Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6bab4a8a authored by Maxime Ripard's avatar Maxime Ripard Committed by Daniel Lezcano
Browse files

clockevent: sun4i: Fix race condition in the probe code 



The interrupts were activated and the handler registered before the clockevent
was registered in the probe function.

The interrupt handler, however, was making the assumption that the clockevent
device was registered.

That could cause a null pointer dereference if the timer interrupt was firing
during this narrow window.

Fix that by moving the clockevent registration before the interrupt is enabled.

Reported-by: default avatarRoman Byshko <rbyshko@gmail.com>
Signed-off-by: default avatarMaxime Ripard <maxime.ripard@free-electrons.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDaniel Lezcano <daniel.lezcano@linaro.org>
parent 59aa896d

drivers/clocksource/sun4i_timer.c

+6 −6
Original line number Diff line number Diff line
@@ -182,6 +182,12 @@ static void __init sun4i_timer_init(struct device_node *node) 
	/* Make sure timer is stopped before playing with interrupts */

	sun4i_clkevt_time_stop(0);



	sun4i_clockevent.cpumask = cpu_possible_mask;

	sun4i_clockevent.irq = irq;



	clockevents_config_and_register(&sun4i_clockevent, rate,

					TIMER_SYNC_TICKS, 0xffffffff);



	ret = setup_irq(irq, &sun4i_timer_irq);

	if (ret)

		pr_warn("failed to setup irq %d\n", irq);
@@ -189,12 +195,6 @@ static void __init sun4i_timer_init(struct device_node *node) 
	/* Enable timer0 interrupt */

	val = readl(timer_base + TIMER_IRQ_EN_REG);

	writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);



	sun4i_clockevent.cpumask = cpu_possible_mask;

	sun4i_clockevent.irq = irq;



	clockevents_config_and_register(&sun4i_clockevent, rate,

					TIMER_SYNC_TICKS, 0xffffffff);

}

CLOCKSOURCE_OF_DECLARE(sun4i, "allwinner,sun4i-a10-timer",

		       sun4i_timer_init);