• Chen-Yu Tsai's avatar
    Revert "clocksource/drivers/timer_sun5i: Replace code by clocksource_mmio_init" · 59387683
    Chen-Yu Tsai authored
    struct clocksource is also used by the clk notifier callback, to
    unregister and re-register the clocksource with a different clock rate.
    clocksource_mmio_init does not pass back a pointer to the struct used,
    and the clk notifier callback assumes that the struct clocksource in
    struct sun5i_timer_clksrc is valid. This results in a kernel NULL
    pointer dereference when the hstimer clock is changed:
    
    Unable to handle kernel NULL pointer dereference at virtual address 00000004
    [<c03a4678>] (clocksource_unbind) from [<c03a46d4>] (clocksource_unregister+0x2c/0x44)
    [<c03a46d4>] (clocksource_unregister) from [<c0a6f350>] (sun5i_rate_cb_clksrc+0x34/0x3c)
    [<c0a6f350>] (sun5i_rate_cb_clksrc) from [<c035ea50>] (notifier_call_chain+0x44/0x84)
    [<c035ea50>] (notifier_call_chain) from [<c035edc0>] (__srcu_notifier_call_chain+0x44/0x60)
    [<c035edc0>] (__srcu_notifier_call_chain) from [<c035edf4>] (srcu_notifier_call_chain+0x18/0x20)
    [<c035edf4>] (srcu_notifier_call_chain) from [<c0670174>] (__clk_notify+0x70/0x7c)
    [<c0670174>] (__clk_notify) from [<c06702c0>] (clk_propagate_rate_change+0xa4/0xc4)
    [<c06702c0>] (clk_propagate_rate_change) from [<c0670288>] (clk_propagate_rate_change+0x6c/0xc4)
    
    Revert the commit for now. clocksource_mmio_init can be made to pass back
    a pointer, but the code churn and usage of an inner struct might not be
    worth it.
    
    Fixes: 157dfade ("clocksource/drivers/timer_sun5i: Replace code by clocksource_mmio_init")
    Reported-by: default avatarMaxime Ripard <maxime.ripard@free-electrons.com>
    Signed-off-by: default avatarChen-Yu Tsai <wens@csie.org>
    Cc: linux-sunxi@googlegroups.com
    Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
    Cc: linux-arm-kernel@lists.infradead.org
    Link: http://lkml.kernel.org/r/20161018054918.26855-1-wens@csie.orgSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    59387683
timer-sun5i.c 9.19 KB