lkml.org 
[lkml]   [2016]   [Nov]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.8 65/92] Revert "clocksource/drivers/timer_sun5i: Replace code by clocksource_mmio_init"
    Date
    4.8-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Chen-Yu Tsai <wens@csie.org>

    commit 593876838826914a7e4e05fbbcb728be6fbc4d89 upstream.

    struct clocksource is also used by the clk notifier callback, to
    unregister and re-register the clocksource with a different clock rate.
    clocksource_mmio_init does not pass back a pointer to the struct used,
    and the clk notifier callback assumes that the struct clocksource in
    struct sun5i_timer_clksrc is valid. This results in a kernel NULL
    pointer dereference when the hstimer clock is changed:

    Unable to handle kernel NULL pointer dereference at virtual address 00000004
    [<c03a4678>] (clocksource_unbind) from [<c03a46d4>] (clocksource_unregister+0x2c/0x44)
    [<c03a46d4>] (clocksource_unregister) from [<c0a6f350>] (sun5i_rate_cb_clksrc+0x34/0x3c)
    [<c0a6f350>] (sun5i_rate_cb_clksrc) from [<c035ea50>] (notifier_call_chain+0x44/0x84)
    [<c035ea50>] (notifier_call_chain) from [<c035edc0>] (__srcu_notifier_call_chain+0x44/0x60)
    [<c035edc0>] (__srcu_notifier_call_chain) from [<c035edf4>] (srcu_notifier_call_chain+0x18/0x20)
    [<c035edf4>] (srcu_notifier_call_chain) from [<c0670174>] (__clk_notify+0x70/0x7c)
    [<c0670174>] (__clk_notify) from [<c06702c0>] (clk_propagate_rate_change+0xa4/0xc4)
    [<c06702c0>] (clk_propagate_rate_change) from [<c0670288>] (clk_propagate_rate_change+0x6c/0xc4)

    Revert the commit for now. clocksource_mmio_init can be made to pass back
    a pointer, but the code churn and usage of an inner struct might not be
    worth it.

    Fixes: 157dfadef832 ("clocksource/drivers/timer_sun5i: Replace code by clocksource_mmio_init")
    Reported-by: Maxime Ripard <maxime.ripard@free-electrons.com>
    Signed-off-by: Chen-Yu Tsai <wens@csie.org>
    Cc: linux-sunxi@googlegroups.com
    Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
    Cc: linux-arm-kernel@lists.infradead.org
    Link: http://lkml.kernel.org/r/20161018054918.26855-1-wens@csie.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/clocksource/timer-sun5i.c | 16 ++++++++++++++--
    1 file changed, 14 insertions(+), 2 deletions(-)

    --- a/drivers/clocksource/timer-sun5i.c
    +++ b/drivers/clocksource/timer-sun5i.c
    @@ -152,6 +152,13 @@ static irqreturn_t sun5i_timer_interrupt
    return IRQ_HANDLED;
    }

    +static cycle_t sun5i_clksrc_read(struct clocksource *clksrc)
    +{
    + struct sun5i_timer_clksrc *cs = to_sun5i_timer_clksrc(clksrc);
    +
    + return ~readl(cs->timer.base + TIMER_CNTVAL_LO_REG(1));
    +}
    +
    static int sun5i_rate_cb_clksrc(struct notifier_block *nb,
    unsigned long event, void *data)
    {
    @@ -210,8 +217,13 @@ static int __init sun5i_setup_clocksourc
    writel(TIMER_CTL_ENABLE | TIMER_CTL_RELOAD,
    base + TIMER_CTL_REG(1));

    - ret = clocksource_mmio_init(base + TIMER_CNTVAL_LO_REG(1), node->name,
    - rate, 340, 32, clocksource_mmio_readl_down);
    + cs->clksrc.name = node->name;
    + cs->clksrc.rating = 340;
    + cs->clksrc.read = sun5i_clksrc_read;
    + cs->clksrc.mask = CLOCKSOURCE_MASK(32);
    + cs->clksrc.flags = CLOCK_SOURCE_IS_CONTINUOUS;
    +
    + ret = clocksource_register_hz(&cs->clksrc, rate);
    if (ret) {
    pr_err("Couldn't register clock source.\n");
    goto err_remove_notifier;

    \
     
     \ /
      Last update: 2016-11-17 11:58    [W:4.672 / U:0.596 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site