linux-stable.git/drivers/devfreq, branch linux-5.4.y

PM / devfreq: Fix leak in devfreq_dev_release()

2023-09-23T08:59:54+00:00

commit 5693d077595de721f9ddbf9d37f40e5409707dfe upstream.

srcu_init_notifier_head() allocates resources that need to be released
with a srcu_cleanup_notifier_head() call.

Reported by kmemleak.

Fixes: 0fe3a66410a3 ("PM / devfreq: Add new DEVFREQ_TRANSITION_NOTIFIER notifier")
Cc: 
Signed-off-by: Boris Brezillon 
Reviewed-by: Dhruva Gole 
Signed-off-by: Chanwoo Choi 
Signed-off-by: Greg Kroah-Hartman

PM/devfreq: governor: Add a private governor_data for governor

2023-01-18T10:41:52+00:00

[ Upstream commit 5fdded8448924e3631d466eea499b11606c43640 ]

The member void *data in the structure devfreq can be overwrite
by governor_userspace. For example:
1. The device driver assigned the devfreq governor to simple_ondemand
by the function devfreq_add_device() and init the devfreq member
void *data to a pointer of a static structure devfreq_simple_ondemand_data
by the function devfreq_add_device().
2. The user changed the devfreq governor to userspace by the command
"echo userspace > /sys/class/devfreq/.../governor".
3. The governor userspace alloced a dynamic memory for the struct
userspace_data and assigend the member void *data of devfreq to
this memory by the function userspace_init().
4. The user changed the devfreq governor back to simple_ondemand
by the command "echo simple_ondemand > /sys/class/devfreq/.../governor".
5. The governor userspace exited and assigned the member void *data
in the structure devfreq to NULL by the function userspace_exit().
6. The governor simple_ondemand fetched the static information of
devfreq_simple_ondemand_data in the function
devfreq_simple_ondemand_func() but the member void *data of devfreq was
assigned to NULL by the function userspace_exit().
7. The information of upthreshold and downdifferential is lost
and the governor simple_ondemand can't work correctly.

The member void *data in the structure devfreq is designed for
a static pointer used in a governor and inited by the function
devfreq_add_device(). This patch add an element named governor_data
in the devfreq structure which can be used by a governor(E.g userspace)
who want to assign a private data to do some private things.

Fixes: ce26c5bb9569 ("PM / devfreq: Add basic governors")
Cc: stable@vger.kernel.org # 5.10+
Reviewed-by: Chanwoo Choi 
Acked-by: MyungJoo Ham 
Signed-off-by: Kant Fan 
Signed-off-by: Chanwoo Choi 
Signed-off-by: Sasha Levin

PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events

2022-07-07T15:36:49+00:00

commit f44b799603a9b5d2e375b0b2d54dd0b791eddfc2 upstream.

of_get_child_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
This function only calls of_node_put() in normal path,
missing it in error paths.
Add missing of_node_put() to avoid refcount leak.

Fixes: f262f28c1470 ("PM / devfreq: event: Add devfreq_event class")
Signed-off-by: Miaoqian Lin 
Signed-off-by: Chanwoo Choi 
Signed-off-by: Greg Kroah-Hartman

PM / devfreq: rk3399_dmc: Disable edev on remove()

2022-06-14T16:11:29+00:00

[ Upstream commit 2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804 ]

Otherwise we hit an unablanced enable-count when unbinding the DFI
device:

[ 1279.659119] ------------[ cut here ]------------
[ 1279.659179] WARNING: CPU: 2 PID: 5638 at drivers/devfreq/devfreq-event.c:360 devfreq_event_remove_edev+0x84/0x8c
...
[ 1279.659352] Hardware name: Google Kevin (DT)
[ 1279.659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
[ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c
[ 1279.659380] lr : devm_devfreq_event_release+0x1c/0x28
...
[ 1279.659571] Call trace:
[ 1279.659582]  devfreq_event_remove_edev+0x84/0x8c
[ 1279.659590]  devm_devfreq_event_release+0x1c/0x28
[ 1279.659602]  release_nodes+0x1cc/0x244
[ 1279.659611]  devres_release_all+0x44/0x60
[ 1279.659621]  device_release_driver_internal+0x11c/0x1ac
[ 1279.659629]  device_driver_detach+0x20/0x2c
[ 1279.659641]  unbind_store+0x7c/0xb0
[ 1279.659650]  drv_attr_store+0x2c/0x40
[ 1279.659663]  sysfs_kf_write+0x44/0x58
[ 1279.659672]  kernfs_fop_write_iter+0xf4/0x190
[ 1279.659684]  vfs_write+0x2b0/0x2e4
[ 1279.659693]  ksys_write+0x80/0xec
[ 1279.659701]  __arm64_sys_write+0x24/0x30
[ 1279.659714]  el0_svc_common+0xf0/0x1d8
[ 1279.659724]  do_el0_svc_compat+0x28/0x3c
[ 1279.659738]  el0_svc_compat+0x10/0x1c
[ 1279.659746]  el0_sync_compat_handler+0xa8/0xcc
[ 1279.659758]  el0_sync_compat+0x188/0x1c0
[ 1279.659768] ---[ end trace cec200e5094155b4 ]---

Signed-off-by: Brian Norris 
Signed-off-by: Chanwoo Choi 
Signed-off-by: Sasha Levin

PM / devfreq: Use more accurate returned new_freq as resume_freq

2021-05-14T07:44:20+00:00

[ Upstream commit 62453f1ba5d5def9d58e140a50f3f168f028da38 ]

Use the more accurate returned new_freq as resume_freq.
It's the same as how devfreq->previous_freq was updated.

