thermal: devfreq_cooling: use local ops instead of global ops

Fix access illegal address problem in following condition:

There are multiple devfreq cooling devices in system, some of them has
EM model but others do not. Energy model ops such as state2power will
append to global devfreq_cooling_ops when the cooling device with
EM model is registered. It makes the cooling device without EM model
also use devfreq_cooling_ops after appending when registered later by
of_devfreq_cooling_register_power() or of_devfreq_cooling_register().

The IPA governor regards the cooling devices without EM model as a power
actor, because they also have energy model ops, and will access illegal
address at dfc->em_pd when execute cdev->ops->get_requested_power,
cdev->ops->state2power or cdev->ops->power2state.

Fixes: 615510fe13bd2 ("thermal: devfreq_cooling: remove old power model and use EM")
Cc: 5.13+ <stable@vger.kernel.org> # 5.13+
Signed-off-by: Kant Fan <kant@allwinnertech.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

diff --git a/drivers/thermal/devfreq_cooling.c b/drivers/thermal/devfreq_cooling.c
index 4310cb342a9fb1f58ac362168df270c6e33fc8d3..d38a80adec7339fb9be1b291d45e949f0588dfb5 100644 (file)
--- a/drivers/thermal/devfreq_cooling.c
+++ b/drivers/thermal/devfreq_cooling.c
@@ -358,21 +358,28 @@ of_devfreq_cooling_register_power(struct device_node *np, struct devfreq *df,
        struct thermal_cooling_device *cdev;
        struct device *dev = df->dev.parent;
        struct devfreq_cooling_device *dfc;
+       struct thermal_cooling_device_ops *ops;
        char *name;
        int err, num_opps;
 
-       dfc = kzalloc(sizeof(*dfc), GFP_KERNEL);
-       if (!dfc)
+       ops = kmemdup(&devfreq_cooling_ops, sizeof(*ops), GFP_KERNEL);
+       if (!ops)
                return ERR_PTR(-ENOMEM);
 
+       dfc = kzalloc(sizeof(*dfc), GFP_KERNEL);
+       if (!dfc) {
+               err = -ENOMEM;
+               goto free_ops;
+       }
+
        dfc->devfreq = df;
 
        dfc->em_pd = em_pd_get(dev);
        if (dfc->em_pd) {
-               devfreq_cooling_ops.get_requested_power =
+               ops->get_requested_power =
                        devfreq_cooling_get_requested_power;
-               devfreq_cooling_ops.state2power = devfreq_cooling_state2power;
-               devfreq_cooling_ops.power2state = devfreq_cooling_power2state;
+               ops->state2power = devfreq_cooling_state2power;
+               ops->power2state = devfreq_cooling_power2state;
 
                dfc->power_ops = dfc_power;
 
@@ -407,8 +414,7 @@ of_devfreq_cooling_register_power(struct device_node *np, struct devfreq *df,
        if (!name)
                goto remove_qos_req;
 
-       cdev = thermal_of_cooling_device_register(np, name, dfc,
-                                                 &devfreq_cooling_ops);
+       cdev = thermal_of_cooling_device_register(np, name, dfc, ops);
        kfree(name);
 
        if (IS_ERR(cdev)) {
@@ -429,6 +435,8 @@ free_table:
        kfree(dfc->freq_table);
 free_dfc:
        kfree(dfc);
+free_ops:
+       kfree(ops);
 
        return ERR_PTR(err);
 }
@@ -510,11 +518,13 @@ EXPORT_SYMBOL_GPL(devfreq_cooling_em_register);
 void devfreq_cooling_unregister(struct thermal_cooling_device *cdev)
 {
        struct devfreq_cooling_device *dfc;
+       const struct thermal_cooling_device_ops *ops;
        struct device *dev;
 
        if (IS_ERR_OR_NULL(cdev))
                return;
 
+       ops = cdev->ops;
        dfc = cdev->devdata;
        dev = dfc->devfreq->dev.parent;
 
@@ -525,5 +535,6 @@ void devfreq_cooling_unregister(struct thermal_cooling_device *cdev)
 
        kfree(dfc->freq_table);
        kfree(dfc);
+       kfree(ops);
 }
 EXPORT_SYMBOL_GPL(devfreq_cooling_unregister);