[PATCH] cpufreq: Hold the policy write lock when changing boost state

[PATCH] cpufreq: Hold the policy write lock when changing boost state

[Christian Loehle]

The per-policy boost sysfs handler calls policy_set_boost() under
policy->rwsem, but the global boost handler and cpufreq_online() do not.
Consequently, global and per-policy boost changes can concurrently
update policy->boost_enabled, invoke the driver callback and update the
boost frequency QoS request. The driver callbacks also access policy
state, e.g. CPPC updates cpuinfo.max_freq that assumes policy->rw_sem
held.

Take policy->rwsem around policy_set_boost() in both unlocked
callers. Keep locking at the call sites because the per-policy sysfs
handler already holds the lock.

Fixes: 218a06a79d9a ("cpufreq: Support per-policy performance boost")
Signed-off-by: Christian Loehle <christian.loehle@arm.com>
---
 drivers/cpufreq/cpufreq.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 54dde8419bdc..015962e6c1fe 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -576,6 +576,8 @@ static int policy_set_boost(struct cpufreq_policy *policy, bool enable)
 {
 	int ret;
 
+	lockdep_assert_held_write(&policy->rwsem);
+
 	if (policy->boost_enabled == enable)
 		return 0;
 
@@ -1629,6 +1631,8 @@ static int cpufreq_online(unsigned int cpu)
 	 */
 	if (cpufreq_driver->set_boost && policy->boost_supported &&
 	    (new_policy || !cpufreq_boost_enabled())) {
+		guard(cpufreq_policy_write)(policy);
+
 		ret = policy_set_boost(policy, cpufreq_boost_enabled());
 		if (ret) {
 			/* If the set_boost fails, the online operation is not affected */
@@ -2830,6 +2834,8 @@ static int cpufreq_boost_trigger_state(int state)
 		if (!policy->boost_supported)
 			continue;
 
+		guard(cpufreq_policy_write)(policy);
+
 		ret = policy_set_boost(policy, state);
 		if (unlikely(ret))
 			break;
-- 
2.34.1

Re: [PATCH] cpufreq: Hold the policy write lock when changing boost state

[Rafael J. Wysocki (Intel)]

On Tue, Nov 3, 2026 at 7:19 PM Christian Loehle
<christian.loehle@arm.com> wrote:
>
> The per-policy boost sysfs handler calls policy_set_boost() under
> policy->rwsem, but the global boost handler and cpufreq_online() do not.
> Consequently, global and per-policy boost changes can concurrently
> update policy->boost_enabled, invoke the driver callback and update the
> boost frequency QoS request. The driver callbacks also access policy
> state, e.g. CPPC updates cpuinfo.max_freq that assumes policy->rw_sem
> held.
>
> Take policy->rwsem around policy_set_boost() in both unlocked
> callers. Keep locking at the call sites because the per-policy sysfs
> handler already holds the lock.
>
> Fixes: 218a06a79d9a ("cpufreq: Support per-policy performance boost")
> Signed-off-by: Christian Loehle <christian.loehle@arm.com>
> ---
>  drivers/cpufreq/cpufreq.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
> index 54dde8419bdc..015962e6c1fe 100644
> --- a/drivers/cpufreq/cpufreq.c
> +++ b/drivers/cpufreq/cpufreq.c
> @@ -576,6 +576,8 @@ static int policy_set_boost(struct cpufreq_policy *policy, bool enable)
>  {
>         int ret;
>
> +       lockdep_assert_held_write(&policy->rwsem);
> +
>         if (policy->boost_enabled == enable)
>                 return 0;
>
> @@ -1629,6 +1631,8 @@ static int cpufreq_online(unsigned int cpu)
>          */
>         if (cpufreq_driver->set_boost && policy->boost_supported &&
>             (new_policy || !cpufreq_boost_enabled())) {
> +               guard(cpufreq_policy_write)(policy);
> +
>                 ret = policy_set_boost(policy, cpufreq_boost_enabled());
>                 if (ret) {
>                         /* If the set_boost fails, the online operation is not affected */
> @@ -2830,6 +2834,8 @@ static int cpufreq_boost_trigger_state(int state)
>                 if (!policy->boost_supported)
>                         continue;
>
> +               guard(cpufreq_policy_write)(policy);
> +
>                 ret = policy_set_boost(policy, state);
>                 if (unlikely(ret))
>                         break;
> --

Applied as 7.4-rc material, thanks!