linux/drivers
Jane Li 6f1e4efd88 cpufreq: Fix timer/workqueue corruption by protecting reading governor_enabled
When a CPU is hot removed we'll cancel all the delayed work items via
gov_cancel_work(). Sometimes the delayed work function determines that
it should adjust the delay for all other CPUs that the policy is
managing. If this scenario occurs, the canceling CPU will cancel its own
work but queue up the other CPUs works to run.

Commit 3617f2 (cpufreq: Fix timer/workqueue corruption due to double
queueing) has tried to fix this, but reading governor_enabled is not
protected by cpufreq_governor_lock. Even though od_dbs_timer() checks
governor_enabled before gov_queue_work(), this scenario may occur. For
example:

 CPU0                                        CPU1
 ----                                        ----
 cpu_down()
  ...                                        <work runs>
  __cpufreq_remove_dev()                     od_dbs_timer()
   __cpufreq_governor()                       policy->governor_enabled
    policy->governor_enabled = false;
    cpufreq_governor_dbs()
     case CPUFREQ_GOV_STOP:
      gov_cancel_work(dbs_data, policy);
       cpu0 work is canceled
        timer is canceled
        cpu1 work is canceled
        <waits for cpu1>
                                              gov_queue_work(*, *, true);
                                               cpu0 work queued
                                               cpu1 work queued
                                               cpu2 work queued
                                               ...
        cpu1 work is canceled
        cpu2 work is canceled
        ...

At the end of the GOV_STOP case cpu0 still has a work queued to
run although the code is expecting all of the works to be
canceled. __cpufreq_remove_dev() will then proceed to
re-initialize all the other CPUs works except for the CPU that is
going down. The CPUFREQ_GOV_START case in cpufreq_governor_dbs()
will trample over the queued work and debugobjects will spit out
a warning:

WARNING: at lib/debugobjects.c:260 debug_print_object+0x94/0xbc()
ODEBUG: init active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x14
Modules linked in:
CPU: 1 PID: 1205 Comm: sh Tainted: G        W    3.10.0 #200
[<c01144f0>] (unwind_backtrace+0x0/0xf8) from [<c0111d98>] (show_stack+0x10/0x14)
[<c0111d98>] (show_stack+0x10/0x14) from [<c01272cc>] (warn_slowpath_common+0x4c/0x68)
[<c01272cc>] (warn_slowpath_common+0x4c/0x68) from [<c012737c>] (warn_slowpath_fmt+0x30/0x40)
[<c012737c>] (warn_slowpath_fmt+0x30/0x40) from [<c034c640>] (debug_print_object+0x94/0xbc)
[<c034c640>] (debug_print_object+0x94/0xbc) from [<c034c7f8>] (__debug_object_init+0xc8/0x3c0)
[<c034c7f8>] (__debug_object_init+0xc8/0x3c0) from [<c01360e0>] (init_timer_key+0x20/0x104)
[<c01360e0>] (init_timer_key+0x20/0x104) from [<c04872ac>] (cpufreq_governor_dbs+0x1dc/0x68c)
[<c04872ac>] (cpufreq_governor_dbs+0x1dc/0x68c) from [<c04833a8>] (__cpufreq_governor+0x80/0x1b0)
[<c04833a8>] (__cpufreq_governor+0x80/0x1b0) from [<c0483704>] (__cpufreq_remove_dev.isra.12+0x22c/0x380)
[<c0483704>] (__cpufreq_remove_dev.isra.12+0x22c/0x380) from [<c0692f38>] (cpufreq_cpu_callback+0x48/0x5c)
[<c0692f38>] (cpufreq_cpu_callback+0x48/0x5c) from [<c014fb40>] (notifier_call_chain+0x44/0x84)
[<c014fb40>] (notifier_call_chain+0x44/0x84) from [<c012ae44>] (__cpu_notify+0x2c/0x48)
[<c012ae44>] (__cpu_notify+0x2c/0x48) from [<c068dd40>] (_cpu_down+0x80/0x258)
[<c068dd40>] (_cpu_down+0x80/0x258) from [<c068df40>] (cpu_down+0x28/0x3c)
[<c068df40>] (cpu_down+0x28/0x3c) from [<c068e4c0>] (store_online+0x30/0x74)
[<c068e4c0>] (store_online+0x30/0x74) from [<c03a7308>] (dev_attr_store+0x18/0x24)
[<c03a7308>] (dev_attr_store+0x18/0x24) from [<c0256fe0>] (sysfs_write_file+0x100/0x180)
[<c0256fe0>] (sysfs_write_file+0x100/0x180) from [<c01fec9c>] (vfs_write+0xbc/0x184)
[<c01fec9c>] (vfs_write+0xbc/0x184) from [<c01ff034>] (SyS_write+0x40/0x68)
[<c01ff034>] (SyS_write+0x40/0x68) from [<c010e200>] (ret_fast_syscall+0x0/0x48)

In gov_queue_work(), lock cpufreq_governor_lock before gov_queue_work,
and unlock it after __gov_queue_work(). In this way, governor_enabled
is guaranteed not changed in gov_queue_work().

