linux-stable.git/drivers/thermal, branch v6.7.8 Linux kernel stable tree thermal: core: Fix thermal zone suspend-resume synchronization 2024-02-05T20:16:46+00:00 Rafael J. Wysocki rafael.j.wysocki@intel.com 2023-12-18T19:25:02+00:00 f4a3fdbd26e7e94b4cf8c86aabec6a37a53e18e0 [ Upstream commit 4e814173a8c4f432fd068b1c796f0416328c9d99 ] There are 3 synchronization issues with thermal zone suspend-resume during system-wide transitions: 1. The resume code runs in a PM notifier which is invoked after user space has been thawed, so it can run concurrently with user space which can trigger a thermal zone device removal. If that happens, the thermal zone resume code may use a stale pointer to the next list element and crash, because it does not hold thermal_list_lock while walking thermal_tz_list. 2. The thermal zone resume code calls thermal_zone_device_init() outside the zone lock, so user space or an update triggered by the platform firmware may see an inconsistent state of a thermal zone leading to unexpected behavior. 3. Clearing the in_suspend global variable in thermal_pm_notify() allows __thermal_zone_device_update() to continue for all thermal zones and it may as well run before the thermal_tz_list walk (or at any point during the list walk for that matter) and attempt to operate on a thermal zone that has not been resumed yet. It may also race destructively with thermal_zone_device_init(). To address these issues, add thermal_list_lock locking to thermal_pm_notify(), especially arount the thermal_tz_list, make it call thermal_zone_device_init() back-to-back with __thermal_zone_device_update() under the zone lock and replace in_suspend with per-zone bool "suspend" indicators set and unset under the given zone's lock. Link: https://lore.kernel.org/linux-pm/20231218162348.69101-1-bo.ye@mediatek.com/ Reported-by: Bo Ye <bo.ye@mediatek.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 4e814173a8c4f432fd068b1c796f0416328c9d99 ]

There are 3 synchronization issues with thermal zone suspend-resume
during system-wide transitions:

 1. The resume code runs in a PM notifier which is invoked after user
    space has been thawed, so it can run concurrently with user space
    which can trigger a thermal zone device removal.  If that happens,
    the thermal zone resume code may use a stale pointer to the next
    list element and crash, because it does not hold thermal_list_lock
    while walking thermal_tz_list.

 2. The thermal zone resume code calls thermal_zone_device_init()
    outside the zone lock, so user space or an update triggered by
    the platform firmware may see an inconsistent state of a
    thermal zone leading to unexpected behavior.

 3. Clearing the in_suspend global variable in thermal_pm_notify()
    allows __thermal_zone_device_update() to continue for all thermal
    zones and it may as well run before the thermal_tz_list walk (or
    at any point during the list walk for that matter) and attempt to
    operate on a thermal zone that has not been resumed yet.  It may
    also race destructively with thermal_zone_device_init().

To address these issues, add thermal_list_lock locking to
thermal_pm_notify(), especially arount the thermal_tz_list,
make it call thermal_zone_device_init() back-to-back with
__thermal_zone_device_update() under the zone lock and replace
in_suspend with per-zone bool "suspend" indicators set and unset
under the given zone's lock.

Link: https://lore.kernel.org/linux-pm/20231218162348.69101-1-bo.ye@mediatek.com/
Reported-by: Bo Ye <bo.ye@mediatek.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
thermal: intel: hfi: Add syscore callbacks for system-wide PM 2024-02-01T00:21:16+00:00 Ricardo Neri ricardo.neri-calderon@linux.intel.com 2024-01-10T03:07:04+00:00 c9d6d63b6c03afaa6f185df249af693a7939577c [ Upstream commit 97566d09fd02d2ab329774bb89a2cdf2267e86d9 ] The kernel allocates a memory buffer and provides its location to the hardware, which uses it to update the HFI table. This allocation occurs during boot and remains constant throughout runtime. When resuming from hibernation, the restore kernel allocates a second memory buffer and reprograms the HFI hardware with the new location as part of a normal boot. The location of the second memory buffer may differ from the one allocated by the image kernel. When the restore kernel transfers control to the image kernel, its HFI buffer becomes invalid, potentially leading to memory corruption if the hardware writes to it (the hardware continues to use the buffer from the restore kernel). It is also possible that the hardware "forgets" the address of the memory buffer when resuming from "deep" suspend. Memory corruption may also occur in such a scenario. To prevent the described memory corruption, disable HFI when preparing to suspend or hibernate. Enable it when resuming. Add syscore callbacks to handle the package of the boot CPU (packages of non-boot CPUs are handled via CPU offline). Syscore ops always run on the boot CPU. Additionally, HFI only needs to be disabled during "deep" suspend and hibernation. Syscore ops only run in these cases. Cc: 6.1+ <stable@vger.kernel.org> # 6.1+ Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> [ rjw: Comment adjustment, subject and changelog edits ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 97566d09fd02d2ab329774bb89a2cdf2267e86d9 ]

The kernel allocates a memory buffer and provides its location to the
hardware, which uses it to update the HFI table. This allocation occurs
during boot and remains constant throughout runtime.

When resuming from hibernation, the restore kernel allocates a second
memory buffer and reprograms the HFI hardware with the new location as
part of a normal boot. The location of the second memory buffer may
differ from the one allocated by the image kernel.

When the restore kernel transfers control to the image kernel, its HFI
buffer becomes invalid, potentially leading to memory corruption if the
hardware writes to it (the hardware continues to use the buffer from the
restore kernel).

It is also possible that the hardware "forgets" the address of the memory
buffer when resuming from "deep" suspend. Memory corruption may also occur
in such a scenario.

