linux-stable.git/drivers/opp/core.c, branch linux-rolling-lts

OPP: Fix race between OPP addition and lookup

2026-07-24T14:15:46+00:00

[ Upstream commit f5e1cc9a284bff2510981643a5bca4bc4c21b81a ]

A race exists between dev_pm_opp_add_dynamic() and
dev_pm_opp_find_freq_exact():

  CPU0 (add)                          CPU1 (lookup)
  -------------------------------     ------------------------------
  _opp_add()
    mutex_lock()
    list_add(&new_opp->node, head)
    mutex_unlock()                    _opp_table_find_key()
                                        mutex_lock()
                                        dev_pm_opp_get(opp)
                                          kref_get()
                                        mutex_unlock()
    kref_init(&new_opp->kref)
                                      dev_pm_opp_put()
                                        kref_put_mutex()

The newly added OPP is inserted into the list before its kref is
initialized. A concurrent lookup can find this OPP and increment its
reference count while it is still uninitialized, leading to refcount
corruption and a potential premature free.

Fix this by initializing ->kref and ->opp_table before making the OPP
visible via list_add(). This ensures any concurrent lookup observes a
fully initialized object.

Fixes: 7034764a1e4a (PM / OPP: Add 'struct kref' to struct dev_pm_opp)
Co-developed-by: Ling Xu 
Signed-off-by: Ling Xu 
Signed-off-by: Di Shen 
[ Viresh: Updated commit log ]
Signed-off-by: Viresh Kumar 
Signed-off-by: Sasha Levin

OPP: Move break out of scoped_guard in dev_pm_opp_xlate_required_opp()

2026-05-23T11:06:23+00:00

[ Upstream commit 3d2398f44a2d48fb1c575a6e0bc6b38f3e689e22 ]

The commit ff9c512041f2 ("OPP: Use mutex locking guards")
unintentionally made the for loop run longer than required.

scoped_guard() is implemented as a for loop. The break statement now
breaks out out the scoped_guard() and not out of the outer for loop.
The outer loop always iterates to completion.

Fix it.

Fixes: ff9c512041f2 ("OPP: Use mutex locking guards")
Reported-by: David Lechner 
Signed-off-by: Viresh Kumar 
Signed-off-by: Sasha Levin

OPP: Return correct value in dev_pm_opp_get_level

2026-02-26T22:59:00+00:00

[ Upstream commit 0b7277e02dabba2a9921a7f4761ae6e627e7297a ]

Commit 073d3d2ca7d4 ("OPP: Level zero is valid") modified the
documentation for this function to indicate that errors should return a
non-zero value to avoid colliding with the OPP level zero, however
forgot to actually update the return.

No in-tree kernel code depends on the error value being 0.

Fixes: 073d3d2ca7d4 ("OPP: Level zero is valid")
Signed-off-by: Aleks Todorov 
Signed-off-by: Viresh Kumar 
Signed-off-by: Sasha Levin

OPP: Add support to find OPP for a set of keys

2025-08-26T05:10:58+00:00

Some clients, such as PCIe, may operate at the same clock frequency
across different data rates by varying link width. In such cases,
frequency alone is not sufficient to uniquely identify an OPP.

To support these scenarios, introduce a new API
dev_pm_opp_find_key_exact() that allows OPP lookup with different
set of keys like freq, level & bandwidth.

Signed-off-by: Krishna Chaitanya Chundru 
[ Viresh: Minor cleanups ]
Signed-off-by: Viresh Kumar

OPP: switch to use kmemdup_array()

2025-05-19T10:07:53+00:00

Use kmemdup_array() to avoid multiplication and possible overflows.

Signed-off-by: Zhang Enpei 
Signed-off-by: Viresh Kumar

OPP: Use mutex locking guards

2025-05-02T05:25:52+00:00

Use mutex locking guard in the OPP core.

No intentional functional impact.

Signed-off-by: Viresh Kumar

OPP: Define and use scope-based cleanup helpers

2025-05-02T05:25:40+00:00

Define and use scope-based cleanup helpers for `struct opp` and `struct
opp_table`.

No intentional functional impact.

Signed-off-by: Viresh Kumar

OPP: Return opp_table from dev_pm_opp_get_opp_table_ref()

2025-04-24T10:35:56+00:00

For convenience of users, return back the pointer to the opp_table from
dev_pm_opp_get_opp_table_ref(), so they can do:

	opp_table = dev_pm_opp_get_opp_table_ref(tmp_table);

No intentional functional impact.

Signed-off-by: Viresh Kumar

OPP: Return opp from dev_pm_opp_get()

2025-04-24T10:35:53+00:00

For convenience of users, return back the pointer to the opp from
dev_pm_opp_get(), so they can do:

	opp = dev_pm_opp_get(tmp_opp);

No intentional functional impact.

Signed-off-by: Viresh Kumar

OPP: Remove _get_opp_table_kref()

2025-04-24T10:35:33+00:00

Use dev_pm_opp_get_opp_table_ref() directly instead.

No intentional functional impact.

Signed-off-by: Viresh Kumar