[PATCH 06/16] intel_idle: Avoid a double free of the per-CPU data.

Tim Gardner tim.gardner at canonical.com
Wed Aug 24 21:29:36 UTC 2016

From: Richard Cochran <rcochran at linutronix.de>

BugLink: http://bugs.launchpad.net/bugs/1591821

The helper function, intel_idle_cpuidle_devices_uninit, frees the
globally allocated per-CPU data.  However, this function is invoked
from the hot plug notifier callback at a time when freeing that data
is not safe.

If the call to cpuidle_register_driver() should fail (say, due to lack
of memory), then the driver will free its per-CPU region.  On the
*next* CPU_ONLINE event, the driver will happily use the region again
and even free it again if the failure repeats.

This patch fixes the issue by moving the call to free_percpu() outside
of the helper function at the two call sites that actually need to
free the per-CPU data.

Signed-off-by: Richard Cochran <rcochran at linutronix.de>
Signed-off-by: Len Brown <len.brown at intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki at intel.com>
(cherry picked from commit ca42489d9ee3262482717c83428e087322fdc39c)
Signed-off-by: Tim Gardner <tim.gardner at canonical.com>
 drivers/idle/intel_idle.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 5dd741f..0b56872 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -1002,7 +1002,7 @@ static int __init intel_idle_probe(void)
  * intel_idle_cpuidle_devices_uninit()
- * unregister, free cpuidle_devices
+ * Unregisters the cpuidle devices.
 static void intel_idle_cpuidle_devices_uninit(void)
@@ -1013,9 +1013,6 @@ static void intel_idle_cpuidle_devices_uninit(void)
 		dev = per_cpu_ptr(intel_idle_cpuidle_devices, i);
-	free_percpu(intel_idle_cpuidle_devices);
-	return;
@@ -1231,6 +1228,7 @@ static int __init intel_idle_init(void)
 		if (retval) {
+			free_percpu(intel_idle_cpuidle_devices);
 			return retval;
@@ -1253,6 +1251,7 @@ static void __exit intel_idle_exit(void)
+	free_percpu(intel_idle_cpuidle_devices);

More information about the kernel-team mailing list