To prevent the described memory corruption, disable HFI when preparing to
suspend or hibernate. Enable it when resuming.

Add syscore callbacks to handle the package of the boot CPU (packages of
non-boot CPUs are handled via CPU offline). Syscore ops always run on the
boot CPU. Additionally, HFI only needs to be disabled during "deep" suspend
and hibernation. Syscore ops only run in these cases.

Cc: 6.1+ <stable@vger.kernel.org> # 6.1+
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
[ rjw: Comment adjustment, subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
thermal: intel: hfi: Disable an HFI instance when all its CPUs go offline 2024-02-01T00:21:16+00:00 Ricardo Neri ricardo.neri-calderon@linux.intel.com 2024-01-03T04:14:58+00:00 74090a40021a7d78429bd7af6f7cd7e90e489444 [ Upstream commit 1c53081d773c2cb4461636559b0d55b46559ceec ] In preparation to support hibernation, add functionality to disable an HFI instance during CPU offline. The last CPU of an instance that goes offline will disable such instance. The Intel Software Development Manual states that the operating system must wait for the hardware to set MSR_IA32_PACKAGE_THERM_STATUS[26] after disabling an HFI instance to ensure that it will no longer write on the HFI memory. Some processors, however, do not ever set such bit. Wait a minimum of 2ms to give time hardware to complete any pending memory writes. Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Stable-dep-of: 97566d09fd02 ("thermal: intel: hfi: Add syscore callbacks for system-wide PM") Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 1c53081d773c2cb4461636559b0d55b46559ceec ]

In preparation to support hibernation, add functionality to disable an HFI
instance during CPU offline. The last CPU of an instance that goes offline
will disable such instance.

The Intel Software Development Manual states that the operating system must
wait for the hardware to set MSR_IA32_PACKAGE_THERM_STATUS[26] after
disabling an HFI instance to ensure that it will no longer write on the HFI
memory. Some processors, however, do not ever set such bit. Wait a minimum
of 2ms to give time hardware to complete any pending memory writes.

Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 97566d09fd02 ("thermal: intel: hfi: Add syscore callbacks for system-wide PM")
Signed-off-by: Sasha Levin <sashal@kernel.org>
thermal: intel: hfi: Refactor enabling code into helper functions 2024-02-01T00:21:15+00:00 Ricardo Neri ricardo.neri-calderon@linux.intel.com 2024-01-03T04:14:56+00:00 b326de729f87b3ad53a382c871701f3016582e24 [ Upstream commit 8a8b6bb93c704776c4b05cb517c3fa8baffb72f5 ] In preparation for the addition of a suspend notifier, wrap the logic to enable HFI and program its memory buffer into helper functions. Both the CPU hotplug callback and the suspend notifier will use them. This refactoring does not introduce functional changes. Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Stable-dep-of: 97566d09fd02 ("thermal: intel: hfi: Add syscore callbacks for system-wide PM") Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 8a8b6bb93c704776c4b05cb517c3fa8baffb72f5 ]

In preparation for the addition of a suspend notifier, wrap the logic to
enable HFI and program its memory buffer into helper functions. Both the
CPU hotplug callback and the suspend notifier will use them.

This refactoring does not introduce functional changes.

Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 97566d09fd02 ("thermal: intel: hfi: Add syscore callbacks for system-wide PM")
Signed-off-by: Sasha Levin <sashal@kernel.org>
thermal: gov_power_allocator: avoid inability to reset a cdev 2024-02-01T00:21:02+00:00 Di Shen di.shen@unisoc.com 2024-01-10T11:55:26+00:00 538db7912d9bd8d92f5afef03c0d5eafe1ef0fbe commit e95fa7404716f6e25021e66067271a4ad8eb1486 upstream. Commit 0952177f2a1f ("thermal/core/power_allocator: Update once cooling devices when temp is low") adds an update flag to avoid triggering a thermal event when there is no need, and the thermal cdev is updated once when the temperature is low. But when the trips are writable, and switch_on_temp is set to be a higher value, the cooling device state may not be reset to 0, because last_temperature is smaller than switch_on_temp. For example: First: switch_on_temp=70 control_temp=85; Then userspace change the trip_temp: switch_on_temp=45 control_temp=55 cur_temp=54 Then userspace reset the trip_temp: switch_on_temp=70 control_temp=85 cur_temp=57 last_temp=54 At this time, the cooling device state should be reset to 0. However, because cur_temp(57) < switch_on_temp(70) last_temp(54) < switch_on_temp(70) ----> update = false, update is false, the cooling device state can not be reset. Using the observation that tz->passive can also be regarded as the temperature status, set the update flag to the tz->passive value. When the temperature drops below switch_on for the first time, the states of cooling devices can be reset once, and tz->passive is updated to 0. In the next round, because tz->passive is 0, cdev->state will not be updated. By using the tz->passive value as the "update" flag, the issue above can be solved, and the cooling devices can be updated only once when the temperature is low. Fixes: 0952177f2a1f ("thermal/core/power_allocator: Update once cooling devices when temp is low") Cc: 5.13+ <stable@vger.kernel.org> # 5.13+ Suggested-by: Wei Wang <wvw@google.com> Signed-off-by: Di Shen <di.shen@unisoc.com> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit e95fa7404716f6e25021e66067271a4ad8eb1486 upstream.

Commit 0952177f2a1f ("thermal/core/power_allocator: Update once
cooling devices when temp is low") adds an update flag to avoid
triggering a thermal event when there is no need, and the thermal
cdev is updated once when the temperature is low.

But when the trips are writable, and switch_on_temp is set to be a
higher value, the cooling device state may not be reset to 0,
because last_temperature is smaller than switch_on_temp.

