From 5a2f4ce3fa941e3b16cb788c94d83d928f872086 Mon Sep 17 00:00:00 2001
From: Jonathan Avila <avilaj@codeaurora.org>
Date: Fri, 1 Dec 2017 16:45:18 -0800
Subject: [PATCH] PM / devfreq: Introduce a sysfs lock

Currently, concurrent writes to sysfs entries leave the	possibility for
race conditions within the devfreq framework.  For example, concurrently
executing max_freq_store and governor_store can result in attempting to
perform an update_devfreq() before the new governor's start handler can be
executed.

A more concrete case is a race between polling_interval_store and
governor_store.  Because no lock is used after calling into the event
handler of the old governor and there's nothing preventing work from being
queued after the monitor is stopped, it's possible to accidentally cause
delayed work to be queued on the governor being switched to.  This can be
seen if you create two threads, one which changes a device's governor
between simple_ondemand and performance, and one which changes its polling
interval between 45 and 50.

All of these races can be addressed with the introduction of a lock that
prevents sysfs operations from interleaving in this fashion.

Change-Id: Ia6887dcb2d69dc2576837a6c09fed55a28943abc
Signed-off-by: Jonathan Avila <avilaj@codeaurora.org>
---
 drivers/devfreq/devfreq.c | 14 +++++++++++++-
 include/linux/devfreq.h   |  1 +
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
index a7df9cb616ee..3357aafc8c75 100644
--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -520,6 +520,7 @@ static void _remove_devfreq(struct devfreq *devfreq)
 		devfreq->profile->exit(devfreq->dev.parent);
 
 	mutex_destroy(&devfreq->lock);
+	mutex_destroy(&devfreq->sysfs_lock);
 	kfree(devfreq);
 }
 
@@ -576,6 +577,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
 	}
 
 	mutex_init(&devfreq->lock);
+	mutex_init(&devfreq->sysfs_lock);
 	mutex_lock(&devfreq->lock);
 	devfreq->dev.parent = dev;
 	devfreq->dev.class = devfreq_class;
@@ -972,12 +974,13 @@ static ssize_t governor_store(struct device *dev, struct device_attribute *attr,
 		goto out;
 	}
 
+	mutex_lock(&df->sysfs_lock);
 	if (df->governor) {
 		ret = df->governor->event_handler(df, DEVFREQ_GOV_STOP, NULL);
 		if (ret) {
 			dev_warn(dev, "%s: Governor %s not stopped(%d)\n",
 				 __func__, df->governor->name, ret);
-			goto out;
+			goto gov_stop_out;
 		}
 	}
 	prev_gov = df->governor;
@@ -995,6 +998,9 @@ static ssize_t governor_store(struct device *dev, struct device_attribute *attr,
 						    NULL);
 		}
 	}
+
+gov_stop_out:
+	mutex_unlock(&df->sysfs_lock);
 out:
 	mutex_unlock(&devfreq_list_lock);
 
@@ -1089,8 +1095,10 @@ static ssize_t polling_interval_store(struct device *dev,
 	if (ret != 1)
 		return -EINVAL;
 
+	mutex_lock(&df->sysfs_lock);
 	df->governor->event_handler(df, DEVFREQ_GOV_INTERVAL, &value);
 	ret = count;
+	mutex_unlock(&df->sysfs_lock);
 
 	return ret;
 }
@@ -1108,6 +1116,7 @@ static ssize_t min_freq_store(struct device *dev, struct device_attribute *attr,
 	if (ret != 1)
 		return -EINVAL;
 
+	mutex_lock(&df->sysfs_lock);
 	mutex_lock(&df->lock);
 	max = df->max_freq;
 	if (value && max && value > max) {
@@ -1120,6 +1129,7 @@ static ssize_t min_freq_store(struct device *dev, struct device_attribute *attr,
 	ret = count;
 unlock:
 	mutex_unlock(&df->lock);
+	mutex_unlock(&df->sysfs_lock);
 	return ret;
 }
 
@@ -1135,6 +1145,7 @@ static ssize_t max_freq_store(struct device *dev, struct device_attribute *attr,
 	if (ret != 1)
 		return -EINVAL;
 
+	mutex_lock(&df->sysfs_lock);
 	mutex_lock(&df->lock);
 	min = df->min_freq;
 	if (value && min && value < min) {
@@ -1147,6 +1158,7 @@ static ssize_t max_freq_store(struct device *dev, struct device_attribute *attr,
 	ret = count;
 unlock:
 	mutex_unlock(&df->lock);
+	mutex_unlock(&df->sysfs_lock);
 	return ret;
 }
 
diff --git a/include/linux/devfreq.h b/include/linux/devfreq.h
index 8e849a672dcd..eb84ce6b9a48 100644
--- a/include/linux/devfreq.h
+++ b/include/linux/devfreq.h
@@ -167,6 +167,7 @@ struct devfreq {
 	struct list_head node;
 
 	struct mutex lock;
+	struct mutex sysfs_lock;
 	struct device dev;
 	struct devfreq_dev_profile *profile;
 	const struct devfreq_governor *governor;