Commit ca42489d authored by Richard Cochran's avatar Richard Cochran Committed by Rafael J. Wysocki

intel_idle: Avoid a double free of the per-CPU data.

The helper function, intel_idle_cpuidle_devices_uninit, frees the
globally allocated per-CPU data.  However, this function is invoked
from the hot plug notifier callback at a time when freeing that data
is not safe.

If the call to cpuidle_register_driver() should fail (say, due to lack
of memory), then the driver will free its per-CPU region.  On the
*next* CPU_ONLINE event, the driver will happily use the region again
and even free it again if the failure repeats.

This patch fixes the issue by moving the call to free_percpu() outside
of the helper function at the two call sites that actually need to
free the per-CPU data.
Signed-off-by: default avatarRichard Cochran <rcochran@linutronix.de>
Signed-off-by: default avatarLen Brown <len.brown@intel.com>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
parent e9df69cc
...@@ -1002,7 +1002,7 @@ static int __init intel_idle_probe(void) ...@@ -1002,7 +1002,7 @@ static int __init intel_idle_probe(void)
/* /*
* intel_idle_cpuidle_devices_uninit() * intel_idle_cpuidle_devices_uninit()
* unregister, free cpuidle_devices * Unregisters the cpuidle devices.
*/ */
static void intel_idle_cpuidle_devices_uninit(void) static void intel_idle_cpuidle_devices_uninit(void)
{ {
...@@ -1013,9 +1013,6 @@ static void intel_idle_cpuidle_devices_uninit(void) ...@@ -1013,9 +1013,6 @@ static void intel_idle_cpuidle_devices_uninit(void)
dev = per_cpu_ptr(intel_idle_cpuidle_devices, i); dev = per_cpu_ptr(intel_idle_cpuidle_devices, i);
cpuidle_unregister_device(dev); cpuidle_unregister_device(dev);
} }
free_percpu(intel_idle_cpuidle_devices);
return;
} }
/* /*
...@@ -1231,6 +1228,7 @@ static int __init intel_idle_init(void) ...@@ -1231,6 +1228,7 @@ static int __init intel_idle_init(void)
if (retval) { if (retval) {
cpu_notifier_register_done(); cpu_notifier_register_done();
cpuidle_unregister_driver(&intel_idle_driver); cpuidle_unregister_driver(&intel_idle_driver);
free_percpu(intel_idle_cpuidle_devices);
return retval; return retval;
} }
} }
...@@ -1253,6 +1251,7 @@ static void __exit intel_idle_exit(void) ...@@ -1253,6 +1251,7 @@ static void __exit intel_idle_exit(void)
cpu_notifier_register_done(); cpu_notifier_register_done();
cpuidle_unregister_driver(&intel_idle_driver); cpuidle_unregister_driver(&intel_idle_driver);
free_percpu(intel_idle_cpuidle_devices);
} }
module_init(intel_idle_init); module_init(intel_idle_init);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment