• Viresh Kumar's avatar
    cpufreq: Fix NULL reference crash while accessing policy->governor_data · e4b133cc
    Viresh Kumar authored
    There is a race discovered by Juri, where we are able to:
    - create and read a sysfs file before policy->governor_data is being set
      to a non NULL value.
      OR
    - set policy->governor_data to NULL, and reading a file before being
      destroyed.
    
    And so such a crash is reported:
    
    Unable to handle kernel NULL pointer dereference at virtual address 0000000c
    pgd = edfc8000
    [0000000c] *pgd=bfc8c835
    Internal error: Oops: 17 [#1] SMP ARM
    Modules linked in:
    CPU: 4 PID: 1730 Comm: cat Not tainted 4.5.0-rc1+ #463
    Hardware name: ARM-Versatile Express
    task: ee8e8480 ti: ee930000 task.ti: ee930000
    PC is at show_ignore_nice_load_gov_pol+0x24/0x34
    LR is at show+0x4c/0x60
    pc : [<c058f1bc>]    lr : [<c058ae88>]    psr: a0070013
    sp : ee931dd0  ip : ee931de0  fp : ee931ddc
    r10: ee4bc290  r9 : 00001000  r8 : ef2cb000
    r7 : ee4bc200  r6 : ef2cb000  r5 : c0af57b0  r4 : ee4bc2e0
    r3 : 00000000  r2 : 00000000  r1 : c0928df4  r0 : ef2cb000
    Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
    Control: 10c5387d  Table: adfc806a  DAC: 00000051
    Process cat (pid: 1730, stack limit = 0xee930210)
    Stack: (0xee931dd0 to 0xee932000)
    1dc0:                                     ee931dfc ee931de0 c058ae88 c058f1a4
    1de0: edce3bc0 c07bfca4 edce3ac0 00001000 ee931e24 ee931e00 c01fcb90 c058ae48
    1e00: 00000001 edce3bc0 00000000 00000001 ee931e50 ee8ff480 ee931e34 ee931e28
    1e20: c01fb33c c01fcb0c ee931e8c ee931e38 c01a5210 c01fb314 ee931e9c ee931e48
    1e40: 00000000 edce3bf0 befe4a00 ee931f78 00000000 00000000 000001e4 00000000
    1e60: c00545a8 edce3ac0 00001000 00001000 befe4a00 ee931f78 00000000 00001000
    1e80: ee931ed4 ee931e90 c01fbed8 c01a5038 ed085a58 00020000 00000000 00000000
    1ea0: c0ad72e4 ee931f78 ee8ff488 ee8ff480 c077f3fc 00001000 befe4a00 ee931f78
    1ec0: 00000000 00001000 ee931f44 ee931ed8 c017c328 c01fbdc4 00001000 00000000
    1ee0: ee8ff480 00001000 ee931f44 ee931ef8 c017c65c c03deb10 ee931fac ee931f08
    1f00: c0009270 c001f290 c0a8d968 ef2cb000 ef2cb000 ee8ff480 00000020 ee8ff480
    1f20: ee8ff480 befe4a00 00001000 ee931f78 00000000 00000000 ee931f74 ee931f48
    1f40: c017d1ec c017c2f8 c019c724 c019c684 ee8ff480 ee8ff480 00001000 befe4a00
    1f60: 00000000 00000000 ee931fa4 ee931f78 c017d2a8 c017d160 00000000 00000000
    1f80: 000a9f20 00001000 befe4a00 00000003 c000ffe4 ee930000 00000000 ee931fa8
    1fa0: c000fe40 c017d264 000a9f20 00001000 00000003 befe4a00 00001000 00000000
    Unable to handle kernel NULL pointer dereference at virtual address 0000000c
    1fc0: 000a9f20 00001000 befe4a00 00000003 00000000 00000000 00000003 00000001
    pgd = edfc4000
    [0000000c] *pgd=bfcac835
    1fe0: 00000000 befe49dc 000197f8 b6e35dfc 60070010 00000003 3065b49d 134ac2c9
    
    [<c058f1bc>] (show_ignore_nice_load_gov_pol) from [<c058ae88>] (show+0x4c/0x60)
    [<c058ae88>] (show) from [<c01fcb90>] (sysfs_kf_seq_show+0x90/0xfc)
    [<c01fcb90>] (sysfs_kf_seq_show) from [<c01fb33c>] (kernfs_seq_show+0x34/0x38)
    [<c01fb33c>] (kernfs_seq_show) from [<c01a5210>] (seq_read+0x1e4/0x4e4)
    [<c01a5210>] (seq_read) from [<c01fbed8>] (kernfs_fop_read+0x120/0x1a0)
    [<c01fbed8>] (kernfs_fop_read) from [<c017c328>] (__vfs_read+0x3c/0xe0)
    [<c017c328>] (__vfs_read) from [<c017d1ec>] (vfs_read+0x98/0x104)
    [<c017d1ec>] (vfs_read) from [<c017d2a8>] (SyS_read+0x50/0x90)
    [<c017d2a8>] (SyS_read) from [<c000fe40>] (ret_fast_syscall+0x0/0x1c)
    Code: e5903044 e1a00001 e3081df4 e34c1092 (e593300c)
    ---[ end trace 5994b9a5111f35ee ]---
    
    Fix that by making sure, policy->governor_data is updated at the right
    places only.
    
    Cc: 4.2+ <stable@vger.kernel.org> # 4.2+
    Reported-and-tested-by: default avatarJuri Lelli <juri.lelli@arm.com>
    Signed-off-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
    Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
    e4b133cc
cpufreq_governor.c 16.1 KB