Commit 5d521a30 authored by Brian Norris's avatar Brian Norris Committed by Chanwoo Choi
Browse files

PM / devfreq: rk3399_dmc: Avoid static (reused) profile 



This static struct can get reused if the device gets removed/reprobed,
and that causes use-after-free in its ->freq_table.

Let's just move the struct to our dynamic allocation.

Signed-off-by: default avatarBrian Norris <briannorris@chromium.org>
Signed-off-by: default avatarChanwoo Choi <cw00.choi@samsung.com>
parent cb178a95

drivers/devfreq/rk3399_dmc.c

+9 −9
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ 
struct rk3399_dmcfreq {

	struct device *dev;

	struct devfreq *devfreq;

	struct devfreq_dev_profile profile;

	struct devfreq_simple_ondemand_data ondemand_data;

	struct clk *dmc_clk;

	struct devfreq_event_dev *edev;
@@ -228,13 +229,6 @@ static int rk3399_dmcfreq_get_cur_freq(struct device *dev, unsigned long *freq) 
	return 0;

}



static struct devfreq_dev_profile rk3399_devfreq_dmc_profile = {

	.polling_ms	= 200,

	.target		= rk3399_dmcfreq_target,

	.get_dev_status	= rk3399_dmcfreq_get_dev_status,

	.get_cur_freq	= rk3399_dmcfreq_get_cur_freq,

};



static __maybe_unused int rk3399_dmcfreq_suspend(struct device *dev)

{

	struct rk3399_dmcfreq *dmcfreq = dev_get_drvdata(dev);
@@ -422,10 +416,16 @@ static int rk3399_dmcfreq_probe(struct platform_device *pdev) 
	data->volt = dev_pm_opp_get_voltage(opp);

	dev_pm_opp_put(opp);



	rk3399_devfreq_dmc_profile.initial_freq = data->rate;

	data->profile = (struct devfreq_dev_profile) {

		.polling_ms	= 200,

		.target		= rk3399_dmcfreq_target,

		.get_dev_status	= rk3399_dmcfreq_get_dev_status,

		.get_cur_freq	= rk3399_dmcfreq_get_cur_freq,

		.initial_freq	= data->rate,

	};



	data->devfreq = devm_devfreq_add_device(dev,

					   &rk3399_devfreq_dmc_profile,

					   &data->profile,

					   DEVFREQ_GOV_SIMPLE_ONDEMAND,

					   &data->ondemand_data);

	if (IS_ERR(data->devfreq)) {