[PATCH] cpufreq: use cpufreq_cpu_get to avoid cpufreq_get race conditions

[PATCH] cpufreq: use cpufreq_cpu_get to avoid cpufreq_get race conditions

[Aaron Plattner]

If a module calls cpufreq_get while cpufreq is initializing, it's possible for
it to be called after cpufreq_driver is set but before cpufreq_cpu_data is
written during subsys_interface_register.  This happens because cpufreq_get
doesn't take the cpufreq_driver_lock around its use of cpufreq_cpu_data.

Fix this by using cpufreq_cpu_get(cpu) to look up the policy rather than reading
it out of cpufreq_cpu_data directly.  cpufreq_cpu_get takes the appropriate
locks to prevent this race from happening.

Since it's possible for policy to be NULL if the caller passes in an invalid CPU
number or calls the function before cpufreq is initialized, delete the
BUG_ON(!policy) and simply return 0.  Don't try to return -ENOENT because that's
negative and the function returns an unsigned integer.

Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
---
 drivers/cpufreq/cpufreq.c | 21 +++++++--------------
 1 file changed, 7 insertions(+), 14 deletions(-)

diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 8d19f7c..158d0b5 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1447,23 +1447,16 @@ static unsigned int __cpufreq_get(unsigned int cpu)
  */
 unsigned int cpufreq_get(unsigned int cpu)
 {
-	struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
+	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
 	unsigned int ret_freq = 0;
 
-	if (cpufreq_disabled() || !cpufreq_driver)
-		return -ENOENT;
-
-	BUG_ON(!policy);
-
-	if (!down_read_trylock(&cpufreq_rwsem))
-		return 0;
-
-	down_read(&policy->rwsem);
-
-	ret_freq = __cpufreq_get(cpu);
+	if (policy) {
+		down_read(&policy->rwsem);
+		ret_freq = __cpufreq_get(cpu);
+		up_read(&policy->rwsem);
 
-	up_read(&policy->rwsem);
-	up_read(&cpufreq_rwsem);
+		cpufreq_cpu_put(policy);
+	}
 
 	return ret_freq;
 }
-- 
1.9.0

Re: [PATCH] cpufreq: use cpufreq_cpu_get to avoid cpufreq_get race conditions

[Rafael J. Wysocki]

On Tuesday, March 04, 2014 12:42:15 PM Aaron Plattner wrote:
> If a module calls cpufreq_get while cpufreq is initializing, it's possible for
> it to be called after cpufreq_driver is set but before cpufreq_cpu_data is
> written during subsys_interface_register.  This happens because cpufreq_get
> doesn't take the cpufreq_driver_lock around its use of cpufreq_cpu_data.

Is this a theoretical race, or can you actually reproduce it?  If so, on what
system/driver?  Or are there any bug reports related to this you can point me
to?

> Fix this by using cpufreq_cpu_get(cpu) to look up the policy rather than reading
> it out of cpufreq_cpu_data directly.  cpufreq_cpu_get takes the appropriate
> locks to prevent this race from happening.
> 
> Since it's possible for policy to be NULL if the caller passes in an invalid CPU
> number or calls the function before cpufreq is initialized, delete the
> BUG_ON(!policy) and simply return 0.  Don't try to return -ENOENT because that's
> negative and the function returns an unsigned integer.
> 
> Signed-off-by: Aaron Plattner <aplattner@nvidia.com>

Viresh, have you seen this?

> ---
>  drivers/cpufreq/cpufreq.c | 21 +++++++--------------
>  1 file changed, 7 insertions(+), 14 deletions(-)
> 
> diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
> index 8d19f7c..158d0b5 100644
> --- a/drivers/cpufreq/cpufreq.c
> +++ b/drivers/cpufreq/cpufreq.c
> @@ -1447,23 +1447,16 @@ static unsigned int __cpufreq_get(unsigned int cpu)
>   */
>  unsigned int cpufreq_get(unsigned int cpu)
>  {
> -	struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
> +	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
>  	unsigned int ret_freq = 0;
>  
> -	if (cpufreq_disabled() || !cpufreq_driver)
> -		return -ENOENT;
> -
> -	BUG_ON(!policy);
> -
> -	if (!down_read_trylock(&cpufreq_rwsem))
> -		return 0;
> -
> -	down_read(&policy->rwsem);
> -
> -	ret_freq = __cpufreq_get(cpu);
> +	if (policy) {
> +		down_read(&policy->rwsem);
> +		ret_freq = __cpufreq_get(cpu);
> +		up_read(&policy->rwsem);
>  
> -	up_read(&policy->rwsem);
> -	up_read(&cpufreq_rwsem);
> +		cpufreq_cpu_put(policy);
> +	}
>  
>  	return ret_freq;
>  }
> 

-- 
I speak only for myself.
Rafael J. Wysocki, Intel Open Source Technology Center.

Re: [PATCH] cpufreq: use cpufreq_cpu_get to avoid cpufreq_get race conditions

[Aaron Plattner]

On 03/05/14 17:23, Rafael J. Wysocki wrote:
> On Tuesday, March 04, 2014 12:42:15 PM Aaron Plattner wrote:
>> If a module calls cpufreq_get while cpufreq is initializing, it's possible for
>> it to be called after cpufreq_driver is set but before cpufreq_cpu_data is
>> written during subsys_interface_register.  This happens because cpufreq_get
>> doesn't take the cpufreq_driver_lock around its use of cpufreq_cpu_data.
>
> Is this a theoretical race, or can you actually reproduce it?  If so, on what
> system/driver?  Or are there any bug reports related to this you can point me
> to?

