From nobody Sat Jul 25 00:16:11 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E70C5403144 for ; Tue, 21 Jul 2026 17:11:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784653917; cv=none; b=FVKmbHNDtYIrZ9Xvpj90G8dTRDbM7TqJJft9owCAqDshvZnrbihA8Gp2jXClSYidzXKGsEedGab7KOecjYIXgsOX5eYwkHD++m5+vpQ1nGystXUa63l4EhdRFrRyI5cPZdnk9DOBU3qJvGsQiDZHl+x0xSohb8zoLJVI0dou2T4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784653917; c=relaxed/simple; bh=4U8yA0YUChRaMOVMbjLw28gimlUxZgOzczMBFEHezTI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=KJnmxmFbGDHDMAcrUQqS94Dm8Ye3rI3NmAXWtG7WhEVRKOqfczPxgC1Tz3J814W4PrUD+7p3+rlPAuZRjYITyXZznpsDzA9QZBEpzWlMgVtSfCMiNjA5YccPqfBPp/CH/zia+IYrM0SpEU4+zI7AbUBanwf/JNnupDrUYFn4sdw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=eiWTPPC+; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=UVxENp2U; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="eiWTPPC+"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="UVxENp2U" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LH2kZQ2318842 for ; Tue, 21 Jul 2026 17:11:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=uYf94+pM2iIpd3sipisRWv mhtydcyHiqiNCiDAnwd/M=; b=eiWTPPC+oy4rgzT7NjtFlKtqflbav1w6LHZ/oK 8zVR/DJlIUENt3VjGYClP24g6dqeeiLfi2TdAm43yNjDfi2aL4xsnFwCF7glNHkt e4iWLHyGU7Z5Oseocab0z9oZvremmXMsSrIUHCorQxBHfZTXQbWhv8LfHQK6oIca gGUalwgWH+9w+UZeC1dX+fxgi4doXYY9Ho4GumpI6d7dSZPzxl0qI6awqzR5noV6 +UOgm/Au5LDRK10g1W9azrrmAGO/Y66ucVgXc/BDGKrySCzhkhFlv7gC0JSGAXlQ xeKtZbtxNkDYdkmQnnMAQ9Ef/3q8RlDypj8iocZdWZMaWdAQ== Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fj1se3k3q-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 21 Jul 2026 17:11:53 +0000 (GMT) Received: by mail-pl1-f198.google.com with SMTP id d9443c01a7336-2cccfa32670so146759675ad.2 for ; Tue, 21 Jul 2026 10:11:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784653912; x=1785258712; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=uYf94+pM2iIpd3sipisRWvmhtydcyHiqiNCiDAnwd/M=; b=UVxENp2Uefnzdlbn2Czj5qpSrMUfRiY2PcjgiWf/ob/EkjOLUXgKWUO9aaNi766pq5 kVPYeaMwTOEOK8R2caHuNVYD3AXI7Q8OpJMPmOIR/iNm4EcC6rJY3Ghlm3hbmb+mHsiF rFPTBXLGrCx5RFDVFpVlawuZAcVPOH5doJoGAtOI3N127Slyflb4iRa5bw0l4W3IzAOL 9ue6p+d4vZKErN6tsqiuot4aVPycIxsacZxzxdyBhcv6n+dkcnrmokRpqCKxnBTqnG/A SA4DyDP8xLG/YlkqG+MfOIIeMKFnpcpfd3cSoNeqAq/ipuYRghxgJkik7G3SQG1fLJDM cf3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784653912; x=1785258712; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=uYf94+pM2iIpd3sipisRWvmhtydcyHiqiNCiDAnwd/M=; b=N/DADXx8L25OVsXmMAbSEqo1Em+mAOhKEPssoXFXMFcxBkp5Ly/FEpTgAvxegmEYHt S3C/pBNaN0YwpqmMGBeM3EpNPWQth1ixrLfIoVYglIvtdIzBJELkMV3YEWwwiP/3RMlS ugtJucR1DBwxWsQVptWV2J1G5phOygMbmzN8totoLEPSMuLKbgyQhG17bHqPybzR7Krv GdwUybvRGhgaTV1xOTexOCdzdrpnRGjXSP9DZCtzN3EfBPm50z8glze/921OmcAhXSlZ 1DPfkNUeayYB9Ym9SjjBu1ukXZxc//fVP63iWZnqYbHeKZk2XX67sZuwCYSKZtt5Ilxv 3T9Q== X-Forwarded-Encrypted: i=1; AHgh+RqblAUqU+qx/TNxD5PHYKClE5GFhFsLRmC5F9Z+n5CP3miO4FdPOyZ9LTx9EJMZsdFN3iB3s529hTR9U1U=@vger.kernel.org X-Gm-Message-State: AOJu0YxcC6vK6Sn/ddamphJA1bXTa1Rv+1O/jNL8UyXVvYazjYHDddYK tYh4+9MdHYuiNyO7LSTOWG6FmFeFGvAaLYs5duL4I/Thdt0Ls+g0b/LyBV5koECYbof/TYyke5c tWxgee3B/ieG76s7jwZdmw818Xn2CvSgP9+pPJZz+ZhxBuTondKse1JQth645NU1y6s0= X-Gm-Gg: