Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754713AbeAHRe6 (ORCPT + 1 other); Mon, 8 Jan 2018 12:34:58 -0500 Received: from terminus.zytor.com ([65.50.211.136]:52189 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754694AbeAHRey (ORCPT ); Mon, 8 Jan 2018 12:34:54 -0500 Date: Mon, 8 Jan 2018 09:30:31 -0800 From: tip-bot for Daniel Lezcano Message-ID: Cc: mcoquelin.stm32@gmail.com, daniel.lezcano@linaro.org, benjamin.gaignard@st.com, alexandre.torgue@st.com, linux-kernel@vger.kernel.org, tglx@linutronix.de, torvalds@linux-foundation.org, mingo@kernel.org, peterz@infradead.org, hpa@zytor.com Reply-To: mcoquelin.stm32@gmail.com, daniel.lezcano@linaro.org, benjamin.gaignard@st.com, alexandre.torgue@st.com, tglx@linutronix.de, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, mingo@kernel.org, peterz@infradead.org, hpa@zytor.com In-Reply-To: <1515418139-23276-11-git-send-email-daniel.lezcano@linaro.org> References: <1515418139-23276-11-git-send-email-daniel.lezcano@linaro.org> To: linux-tip-commits@vger.kernel.org Subject: [tip:timers/core] clocksource/drivers/stm32: Fix kernel panic with multiple timers Git-Commit-ID: e0aeca3d8cbaea514eb98df1149faa918f9ec42d X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: Commit-ID: e0aeca3d8cbaea514eb98df1149faa918f9ec42d Gitweb: https://git.kernel.org/tip/e0aeca3d8cbaea514eb98df1149faa918f9ec42d Author: Daniel Lezcano AuthorDate: Mon, 8 Jan 2018 14:28:50 +0100 Committer: Ingo Molnar CommitDate: Mon, 8 Jan 2018 17:57:25 +0100 clocksource/drivers/stm32: Fix kernel panic with multiple timers The current code hides a couple of bugs: - The global variable 'clock_event_ddata' is overwritten each time the init function is invoked. This is fixed with a kmemdup() instead of assigning the global variable. That prevents a memory corruption when several timers are defined in the DT. - The clockevent's event_handler is NULL if the time framework does not select the clockevent when registering it, this is fine but the init code generates in any case an interrupt leading to dereference this NULL pointer. The stm32 timer works with shadow registers, a mechanism to cache the registers. When a change is done in one buffered register, we need to artificially generate an event to force the timer to copy the content of the register to the shadowed register. The auto-reload register (ARR) is one of the shadowed register as well as the prescaler register (PSC), so in order to force the copy, we issue an event which in turn leads to an interrupt and the NULL dereference. This is fixed by inverting two lines where we clear the status register before enabling the update event interrupt. As this kernel crash is resulting from the combination of these two bugs, the fixes are grouped into a single patch. Tested-by: Benjamin Gaignard Signed-off-by: Daniel Lezcano Acked-by: Benjamin Gaignard Cc: Alexandre Torgue Cc: Linus Torvalds Cc: Maxime Coquelin Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1515418139-23276-11-git-send-email-daniel.lezcano@linaro.org Signed-off-by: Ingo Molnar --- drivers/clocksource/timer-stm32.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/clocksource/timer-stm32.c b/drivers/clocksource/timer-stm32.c index 8f24237..4bfeb99 100644 --- a/drivers/clocksource/timer-stm32.c +++ b/drivers/clocksource/timer-stm32.c @@ -106,6 +106,10 @@ static int __init stm32_clockevent_init(struct device_node *np) unsigned long rate, max_delta; int irq, ret, bits, prescaler = 1; + data = kmemdup(&clock_event_ddata, sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + clk = of_clk_get(np, 0); if (IS_ERR(clk)) { ret = PTR_ERR(clk); @@ -156,8 +160,8 @@ static int __init stm32_clockevent_init(struct device_node *np) writel_relaxed(prescaler - 1, data->base + TIM_PSC); writel_relaxed(TIM_EGR_UG, data->base + TIM_EGR); - writel_relaxed(TIM_DIER_UIE, data->base + TIM_DIER); writel_relaxed(0, data->base + TIM_SR); + writel_relaxed(TIM_DIER_UIE, data->base + TIM_DIER); data->periodic_top = DIV_ROUND_CLOSEST(rate, prescaler * HZ); @@ -184,6 +188,7 @@ err_iomap: err_clk_enable: clk_put(clk); err_clk_get: + kfree(data); return ret; }