linux-kernel - Re: [PATCH] opp: Reinitialize the list_kref before adding the static OPPs again

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20191018211214.444D32089C@mail.kernel.org>
Date:   Fri, 18 Oct 2019 14:12:13 -0700
From:   Stephen Boyd <sboyd@...nel.org>
To:     Nishanth Menon <nm@...com>, Viresh Kumar <viresh.kumar@...aro.org>,
        Viresh Kumar <vireshk@...nel.org>
Cc:     Viresh Kumar <viresh.kumar@...aro.org>, linux-pm@...r.kernel.org,
        Vincent Guittot <vincent.guittot@...aro.org>,
        Rafael Wysocki <rjw@...ysocki.net>,
        Dmitry Osipenko <digetx@...il.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] opp: Reinitialize the list_kref before adding the static OPPs again

Quoting Viresh Kumar (2019-10-18 02:28:41)
> The list_kref reaches a count of 0 when all the static OPPs are removed,
> for example when dev_pm_opp_of_cpumask_remove_table() is called, though
> the actual OPP table may not get freed as it may still be referenced by
> other parts of the kernel, like from a call to
> dev_pm_opp_set_supported_hw(). And if we call
> dev_pm_opp_of_cpumask_add_table() again at this point, we must
> reinitialize the list_kref otherwise the kernel will hit a WARN() in
> kref infrastructure for incrementing a kref with value 0.
> 
> Fixes: 11e1a1648298 ("opp: Don't decrement uninitialized list_kref")
> Reported-by: Dmitry Osipenko <digetx@...il.com>
> Signed-off-by: Viresh Kumar <viresh.kumar@...aro.org>
> ---
>  drivers/opp/of.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/opp/of.c b/drivers/opp/of.c
> index 6dc41faf74b5..1cbb58240b80 100644
> --- a/drivers/opp/of.c
> +++ b/drivers/opp/of.c
> @@ -663,6 +663,13 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)
>                 return 0;
>         }
>  
> +       /*
> +        * Re-initialize list_kref every time we add static OPPs to the OPP
> +        * table as the reference count may be 0 after the last tie static OPPs

s/tie/time/

> +        * were removed.
> +        */
> +       kref_init(&opp_table->list_kref);

It seems racy. Why are we doing this vs. making an entirely new and
different OPP structure? Or why is the count reaching 0 when something
is obviously still referencing it?

> +
>         /* We have opp-table node now, iterate over it and add OPPs */
>         for_each_available_child_of_node(opp_table->np, np) {
>                 opp = _opp_add_static_v2(opp_table, dev, np);