, node) {

		if (dynamic == temp->dynamic) {

		/*

		 * Refcount must be dropped only once for each OPP by OPP core,

		 * do that with help of "removed" flag.

		 */

		if (!temp->removed && dynamic == temp->dynamic) {

			opp = temp;

			break;

		}
@@ -1502,10 +1506,27 @@ static struct dev_pm_opp *_opp_get_next(struct opp_table *opp_table, 
	return opp;

}



bool _opp_remove_all_static(struct opp_table *opp_table)

/*

 * Can't call dev_pm_opp_put() from under the lock as debugfs removal needs to

 * happen lock less to avoid circular dependency issues. This routine must be

 * called without the opp_table->lock held.

 */

static void _opp_remove_all(struct opp_table *opp_table, bool dynamic)

{

	struct dev_pm_opp *opp;



	while ((opp = _opp_get_next(opp_table, dynamic))) {

		opp->removed = true;

		dev_pm_opp_put(opp);



		/* Drop the references taken by dev_pm_opp_add() */

		if (dynamic)

			dev_pm_opp_put_opp_table(opp_table);

	}

}



bool _opp_remove_all_static(struct opp_table *opp_table)

{

	mutex_lock(&opp_table->lock);



	if (!opp_table->parsed_static_opps) {
@@ -1520,13 +1541,7 @@ bool _opp_remove_all_static(struct opp_table *opp_table) 


	mutex_unlock(&opp_table->lock);



	/*

	 * Can't remove the OPP from under the lock, debugfs removal needs to

	 * happen lock less to avoid circular dependency issues.

	 */

	while ((opp = _opp_get_next(opp_table, false)))

		dev_pm_opp_put(opp);



	_opp_remove_all(opp_table, false);

	return true;

}
@@ -1539,25 +1554,12 @@ bool _opp_remove_all_static(struct opp_table *opp_table) 
void dev_pm_opp_remove_all_dynamic(struct device *dev)

{

	struct opp_table *opp_table;

	struct dev_pm_opp *opp;

	int count = 0;



	opp_table = _find_opp_table(dev);

	if (IS_ERR(opp_table))

		return;



	/*

	 * Can't remove the OPP from under the lock, debugfs removal needs to

	 * happen lock less to avoid circular dependency issues.

	 */

	while ((opp = _opp_get_next(opp_table, true))) {

		dev_pm_opp_put(opp);

		count++;

	}



	/* Drop the references taken by dev_pm_opp_add() */

	while (count--)

		dev_pm_opp_put_opp_table(opp_table);

	_opp_remove_all(opp_table, true);



	/* Drop the reference taken by _find_opp_table() */

	dev_pm_opp_put_opp_table(opp_table);

drivers/opp/opp.h

+2 −0
Original line number Diff line number Diff line
@@ -56,6 +56,7 @@ extern struct list_head opp_tables, lazy_opp_tables; 
 * @dynamic:	not-created from static DT entries.

 * @turbo:	true if turbo (boost) OPP

 * @suspend:	true if suspend OPP

 * @removed:	flag indicating that OPP's reference is dropped by OPP core.

 * @pstate: Device's power domain's performance state.

 * @rate:	Frequency in hertz

 * @level:	Performance level
@@ -78,6 +79,7 @@ struct dev_pm_opp { 
	bool dynamic;

	bool turbo;

	bool suspend;

	bool removed;

	unsigned int pstate;

	unsigned long rate;

	unsigned int level;