diff options
| author | Richard Cochran <rcochran@linutronix.de> | 2016-04-06 17:00:53 -0400 |
|---|---|---|
| committer | Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 2016-04-07 22:10:57 +0200 |
| commit | ca42489d9ee3262482717c83428e087322fdc39c (patch) | |
| tree | e5a121d896f3800241610c64ab0eb9cd87732bb1 /drivers/idle | |
| parent | e9df69ccd1322e87eee10f28036fad9e6c71f8dd (diff) | |
| download | linux-stable-ca42489d9ee3262482717c83428e087322fdc39c.tar.gz linux-stable-ca42489d9ee3262482717c83428e087322fdc39c.tar.bz2 linux-stable-ca42489d9ee3262482717c83428e087322fdc39c.zip | |
intel_idle: Avoid a double free of the per-CPU data.
The helper function, intel_idle_cpuidle_devices_uninit, frees the
globally allocated per-CPU data. However, this function is invoked
from the hot plug notifier callback at a time when freeing that data
is not safe.
If the call to cpuidle_register_driver() should fail (say, due to lack
of memory), then the driver will free its per-CPU region. On the
*next* CPU_ONLINE event, the driver will happily use the region again
and even free it again if the failure repeats.
This patch fixes the issue by moving the call to free_percpu() outside
of the helper function at the two call sites that actually need to
free the per-CPU data.
Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Diffstat (limited to 'drivers/idle')
| -rw-r--r-- | drivers/idle/intel_idle.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c index 5dd741ff4de3..0b568728867e 100644 --- a/drivers/idle/intel_idle.c +++ b/drivers/idle/intel_idle.c @@ -1002,7 +1002,7 @@ static int __init intel_idle_probe(void) /* * intel_idle_cpuidle_devices_uninit() - * unregister, free cpuidle_devices + * Unregisters the cpuidle devices. */ static void intel_idle_cpuidle_devices_uninit(void) { @@ -1013,9 +1013,6 @@ static void intel_idle_cpuidle_devices_uninit(void) dev = per_cpu_ptr(intel_idle_cpuidle_devices, i); cpuidle_unregister_device(dev); } - - free_percpu(intel_idle_cpuidle_devices); - return; } /* @@ -1231,6 +1228,7 @@ static int __init intel_idle_init(void) if (retval) { cpu_notifier_register_done(); cpuidle_unregister_driver(&intel_idle_driver); + free_percpu(intel_idle_cpuidle_devices); return retval; } } @@ -1253,6 +1251,7 @@ static void __exit intel_idle_exit(void) cpu_notifier_register_done(); cpuidle_unregister_driver(&intel_idle_driver); + free_percpu(intel_idle_cpuidle_devices); } module_init(intel_idle_init); |