Re: [PATCH] pm/opp: fix race between opp_add and opp_get

[Xuewen Yan]

Hi Viresh,

On Tue, May 5, 2026 at 11:36 AM Viresh Kumar <viresh.kumar@xxxxxxxxxx> wrote:
>
> On 27-04-26, 20:00, Xuewen Yan wrote:
> > From: Di Shen <di.shen@xxxxxxxxxx>
> >
> > There is a race between opp_table_find_key and dev_pm_opp_add_dynamic:
> >
> > dev_pm_opp_add_dynamic                dev_pm_opp_find_freq_exact
> > _opp_add_v1                           _find_key
> > _opp_add                              _opp_table_find_key
> > mutex_lock(opp_table->lock)
> > list_add(&new_opp->node, head)
> > mutex_unlock(opp_table->lock)
> >                                      mutex_lock(opp_table->lock)
> >                                      dev_pm_opp_get(opp)
> >                                      kref_get(&opp->kref)
> >                                        refcount_inc(&kref->refcount);
> >                                      mutex_unlock(opp_table->lock)
> > kref_init(&new_opp->kref)
> >   refcount_set(&kref->refcount, 1);
> >                                      dev_pm_opp_put()
> >                                      kref_put_mutex()
> >
> > This would cause the opp be freed.
> >
> > So use the mutex to protect opp's ref count.
> >
> > Co-developed-by: Ling Xu <ling_ling.xu@xxxxxxxxxx>
> > Signed-off-by: Ling Xu <ling_ling.xu@xxxxxxxxxx>
> > Signed-off-by: Di Shen <di.shen@xxxxxxxxxx>
> > ---
> >  drivers/opp/core.c | 5 ++---
> >  1 file changed, 2 insertions(+), 3 deletions(-)
>
> Good catch.
>
> Applied. Thanks.

Need we add fix tag？
Fixes: 7034764a1e4a (PM / OPP: Add 'struct kref' to struct dev_pm_opp)

>
> --
> viresh