From patchwork Mon Jan 8 13:28:50 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Lezcano X-Patchwork-Id: 10149581 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 6ADFB602CA for ; Mon, 8 Jan 2018 13:33:02 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 464552841E for ; Mon, 8 Jan 2018 13:33:02 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 44E3628770; Mon, 8 Jan 2018 13:33:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 016DE2841E for ; Mon, 8 Jan 2018 13:31:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=GDaeRh+e2CpImeB2XomNDCGPeMQsDV4fe6E7z2sT4QA=; b=dZ9LA0r3ARGrWR5pVLYBH86wbJ oVWPxUcczZ2FMaRzW9wG4K7QuW/MFIME8n4ONjpQuczdH/d4JYoNhi99H/SOeRLX/ixGLYTGRXEKV wL+Y0NAdDOwUXjWPYT9w/jwGdGK3R08q1UXiVyvwJ5nLdtjqYTWOfJ0flsBrUd0k/pXf7i+wD2KL5 ygLsbmG7Erfa0R/NmcuLE1T++vFDqqda/H7ZqCj2QbOhGV/fYj3nHAxRn7C0Wj+bAPEExM44LbHp6 b0sNUv0SR5oUyYZ2OMNuOJlA4BAmOtx9KPs3UW9G7xJAlnjesSKilEP8O67WkLdRkQIw6iA0H2Wzo jg6QX6fA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eYXWq-0005UJ-KW; Mon, 08 Jan 2018 13:31:52 +0000 Received: from mail-wm0-x243.google.com ([2a00:1450:400c:c09::243]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eYXUv-0003FU-HO for linux-arm-kernel@lists.infradead.org; Mon, 08 Jan 2018 13:30:06 +0000 Received: by mail-wm0-x243.google.com with SMTP id i11so14199427wmf.4 for ; Mon, 08 Jan 2018 05:29:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=dvLnzOk0r+Y0lU6cqlJZCJcFZ16TE9y1s6sJ2FFf0gA=; b=TwtXvkEQGqi5WPnnafzxNJjfQs/MLqJmEfWMT/g4/LY8tYleo8k6oJVwS/h8HxXw7Y 4s/h2NLgzbDPzBX1tLUf8yOR6fd18bGq4jiAUN5iQGtX1R/giFYuTz7sqRG51i15k/lA HEjlIvhaNIpaeN1wnD38ZzDbED4Y9EKyPCXCo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=dvLnzOk0r+Y0lU6cqlJZCJcFZ16TE9y1s6sJ2FFf0gA=; b=bPiw+b2mRMokxYPg1zK9hmTJm7oh+oDvV06wAxg89FSr1YqVrFCPYOXoN1QOdOiBbM zWMeUazEKONFq3+f7LbG7JnV1fsY4QODIkpP5kATi+owyYIXn06HoRuPLKjLEPIuYXXR Gt8GApbo1LOcpnW6IjvM9Og5b+e+q6W3yVRz4OvjtnDx47G4mxmxHFy9nfi4VG+yP2Hc KSZBHml+bZtPGzqnmWlulagTpb8LommS+qW35+WKDw/YOZ+9ydsDfR4CvBJDSwOw0iI8 SURMbJVugK/IojXuIiGXX07Di+Qmi1GNzLwo0++SKJHqJiWiEhefUvmYL6Buwe1LFAtM bH4A== X-Gm-Message-State: AKGB3mKDbufn8oS1UmJD0yVIX4g5xONbBQML0ZqLAT0lq5FJ6XgPKQNI oHKW+vtav0cZQL95DUZCgKTWqA== X-Google-Smtp-Source: ACJfBov+ZW0i7KH+SpP4IdP8xIwB3b7hWvbzjDXouf/oTN1rK7Pw7F2D1Lj7Q6k2Jne/L5Rt0GDTMg== X-Received: by 10.28.229.194 with SMTP id c185mr8652130wmh.142.1515418181938; Mon, 08 Jan 2018 05:29:41 -0800 (PST) Received: from mai.lan ([2001:41d0:fe90:b800:312a:53a5:1bef:6622]) by smtp.gmail.com with ESMTPSA id q196sm14354222wmb.22.2018.01.08.05.29.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 08 Jan 2018 05:29:41 -0800 (PST) From: Daniel Lezcano To: tglx@linutronix.de Subject: [PATCH 11/20] clocksource/drivers/stm32: Fix kernel panic with multiple timers Date: Mon, 8 Jan 2018 14:28:50 +0100 Message-Id: <1515418139-23276-11-git-send-email-daniel.lezcano@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1515418139-23276-1-git-send-email-daniel.lezcano@linaro.org> References: <1bbaef2e-4080-3f54-7db3-a8989acfd691@free.fr> <1515418139-23276-1-git-send-email-daniel.lezcano@linaro.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180108_052954_064966_359C2E3F X-CRM114-Status: GOOD ( 16.93 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Alexandre Torgue , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Maxime Coquelin , "moderated list:ARM/STM32 ARCHITECTURE" , Benjamin Gaignard MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP The current code hides a couple of bugs. - The global variable 'clock_event_ddata' is overwritten each time the init function is invoked. This is fixed with a kmemdup instead of assigning the global variable. That prevents a memory corruption when several timers are defined in the DT. - The clockevent's event_handler is NULL if the time framework does not select the clockevent when registering it, this is fine but the init code generates in any case an interrupt leading to dereference this NULL pointer. The stm32 timer works with shadow registers, a mechanism to cache the registers. When a change is done in one buffered register, we need to artificially generate an event to force the timer to copy the content of the register to the shadowed register. The auto-reload register (ARR) is one of the shadowed register as well as the prescaler register (PSC), so in order to force the copy, we issue an event which in turn leads to an interrupt and the NULL dereference. This is fixed by inverting two lines where we clear the status register before enabling the update event interrupt. As this kernel crash is resulting from the combination of these two bugs, the fixes are grouped into a single patch. Cc: stable@vger.kernel.org Signed-off-by: Daniel Lezcano Tested-by: Benjamin Gaignard Acked-by: Benjamin Gaignard --- drivers/clocksource/timer-stm32.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/clocksource/timer-stm32.c b/drivers/clocksource/timer-stm32.c index 8f24237..4bfeb99 100644 --- a/drivers/clocksource/timer-stm32.c +++ b/drivers/clocksource/timer-stm32.c @@ -106,6 +106,10 @@ static int __init stm32_clockevent_init(struct device_node *np) unsigned long rate, max_delta; int irq, ret, bits, prescaler = 1; + data = kmemdup(&clock_event_ddata, sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + clk = of_clk_get(np, 0); if (IS_ERR(clk)) { ret = PTR_ERR(clk); @@ -156,8 +160,8 @@ static int __init stm32_clockevent_init(struct device_node *np) writel_relaxed(prescaler - 1, data->base + TIM_PSC); writel_relaxed(TIM_EGR_UG, data->base + TIM_EGR); - writel_relaxed(TIM_DIER_UIE, data->base + TIM_DIER); writel_relaxed(0, data->base + TIM_SR); + writel_relaxed(TIM_DIER_UIE, data->base + TIM_DIER); data->periodic_top = DIV_ROUND_CLOSEST(rate, prescaler * HZ); @@ -184,6 +188,7 @@ static int __init stm32_clockevent_init(struct device_node *np) err_clk_enable: clk_put(clk); err_clk_get: + kfree(data); return ret; }