cpufreq_policy_alloc() initializes policy->rwsem after
kobject_init_and_add() has created the policy sysfs directory and its
default attributes. A sysfs access can therefore reach a policy callback
before the semaphore has been initialized.

Initialize policy->rwsem before publishing the policy kobject so sysfs
callbacks always see an initialized semaphore.

Fixes: 2fc3384dc75b ("cpufreq: Initialize policy->kobj while allocating policy")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260830155301.2713780-1-runyu.xiao@seu.edu.cn/
Assisted-by: Codex:GPT-5
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

---
v3:
- Move Signed-off-by to the end of the trailer block and add Zhongqiu Han's
  Reviewed-by tag.

v2:
- Correct the Fixes tag to the commit that introduced policy kobject publication.
---
 drivers/cpufreq/cpufreq.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 0d0df986f..9efbf5b17 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1258,6 +1258,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
 	if (!zalloc_cpumask_var(&policy->real_cpus, GFP_KERNEL))
 		goto err_free_rcpumask;
 
+	init_rwsem(&policy->rwsem);
+
 	init_completion(&policy->kobj_unregister);
 	ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq,
 				   cpufreq_global_kobject, "policy%u", cpu);
@@ -1272,8 +1274,6 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
 		goto err_free_real_cpus;
 	}
 
-	init_rwsem(&policy->rwsem);
-
 	freq_constraints_init(&policy->constraints);
 
 	policy->nb_min.notifier_call = cpufreq_notifier_min;
-- 
2.34.1

On 02-09-26, 12:19, Runyu Xiao wrote:
> cpufreq_policy_alloc() initializes policy->rwsem after
> kobject_init_and_add() has created the policy sysfs directory and its
> default attributes. A sysfs access can therefore reach a policy callback
> before the semaphore has been initialized.
> 
> Initialize policy->rwsem before publishing the policy kobject so sysfs
> callbacks always see an initialized semaphore.
> 
> Fixes: 2fc3384dc75b ("cpufreq: Initialize policy->kobj while allocating policy")
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/all/20260830155301.2713780-1-runyu.xiao@seu.edu.cn/
> Assisted-by: Codex:GPT-5
> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

Acked-by: Viresh Kumar <viresh.kumar@linaro.org>

-- 
viresh

On Wed, Sep 2, 2026 at 6:27 AM Viresh Kumar <viresh.kumar@linaro.org> wrote:
>
> On 02-09-26, 12:19, Runyu Xiao wrote:
> > cpufreq_policy_alloc() initializes policy->rwsem after
> > kobject_init_and_add() has created the policy sysfs directory and its
> > default attributes. A sysfs access can therefore reach a policy callback
> > before the semaphore has been initialized.
> >
> > Initialize policy->rwsem before publishing the policy kobject so sysfs
> > callbacks always see an initialized semaphore.
> >
> > Fixes: 2fc3384dc75b ("cpufreq: Initialize policy->kobj while allocating policy")
> > Cc: stable@vger.kernel.org
> > Link: https://lore.kernel.org/all/20260830155301.2713780-1-runyu.xiao@seu.edu.cn/
> > Assisted-by: Codex:GPT-5
> > Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
> > Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
>
> Acked-by: Viresh Kumar <viresh.kumar@linaro.org>

Applied as 7.3-rc material, thanks!