No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Schspa Shi cd1f386120 cpufreq: Fix possible race in cpufreq online error path
[ Upstream commit f346e96267cd76175d6c201b40f770c0116a8a04 ]

When cpufreq online fails, the policy->cpus mask is not cleared and
policy->rwsem is released too early, so the driver can be invoked
via the cpuinfo_cur_freq sysfs attribute while its ->offline() or
->exit() callbacks are being run.

Take policy->clk as an example:

static int cpufreq_online(unsigned int cpu)
{
  ...
  // policy->cpus != 0 at this time
  down_write(&policy->rwsem);
  ret = cpufreq_add_dev_interface(policy);
  up_write(&policy->rwsem);

  return 0;

out_destroy_policy:
	for_each_cpu(j, policy->real_cpus)
		remove_cpu_dev_symlink(policy, get_cpu_device(j));
    up_write(&policy->rwsem);
...
out_exit_policy:
  if (cpufreq_driver->exit)
    cpufreq_driver->exit(policy);
      clk_put(policy->clk);
      // policy->clk is a wild pointer
...
                                    ^
                                    |
                            Another process access
                            __cpufreq_get
                              cpufreq_verify_current_freq
                                cpufreq_generic_get
                                  // acces wild pointer of policy->clk;
                                    |
                                    |
out_offline_policy:                 |
  cpufreq_policy_free(policy);      |
    // deleted here, and will wait for no body reference
    cpufreq_policy_put_kobj(policy);
}

Address this by modifying cpufreq_online() to release policy->rwsem
in the error path after the driver callbacks have run and to clear
policy->cpus before releasing the semaphore.

Fixes: 7106e02bae ("cpufreq: release policy->rwsem on error")
Signed-off-by: Schspa Shi <schspa@gmail.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-06-14 18:11:33 +02:00
arch x86/delay: Fix the wrong asm constraint in delay_loop() 2022-06-14 18:11:31 +02:00
block block: return ELEVATOR_DISCARD_MERGE if possible 2022-05-25 09:14:38 +02:00
certs
crypto crypto: ecrdsa - Fix incorrect use of vli_cmp 2022-06-06 08:33:50 +02:00
Documentation hwmon: Make chip parameter for with_info API mandatory 2022-06-14 18:11:29 +02:00
drivers cpufreq: Fix possible race in cpufreq online error path 2022-06-14 18:11:33 +02:00
fs fat: add ratelimit to fat*_ent_bread() 2022-06-14 18:11:30 +02:00
include efi: Add missing prototype for efi_capsule_setup_info 2022-06-14 18:11:33 +02:00
init
ipc
kernel sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq 2022-06-14 18:11:33 +02:00
lib assoc_array: Fix BUG_ON during garbage collect 2022-06-06 08:33:50 +02:00
LICENSES
mm zsmalloc: fix races between asynchronous zspage free and page migration 2022-06-06 08:33:50 +02:00
net NFC: NULL out the dev->rfkill to prevent UAF 2022-06-14 18:11:33 +02:00
samples
scripts
security lockdown: also lock down previous kgdb use 2022-06-06 08:33:48 +02:00
sound ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe 2022-06-14 18:11:31 +02:00
tools selftests/bpf: fix btf_dump/btf_dump due to recent clang change 2022-06-14 18:11:29 +02:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.197 2022-06-06 08:33:51 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.