Quoting Viresh Kumar (2019-10-18 02:28:41)
> The list_kref reaches a count of 0 when all the static OPPs are removed,
> for example when dev_pm_opp_of_cpumask_remove_table() is called, though
> the actual OPP table may not get freed as it may still be referenced by
> other parts of the kernel, like from a call to
> dev_pm_opp_set_supported_hw(). And if we call
> dev_pm_opp_of_cpumask_add_table() again at this point, we must
> reinitialize the list_kref otherwise the kernel will hit a WARN() in
> kref infrastructure for incrementing a kref with value 0.
>
> Fixes: 11e1a1648298 ("opp: Don't decrement uninitialized list_kref")
> Reported-by: Dmitry Osipenko <[email protected]>
> Signed-off-by: Viresh Kumar <[email protected]>
> ---
> drivers/opp/of.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/opp/of.c b/drivers/opp/of.c
> index 6dc41faf74b5..1cbb58240b80 100644
> --- a/drivers/opp/of.c
> +++ b/drivers/opp/of.c
> @@ -663,6 +663,13 @@ static int _of_add_opp_table_v2(struct device *dev,
> struct opp_table *opp_table)
> return 0;
> }
>
> + /*
> + * Re-initialize list_kref every time we add static OPPs to the OPP
> + * table as the reference count may be 0 after the last tie static
> OPPs
s/tie/time/
> + * were removed.
> + */
> + kref_init(&opp_table->list_kref);
It seems racy. Why are we doing this vs. making an entirely new and
different OPP structure? Or why is the count reaching 0 when something
is obviously still referencing it?
> +
> /* We have opp-table node now, iterate over it and add OPPs */
> for_each_available_child_of_node(opp_table->np, np) {
> opp = _opp_add_static_v2(opp_table, dev, np);