It reproduces on my Arch Linux system at home with the nvidia driver, 
and there has been at least one bug report that looks like the same thing:

https://bbs.archlinux.org/viewtopic.php?id=177934

I reproduced the problem with v3.13.5, then applied this change and was 
able to boot successfully 10/10 times.  So I guess that means you can add

Tested-by: Aaron Plattner <aplattner@nvidia.com>

to the commit.

-- Aaron

>> Fix this by using cpufreq_cpu_get(cpu) to look up the policy rather than reading
>> it out of cpufreq_cpu_data directly.  cpufreq_cpu_get takes the appropriate
>> locks to prevent this race from happening.
>>
>> Since it's possible for policy to be NULL if the caller passes in an invalid CPU
>> number or calls the function before cpufreq is initialized, delete the
>> BUG_ON(!policy) and simply return 0.  Don't try to return -ENOENT because that's
>> negative and the function returns an unsigned integer.
>>
>> Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
>
> Viresh, have you seen this?
>
>> ---
>>   drivers/cpufreq/cpufreq.c | 21 +++++++--------------
>>   1 file changed, 7 insertions(+), 14 deletions(-)
>>
>> diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
>> index 8d19f7c..158d0b5 100644
>> --- a/drivers/cpufreq/cpufreq.c
>> +++ b/drivers/cpufreq/cpufreq.c
>> @@ -1447,23 +1447,16 @@ static unsigned int __cpufreq_get(unsigned int cpu)
>>    */
>>   unsigned int cpufreq_get(unsigned int cpu)
>>   {
>> -	struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
>> +	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
>>   	unsigned int ret_freq = 0;
>>
>> -	if (cpufreq_disabled() || !cpufreq_driver)
>> -		return -ENOENT;
>> -
>> -	BUG_ON(!policy);
>> -
>> -	if (!down_read_trylock(&cpufreq_rwsem))
>> -		return 0;
>> -
>> -	down_read(&policy->rwsem);
>> -
>> -	ret_freq = __cpufreq_get(cpu);
>> +	if (policy) {
>> +		down_read(&policy->rwsem);
>> +		ret_freq = __cpufreq_get(cpu);
>> +		up_read(&policy->rwsem);
>>
>> -	up_read(&policy->rwsem);
>> -	up_read(&cpufreq_rwsem);
>> +		cpufreq_cpu_put(policy);
>> +	}
>>
>>   	return ret_freq;
>>   }
>>
>

Re: [PATCH] cpufreq: use cpufreq_cpu_get to avoid cpufreq_get race conditions

[Rafael J. Wysocki]

On Wednesday, March 05, 2014 05:14:26 PM Aaron Plattner wrote:
> On 03/05/14 17:23, Rafael J. Wysocki wrote:
> > On Tuesday, March 04, 2014 12:42:15 PM Aaron Plattner wrote:
> >> If a module calls cpufreq_get while cpufreq is initializing, it's possible for
> >> it to be called after cpufreq_driver is set but before cpufreq_cpu_data is
> >> written during subsys_interface_register.  This happens because cpufreq_get
> >> doesn't take the cpufreq_driver_lock around its use of cpufreq_cpu_data.
> >
> > Is this a theoretical race, or can you actually reproduce it?  If so, on what
> > system/driver?  Or are there any bug reports related to this you can point me
> > to?
> 
> It reproduces on my Arch Linux system at home with the nvidia driver, 
> and there has been at least one bug report that looks like the same thing:
> 
> https://bbs.archlinux.org/viewtopic.php?id=177934
> 
> I reproduced the problem with v3.13.5, then applied this change and was 
> able to boot successfully 10/10 times.  So I guess that means you can add
> 
> Tested-by: Aaron Plattner <aplattner@nvidia.com>

Tested-by is not needed if you're the author.

Everybody should test their patches, right? ;-)

I'll mark it for 3.13-stable and add the link above to the changelog.

Thanks!

-- 
I speak only for myself.
Rafael J. Wysocki, Intel Open Source Technology Center.

Re: [PATCH] cpufreq: use cpufreq_cpu_get to avoid cpufreq_get race conditions

[Viresh Kumar]

On 6 March 2014 09:23, Rafael J. Wysocki <rjw@rjwysocki.net> wrote:
> On Tuesday, March 04, 2014 12:42:15 PM Aaron Plattner wrote:
>> If a module calls cpufreq_get while cpufreq is initializing, it's possible for
>> it to be called after cpufreq_driver is set but before cpufreq_cpu_data is
>> written during subsys_interface_register.  This happens because cpufreq_get
>> doesn't take the cpufreq_driver_lock around its use of cpufreq_cpu_data.
>
> Is this a theoretical race, or can you actually reproduce it?  If so, on what
> system/driver?  Or are there any bug reports related to this you can point me
> to?
>
>> Fix this by using cpufreq_cpu_get(cpu) to look up the policy rather than reading
>> it out of cpufreq_cpu_data directly.  cpufreq_cpu_get takes the appropriate
>> locks to prevent this race from happening.
>>
>> Since it's possible for policy to be NULL if the caller passes in an invalid CPU
>> number or calls the function before cpufreq is initialized, delete the
>> BUG_ON(!policy) and simply return 0.  Don't try to return -ENOENT because that's
>> negative and the function returns an unsigned integer.
>>
>> Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
>
> Viresh, have you seen this?

Sorry for being late. Though I see you have already applied this one,
I will still add this for records :)

Acked-by: Viresh Kumar <viresh.kumar@linaro.org>