For example:
First:
switch_on_temp=70 control_temp=85;
Then userspace change the trip_temp:
switch_on_temp=45 control_temp=55 cur_temp=54

Then userspace reset the trip_temp:
switch_on_temp=70 control_temp=85 cur_temp=57 last_temp=54

At this time, the cooling device state should be reset to 0.
However, because cur_temp(57) < switch_on_temp(70)
last_temp(54) < switch_on_temp(70)  ---->  update = false,
update is false, the cooling device state can not be reset.

Using the observation that tz->passive can also be regarded as the
temperature status, set the update flag to the tz->passive value.

When the temperature drops below switch_on for the first time, the
states of cooling devices can be reset once, and tz->passive is updated
to 0. In the next round, because tz->passive is 0, cdev->state will not
be updated.

By using the tz->passive value as the "update" flag, the issue above
can be solved, and the cooling devices can be updated only once when the
temperature is low.

Fixes: 0952177f2a1f ("thermal/core/power_allocator: Update once cooling devices when temp is low")
Cc: 5.13+ <stable@vger.kernel.org> # 5.13+
Suggested-by: Wei Wang <wvw@google.com>
Signed-off-by: Di Shen <di.shen@unisoc.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgment 2024-01-25T23:44:40+00:00 Binbin Zhou zhoubinbin@loongson.cn 2023-11-24T09:57:45+00:00 6010a9fc14eb1feab5cafd84422001134fe8ec58 [ Upstream commit 15ef92e9c41124ee9d88b01208364f3fe1f45f84 ] PTR_ERR() returns -ENODEV when thermal-zones are undefined, and we need -ENODEV as the right value for comparison. Otherwise, tz->type is NULL when thermal-zones is undefined, resulting in the following error: [ 12.290030] CPU 1 Unable to handle kernel paging request at virtual address fffffffffffffff1, era == 900000000355f410, ra == 90000000031579b8 [ 12.302877] Oops[#1]: [ 12.305190] CPU: 1 PID: 181 Comm: systemd-udevd Not tainted 6.6.0-rc7+ #5385 [ 12.312304] pc 900000000355f410 ra 90000000031579b8 tp 90000001069e8000 sp 90000001069eba10 [ 12.320739] a0 0000000000000000 a1 fffffffffffffff1 a2 0000000000000014 a3 0000000000000001 [ 12.329173] a4 90000001069eb990 a5 0000000000000001 a6 0000000000001001 a7 900000010003431c [ 12.337606] t0 fffffffffffffff1 t1 54567fd5da9b4fd4 t2 900000010614ec40 t3 00000000000dc901 [ 12.346041] t4 0000000000000000 t5 0000000000000004 t6 900000010614ee20 t7 900000000d00b790 [ 12.354472] t8 00000000000dc901 u0 54567fd5da9b4fd4 s9 900000000402ae10 s0 900000010614ec40 [ 12.362916] s1 90000000039fced0 s2 ffffffffffffffed s3 ffffffffffffffed s4 9000000003acc000 [ 12.362931] s5 0000000000000004 s6 fffffffffffff000 s7 0000000000000490 s8 90000001028b2ec8 [ 12.362938] ra: 90000000031579b8 thermal_add_hwmon_sysfs+0x258/0x300 [ 12.386411] ERA: 900000000355f410 strscpy+0xf0/0x160 [ 12.391626] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 12.397898] PRMD: 00000004 (PPLV0 +PIE -PWE) [ 12.403678] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 12.409859] ECFG: 00071c1c (LIE=2-4,10-12 VS=7) [ 12.415882] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [ 12.415907] BADV: fffffffffffffff1 [ 12.415911] PRID: 0014a000 (Loongson-64bit, Loongson-2K1000) [ 12.415917] Modules linked in: loongson2_thermal(+) vfat fat uio_pdrv_genirq uio fuse zram zsmalloc [ 12.415950] Process systemd-udevd (pid: 181, threadinfo=00000000358b9718, task=00000000ace72fe3) [ 12.415961] Stack : 0000000000000dc0 54567fd5da9b4fd4 900000000402ae10 9000000002df9358 [ 12.415982] ffffffffffffffed 0000000000000004 9000000107a10aa8 90000001002a3410 [ 12.415999] ffffffffffffffed ffffffffffffffed 9000000107a11268 9000000003157ab0 [ 12.416016] 9000000107a10aa8 ffffff80020fc0c8 90000001002a3410 ffffffffffffffed [ 12.416032] 0000000000000024 ffffff80020cc1e8 900000000402b2a0 9000000003acc000 [ 12.416048] 90000001002a3410 0000000000000000 ffffff80020f4030 90000001002a3410 [ 12.416065] 0000000000000000 9000000002df6808 90000001002a3410 0000000000000000 [ 12.416081] ffffff80020f4030 0000000000000000 90000001002a3410 9000000002df2ba8 [ 12.416097] 00000000000000b4 90000001002a34f4 90000001002a3410 0000000000000002 [ 12.416114] ffffff80020f4030 fffffffffffffff0 90000001002a3410 9000000002df2f30 [ 12.416131] ... [ 12.416138] Call Trace: [ 12.416142] [<900000000355f410>] strscpy+0xf0/0x160 [ 12.416167] [<90000000031579b8>] thermal_add_hwmon_sysfs+0x258/0x300 [ 12.416183] [<9000000003157ab0>] devm_thermal_add_hwmon_sysfs+0x50/0xe0 [ 12.416200] [<ffffff80020cc1e8>] loongson2_thermal_probe+0x128/0x200 [loongson2_thermal] [ 12.416232] [<9000000002df6808>] platform_probe+0x68/0x140 [ 12.416249] [<9000000002df2ba8>] really_probe+0xc8/0x3c0 [ 12.416269] [<9000000002df2f30>] __driver_probe_device+0x90/0x180 [ 12.416286] [<9000000002df3058>] driver_probe_device+0x38/0x160 [ 12.416302] [<9000000002df33a8>] __driver_attach+0xa8/0x200 [ 12.416314] [<9000000002deffec>] bus_for_each_dev+0x8c/0x120 [ 12.416330] [<9000000002df198c>] bus_add_driver+0x10c/0x2a0 [ 12.416346] [<9000000002df46b4>] driver_register+0x74/0x160 [ 12.416358] [<90000000022201a4>] do_one_initcall+0x84/0x220 [ 12.416372] [<90000000022f3ab8>] do_init_module+0x58/0x2c0 [ 12.416386] [<90000000022f6538>] init_module_from_file+0x98/0x100 [ 12.416399] [<90000000022f67f0>] sys_finit_module+0x230/0x3c0 [ 12.416412] [<900000000358f7c8>] do_syscall+0x88/0xc0 [ 12.416431] [<900000000222137c>] handle_syscall+0xbc/0x158 Fixes: e7e3a7c35791 ("thermal/drivers/loongson-2: Add thermal management support") Cc: Yinbo Zhu <zhuyinbo@loongson.cn> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/343c14de98216636a47b43e8bfd47b70d0a8e068.1700817227.git.zhoubinbin@loongson.cn Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 15ef92e9c41124ee9d88b01208364f3fe1f45f84 ]

