[PATCH] cpufreq: intel_pstate: cancel HWP notify work in driver cleanup

[PATCH] cpufreq: intel_pstate: cancel HWP notify work in driver cleanup

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

intel_pstate_driver_cleanup() frees per-CPU data without cancelling the
pending HWP notify delayed work. If hwp_notify_work is still scheduled
or running when the struct is freed, the work function accesses freed
memory via container_of().

Call intel_pstate_disable_hwp_interrupt() before kfree() to disable
the interrupt source and cancel the pending work, matching the pattern
used in intel_pstate_suspend() and intel_pstate_hwp_offline().

Fixes: d0e936adfe84 ("cpufreq: intel_pstate: Add HWP_HIGHEST_PERF_CHANGE handling")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/cpufreq/intel_pstate.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 17158cb25dd89..0e6ae4cdda5de 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -3436,6 +3436,8 @@ static void intel_pstate_driver_cleanup(void)
 			if (intel_pstate_driver == &intel_pstate)
 				intel_pstate_clear_update_util_hook(cpu);
 
+			intel_pstate_disable_hwp_interrupt(all_cpu_data[cpu]);
+
 			kfree(all_cpu_data[cpu]);
 			WRITE_ONCE(all_cpu_data[cpu], NULL);
 		}
-- 
2.47.3

Re: [PATCH] cpufreq: intel_pstate: cancel HWP notify work in driver cleanup

[Rafael J. Wysocki (Intel)]

On Tue, Oct 20, 2026 at 12:26 AM Tristan Madani <tristmd@gmail.com> wrote:
>
> From: Tristan Madani <tristan@talencesecurity.com>
>
> intel_pstate_driver_cleanup() frees per-CPU data without cancelling the
> pending HWP notify delayed work. If hwp_notify_work is still scheduled
> or running when the struct is freed, the work function accesses freed
> memory via container_of().
>
> Call intel_pstate_disable_hwp_interrupt() before kfree() to disable
> the interrupt source and cancel the pending work, matching the pattern
> used in intel_pstate_suspend() and intel_pstate_hwp_offline().
>
> Fixes: d0e936adfe84 ("cpufreq: intel_pstate: Add HWP_HIGHEST_PERF_CHANGE handling")

Where did you get this commit from?  It is not a mainline one AFAICS.

> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/cpufreq/intel_pstate.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
> index 17158cb25dd89..0e6ae4cdda5de 100644
> --- a/drivers/cpufreq/intel_pstate.c
> +++ b/drivers/cpufreq/intel_pstate.c
> @@ -3436,6 +3436,8 @@ static void intel_pstate_driver_cleanup(void)
>                         if (intel_pstate_driver == &intel_pstate)
>                                 intel_pstate_clear_update_util_hook(cpu);
>
> +                       intel_pstate_disable_hwp_interrupt(all_cpu_data[cpu]);
> +
>                         kfree(all_cpu_data[cpu]);
>                         WRITE_ONCE(all_cpu_data[cpu], NULL);
>                 }
> --

The Fixes: tag replaced with the following one:

Fixes: d845cd901b28 ("cpufreq: intel_pstate: Support highest
performance change interrupt")

and patch applied as 7.4-rc material.

Thanks!