Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1372826

[PATCH 07/13] intel_idle: Avoid a double free of the per-CPU data.

Show all headers | View raw

From: Richard Cochran <rcochran@linutronix.de>

The helper function, intel_idle_cpuidle_devices_uninit, frees the
globally allocated per-CPU data.  However, this function is invoked
from the hot plug notifier callback at a time when freeing that data
is not safe.

If the call to cpuidle_register_driver() should fail (say, due to lack
of memory), then the driver will free its per-CPU region.  On the
*next* CPU_ONLINE event, the driver will happily use the region again
and even free it again if the failure repeats.

This patch fixes the issue by moving the call to free_percpu() outside
of the helper function at the two call sites that actually need to
free the per-CPU data.

Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
---
 drivers/idle/intel_idle.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 085538a..04fe4df 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -1069,7 +1069,7 @@ static int __init intel_idle_probe(void)
 
 /*
  * intel_idle_cpuidle_devices_uninit()
- * unregister, free cpuidle_devices
+ * Unregisters the cpuidle devices.
  */
 static void intel_idle_cpuidle_devices_uninit(void)
 {
@@ -1080,9 +1080,6 @@ static void intel_idle_cpuidle_devices_uninit(void)
 		dev = per_cpu_ptr(intel_idle_cpuidle_devices, i);
 		cpuidle_unregister_device(dev);
 	}
-
-	free_percpu(intel_idle_cpuidle_devices);
-	return;
 }
 
 /*
@@ -1368,6 +1365,7 @@ static int __init intel_idle_init(void)
 		if (retval) {
 			cpu_notifier_register_done();
 			cpuidle_unregister_driver(&intel_idle_driver);
+			free_percpu(intel_idle_cpuidle_devices);
 			return retval;
 		}
 	}
@@ -1390,6 +1388,7 @@ static void __exit intel_idle_exit(void)
 	cpu_notifier_register_done();
 
 	cpuidle_unregister_driver(&intel_idle_driver);
+	free_percpu(intel_idle_cpuidle_devices);
 }
 
 module_init(intel_idle_init);
-- 
2.8.0.rc4.16.g56331f8

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/13] intel_idle patches ready for upstream Len Brown <lenb@kernel.org> - 2016-04-06 23:10 +0200
  [PATCH 13/13] intel_idle: Add KBL support Len Brown <lenb@kernel.org> - 2016-04-06 23:10 +0200
  [PATCH 08/13] intel_idle: Setup the timer broadcast only on successful driver load. Len Brown <lenb@kernel.org> - 2016-04-06 23:10 +0200
  [PATCH 07/13] intel_idle: Avoid a double free of the per-CPU data. Len Brown <lenb@kernel.org> - 2016-04-06 23:10 +0200
  [PATCH 02/13] intel_idle: remove useless return from void function. Len Brown <lenb@kernel.org> - 2016-04-06 23:10 +0200
  [PATCH 04/13] intel_idle: Remove redundant initialization calls. Len Brown <lenb@kernel.org> - 2016-04-06 23:10 +0200
  [PATCH 06/13] intel_idle: Fix dangling registration on error path. Len Brown <lenb@kernel.org> - 2016-04-06 23:10 +0200
  [PATCH 01/13] intel_idle: add BXT support Len Brown <lenb@kernel.org> - 2016-04-06 23:10 +0200
  [PATCH 09/13] intel_idle: Don't overreact to a cpuidle registration failure. Len Brown <lenb@kernel.org> - 2016-04-06 23:10 +0200

csiph-web