Fixes: 83f8ca45afbf0 ("PM / devfreq: add support for suspend/resume of a devfreq device")
Signed-off-by: Dong Aisheng 
Signed-off-by: Chanwoo Choi 
Signed-off-by: Sasha Levin

PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out

2020-10-01T11:17:14+00:00

[ Upstream commit 53b4b2aeee26f42cde5ff2a16dd0d8590c51a55a ]

There is another kHz-conversion bug in the code, resulting in integer
overflow. Although, this time the resulting value is 4294966296 and it's
close to ULONG_MAX, which is okay in this case.

Reviewed-by: Chanwoo Choi 
Tested-by: Peter Geis 
Signed-off-by: Dmitry Osipenko 
Signed-off-by: Chanwoo Choi 
Signed-off-by: Sasha Levin

PM / devfreq: rk3399_dmc: Fix kernel oops when rockchip,pmu is absent

2020-09-03T09:26:50+00:00

[ Upstream commit 63ef91f24f9bfc70b6446319f6cabfd094481372 ]

Booting a recent kernel on a rk3399-based system (nanopc-t4),
equipped with a recent u-boot and ATF results in an Oops due
to a NULL pointer dereference.

This turns out to be due to the rk3399-dmc driver looking for
an *undocumented* property (rockchip,pmu), and happily using
a NULL pointer when the property isn't there.

Instead, make most of what was brought in with 9173c5ceb035
("PM / devfreq: rk3399_dmc: Pass ODT and auto power down parameters
to TF-A.") conditioned on finding this property in the device-tree,
preventing the driver from exploding.

Cc: stable@vger.kernel.org
Fixes: 9173c5ceb035 ("PM / devfreq: rk3399_dmc: Pass ODT and auto power down parameters to TF-A.")
Signed-off-by: Marc Zyngier 
Signed-off-by: Chanwoo Choi 
Signed-off-by: Sasha Levin

PM / devfreq: rk3399_dmc: Disable devfreq-event device when fails

2020-09-03T09:26:50+00:00

[ Upstream commit 39a6e4739c19d5334e552d71ceca544ed84f4b87 ]

The probe process may fail, but the devfreq event device remains
enabled. Call devfreq_event_disable_edev on the error return path.

Signed-off-by: Yangtao Li 
Signed-off-by: Chanwoo Choi 
Signed-off-by: Sasha Levin

PM / devfreq: rk3399_dmc: Add missing of_node_put()

2020-09-03T09:26:50+00:00

[ Upstream commit 29d867e97f7d781972ed542acfca3c2c0b512603 ]

of_node_put() needs to be called when the device node which is got
from of_parse_phandle has finished using.

Signed-off-by: Yangtao Li 
Signed-off-by: Chanwoo Choi 
Signed-off-by: Sasha Levin

PM / devfreq: Add missing locking while setting suspend_freq

2020-05-10T08:31:34+00:00

commit e1e047ace8cef6d143f38c7d769753f133becbe6 upstream.

Commit 2abb0d5268ae ("PM / devfreq: Lock devfreq in trans_stat_show")
revealed a missing locking while calling devfreq_update_status() function
during suspend/resume cycle.

Code analysis revealed that devfreq_set_target() function was called
without needed locks held for setting device specific suspend_freq if such
has been defined. This patch fixes that by adding the needed locking, what
fixes following kernel warning on Exynos4412-based OdroidU3 board during
system suspend:

PM: suspend entry (deep)
Filesystems sync: 0.002 seconds
Freezing user space processes ... (elapsed 0.001 seconds) done.
OOM killer disabled.
Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done.
------------[ cut here ]------------
WARNING: CPU: 2 PID: 1385 at drivers/devfreq/devfreq.c:204 devfreq_update_status+0xc0/0x188
Modules linked in:
CPU: 2 PID: 1385 Comm: rtcwake Not tainted 5.4.0-rc6-next-20191111 #6848
Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[] (show_stack) from [] (dump_stack+0xb4/0xe0)
[] (dump_stack) from [] (__warn+0xf4/0x10c)
[] (__warn) from [] (warn_slowpath_fmt+0xb0/0xb8)
[] (warn_slowpath_fmt) from [] (devfreq_update_status+0xc0/0x188)
[] (devfreq_update_status) from [] (devfreq_set_target+0xb0/0x15c)
[] (devfreq_set_target) from [] (devfreq_suspend+0x2c/0x64)
[] (devfreq_suspend) from [] (dpm_suspend+0xa4/0x57c)
[] (dpm_suspend) from [] (dpm_suspend_start+0x98/0xa0)
[] (dpm_suspend_start) from [] (suspend_devices_and_enter+0xec/0xc74)
[] (suspend_devices_and_enter) from [] (pm_suspend+0x340/0x410)
[] (pm_suspend) from [] (state_store+0x6c/0xc8)
[] (state_store) from [] (kernfs_fop_write+0x10c/0x228)
[] (kernfs_fop_write) from [] (__vfs_write+0x30/0x1d0)
[] (__vfs_write) from [] (vfs_write+0xa4/0x180)
[] (vfs_write) from [] (ksys_write+0x60/0xd8)
[] (ksys_write) from [] (ret_fast_syscall+0x0/0x28)
Exception stack(0xed3d7fa8 to 0xed3d7ff0)
...
irq event stamp: 9667
hardirqs last  enabled at (9679): [] _raw_spin_unlock_irq+0x20/0x58
hardirqs last disabled at (9698): [] __schedule+0xd8/0x818
softirqs last  enabled at (9694): [] __do_softirq+0x4fc/0x5fc
softirqs last disabled at (9719): [] irq_exit+0x16c/0x170
---[ end trace 41ac5b57d046bdbc ]---
------------[ cut here ]------------

Signed-off-by: Marek Szyprowski 
Acked-by: Chanwoo Choi 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman