From patchwork Mon Jan 8 13:28:50 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Lezcano X-Patchwork-Id: 123722 Delivered-To: patch@linaro.org Received: by 10.140.22.227 with SMTP id 90csp2730765qgn; Mon, 8 Jan 2018 05:32:52 -0800 (PST) X-Google-Smtp-Source: ACJfBosTR/OhFUgkP+fzBm0xxw6ByESEaRvrqPR4Gqn4s2djV/dQHjCOOkdGkUu7P7wWl77DzFZ4 X-Received: by 10.99.165.80 with SMTP id r16mr8963207pgu.382.1515418372847; Mon, 08 Jan 2018 05:32:52 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1515418372; cv=none; d=google.com; s=arc-20160816; b=Mdc6BndPQopFP3kKvEA4O0/HdE6MPX9yZ73Nvr1ghEr0G1RvTRbFm+Wyq63Cd8EVds tb0/18CsGb1p938VjODy0Zk5pkiNTK5U4+DsHk4AQZKMkN+kDsBS/vgEa+g972wBNMPZ 4c72dJJsSVvY1bbgvrh0U+SHXHPGbZyudKbUq4Jq1//rLKmIw+fW/ZrOMldEyia6Vbtn X40RdpiZJMvNbjkcCwmm3S1EyrM2E7I70xEWdVxsc+afXl9qt+ukLY6WsP+DQVEI7xlE SFM4VTzbHyu8ESd6TtruXTKyKEWOBhw5coCqS6j+WHdtexwMd8mPwxlokXulBle8EFMx 2GfQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=dvLnzOk0r+Y0lU6cqlJZCJcFZ16TE9y1s6sJ2FFf0gA=; b=IZa032kUQ+W8TYxrpV5x/MMSXZrMqYXxiB8KPHkBnyz5s/tllGIQpEE5a8p9hYZPoJ /z7mAe532FA5E/LQi5pIiBH1UqKQT8VkM0Dv4dW47qdq1nnSk54ulyO04RwUkSZ3frYs /7aT3YO83+KaFpHTrMfRE9hSJReHRZcvt9Otsinslbv72MfSTKzoBT/OGKSK41JfiXkL LiDX+a5WQNdbVVRcl4V/N783hh9+si3R+TR007NfT3drS3ro13FLYP5ba9qHV3OZsC0Z a7dEnGjQnWB3eXMMvv4LFX4qkL/Kqx27QIKzUauPjysMLWHGhxHgHfIw39Jc8xMnspN0 rAog== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=TwtXvkEQ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id g7si7482755pgq.707.2018.01.08.05.32.52; Mon, 08 Jan 2018 05:32:52 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=TwtXvkEQ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933535AbeAHNcu (ORCPT + 28 others); Mon, 8 Jan 2018 08:32:50 -0500 Received: from mail-wm0-f66.google.com ([74.125.82.66]:35158 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933359AbeAHN3n (ORCPT ); Mon, 8 Jan 2018 08:29:43 -0500 Received: by mail-wm0-f66.google.com with SMTP id a79so14216337wma.0 for ; Mon, 08 Jan 2018 05:29:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=dvLnzOk0r+Y0lU6cqlJZCJcFZ16TE9y1s6sJ2FFf0gA=; b=TwtXvkEQGqi5WPnnafzxNJjfQs/MLqJmEfWMT/g4/LY8tYleo8k6oJVwS/h8HxXw7Y 4s/h2NLgzbDPzBX1tLUf8yOR6fd18bGq4jiAUN5iQGtX1R/giFYuTz7sqRG51i15k/lA HEjlIvhaNIpaeN1wnD38ZzDbED4Y9EKyPCXCo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=dvLnzOk0r+Y0lU6cqlJZCJcFZ16TE9y1s6sJ2FFf0gA=; b=tJXOL7/Z30Pv71yfHsoq5JVn5UJbt63zZ1d07DB8rvU9xxnNtibBhcdmtulvdSZGos 07gMWVVLu6VgEDrQjuq+UL4GNGWkw48XaFs+P2lWAo8NQ2XXDwdNnENU2s9m6p2fJTox Sxim8EXMcpJ56Z0LVM3FI7bmF8CkgXKSmcIEJmv1J1MXrDffQoMvs+RmacHvRnwIcVnW u3dfUzKtRi88uYOq2Vx8SFOoCQZV4goq3KC/ApM7LEu2g2UhAsF9P3VkKtYDgv4PHiig MF+YR7wD0c/dh+cfkLnmdKbg/qStES2vzs6Du4B5+fklJ3QsrpPDKOdBz7Fm3TTv5b31 aSwg== X-Gm-Message-State: AKGB3mJOw98YHuatmUMsMi82W1bqQLLaAJoHuC9pcp31bsj+HZER7Ees zStJBOoDJvVqFSbxrVzck4ZQIQ== X-Received: by 10.28.229.194 with SMTP id c185mr8652130wmh.142.1515418181938; Mon, 08 Jan 2018 05:29:41 -0800 (PST) Received: from mai.lan ([2001:41d0:fe90:b800:312a:53a5:1bef:6622]) by smtp.gmail.com with ESMTPSA id q196sm14354222wmb.22.2018.01.08.05.29.