PTR_ERR() returns -ENODEV when thermal-zones are undefined, and we need
-ENODEV as the right value for comparison.

Otherwise, tz->type is NULL when thermal-zones is undefined, resulting
in the following error:

[   12.290030] CPU 1 Unable to handle kernel paging request at virtual address fffffffffffffff1, era == 900000000355f410, ra == 90000000031579b8
[   12.302877] Oops[#1]:
[   12.305190] CPU: 1 PID: 181 Comm: systemd-udevd Not tainted 6.6.0-rc7+ #5385
[   12.312304] pc 900000000355f410 ra 90000000031579b8 tp 90000001069e8000 sp 90000001069eba10
[   12.320739] a0 0000000000000000 a1 fffffffffffffff1 a2 0000000000000014 a3 0000000000000001
[   12.329173] a4 90000001069eb990 a5 0000000000000001 a6 0000000000001001 a7 900000010003431c
[   12.337606] t0 fffffffffffffff1 t1 54567fd5da9b4fd4 t2 900000010614ec40 t3 00000000000dc901
[   12.346041] t4 0000000000000000 t5 0000000000000004 t6 900000010614ee20 t7 900000000d00b790
[   12.354472] t8 00000000000dc901 u0 54567fd5da9b4fd4 s9 900000000402ae10 s0 900000010614ec40
[   12.362916] s1 90000000039fced0 s2 ffffffffffffffed s3 ffffffffffffffed s4 9000000003acc000
[   12.362931] s5 0000000000000004 s6 fffffffffffff000 s7 0000000000000490 s8 90000001028b2ec8
[   12.362938]    ra: 90000000031579b8 thermal_add_hwmon_sysfs+0x258/0x300
[   12.386411]   ERA: 900000000355f410 strscpy+0xf0/0x160
[   12.391626]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
[   12.397898]  PRMD: 00000004 (PPLV0 +PIE -PWE)
[   12.403678]  EUEN: 00000000 (-FPE -SXE -ASXE -BTE)
[   12.409859]  ECFG: 00071c1c (LIE=2-4,10-12 VS=7)
[   12.415882] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)
[   12.415907]  BADV: fffffffffffffff1
[   12.415911]  PRID: 0014a000 (Loongson-64bit, Loongson-2K1000)
[   12.415917] Modules linked in: loongson2_thermal(+) vfat fat uio_pdrv_genirq uio fuse zram zsmalloc
[   12.415950] Process systemd-udevd (pid: 181, threadinfo=00000000358b9718, task=00000000ace72fe3)
[   12.415961] Stack : 0000000000000dc0 54567fd5da9b4fd4 900000000402ae10 9000000002df9358
[   12.415982]         ffffffffffffffed 0000000000000004 9000000107a10aa8 90000001002a3410
[   12.415999]         ffffffffffffffed ffffffffffffffed 9000000107a11268 9000000003157ab0
[   12.416016]         9000000107a10aa8 ffffff80020fc0c8 90000001002a3410 ffffffffffffffed
[   12.416032]         0000000000000024 ffffff80020cc1e8 900000000402b2a0 9000000003acc000
[   12.416048]         90000001002a3410 0000000000000000 ffffff80020f4030 90000001002a3410
[   12.416065]         0000000000000000 9000000002df6808 90000001002a3410 0000000000000000
[   12.416081]         ffffff80020f4030 0000000000000000 90000001002a3410 9000000002df2ba8
[   12.416097]         00000000000000b4 90000001002a34f4 90000001002a3410 0000000000000002
[   12.416114]         ffffff80020f4030 fffffffffffffff0 90000001002a3410 9000000002df2f30
[   12.416131]         ...
[   12.416138] Call Trace:
[   12.416142] [<900000000355f410>] strscpy+0xf0/0x160
[   12.416167] [<90000000031579b8>] thermal_add_hwmon_sysfs+0x258/0x300
[   12.416183] [<9000000003157ab0>] devm_thermal_add_hwmon_sysfs+0x50/0xe0
[   12.416200] [<ffffff80020cc1e8>] loongson2_thermal_probe+0x128/0x200 [loongson2_thermal]
[   12.416232] [<9000000002df6808>] platform_probe+0x68/0x140
[   12.416249] [<9000000002df2ba8>] really_probe+0xc8/0x3c0
[   12.416269] [<9000000002df2f30>] __driver_probe_device+0x90/0x180
[   12.416286] [<9000000002df3058>] driver_probe_device+0x38/0x160
[   12.416302] [<9000000002df33a8>] __driver_attach+0xa8/0x200
[   12.416314] [<9000000002deffec>] bus_for_each_dev+0x8c/0x120
[   12.416330] [<9000000002df198c>] bus_add_driver+0x10c/0x2a0
[   12.416346] [<9000000002df46b4>] driver_register+0x74/0x160
[   12.416358] [<90000000022201a4>] do_one_initcall+0x84/0x220
[   12.416372] [<90000000022f3ab8>] do_init_module+0x58/0x2c0
[   12.416386] [<90000000022f6538>] init_module_from_file+0x98/0x100
[   12.416399] [<90000000022f67f0>] sys_finit_module+0x230/0x3c0
[   12.416412] [<900000000358f7c8>] do_syscall+0x88/0xc0
[   12.416431] [<900000000222137c>] handle_syscall+0xbc/0x158

