summaryrefslogtreecommitdiffstats
path: root/drivers/idle
diff options
context:
space:
mode:
authorRichard Cochran <rcochran@linutronix.de>2016-04-06 17:00:53 -0400
committerRafael J. Wysocki <rafael.j.wysocki@intel.com>2016-04-07 22:10:57 +0200
commitca42489d9ee3262482717c83428e087322fdc39c (patch)
treee5a121d896f3800241610c64ab0eb9cd87732bb1 /drivers/idle
parente9df69ccd1322e87eee10f28036fad9e6c71f8dd (diff)
downloadlinux-stable-ca42489d9ee3262482717c83428e087322fdc39c.tar.gz
linux-stable-ca42489d9ee3262482717c83428e087322fdc39c.tar.bz2
linux-stable-ca42489d9ee3262482717c83428e087322fdc39c.zip
intel_idle: Avoid a double free of the per-CPU data.
The helper function, intel_idle_cpuidle_devices_uninit, frees the globally allocated per-CPU data. However, this function is invoked from the hot plug notifier callback at a time when freeing that data is not safe. If the call to cpuidle_register_driver() should fail (say, due to lack of memory), then the driver will free its per-CPU region. On the *next* CPU_ONLINE event, the driver will happily use the region again and even free it again if the failure repeats. This patch fixes the issue by moving the call to free_percpu() outside of the helper function at the two call sites that actually need to free the per-CPU data. Signed-off-by: Richard Cochran <rcochran@linutronix.de> Signed-off-by: Len Brown <len.brown@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Diffstat (limited to 'drivers/idle')
-rw-r--r--drivers/idle/intel_idle.c7
1 files changed, 3 insertions, 4 deletions
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 5dd741ff4de3..0b568728867e 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -1002,7 +1002,7 @@ static int __init intel_idle_probe(void)
/*
* intel_idle_cpuidle_devices_uninit()
- * unregister, free cpuidle_devices
+ * Unregisters the cpuidle devices.
*/
static void intel_idle_cpuidle_devices_uninit(void)
{
@@ -1013,9 +1013,6 @@ static void intel_idle_cpuidle_devices_uninit(void)
dev = per_cpu_ptr(intel_idle_cpuidle_devices, i);
cpuidle_unregister_device(dev);
}
-
- free_percpu(intel_idle_cpuidle_devices);
- return;
}
/*
@@ -1231,6 +1228,7 @@ static int __init intel_idle_init(void)
if (retval) {
cpu_notifier_register_done();
cpuidle_unregister_driver(&intel_idle_driver);
+ free_percpu(intel_idle_cpuidle_devices);
return retval;
}
}
@@ -1253,6 +1251,7 @@ static void __exit intel_idle_exit(void)
cpu_notifier_register_done();
cpuidle_unregister_driver(&intel_idle_driver);
+ free_percpu(intel_idle_cpuidle_devices);
}
module_init(intel_idle_init);