Signed-off-by: Jane Li <jiel@marvell.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-01-06 01:22:02 +01:00
..
accessibility
acpi Merge branch 'acpica' 2013-11-27 01:03:27 +01:00
amba
ata SCSI fixes on 20131206 2013-12-06 08:30:18 -08:00
atm atm: idt77252: fix dev refcnt leak 2013-11-19 15:53:02 -05:00
auxdisplay
base Revert "cpufreq: suspend governors on system suspend/hibernate" 2013-12-08 01:04:17 +01:00
bcma Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2013-11-13 17:40:34 +09:00
block null_blk: mem garbage on NUMA systems during init 2013-12-15 12:17:16 -08:00
bluetooth
bus Merge branch 'for-linus' of git://git.linaro.org/people/rmk/linux-arm 2013-11-14 08:51:29 +09:00
cdrom
char Char/Misc driver fixes for 3.13-rc3 2013-12-08 18:47:25 -08:00
clk Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-11-15 16:47:22 -08:00
clocksource clocksource: arm_arch_timer: Hide eventstream Kconfig on non-ARM 2013-11-21 00:06:52 +01:00
connector connector: improved unaligned access error fix 2013-11-14 17:19:20 -05:00
cpufreq cpufreq: Fix timer/workqueue corruption by protecting reading governor_enabled 2014-01-06 01:22:02 +01:00
cpuidle cpuidle: Check for dev before deregistering it. 2013-12-03 22:05:22 +01:00
crypto crypto: talitos - fix aead sglen for case 'dst != src' 2013-11-28 22:25:17 +08:00
dca
devfreq
dio
dma dma: fix build breakage in s3c24xx-dma 2013-12-04 11:24:30 +05:30
edac sb_edac: Shut up compiler warning when EDAC_DEBUG is enabled 2013-11-30 12:26:36 +01:00
eisa
extcon extcon: remove freed groups caused the panic or warning in unregister flow 2013-11-26 15:17:23 +09:00
firewire [SCSI] Disable WRITE SAME for RAID and virtual host adapter drivers 2013-11-29 08:48:39 +04:00
firmware efi-pstore: Make efi-pstore return a unique id 2013-11-29 10:11:06 +00:00
fmc
gpio A rather big fix for a regression where we have dropped omap4 hwmod 2013-12-09 15:38:41 -08:00
gpu radeon_pm: fix oops in hwmon_attributes_visible() and radeon_hwmon_show_temp_thresh() 2013-12-15 12:16:00 -08:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2013-12-13 13:21:28 -08:00
hsi
hv
hwmon hwmon fixes for 3.13-rc4 2013-12-12 11:05:19 -08:00
hwspinlock
i2c i2c: imx: Check the return value from clk_prepare_enable() 2013-12-12 22:48:22 +01:00
ide More ACPI and power management updates for 3.13-rc1 2013-11-20 13:25:04 -08:00
idle intel_idle: Fixed C6 state on Avoton/Rangeley processors 2013-11-28 14:35:26 +01:00
iio Fix build failure for gp2ap020a00f.c 2013-12-02 21:11:30 +00:00
infiniband Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2013-11-22 10:52:03 -08:00
input Input: adxl34x - Fix bug in definition of ADXL346_2D_ORIENT 2013-12-09 22:23:31 -08:00
iommu iommu/arm-smmu: fix error return code in arm_smmu_device_dt_probe() 2013-12-06 16:44:25 +00:00
ipack
irqchip Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2013-12-02 10:15:39 -08:00
isdn net: rework recvmsg handler msg_name and msg_namelen logic 2013-11-20 21:52:30 -05:00
leds leds: pwm: Fix for deferred probe in DT booted mode 2013-12-02 11:53:17 -08:00
lguest
macintosh powerpc/windfarm: Fix XServe G5 fan control Makefile issue 2013-11-27 11:35:47 +11:00
mailbox
md A set of device-mapper fixes for 3.13. 2013-12-13 13:22:22 -08:00
media [media] videobuf2-dma-sg: fix possible memory leak 2013-12-10 05:40:57 -02:00
memory
