From patchwork Thu Jan 4 12:50:19 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Lezcano X-Patchwork-Id: 123411 Delivered-To: patch@linaro.org Received: by 10.140.22.227 with SMTP id 90csp11389575qgn; Thu, 4 Jan 2018 04:51:24 -0800 (PST) X-Google-Smtp-Source: ACJfBotep8kt+DZOM8UD4V0gWhe2s07NJTafS1xhlZPhrwqZn5Fv6vqL+xn2TBtz+Isk/UZqeIf6 X-Received: by 10.99.179.6 with SMTP id i6mr3898975pgf.77.1515070283925; Thu, 04 Jan 2018 04:51:23 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1515070283; cv=none; d=google.com; s=arc-20160816; b=f7E+Urw9jmKjMRWnvToUfAMmyT8nwRbdOVLe705RklS2NpJ/ErSLa39z9Uc7qMmeAZ iQfll95CfSHPERjsuGoJ7EYJVRyQKvGh/yXi0OJ4Ml8yaxMrgopGHu0nFZn+hKucCcDo 3uH1kZ7K0a8Luvjymd1VeZXc5+SrKKTOA1KMDRWJZfgNHM90PXi7VxY1BC+fi9X4OI/G MmS+ORYPZwbeq9wLkDqYP7MpQX01xiNBguoOWa9iBJ8VUgyIfHnGgfPd7JsOegVEqF5v B7j0pvzUgoR6LfdrJTEeqXSGizqS6YRK+C1jRUkULYEpYiMl3qnMRb6yEgBJwgp/k7AW lxUw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=lmEr5E+Ci/rbmrsMGX5Vi4ZmyVsHhrCVFOoM4NLfSdc=; b=BcKOtoocNXxA+vZ30S9pfchIS1qc3x262IET+JMmnb1P+DtfsmS/UqNvy7ZWvJq2ni KSfqUEOqniL/bo7f6YJnngkaVVMNSRsJur9Eu9+8NQgnNBKPnf6NqwEDhll/Uk+M/E5o DPy1SMGAsn43Wm6h6nzACUqw4C3daybq44ww5/CRsLnj69hewYkNBOMR70CzirLI7ExO Mm7dppxivcx8VnL2DLYKLs+U6zfcbOHxZEYUUhjHPgTM3y0rtOD1Zql3fWiAiCMRQDQa fxTsTl7w0ioor2eA5vniS0zoJVgc5wDogMSn14dHysc8LEJnpJg5N15aYhjol2Ylsh6m ufDg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=DCWxcKSt; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id c80si2283237pfb.307.2018.01.04.04.51.23; Thu, 04 Jan 2018 04:51:23 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=DCWxcKSt; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752740AbeADMvV (ORCPT + 27 others); Thu, 4 Jan 2018 07:51:21 -0500 Received: from mail-wr0-f193.google.com ([209.85.128.193]:33998 "EHLO mail-wr0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752671AbeADMvS (ORCPT ); Thu, 4 Jan 2018 07:51:18 -0500 Received: by mail-wr0-f193.google.com with SMTP id 36so1396148wrh.1 for ; Thu, 04 Jan 2018 04:51:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=lmEr5E+Ci/rbmrsMGX5Vi4ZmyVsHhrCVFOoM4NLfSdc=; b=DCWxcKStHWQKAUYLVoFDRWOnW2XLOxKSNq60H4+kuePZvvXaome9GaUkhF0RoZTwh2 Wv3whQEc50RuVcB8yHkUILXexlGwHNeTgUGbyZNE6d+FHkm2DpuIn+1jIqz8jUTCpklE UfSTNI+U3+mihoK9GMpsGo3wW+21TzybiCY3Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=lmEr5E+Ci/rbmrsMGX5Vi4ZmyVsHhrCVFOoM4NLfSdc=; b=R4u+OdHW9uFaJRe6rozHD0Smh7Ef6kL9ueq1JTJuRkpGV2XKMOxEvZiPIVJIMkE+La VCYKCKnVdQejyNy8lixQjTanhJC8i6EmDZv95L3+7L7lH5CFiC4x6DLeh/EgKJh/6ZZd /j3HF2bZeaOSWojqqJVM95eNgYYSWgv42ZtwECFSTMSYJN/koY9a3lEYBq+9UvCfzNIE CbBSEHGNrBDo9CQ3w5UkLvvdMH+lh361+GpM4iJZ9p8W2hptiMsGLbhDC74Qv7N76KE6 Yphha8FoGQ0/cKrLdPXWIEOh4JUUasmickEEh7n+vt7JJht8dsi1CxY5DFOYpWUeJG/T fHjA== X-Gm-Message-State: AKGB3mJMO6nO1iZd7lkQWMNV0IYZcci1eER3QeADt2psaivUtCiO86lg ZOxSd/mVSar3Ny0r1T3jZ8ijkg== X-Received: by 10.223.134.134 with SMTP id 6mr4410125wrx.17.1515070277374; Thu, 04 Jan 2018 04:51:17 -0800 (PST) Received: from mai.lan ([2001:41d0:fe90:b800:c10d:405d:d60:60bb]) by smtp.gmail.com with ESMTPSA id d71sm3668348wma.7.2018.01.04.04.51.