cpufreq: Fix cpufreq driver module refcount balance after suspend/resume

Since cpufreq_cpu_put() called by __cpufreq_remove_dev() drops the
driver module refcount, __cpufreq_remove_dev() causes that refcount
to become negative for the cpufreq driver after a suspend/resume
cycle.

This is not the only bad thing that happens there, however, because
kobject_put() should only be called for the policy kobject at this
point if the CPU is not the last one for that policy.

Namely, if the given CPU is the last one for that policy, the
policy kobject's refcount should be 1 at this point, as set by
cpufreq_add_dev_interface(), and only needs to be dropped once for
the kobject to go away.  This actually happens under the cpu == 1
check, so it need not be done before by cpufreq_cpu_put().

On the other hand, if the given CPU is not the last one for that
policy, this means that cpufreq_add_policy_cpu() has been called
at least once for that policy and cpufreq_cpu_get() has been
called for it too.  To balance that cpufreq_cpu_get(), we need to
call cpufreq_cpu_put() in that case.

Thus, to fix the described problem and keep the reference
counters balanced in both cases, move the cpufreq_cpu_get() call
in __cpufreq_remove_dev() to the code path executed only for
CPUs that share the policy with other CPUs.

Reported-and-tested-by: Toralf Förster <toralf.foerster@gmx.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Cc: 3.10+ <stable@vger.kernel.org>

1 files changed, 10 insertions, 9 deletions

diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index a4ad7339588d..f0a5e2b0eb8a 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1177,14 +1177,11 @@ static int __cpufreq_remove_dev(struct device *dev,
                                 __func__, cpu_dev->id, cpu);
         }
 
-        if ((cpus == 1) && (cpufreq_driver->target))
-                __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
-
-        pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
-        cpufreq_cpu_put(data);
-
         /* If cpu is last user of policy, free policy */
         if (cpus == 1) {
+                if (cpufreq_driver->target)
+                        __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
+
                 lock_policy_rwsem_read(cpu);
                 kobj = &data->kobj;
                 cmp = &data->kobj_unregister;
@@ -1205,9 +1202,13 @@ static int __cpufreq_remove_dev(struct device *dev,
                 free_cpumask_var(data->related_cpus);
                 free_cpumask_var(data->cpus);
                 kfree(data);
-        } else if (cpufreq_driver->target) {
-                __cpufreq_governor(data, CPUFREQ_GOV_START);
-                __cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
+        } else {
+                pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
+                cpufreq_cpu_put(data);
+                if (cpufreq_driver->target) {
+                        __cpufreq_governor(data, CPUFREQ_GOV_START);
+                        __cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
+                }
         }
 
         per_cpu(cpufreq_policy_cpu, cpu) = -1;