Fixes: e7e3a7c35791 ("thermal/drivers/loongson-2: Add thermal management support")
Cc: Yinbo Zhu <zhuyinbo@loongson.cn>
Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/343c14de98216636a47b43e8bfd47b70d0a8e068.1700817227.git.zhoubinbin@loongson.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
thermal: core: Fix NULL pointer dereference in zone registration error path 2024-01-25T23:44:40+00:00 Rafael J. Wysocki rafael.j.wysocki@intel.com 2023-12-14T10:52:25+00:00 02871710b93058eb1249d5847c0b2d1c2c3c98ae [ Upstream commit 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea ] If device_register() in thermal_zone_device_register_with_trips() returns an error, the tz variable is set to NULL and subsequently dereferenced in kfree(tz->tzp). Commit adc8749b150c ("thermal/drivers/core: Use put_device() if device_register() fails") added the tz = NULL assignment in question to avoid a possible double-free after dropping the reference to the zone device. However, after commit 4649620d9404 ("thermal: core: Make thermal_zone_device_unregister() return after freeing the zone"), that assignment has become redundant, because dropping the reference to the zone device does not cause the zone object to be freed any more. Drop it to address the NULL pointer dereference. Fixes: 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea ]

If device_register() in thermal_zone_device_register_with_trips()
returns an error, the tz variable is set to NULL and subsequently
dereferenced in kfree(tz->tzp).

Commit adc8749b150c ("thermal/drivers/core: Use put_device() if
device_register() fails") added the tz = NULL assignment in question to
avoid a possible double-free after dropping the reference to the zone
device.  However, after commit 4649620d9404 ("thermal: core: Make
thermal_zone_device_unregister() return after freeing the zone"), that
assignment has become redundant, because dropping the reference to the
zone device does not cause the zone object to be freed any more.

Drop it to address the NULL pointer dereference.

Fixes: 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Merge tag 'thermal-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm 2023-11-01T01:28:37+00:00 Linus Torvalds torvalds@linux-foundation.org 2023-11-01T01:28:37+00:00 4ac4677fdb76f644e09a6331bab65919b85f617d Pull thermal control updates from Rafael Wysocki: "These further rework the ACPI thermal driver, after the changes made to it in the previous cycle, to make it easier to grasp, get rid of redundant pieces of internal data structures and eliminate its reliance on a specific ordering of trip point objects in the thermal core, make thermal core adjustments needed for the ACPI thermal driver rework, modify the thermal governor interface so as to use trip pointers for representing trip points in it, switch over multiple thermal drivers to using void platform driver remove callbacks, add support for 2 hardware features to the Intel int340x thermal driver, add support for new hardware on ARM platforms, update documentation, fix problems, clean up code and update the MAINTAINERS record for thermal control. Specifics: - Untangle the initialization and updates of passive and active trip points in the ACPI thermal driver (Rafael Wysocki) - Reduce code duplication related to the initialization and updates of trip points in the ACPI thermal driver (Rafael Wysocki) - Use trip pointers for cooling device binding in the ACPI thermal driver (Rafael Wysocki) - Simplify critical and hot trips representation in the ACPI thermal driver (Rafael Wysocki) - Use trip pointers in thermal governors and in the related part of the thermal core (Rafael Wysocki) - Drop the trips_disabled bitmask that has become redundant from the thermal core (Rafael Wysocki) - Avoid updating trip points when the thermal zone temperature falls into a trip point's hysteresis range (ícolas F. R. A. Prado) - Add power floor notifications support to the int340x thermal control driver (Srinivas Pandruvada) - Rework updating trip points in the int340x thermal driver so that it does not access thermal zone internals directly (Rafael Wysocki) - Use param_get_byte() instead of param_get_int() as the max_idle module parameter .get() callback in the Intel powerclamp thermal driver to avoid possible out-of-bounds access (David Arcari) - Add workload hints support to the int340x thermal driver (Srinivas Pandruvada) - Add support for Mediatek LVTS MT8192 along with suspend/resume routines (Balsam Chihi) - Fix probe for THERMAL_V2 in the Mediatek LVTS driver (Markus Schneider-Pargmann) - Remove duplicate error message from the max76620 driver when thermal_of_zone_register() fails (Thierry Reding) - Add i.MX7D compatible bindings to fix a warning from dtbs_check for the imx6ul platform (Alexander Stein) - Add sa8775p compatible to the QCom tsens driver (Priyansh Jain) - Fix error check in lvts_debugfs_init() to be against PTR_ERR() in the LVTS Mediatek driver (Minjie Du) - Remove unused variable in thermal/tools (Kuan-Wei Chiu) - Document the imx8dl thermal sensor (Fabio Estevam) - Add variable names in callback prototypes to prevent warning from checkpatch.pl in the imx8mm driver (Bragatheswaran Manickavel) - Add missing unevaluatedProperties on child node schemas for tegra124 (Rob Herring) - Add mt7988 support to the Mediatek LVTS driver (Frank Wunderlich)" * tag 'thermal-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (111 commits) thermal: ACPI: Include the right header file thermal: core: Don't update trip points inside the hysteresis range thermal: core: Pass trip pointer to governor throttle callback thermal: gov_step_wise: Fold update_passive_instance() into its caller thermal: gov_power_allocator: Use trip pointers instead of trip indices thermal: gov_fair_share: Rearrange get_trip_level() thermal: trip: Define for_each_trip() macro thermal: trip: Simplify computing trip indices thermal/qcom/tsens: Drop ops_v0_1 thermal/drivers/mediatek/lvts_thermal: Update calibration data documentation thermal/drivers/mediatek/lvts_thermal: Add mt8192 support thermal/drivers/mediatek/lvts_thermal: Add suspend and resume dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for mt8192 thermal/drivers/mediatek: Fix probe for THERMAL_V2 thermal/drivers/max77620: Remove duplicate error message dt-bindings: timer: add imx7d compatible dt-bindings: net: microchip: Allow nvmem-cell usage dt-bindings: imx-thermal: Add #thermal-sensor-cells property dt-bindings: thermal: tsens: Add sa8775p compatible thermal/drivers/mediatek/lvts_thermal: Fix error check in lvts_debugfs_init() ... 
Pull thermal control updates from Rafael Wysocki:
 "These further rework the ACPI thermal driver, after the changes made
  to it in the previous cycle, to make it easier to grasp, get rid of
  redundant pieces of internal data structures and eliminate its
  reliance on a specific ordering of trip point objects in the thermal
  core, make thermal core adjustments needed for the ACPI thermal driver
  rework, modify the thermal governor interface so as to use trip
  pointers for representing trip points in it, switch over multiple
  thermal drivers to using void platform driver remove callbacks, add
  support for 2 hardware features to the Intel int340x thermal driver,
  add support for new hardware on ARM platforms, update documentation,
  fix problems, clean up code and update the MAINTAINERS record for
  thermal control.

