From patchwork Thu Feb 19 10:41:33 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthias Brugger X-Patchwork-Id: 5850851 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 1E715BF440 for ; Thu, 19 Feb 2015 10:44:12 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 4162320272 for ; Thu, 19 Feb 2015 10:44:11 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 66EA120260 for ; Thu, 19 Feb 2015 10:44:10 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1YOOYb-0000Om-G1; Thu, 19 Feb 2015 10:42:09 +0000 Received: from mail-wg0-x235.google.com ([2a00:1450:400c:c00::235]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1YOOYY-0000Li-NZ; Thu, 19 Feb 2015 10:42:07 +0000 Received: by mail-wg0-f53.google.com with SMTP id a1so6318172wgh.12; Thu, 19 Feb 2015 02:41:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=2hzfJHGoub7O+LH+wUzgaEOvkn2NsIB13zSMrs24B+Q=; b=N7+270av2y9y+It2movCieu4hTkJkw/EhGC147Hd+dgLKT/xkTQv/JCPfBy1dLNmOm Y+n34hldxJQFht5QXJZVD8VHsvTh8Cgcm9cS4nB0NSzUiGMfNHKaDRoMiNJd8HjxrRgC V/nggunZInyjjlJToLnRafQRvnXc4V1W8+Gq3zrbwf88zxon+lQBSqX+Hqnfr2wedns0 bSuoSYfpC2XNnDdCFbdbvo09ik0t0z5PSqHbWirpZbthrUy9LK5RqzQYVGs9uxhK9N6V Q2mlMx4U2M/K0amhJr1BJjQMhg4U6Abef17f7U7QGabgHyXkNuy0VmTE6INfIooMLaXG fJTQ== X-Received: by 10.181.13.174 with SMTP id ez14mr5402238wid.72.1424342500988; Thu, 19 Feb 2015 02:41:40 -0800 (PST) Received: from localhost.localdomain (66.Red-83-39-6.dynamicIP.rima-tde.net. [83.39.6.66]) by mx.google.com with ESMTPSA id x6sm36793255wjf.24.2015.02.19.02.41.39 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 19 Feb 2015 02:41:40 -0800 (PST) From: Matthias Brugger To: daniel.lezcano@linaro.org, tglx@linutronix.de, matthias.bgg@gmail.com Subject: [PATCH] clocksource: mtk: Fix race conditions in probe code Date: Thu, 19 Feb 2015 11:41:33 +0100 Message-Id: <1424342493-31391-1-git-send-email-matthias.bgg@gmail.com> X-Mailer: git-send-email 1.9.1 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20150219_024206_931486_A355F6B9 X-CRM114-Status: UNSURE ( 9.31 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -0.8 (/) Cc: linux-arm-kernel@lists.infradead.org, stable@vger.kernel.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org, yongbae2@gmail.com X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP We have two race conditions in the probe code which could lead to a null pointer dereference in the interrupt handler. The interrupt handler accesses the clockevent device, which may not yet be registered. First race condition happens when the interrupt handler gets registered before the interrupts get disabled. The second race condition happens when the interrupts get enabled, but the clockevent device is not yet registered. Fix that by disabling the interrupts before we register the interrupt and enable the interrupts after the clockevent device got registered. Reported-by: Gongbae Park Signed-off-by: Matthias Brugger Cc: stable@vger.kernel.org --- drivers/clocksource/mtk_timer.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/clocksource/mtk_timer.c b/drivers/clocksource/mtk_timer.c index 32a3d25..68ab423 100644 --- a/drivers/clocksource/mtk_timer.c +++ b/drivers/clocksource/mtk_timer.c @@ -224,6 +224,8 @@ static void __init mtk_timer_init(struct device_node *node) } rate = clk_get_rate(clk); + mtk_timer_global_reset(evt); + if (request_irq(evt->dev.irq, mtk_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL, "mtk_timer", evt)) { pr_warn("failed to setup irq %d\n", evt->dev.irq); @@ -232,8 +234,6 @@ static void __init mtk_timer_init(struct device_node *node) evt->ticks_per_jiffy = DIV_ROUND_UP(rate, HZ); - mtk_timer_global_reset(evt); - /* Configure clock source */ mtk_timer_setup(evt, GPT_CLK_SRC, TIMER_CTRL_OP_FREERUN); clocksource_mmio_init(evt->gpt_base + TIMER_CNT_REG(GPT_CLK_SRC), @@ -241,10 +241,11 @@ static void __init mtk_timer_init(struct device_node *node) /* Configure clock event */ mtk_timer_setup(evt, GPT_CLK_EVT, TIMER_CTRL_OP_REPEAT); - mtk_timer_enable_irq(evt, GPT_CLK_EVT); - clockevents_config_and_register(&evt->dev, rate, 0x3, 0xffffffff); + + mtk_timer_enable_irq(evt, GPT_CLK_EVT); + return; err_clk_disable: