In cpufreq_policy_put_kobj(), policy->rwsem is used. But in
cpufreq_policy_alloc(), if freq_qos_add_notifier() returns an error, error
path via err_kobj_remove or err_min_qos_notifier will be reached and
cpufreq_policy_put_kobj() will be called before policy->rwsem is
initialized. Thus, the calling of init_rwsem() should be moved to where
before these two error paths can be reached.

Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
---
 drivers/cpufreq/cpufreq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 1bc665b5bba8..efc1f4ac85cb 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1284,6 +1284,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
 		goto err_free_real_cpus;
 	}
 
+	init_rwsem(&policy->rwsem);
+
 	freq_constraints_init(&policy->constraints);
 
 	policy->nb_min.notifier_call = cpufreq_notifier_min;
@@ -1306,7 +1308,6 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
 	}
 
 	INIT_LIST_HEAD(&policy->policy_list);
-	init_rwsem(&policy->rwsem);
 	spin_lock_init(&policy->transition_lock);
 	init_waitqueue_head(&policy->transition_wait);
 	INIT_WORK(&policy->update, handle_update);
-- 
2.33.0

On Mon, Jun 23, 2025 at 3:34 PM Lifeng Zheng <zhenglifeng1@huawei.com> wrote:
>
> In cpufreq_policy_put_kobj(), policy->rwsem is used. But in
> cpufreq_policy_alloc(), if freq_qos_add_notifier() returns an error, error
> path via err_kobj_remove or err_min_qos_notifier will be reached and
> cpufreq_policy_put_kobj() will be called before policy->rwsem is
> initialized. Thus, the calling of init_rwsem() should be moved to where
> before these two error paths can be reached.

Since this is a fix, any chance to add a Fixes: tag here?

> Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
> ---
>  drivers/cpufreq/cpufreq.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
> index 1bc665b5bba8..efc1f4ac85cb 100644
> --- a/drivers/cpufreq/cpufreq.c
> +++ b/drivers/cpufreq/cpufreq.c
> @@ -1284,6 +1284,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
>                 goto err_free_real_cpus;
>         }
>
> +       init_rwsem(&policy->rwsem);
> +
>         freq_constraints_init(&policy->constraints);
>
>         policy->nb_min.notifier_call = cpufreq_notifier_min;
> @@ -1306,7 +1308,6 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
>         }
>
>         INIT_LIST_HEAD(&policy->policy_list);
> -       init_rwsem(&policy->rwsem);
>         spin_lock_init(&policy->transition_lock);
>         init_waitqueue_head(&policy->transition_wait);
>         INIT_WORK(&policy->update, handle_update);
> --
> 2.33.0
>

On 2025/6/23 23:29, Rafael J. Wysocki wrote:

> On Mon, Jun 23, 2025 at 3:34 PM Lifeng Zheng <zhenglifeng1@huawei.com> wrote:
>>
>> In cpufreq_policy_put_kobj(), policy->rwsem is used. But in
>> cpufreq_policy_alloc(), if freq_qos_add_notifier() returns an error, error
>> path via err_kobj_remove or err_min_qos_notifier will be reached and
>> cpufreq_policy_put_kobj() will be called before policy->rwsem is
>> initialized. Thus, the calling of init_rwsem() should be moved to where
>> before these two error paths can be reached.
> 
> Since this is a fix, any chance to add a Fixes: tag here?

You are right. Will add it. Thanks.

> 
>> Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
>> ---
>>  drivers/cpufreq/cpufreq.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
>> index 1bc665b5bba8..efc1f4ac85cb 100644
>> --- a/drivers/cpufreq/cpufreq.c
>> +++ b/drivers/cpufreq/cpufreq.c
>> @@ -1284,6 +1284,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
>>                 goto err_free_real_cpus;
>>         }
>>
>> +       init_rwsem(&policy->rwsem);
>> +
>>         freq_constraints_init(&policy->constraints);
>>
>>         policy->nb_min.notifier_call = cpufreq_notifier_min;
>> @@ -1306,7 +1308,6 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
>>         }
>>
>>         INIT_LIST_HEAD(&policy->policy_list);
>> -       init_rwsem(&policy->rwsem);
>>         spin_lock_init(&policy->transition_lock);
>>         init_waitqueue_head(&policy->transition_wait);
>>         INIT_WORK(&policy->update, handle_update);
>> --
>> 2.33.0
>>
>