  Specifics:

   - Untangle the initialization and updates of passive and active trip
     points in the ACPI thermal driver (Rafael Wysocki)

   - Reduce code duplication related to the initialization and updates
     of trip points in the ACPI thermal driver (Rafael Wysocki)

   - Use trip pointers for cooling device binding in the ACPI thermal
     driver (Rafael Wysocki)

   - Simplify critical and hot trips representation in the ACPI thermal
     driver (Rafael Wysocki)

   - Use trip pointers in thermal governors and in the related part of
     the thermal core (Rafael Wysocki)

   - Drop the trips_disabled bitmask that has become redundant from the
     thermal core (Rafael Wysocki)

   - Avoid updating trip points when the thermal zone temperature falls
     into a trip point's hysteresis range (ícolas F. R. A. Prado)

   - Add power floor notifications support to the int340x thermal
     control driver (Srinivas Pandruvada)

   - Rework updating trip points in the int340x thermal driver so that
     it does not access thermal zone internals directly (Rafael
     Wysocki)

   - Use param_get_byte() instead of param_get_int() as the max_idle
     module parameter .get() callback in the Intel powerclamp thermal
     driver to avoid possible out-of-bounds access (David Arcari)

   - Add workload hints support to the int340x thermal driver (Srinivas
     Pandruvada)

   - Add support for Mediatek LVTS MT8192 along with suspend/resume
     routines (Balsam Chihi)

   - Fix probe for THERMAL_V2 in the Mediatek LVTS driver (Markus
     Schneider-Pargmann)

   - Remove duplicate error message from the max76620 driver when
     thermal_of_zone_register() fails (Thierry Reding)

   - Add i.MX7D compatible bindings to fix a warning from dtbs_check for
     the imx6ul platform (Alexander Stein)

   - Add sa8775p compatible to the QCom tsens driver (Priyansh Jain)

   - Fix error check in lvts_debugfs_init() to be against PTR_ERR() in
     the LVTS Mediatek driver (Minjie Du)

   - Remove unused variable in thermal/tools (Kuan-Wei Chiu)

   - Document the imx8dl thermal sensor (Fabio Estevam)

   - Add variable names in callback prototypes to prevent warning from
     checkpatch.pl in the imx8mm driver (Bragatheswaran Manickavel)

   - Add missing unevaluatedProperties on child node schemas for
     tegra124 (Rob Herring)

   - Add mt7988 support to the Mediatek LVTS driver (Frank Wunderlich)"

