From patchwork Thu Jan 4 12:50:19 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Lezcano X-Patchwork-Id: 10144653 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A35836034B for ; Thu, 4 Jan 2018 12:51:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8F04528631 for ; Thu, 4 Jan 2018 12:51:36 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 83B9228633; Thu, 4 Jan 2018 12:51:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 0A5BE28630 for ; Thu, 4 Jan 2018 12:51:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=kpU5WLYW/ipRogaCgjbVel/F4zWfy8tHX8c09Nd2Ak4=; b=Js7RgM2k+wDJhST2iFyp/gTCLl QtsyguZDxiSfm2AOxn3z20pu79JUvE12KUK5tKf1Pj84PMkFQiO2uGA6Z1zvUn/69BjM2QYV6LDO/ 9h4n2ErToFPSRMKbPf35vm8dnQf8bomqyjJGnvg+sJD1CWFytzTp48lSlFomd8vEHLqWtKlmFsdLa 16OlFDdT4pZ5lZrURWaNHbT9xmbw9P+SeNnRU/8H3Zve2twyNpBv4uyDgPJ2yTzUtPKp1g3JdFzTF /rYjR01LMEPKUAoqMPqgsNzI5BW7LXx4X5CvgRLwWrWimcOMknC64QT/EPh8cSRGag6Qd3uMRiTPr ZBbxZJ+g==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eX4zd-0005uX-8D; Thu, 04 Jan 2018 12:51:33 +0000 Received: from mail-wr0-x244.google.com ([2a00:1450:400c:c0c::244]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eX4zZ-0005r6-SB for linux-arm-kernel@lists.infradead.org; Thu, 04 Jan 2018 12:51:31 +0000 Received: by mail-wr0-x244.google.com with SMTP id l19so1397139wrc.2 for ; Thu, 04 Jan 2018 04:51:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=lmEr5E+Ci/rbmrsMGX5Vi4ZmyVsHhrCVFOoM4NLfSdc=; b=DCWxcKStHWQKAUYLVoFDRWOnW2XLOxKSNq60H4+kuePZvvXaome9GaUkhF0RoZTwh2 Wv3whQEc50RuVcB8yHkUILXexlGwHNeTgUGbyZNE6d+FHkm2DpuIn+1jIqz8jUTCpklE UfSTNI+U3+mihoK9GMpsGo3wW+21TzybiCY3Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=lmEr5E+Ci/rbmrsMGX5Vi4ZmyVsHhrCVFOoM4NLfSdc=; b=GPK5D6ejbL5rzbKX33vWdqoen8okwNomqoD9EtH52zxF4fv0LAusqQib/R5yJChZPT Qav5taKBgtrS5lvVhtGhgHNOGk5t158c+ZH+b7Lu+2jjiuiPeekZsgzvp/0CEgLGQWS5 lyegYG616pRpype6Vayq06ACTub1c82D81HKR0MaoHZ+zBUhW4Wow96/NPRhM8d8TIf7 bxS0E90kYwldGT89yY8eQonu2VWXzwaVum6gtONLcJvy6bJybCMl0eB8SYbvCsQgVJ53 Z5vmxjMF4hGh3odANq4KdcIaWEEbAf3HkbaKJ3oxzveM7D+/gHd/8cMXJ8+j7XUm/wvg iaiw== X-Gm-Message-State: AKGB3mLE62ZQL0WzhdAxTGtrIAF8/GJgGWWi9R9TUmEW6U2YWRlBGrau wT9R8I2OiAAFOOUfmaE2g4CYgA== X-Google-Smtp-Source: ACJfBosno4oaVkRPz7NNDn3PyzV6gwnMttKJ4JHFflxzaLA8rRff/PZByGxPuK/o5/ZKMT5kXoPWnA== X-Received: by 10.223.134.134 with SMTP id 6mr4410125wrx.17.1515070277374; Thu, 04 Jan 2018 04:51:17 -0800 (PST) Received: from mai.lan ([2001:41d0:fe90:b800:c10d:405d:d60:60bb]) by smtp.gmail.com with ESMTPSA id d71sm3668348wma.7.2018.01.04.04.51.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 04 Jan 2018 04:51:16 -0800 (PST) From: Daniel Lezcano To: daniel.lezcano@linaro.org, tglx@linutronix.de Subject: [PATCH 03/12] clocksource/drivers/stm32: Fix kernel panic with multiple timers Date: Thu, 4 Jan 2018 13:50:19 +0100 Message-Id: <1515070228-10481-4-git-send-email-daniel.lezcano@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1515070228-10481-1-git-send-email-daniel.lezcano@linaro.org> References: <1515070228-10481-1-git-send-email-daniel.lezcano@linaro.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180104_045129_910736_E42E3796 X-CRM114-Status: GOOD ( 17.09 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: benjamin.gaignard@linaro.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Maxime Coquelin , "moderated list:ARM/STM32 ARCHITECTURE" , Alexandre Torgue MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP The current code hides a couple of bugs. - The global variable 'clock_event_ddata' is overwritten each time the init function is invoked. This is fixed with a kmemdup instead of assigning the global variable. That prevents a memory corruption when several timers are defined in the DT. - The clockevent's event_handler is NULL if the time framework does not select the clockevent when registering it, this is fine but the init code generates in any case an interrupt leading to dereference this NULL pointer. The stm32 timer works with shadow registers, a mechanism to cache the registers. When a change is done in one buffered register, we need to artificially generate an event to force the timer to copy the content of the register to the shadowed register. The auto-reload register (ARR) is one of the shadowed register as well as the prescaler register (PSC), so in order to force the copy, we issue an event which in turn leads to an interrupt and the NULL dereference. This is fixed by inverting two lines where we clear the status register before enabling the update event interrupt. As this kernel crash is resulting from the combination of these two bugs, the fixes are grouped into a single patch. Cc: stable@vger.kernel.org Signed-off-by: Daniel Lezcano --- drivers/clocksource/timer-stm32.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/clocksource/timer-stm32.c b/drivers/clocksource/timer-stm32.c index 8f24237..4bfeb99 100644 --- a/drivers/clocksource/timer-stm32.c +++ b/drivers/clocksource/timer-stm32.c @@ -106,6 +106,10 @@ static int __init stm32_clockevent_init(struct device_node *np) unsigned long rate, max_delta; int irq, ret, bits, prescaler = 1; + data = kmemdup(&clock_event_ddata, sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + clk = of_clk_get(np, 0); if (IS_ERR(clk)) { ret = PTR_ERR(clk); @@ -156,8 +160,8 @@ static int __init stm32_clockevent_init(struct device_node *np) writel_relaxed(prescaler - 1, data->base + TIM_PSC); writel_relaxed(TIM_EGR_UG, data->base + TIM_EGR); - writel_relaxed(TIM_DIER_UIE, data->base + TIM_DIER); writel_relaxed(0, data->base + TIM_SR); + writel_relaxed(TIM_DIER_UIE, data->base + TIM_DIER); data->periodic_top = DIV_ROUND_CLOSEST(rate, prescaler * HZ); @@ -184,6 +188,7 @@ static int __init stm32_clockevent_init(struct device_node *np) err_clk_enable: clk_put(clk); err_clk_get: + kfree(data); return ret; }