--- /dev/null
+From 10470dec3decaf5ed3c596f85debd7c42777ae12 Mon Sep 17 00:00:00 2001
+From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
+Date: Sat, 20 Jun 2020 17:44:49 +0100
+Subject: cpufreq: dt: fix oops on armada37xx
+
+From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
+
+commit 10470dec3decaf5ed3c596f85debd7c42777ae12 upstream.
+
+Commit 0c868627e617e43a295d8 (cpufreq: dt: Allow platform specific
+intermediate callbacks) added two function pointers to the
+struct cpufreq_dt_platform_data. However, armada37xx_cpufreq_driver_init()
+has this struct (pdata) located on the stack and uses only "suspend"
+and "resume" fields. So these newly added "get_intermediate" and
+"target_intermediate" pointers are uninitialized and contain arbitrary
+non-null values, causing all kinds of trouble.
+
+For instance, here is an oops on espressobin after an attempt to change
+the cpefreq governor:
+
+[ 29.174554] Unable to handle kernel execute from non-executable memory at virtual address ffff00003f87bdc0
+...
+[ 29.269373] pc : 0xffff00003f87bdc0
+[ 29.272957] lr : __cpufreq_driver_target+0x138/0x580
+...
+
+Fixed by zeroing out pdata before use.
+
+Cc: <stable@vger.kernel.org> # v5.7+
+Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -456,6 +456,7 @@ static int __init armada37xx_cpufreq_dri
+ /* Now that everything is setup, enable the DVFS at hardware level */
+ armada37xx_cpufreq_enable_dvfs(nb_pm_base);
+
++ memset(&pdata, 0, sizeof(pdata));
+ pdata.suspend = armada37xx_cpufreq_suspend;
+ pdata.resume = armada37xx_cpufreq_resume;
+
--- /dev/null
+From 8cc46ae565c393f77417cb9530b1265eb50f5d2e Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Mon, 29 Jun 2020 13:54:58 +0530
+Subject: cpufreq: Fix locking issues with governors
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+commit 8cc46ae565c393f77417cb9530b1265eb50f5d2e upstream.
+
+The locking around governors handling isn't adequate currently.
+
+The list of governors should never be traversed without the locking
+in place. Also governor modules must not be removed while the code
+in them is still in use.
+
+Reported-by: Quentin Perret <qperret@google.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: All applicable <stable@vger.kernel.org>
+[ rjw: Changelog ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/cpufreq.c | 58 +++++++++++++++++++++++++++-------------------
+ 1 file changed, 35 insertions(+), 23 deletions(-)
+
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -616,6 +616,24 @@ static struct cpufreq_governor *find_gov
+ return NULL;
+ }
+
++static struct cpufreq_governor *get_governor(const char *str_governor)
++{
++ struct cpufreq_governor *t;
++
++ mutex_lock(&cpufreq_governor_mutex);
++ t = find_governor(str_governor);
++ if (!t)
++ goto unlock;
++
++ if (!try_module_get(t->owner))
++ t = NULL;
++
++unlock:
++ mutex_unlock(&cpufreq_governor_mutex);
++
++ return t;
++}
++
+ static unsigned int cpufreq_parse_policy(char *str_governor)
+ {
+ if (!strncasecmp(str_governor, "performance", CPUFREQ_NAME_LEN))
+@@ -635,28 +653,14 @@ static struct cpufreq_governor *cpufreq_
+ {
+ struct cpufreq_governor *t;
+
+- mutex_lock(&cpufreq_governor_mutex);
+-
+- t = find_governor(str_governor);
+- if (!t) {
+- int ret;
++ t = get_governor(str_governor);
++ if (t)
++ return t;
+
+- mutex_unlock(&cpufreq_governor_mutex);
++ if (request_module("cpufreq_%s", str_governor))
++ return NULL;
+
+- ret = request_module("cpufreq_%s", str_governor);
+- if (ret)
+- return NULL;
+-
+- mutex_lock(&cpufreq_governor_mutex);
+-
+- t = find_governor(str_governor);
+- }
+- if (t && !try_module_get(t->owner))
+- t = NULL;
+-
+- mutex_unlock(&cpufreq_governor_mutex);
+-
+- return t;
++ return get_governor(str_governor);
+ }
+
+ /**
+@@ -810,12 +814,14 @@ static ssize_t show_scaling_available_go
+ goto out;
+ }
+
++ mutex_lock(&cpufreq_governor_mutex);
+ for_each_governor(t) {
+ if (i >= (ssize_t) ((PAGE_SIZE / sizeof(char))
+ - (CPUFREQ_NAME_LEN + 2)))
+- goto out;
++ break;
+ i += scnprintf(&buf[i], CPUFREQ_NAME_PLEN, "%s ", t->name);
+ }
++ mutex_unlock(&cpufreq_governor_mutex);
+ out:
+ i += sprintf(&buf[i], "\n");
+ return i;
+@@ -1053,15 +1059,17 @@ static int cpufreq_init_policy(struct cp
+ struct cpufreq_governor *def_gov = cpufreq_default_governor();
+ struct cpufreq_governor *gov = NULL;
+ unsigned int pol = CPUFREQ_POLICY_UNKNOWN;
++ int ret;
+
+ if (has_target()) {
+ /* Update policy governor to the one used before hotplug. */
+- gov = find_governor(policy->last_governor);
++ gov = get_governor(policy->last_governor);
+ if (gov) {
+ pr_debug("Restoring governor %s for cpu %d\n",
+ policy->governor->name, policy->cpu);
+ } else if (def_gov) {
+ gov = def_gov;
++ __module_get(gov->owner);
+ } else {
+ return -ENODATA;
+ }
+@@ -1084,7 +1092,11 @@ static int cpufreq_init_policy(struct cp
+ return -ENODATA;
+ }
+
+- return cpufreq_set_policy(policy, gov, pol);
++ ret = cpufreq_set_policy(policy, gov, pol);
++ if (gov)
++ module_put(gov->owner);
++
++ return ret;
+ }
+
+ static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy, unsigned int cpu)
projects / thirdparty / kernel / stable-queue.git / commitdiff