AR+sD10ABo5jRAhh4queOGJXdffID93rdLrGoCa15Gm1XdceA35m/JMWauIsKCD6fV3 +ecZRPB+rGr4bJnE49zbcS1SmRqnvdF1Qc4Vj61STH3Nvl+RDOY7qaKYYxQqhsKNliLCxtc9VJv 8BQzClHu1TyCxwlVyBoX0GZ2zc5DtnnC0XmlivJhLpWNPqML+P9hsJCV1d5wJgFg8eXI45pHxLv xY7IS1XPWtQIbXN8n7F7RBtnKialIGFcrZbDmhMZ4/jhg62XT9fSP4hn2QpHIcqJqaX40KWhc2E AE6BssPXwarhCHPWD1XHyWdVr1sP8IudKljbySfbvAoIdrEHpidbDC/UZsSAmCy8Uh7/tXun9Ma mENVjVDeDLi8itXlgdg3PFCJgqCY= X-Received: by 2002:a17:903:2287:b0:2c9:9dc9:e423 with SMTP id d9443c01a7336-2cf349bc322mr210344685ad.25.1784653912292; Tue, 21 Jul 2026 10:11:52 -0700 (PDT) X-Received: by 2002:a17:903:2287:b0:2c9:9dc9:e423 with SMTP id d9443c01a7336-2cf349bc322mr210344205ad.25.1784653911630; Tue, 21 Jul 2026 10:11:51 -0700 (PDT) Received: from hu-mojha-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147dc1a67esm813646eec.2.2026.07.21.10.11.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Jul 2026 10:11:51 -0700 (PDT) From: Mukesh Ojha To: MyungJoo Ham , Kyungmin Park , Chanwoo Choi , "Rafael J. Wysocki" , Rajagopal Venkat Cc: linux-pm@vger.kernel.org, linux-kernel@vger.kernel.org, Mukesh Ojha , stable@vger.kernel.org Subject: [PATCH] devfreq: stop monitor before calling governor GOV_STOP Date: Tue, 21 Jul 2026 22:41:41 +0530 Message-ID: <20260721171141.1281754-1-mukesh.ojha@oss.qualcomm.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-ORIG-GUID: eZ5ROdjcZL2Kxg_PJANBgJ9UBFKV9Xxw X-Authority-Analysis: v=2.4 cv=TIZ1jVla c=1 sm=1 tr=0 ts=6a5fa859 cx=c_pps a=MTSHoo12Qbhz2p7MsH1ifg==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=QEJ3Dkhbv9rxNcAKX9QA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=GvdueXVYPmCkWapjIL-Q:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDE4MSBTYWx0ZWRfX0u/cAMmj//AM JAeg8NOiCOOXTOoYdF/gVPG5ulTiwZN2Q5zUG5ojJSN0TLBlTq6LkVDIxn5AWkgytI8glzbnx7a i7wBPyiHGdbi19lRo0Haasqzpru9WmA= X-Proofpoint-GUID: eZ5ROdjcZL2Kxg_PJANBgJ9UBFKV9Xxw X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDE4MSBTYWx0ZWRfX0MQQcmrW+vqe RrzHBn4vSpjYNNBKQsdXeShNTnjuDC3/+udwUdofb5iO6YOEVqFc4GY36rhJnl8uC0J8quhPzHK 7WVfHckBLp2MFRAOvdeeLmw6mvNpoXyreV2OA+rZidB0d8wKrGcDBViEYUb3or5CyOYrIu5U16h BQTGHP+s872noQQ4MHFmi3GLsp1r6EkaDdNxs/8kEG6q02I53WYvt2hc4pIBlP9rZ0mE9MtHxNQ Qz7pk0tBJuyhivALJkxFU9rUYPVDSjzPrp8RL60h8XabJMfC/eAXVgIDU4gamjqtDq9A3WBEian g1lBZCWIHXJrlJ48bCYFoVVEaw08dJ0WFhHkR0LABcDQGUmSbwJR0yHI1gqYdeFYXWkPu+pUttT DN5HIyZNM61ZO6L/GiuGbjNVyxjoHd36ZlYU+RfCylTn9L1CPx9fBhX/6tXhp0T2Px1ZnOX8Oed q5xrJVhc5dhdxwOzjaA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_03,2026-07-21_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 impostorscore=0 priorityscore=1501 spamscore=0 clxscore=1015 malwarescore=0 bulkscore=0 suspectscore=0 adultscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607210181 The following NULL pointer dereference is observed when devfreq_monitor fires after userspace_exit() has freed governor_data: pc : devfreq_userspace_func+0x10/0x2c Code: 39402109 --> ldrb w9, [x0, #8] (x0 =3D NULL) Call trace: devfreq_userspace_func+0x10/0x2c devfreq_monitor+0x34/0x134 process_scheduled_works+0x1d8/0x804 worker_thread+0x1c0/0x458 The fault address 0x8 is userspace_data.valid =E2=80=94 an 8-byte unsigned = long (user_frequency) precedes it, so governor_data =3D=3D NULL is the cause. The race: