summaryrefslogtreecommitdiffstats
path: root/drivers/cpufreq/cpufreq_governor.c
diff options
context:
space:
mode:
authorRafael J. Wysocki <rafael.j.wysocki@intel.com>2016-02-18 02:19:00 +0100
committerRafael J. Wysocki <rafael.j.wysocki@intel.com>2016-03-09 14:41:06 +0100
commit574ef14d5dbcd2743326cc1b28e61a1e7733162a (patch)
tree7dbfd41fbfe7d59f2359d066fc823c119efaab59 /drivers/cpufreq/cpufreq_governor.c
parent8eb055d3f53e52805907ea54e2eec0885be91a50 (diff)
downloadlinux-574ef14d5dbcd2743326cc1b28e61a1e7733162a.tar.bz2
cpufreq: governor: Close dbs_data update race condition
It is possible for a dbs_data object to be updated after its usage counter has become 0. That may happen if governor_store() runs (via a govenor tunable sysfs attribute write) in parallel with cpufreq_governor_exit() called for the last cpufreq policy associated with the dbs_data in question. In that case, if governor_store() acquires dbs_data->mutex right after cpufreq_governor_exit() has released it, the ->store() callback invoked by it may operate on dbs_data with no users. Although sysfs will cause the kobject_put() in cpufreq_governor_exit() to block until governor_store() has returned, that situation may lead to some unexpected results, depending on the implementation of the ->store callback, and therefore it should be avoided. To that end, modify governor_store() to check the dbs_data's usage count before invoking the ->store() callback and return an error if it is 0 at that point. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Diffstat (limited to 'drivers/cpufreq/cpufreq_governor.c')
-rw-r--r--drivers/cpufreq/cpufreq_governor.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index 56dba71d1788..65ed859030ba 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -112,7 +112,7 @@ static ssize_t governor_store(struct kobject *kobj, struct attribute *attr,
mutex_lock(&dbs_data->mutex);
- if (gattr->store)
+ if (dbs_data->usage_count && gattr->store)
ret = gattr->store(dbs_data, buf, count);
mutex_unlock(&dbs_data->mutex);