memstick tree-wide: use reinit_completion instead of INIT_COMPLETION 2013-11-15 09:32:21 +09:00
message drivers/message/i2o/driver.c: add missing destroy_workqueue() on error in i2o_driver_register() 2013-11-13 12:09:26 +09:00
mfd mfd/rtc: s5m: fix register updating by adding regmap for RTC 2013-12-12 18:19:26 -08:00
misc Char/Misc driver fixes for 3.13-rc3 2013-12-08 18:47:25 -08:00
mmc mmc: omap: Fix I2C dependency and make driver usable with device tree 2013-11-26 15:51:16 -08:00
mtd mtd: nand: pxa3xx: Use info->use_dma to release DMA resources 2013-12-12 15:02:04 -08:00
net igb: Fix for issue where values could be too high for udelay function. 2013-12-14 22:59:42 -05:00
nfc
ntb NTB driver bug fixes to address a missed call to pci_enable_msix, 2013-11-26 11:15:12 -08:00
nubus
of Merge branch 'for-linus-dma-masks' of git://git.linaro.org/people/rmk/linux-arm 2013-11-14 07:55:21 +09:00
oprofile
parisc
parport Kconfig cleanups for v3.13 2013-11-15 14:05:15 -08:00
pci Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-12-15 11:56:47 -08:00
pcmcia DeviceTree updates for 3.13. This is a bit larger pull request than 2013-11-12 16:52:17 +09:00
phy
pinctrl sh-pfc: sh7372: Fix pin bias setup 2013-12-03 10:38:41 +01:00
platform sony-laptop: do not scribble keyboard backlight registers on resume 2013-11-26 13:03:36 +09:00
pnp PNP: fix restoring devices after hibernation 2013-12-05 02:01:55 +01:00
power Highlights: 2013-11-18 15:35:09 -08:00
powercap PowerCap: Fix mode for energy counter 2013-12-05 02:05:48 +01:00
pps drivers/pps/clients/pps-gpio.c: remove redundant of_match_ptr 2013-11-13 12:09:35 +09:00
ps3
ptp
pwm
rapidio
regulator regulator: Fixes for v3.13 2013-12-13 11:39:54 -08:00
remoteproc
reset
rpmsg
rtc mfd/rtc: s5m: fix register updating by adding regmap for RTC 2013-12-12 18:19:26 -08:00
s390 s390/sclp: replace uninitialized early_event_mask_sccb variable with sccb_early 2013-12-02 15:31:07 +01:00
sbus
scsi SCSI fixes on 20131206 2013-12-06 08:30:18 -08:00
sfi
sh
sn
spi Merge remote-tracking branches 'spi/fix/bcm2835', 'spi/fix/bcm63xx', 'spi/fix/mpc512x-psc', 'spi/fix/mxs', 'spi/fix/pxa2xx', 'spi/fix/qspi', 'spi/fix/rspi' and 'spi/fix/txx9' into spi-linus 2013-11-28 11:31:35 +00:00
ssb
staging Staging: TIDSPBRIDGE: Use vm_iomap_memory for mmap-ing instead of remap_pfn_range 2013-12-03 09:42:45 -08:00
target Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2013-11-22 10:52:03 -08:00
tc
thermal Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-19 15:50:47 -08:00
tty n_tty: Fix missing newline echo 2013-11-29 12:53:19 -08:00
uio uio: we cannot mmap unaligned page contents 2013-12-02 11:50:37 -08:00
usb usb: hub: Use correct reset for wedged USB3 devices that are NOTATTACHED 2013-12-04 17:00:43 -08:00
uwb
vfio
vhost Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2013-11-22 10:52:03 -08:00
video Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc 2013-12-09 19:21:39 -08:00
virt
virtio Nothing really exciting: some groundwork for changing virtio endian, and 2013-11-15 13:28:47 +09:00
vlynq
vme
w1 drivers/w1/masters/w1-gpio.c: use dev_get_platdata() 2013-11-15 09:32:21 +09:00
watchdog sc1200_wdt: Fix oops 2013-12-10 08:48:15 +01:00
xen Bug-fixes: 2013-12-02 10:12:01 -08:00
zorro
Kconfig ACPI and power management updates for 3.13-rc1 2013-11-14 13:41:48 +09:00
Makefile ACPI and power management updates for 3.13-rc1 2013-11-14 13:41:48 +09:00