devfreq_resume_device() reads df->governor without holding devfreq_list_lock, while governor_store() updates it under that lock. The stale pointer dispatches GOV_RESUME to the old governor (simple_ondemand) after the switch has already completed: CPU 0 (devfreq_resume_device) CPU 1 (governor_store) read df->governor =E2=86=92 simple_ondemand lock(devfreq_list_lock) GOV_STOP =E2=86=92 monitor stopped df->governor =3D userspace GOV_START =E2=86=92 governor_data al= loc'd unlock(devfreq_list_lock) simple_ondemand->event_handler (DEVFREQ_GOV_RESUME) =E2=86=92 devfreq_monitor_resume() stop_polling =3D=3D true =E2=86=92 re-queue work =E2=86=90 stray m= onitor! stop_polling =3D false devfreq_monitor is now queued with df->governor =3D=3D userspace. When devfreq_remove_device() or governor_store() next calls userspace GOV_STOP, userspace_exit() frees governor_data. The stray monitor fires, dereferences NULL governor_data, and crashes. Call devfreq_monitor_stop() before every GOV_STOP dispatch in the core, ensuring the polling work is fully cancelled before any governor tears down its private data. devfreq_monitor_stop() is safe unconditionally: IRQ_DRIVEN governors return immediately, polling governors that already call it in their own GOV_STOP handler make the second call a no-op (stop_polling already true), and governors that never polled get a harmless cancel_delayed_work_sync() on an empty queue. Four sites are fixed: devfreq_remove_device(), governor_store(), devfreq_remove_governor() (governor module unload), and timer_store() (timer-type change performs a GOV_STOP + GOV_START cycle). Fixes: 7e6fdd4bad03 ("PM / devfreq: Core updates to support devices which c= an idle") Cc: stable@vger.kernel.org Signed-off-by: Mukesh Ojha --- drivers/devfreq/devfreq.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c index f08fc6966eae..7538f20657b7 100644 --- a/drivers/devfreq/devfreq.c +++ b/drivers/devfreq/devfreq.c @@ -993,9 +993,12 @@ int devfreq_remove_device(struct devfreq *devfreq) =20 devfreq_cooling_unregister(devfreq->cdev); =20 - if (devfreq->governor) + if (devfreq->governor) { + devfreq_monitor_stop(devfreq); devfreq->governor->event_handler(devfreq, DEVFREQ_GOV_STOP, NULL); + } + device_unregister(&devfreq->dev); =20 return 0; @@ -1344,6 +1347,7 @@ int devfreq_remove_governor(struct devfreq_governor *= governor) =20 if (!strncmp(devfreq->governor->name, governor->name, DEVFREQ_NAME_LEN)) { + devfreq_monitor_stop(devfreq); ret =3D devfreq->governor->event_handler(devfreq, DEVFREQ_GOV_STOP, NULL); if (ret) { @@ -1416,6 +1420,7 @@ static ssize_t governor_store(struct device *dev, str= uct device_attribute *attr, * Stop the current governor and remove the specific sysfs files * which depend on current governor. */ + devfreq_monitor_stop(df); ret =3D df->governor->event_handler(df, DEVFREQ_GOV_STOP, NULL); if (ret) { dev_warn(dev, "%s: Governor %s not stopped(%d)\n", @@ -1863,6 +1868,7 @@ static ssize_t timer_store(struct device *dev, struct= device_attribute *attr, df->profile->timer =3D timer; mutex_unlock(&df->lock); =20 + devfreq_monitor_stop(df); ret =3D df->governor->event_handler(df, DEVFREQ_GOV_STOP, NULL); if (ret) { dev_warn(dev, "%s: Governor %s not stopped(%d)\n", --=20 2.53.0