* tag 'thermal-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (111 commits)
  thermal: ACPI: Include the right header file
  thermal: core: Don't update trip points inside the hysteresis range
  thermal: core: Pass trip pointer to governor throttle callback
  thermal: gov_step_wise: Fold update_passive_instance() into its caller
  thermal: gov_power_allocator: Use trip pointers instead of trip indices
  thermal: gov_fair_share: Rearrange get_trip_level()
  thermal: trip: Define for_each_trip() macro
  thermal: trip: Simplify computing trip indices
  thermal/qcom/tsens: Drop ops_v0_1
  thermal/drivers/mediatek/lvts_thermal: Update calibration data documentation
  thermal/drivers/mediatek/lvts_thermal: Add mt8192 support
  thermal/drivers/mediatek/lvts_thermal: Add suspend and resume
  dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for mt8192
  thermal/drivers/mediatek: Fix probe for THERMAL_V2
  thermal/drivers/max77620: Remove duplicate error message
  dt-bindings: timer: add imx7d compatible
  dt-bindings: net: microchip: Allow nvmem-cell usage
  dt-bindings: imx-thermal: Add #thermal-sensor-cells property
  dt-bindings: thermal: tsens: Add sa8775p compatible
  thermal/drivers/mediatek/lvts_thermal: Fix error check in lvts_debugfs_init()
  ...
Merge tag 'hardening-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 2023-10-31T05:09:55+00:00 Linus Torvalds torvalds@linux-foundation.org 2023-10-31T05:09:55+00:00 befaa609f4c784f505c02ea3ff036adf4f4aa814 Pull hardening updates from Kees Cook: "One of the more voluminous set of changes is for adding the new __counted_by annotation[1] to gain run-time bounds checking of dynamically sized arrays with UBSan. - Add LKDTM test for stuck CPUs (Mark Rutland) - Improve LKDTM selftest behavior under UBSan (Ricardo Cañuelo) - Refactor more 1-element arrays into flexible arrays (Gustavo A. R. Silva) - Analyze and replace strlcpy and strncpy uses (Justin Stitt, Azeem Shaikh) - Convert group_info.usage to refcount_t (Elena Reshetova) - Add __counted_by annotations (Kees Cook, Gustavo A. R. Silva) - Add Kconfig fragment for basic hardening options (Kees Cook, Lukas Bulwahn) - Fix randstruct GCC plugin performance mode to stay in groups (Kees Cook) - Fix strtomem() compile-time check for small sources (Kees Cook)" * tag 'hardening-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (56 commits) hwmon: (acpi_power_meter) replace open-coded kmemdup_nul reset: Annotate struct reset_control_array with __counted_by kexec: Annotate struct crash_mem with __counted_by virtio_console: Annotate struct port_buffer with __counted_by ima: Add __counted_by for struct modsig and use struct_size() MAINTAINERS: Include stackleak paths in hardening entry string: Adjust strtomem() logic to allow for smaller sources hardening: x86: drop reference to removed config AMD_IOMMU_V2 randstruct: Fix gcc-plugin performance mode to stay in group mailbox: zynqmp: Annotate struct zynqmp_ipi_pdata with __counted_by drivers: thermal: tsens: Annotate struct tsens_priv with __counted_by irqchip/imx-intmux: Annotate struct intmux_data with __counted_by KVM: Annotate struct kvm_irq_routing_table with __counted_by virt: acrn: Annotate struct vm_memory_region_batch with __counted_by hwmon: Annotate struct gsc_hwmon_platform_data with __counted_by sparc: Annotate struct cpuinfo_tree with __counted_by isdn: kcapi: replace deprecated strncpy with strscpy_pad isdn: replace deprecated strncpy with strscpy NFS/flexfiles: Annotate struct nfs4_ff_layout_segment with __counted_by nfs41: Annotate struct nfs4_file_layout_dsaddr with __counted_by ... 
Pull hardening updates from Kees Cook:
 "One of the more voluminous set of changes is for adding the new
  __counted_by annotation[1] to gain run-time bounds checking of
  dynamically sized arrays with UBSan.

   - Add LKDTM test for stuck CPUs (Mark Rutland)

   - Improve LKDTM selftest behavior under UBSan (Ricardo Cañuelo)

   - Refactor more 1-element arrays into flexible arrays (Gustavo A. R.
     Silva)

   - Analyze and replace strlcpy and strncpy uses (Justin Stitt, Azeem
     Shaikh)

   - Convert group_info.usage to refcount_t (Elena Reshetova)

   - Add __counted_by annotations (Kees Cook, Gustavo A. R. Silva)

   - Add Kconfig fragment for basic hardening options (Kees Cook, Lukas
     Bulwahn)

   - Fix randstruct GCC plugin performance mode to stay in groups (Kees
     Cook)

   - Fix strtomem() compile-time check for small sources (Kees Cook)"

