mirror of https://github.com/torvalds/linux.git
5938768388
struct clocksource is also used by the clk notifier callback, to
unregister and re-register the clocksource with a different clock rate.
clocksource_mmio_init does not pass back a pointer to the struct used,
and the clk notifier callback assumes that the struct clocksource in
struct sun5i_timer_clksrc is valid. This results in a kernel NULL
pointer dereference when the hstimer clock is changed:
Unable to handle kernel NULL pointer dereference at virtual address 00000004
[<c03a4678>] (clocksource_unbind) from [<c03a46d4>] (clocksource_unregister+0x2c/0x44)
[<c03a46d4>] (clocksource_unregister) from [<c0a6f350>] (sun5i_rate_cb_clksrc+0x34/0x3c)
[<c0a6f350>] (sun5i_rate_cb_clksrc) from [<c035ea50>] (notifier_call_chain+0x44/0x84)
[<c035ea50>] (notifier_call_chain) from [<c035edc0>] (__srcu_notifier_call_chain+0x44/0x60)
[<c035edc0>] (__srcu_notifier_call_chain) from [<c035edf4>] (srcu_notifier_call_chain+0x18/0x20)
[<c035edf4>] (srcu_notifier_call_chain) from [<c0670174>] (__clk_notify+0x70/0x7c)
[<c0670174>] (__clk_notify) from [<c06702c0>] (clk_propagate_rate_change+0xa4/0xc4)
[<c06702c0>] (clk_propagate_rate_change) from [<c0670288>] (clk_propagate_rate_change+0x6c/0xc4)
Revert the commit for now. clocksource_mmio_init can be made to pass back
a pointer, but the code churn and usage of an inner struct might not be
worth it.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| acpi_pm.c | ||
| arm_arch_timer.c | ||
| arm_global_timer.c | ||
| armv7m_systick.c | ||
| asm9260_timer.c | ||
| bcm2835_timer.c | ||
| bcm_kona_timer.c | ||
| cadence_ttc_timer.c | ||
| clksrc-dbx500-prcmu.c | ||
| clksrc-probe.c | ||
| clksrc_st_lpc.c | ||
| clps711x-timer.c | ||
| cs5535-clockevt.c | ||
| dummy_timer.c | ||
| dw_apb_timer.c | ||
| dw_apb_timer_of.c | ||
| em_sti.c | ||
| exynos_mct.c | ||
| fsl_ftm_timer.c | ||
| h8300_timer8.c | ||
| h8300_timer16.c | ||
| h8300_tpu.c | ||
| i8253.c | ||
| jcore-pit.c | ||
| meson6_timer.c | ||
| metag_generic.c | ||
| mips-gic-timer.c | ||
| mmio.c | ||
| moxart_timer.c | ||
| mps2-timer.c | ||
| mtk_timer.c | ||
| mxs_timer.c | ||
| nomadik-mtu.c | ||
| numachip.c | ||
| pxa_timer.c | ||
| qcom-timer.c | ||
| rockchip_timer.c | ||
| samsung_pwm_timer.c | ||
| scx200_hrt.c | ||
| sh_cmt.c | ||
| sh_mtu2.c | ||
| sh_tmu.c | ||
| sun4i_timer.c | ||
| tango_xtal.c | ||
| tcb_clksrc.c | ||
| tegra20_timer.c | ||
| time-armada-370-xp.c | ||
| time-efm32.c | ||
| time-lpc32xx.c | ||
| time-orion.c | ||
| time-pistachio.c | ||
| timer-atlas7.c | ||
| timer-atmel-pit.c | ||
| timer-atmel-st.c | ||
| timer-digicolor.c | ||
| timer-imx-gpt.c | ||
| timer-integrator-ap.c | ||
| timer-keystone.c | ||
| timer-nps.c | ||
| timer-oxnas-rps.c | ||
| timer-prima2.c | ||
| timer-sp.h | ||
| timer-sp804.c | ||
| timer-stm32.c | ||
| timer-sun5i.c | ||
| timer-ti-32k.c | ||
| timer-u300.c | ||
| versatile.c | ||
| vf_pit_timer.c | ||
| vt8500_timer.c | ||
| zevio-timer.c | ||