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 08 Jan 2018 05:29:41 -0800 (PST) From: Daniel Lezcano To: tglx@linutronix.de Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, Benjamin Gaignard , Maxime Coquelin , Alexandre Torgue , linux-arm-kernel@lists.infradead.org (moderated list:ARM/STM32 ARCHITECTURE) Subject: [PATCH 11/20] clocksource/drivers/stm32: Fix kernel panic with multiple timers Date: Mon, 8 Jan 2018 14:28:50 +0100 Message-Id: <1515418139-23276-11-git-send-email-daniel.lezcano@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1515418139-23276-1-git-send-email-daniel.lezcano@linaro.org> References: <1bbaef2e-4080-3f54-7db3-a8989acfd691@free.fr> <1515418139-23276-1-git-send-email-daniel.lezcano@linaro.org> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The current code hides a couple of bugs. - The global variable 'clock_event_ddata' is overwritten each time the init function is invoked. This is fixed with a kmemdup instead of assigning the global variable. That prevents a memory corruption when several timers are defined in the DT. - The clockevent's event_handler is NULL if the time framework does not select the clockevent when registering it, this is fine but the init code generates in any case an interrupt leading to dereference this NULL pointer. The stm32 timer works with shadow registers, a mechanism to cache the registers. When a change is done in one buffered register, we need to artificially generate an event to force the timer to copy the content of the register to the shadowed register. The auto-reload register (ARR) is one of the shadowed register as well as the prescaler register (PSC), so in order to force the copy, we issue an event which in turn leads to an interrupt and the NULL dereference. This is fixed by inverting two lines where we clear the status register before enabling the update event interrupt. As this kernel crash is resulting from the combination of these two bugs, the fixes are grouped into a single patch. Cc: stable@vger.kernel.org Signed-off-by: Daniel Lezcano Tested-by: Benjamin Gaignard Acked-by: Benjamin Gaignard --- drivers/clocksource/timer-stm32.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 2.7.4 diff --git a/drivers/clocksource/timer-stm32.c b/drivers/clocksource/timer-stm32.c index 8f24237..4bfeb99 100644 --- a/drivers/clocksource/timer-stm32.c +++ b/drivers/clocksource/timer-stm32.c @@ -106,6 +106,10 @@ static int __init stm32_clockevent_init(struct device_node *np) unsigned long rate, max_delta; int irq, ret, bits, prescaler = 1; + data = kmemdup(&clock_event_ddata, sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + clk = of_clk_get(np, 0); if (IS_ERR(clk)) { ret = PTR_ERR(clk); @@ -156,8 +160,8 @@ static int __init stm32_clockevent_init(struct device_node *np) writel_relaxed(prescaler - 1, data->base + TIM_PSC); writel_relaxed(TIM_EGR_UG, data->base + TIM_EGR); - writel_relaxed(TIM_DIER_UIE, data->base + TIM_DIER); writel_relaxed(0, data->base + TIM_SR); + writel_relaxed(TIM_DIER_UIE, data->base + TIM_DIER); data->periodic_top = DIV_ROUND_CLOSEST(rate, prescaler * HZ); @@ -184,6 +188,7 @@ static int __init stm32_clockevent_init(struct device_node *np) err_clk_enable: clk_put(clk); err_clk_get: + kfree(data); return ret; }