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 04 Jan 2018 04:51:16 -0800 (PST) From: Daniel Lezcano To: daniel.lezcano@linaro.org, tglx@linutronix.de Cc: linux-kernel@vger.kernel.org, benjamin.gaignard@linaro.org, stable@vger.kernel.org, Maxime Coquelin , Alexandre Torgue , linux-arm-kernel@lists.infradead.org (moderated list:ARM/STM32 ARCHITECTURE) Subject: [PATCH 03/12] clocksource/drivers/stm32: Fix kernel panic with multiple timers Date: Thu, 4 Jan 2018 13:50:19 +0100 Message-Id: <1515070228-10481-4-git-send-email-daniel.lezcano@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1515070228-10481-1-git-send-email-daniel.lezcano@linaro.org> References: <1515070228-10481-1-git-send-email-daniel.lezcano@linaro.org> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The current code hides a couple of bugs. - The global variable 'clock_event_ddata' is overwritten each time the init function is invoked. This is fixed with a kmemdup instead of assigning the global variable. That prevents a memory corruption when several timers are defined in the DT. - The clockevent's event_handler is NULL if the time framework does not select the clockevent when registering it, this is fine but the init code generates in any case an interrupt leading to dereference this NULL pointer. The stm32 timer works with shadow registers, a mechanism to cache the registers. When a change is done in one buffered register, we need to artificially generate an event to force the timer to copy the content of the register to the shadowed register. The auto-reload register (ARR) is one of the shadowed register as well as the prescaler register (PSC), so in order to force the copy, we issue an event which in turn leads to an interrupt and the NULL dereference. This is fixed by inverting two lines where we clear the status register before enabling the update event interrupt. As this kernel crash is resulting from the combination of these two bugs, the fixes are grouped into a single patch. Cc: stable@vger.kernel.org Signed-off-by: Daniel Lezcano --- drivers/clocksource/timer-stm32.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 2.7.4 diff --git a/drivers/clocksource/timer-stm32.c b/drivers/clocksource/timer-stm32.c index 8f24237..4bfeb99 100644 --- a/drivers/clocksource/timer-stm32.c +++ b/drivers/clocksource/timer-stm32.c @@ -106,6 +106,10 @@ static int __init stm32_clockevent_init(struct device_node *np) unsigned long rate, max_delta; int irq, ret, bits, prescaler = 1; + data = kmemdup(&clock_event_ddata, sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + clk = of_clk_get(np, 0); if (IS_ERR(clk)) { ret = PTR_ERR(clk); @@ -156,8 +160,8 @@ static int __init stm32_clockevent_init(struct device_node *np) writel_relaxed(prescaler - 1, data->base + TIM_PSC); writel_relaxed(TIM_EGR_UG, data->base + TIM_EGR); - writel_relaxed(TIM_DIER_UIE, data->base + TIM_DIER); writel_relaxed(0, data->base + TIM_SR); + writel_relaxed(TIM_DIER_UIE, data->base + TIM_DIER); data->periodic_top = DIV_ROUND_CLOSEST(rate, prescaler * HZ); @@ -184,6 +188,7 @@ static int __init stm32_clockevent_init(struct device_node *np) err_clk_enable: clk_put(clk); err_clk_get: + kfree(data); return ret; }