* tag 'hardening-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (56 commits)
  hwmon: (acpi_power_meter) replace open-coded kmemdup_nul
  reset: Annotate struct reset_control_array with __counted_by
  kexec: Annotate struct crash_mem with __counted_by
  virtio_console: Annotate struct port_buffer with __counted_by
  ima: Add __counted_by for struct modsig and use struct_size()
  MAINTAINERS: Include stackleak paths in hardening entry
  string: Adjust strtomem() logic to allow for smaller sources
  hardening: x86: drop reference to removed config AMD_IOMMU_V2
  randstruct: Fix gcc-plugin performance mode to stay in group
  mailbox: zynqmp: Annotate struct zynqmp_ipi_pdata with __counted_by
  drivers: thermal: tsens: Annotate struct tsens_priv with __counted_by
  irqchip/imx-intmux: Annotate struct intmux_data with __counted_by
  KVM: Annotate struct kvm_irq_routing_table with __counted_by
  virt: acrn: Annotate struct vm_memory_region_batch with __counted_by
  hwmon: Annotate struct gsc_hwmon_platform_data with __counted_by
  sparc: Annotate struct cpuinfo_tree with __counted_by
  isdn: kcapi: replace deprecated strncpy with strscpy_pad
  isdn: replace deprecated strncpy with strscpy
  NFS/flexfiles: Annotate struct nfs4_ff_layout_segment with __counted_by
  nfs41: Annotate struct nfs4_file_layout_dsaddr with __counted_by
  ...
Merge tag 'thermal-v6.7-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux 2023-10-25T12:41:10+00:00 Rafael J. Wysocki rafael.j.wysocki@intel.com 2023-10-25T12:41:10+00:00 607218deac6e29c52f4ce521ed467a0d75090a0d Merge thermal control (ARM drivers mostly) updates for 6.7-rc1 from Daniel Lezcano: "- Add support for Mediatek LVTS MT8192 driver along with the suspend/resume routines (Balsam Chihi) - Fix probe for THERMAL_V2 for the Mediatek LVTS driver (Markus Schneider-Pargmann) - Remove duplicate error message in the max76620 driver when thermal_of_zone_register() fails as the sub routine already show one (Thierry Reding) - Add i.MX7D compatible bindings to fix a warning from dtbs_check for the imx6ul platform (Alexander Stein) - Add sa8775p compatible for the QCom tsens driver (Priyansh Jain) - Fix error check in lvts_debugfs_init() which is checking against NULL instead of PTR_ERR() on the LVTS Mediatek driver (Minjie Du) - Remove unused variable in the thermal/tools (Kuan-Wei Chiu) - Document the imx8dl thermal sensor (Fabio Estevam) - Add variable names in callback prototypes to prevent warning from checkpatch.pl for the imx8mm driver (Bragatheswaran Manickavel) - Add missing unevaluatedProperties on child node schemas for tegra124 (Rob Herring) - Add mt7988 support for the Mediatek LVTS driver (Frank Wunderlich)" * tag 'thermal-v6.7-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: thermal/qcom/tsens: Drop ops_v0_1 thermal/drivers/mediatek/lvts_thermal: Update calibration data documentation thermal/drivers/mediatek/lvts_thermal: Add mt8192 support thermal/drivers/mediatek/lvts_thermal: Add suspend and resume dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for mt8192 thermal/drivers/mediatek: Fix probe for THERMAL_V2 thermal/drivers/max77620: Remove duplicate error message dt-bindings: timer: add imx7d compatible dt-bindings: net: microchip: Allow nvmem-cell usage dt-bindings: imx-thermal: Add #thermal-sensor-cells property dt-bindings: thermal: tsens: Add sa8775p compatible thermal/drivers/mediatek/lvts_thermal: Fix error check in lvts_debugfs_init() tools/thermal: Remove unused 'mds' and 'nrhandler' variables dt-bindings: thermal: fsl,scu-thermal: Document imx8dl thermal/drivers/imx8mm_thermal: Fix function pointer declaration by adding identifier name dt-bindings: thermal: nvidia,tegra124-soctherm: Add missing unevaluatedProperties on child node schemas thermal/drivers/mediatek/lvts_thermal: Add mt7988 support thermal/drivers/mediatek/lvts_thermal: Make coeff configurable dt-bindings: thermal: mediatek: Add LVTS thermal sensors for mt7988 dt-bindings: thermal: mediatek: Add mt7988 lvts compatible 
Merge thermal control (ARM drivers mostly) updates for 6.7-rc1 from
Daniel Lezcano:

"- Add support for Mediatek LVTS MT8192 driver along with the
   suspend/resume routines (Balsam Chihi)

 - Fix probe for THERMAL_V2 for the Mediatek LVTS driver (Markus
   Schneider-Pargmann)

 - Remove duplicate error message in the max76620 driver when
   thermal_of_zone_register() fails as the sub routine already show one
   (Thierry Reding)

 - Add i.MX7D compatible bindings to fix a warning from dtbs_check for
   the imx6ul platform (Alexander Stein)

 - Add sa8775p compatible for the QCom tsens driver (Priyansh Jain)

 - Fix error check in lvts_debugfs_init() which is checking against
   NULL instead of PTR_ERR() on the LVTS Mediatek driver (Minjie Du)

 - Remove unused variable in the thermal/tools (Kuan-Wei Chiu)

 - Document the imx8dl thermal sensor (Fabio Estevam)

 - Add variable names in callback prototypes to prevent warning from
   checkpatch.pl for the imx8mm driver (Bragatheswaran Manickavel)

 - Add missing unevaluatedProperties on child node schemas for tegra124
  (Rob Herring)

 - Add mt7988 support for the Mediatek LVTS driver (Frank Wunderlich)"

* tag 'thermal-v6.7-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux:
  thermal/qcom/tsens: Drop ops_v0_1
  thermal/drivers/mediatek/lvts_thermal: Update calibration data documentation
  thermal/drivers/mediatek/lvts_thermal: Add mt8192 support
  thermal/drivers/mediatek/lvts_thermal: Add suspend and resume
  dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for mt8192
  thermal/drivers/mediatek: Fix probe for THERMAL_V2
  thermal/drivers/max77620: Remove duplicate error message
  dt-bindings: timer: add imx7d compatible
  dt-bindings: net: microchip: Allow nvmem-cell usage
  dt-bindings: imx-thermal: Add #thermal-sensor-cells property
  dt-bindings: thermal: tsens: Add sa8775p compatible
  thermal/drivers/mediatek/lvts_thermal: Fix error check in lvts_debugfs_init()
  tools/thermal: Remove unused 'mds' and 'nrhandler' variables
  dt-bindings: thermal: fsl,scu-thermal: Document imx8dl
  thermal/drivers/imx8mm_thermal: Fix function pointer declaration by adding identifier name
  dt-bindings: thermal: nvidia,tegra124-soctherm: Add missing unevaluatedProperties on child node schemas
  thermal/drivers/mediatek/lvts_thermal: Add mt7988 support
  thermal/drivers/mediatek/lvts_thermal: Make coeff configurable
  dt-bindings: thermal: mediatek: Add LVTS thermal sensors for mt7988
  dt-bindings: thermal: mediatek: Add mt7988 lvts compatible