linux-kernel - [PATCH v2] clockevents/drivers/cs5535: improve resilience to spurious interrupts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 19 Oct 2017 22:57:02 +0200
From:   David Kozub <zub@...ux.fjfi.cvut.cz>
To:     Daniel Lezcano <daniel.lezcano@...aro.org>,
        Thomas Gleixner <tglx@...utronix.de>
Cc:     linux-kernel@...r.kernel.org
Subject: [PATCH v2] clockevents/drivers/cs5535: improve resilience to spurious
 interrupts

The interrupt handler mfgpt_tick() is not robust versus spurious
interrupts which happen before the clock event device is registered and
fully initialized.

The reason is that the safe guard against spurious interrupts solely
checks for the clockevents shutdown state, but lacks a check for
detached state. If the interrupt hits while the device is in detached
state it passes the safe guard and dereferences the event handler call
back which is NULL.

Add the missing state check.

Suggested-by: Thomas Gleixner <tglx@...utronix.de>
Signed-off-by: David Kozub <zub@...ux.fjfi.cvut.cz>
---
Changes in v2:
  - Use commit message suggested by Thomas Gleixner
  - Fix formatting of multi-line if condition

 drivers/clocksource/cs5535-clockevt.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c
index a1df588343f2..1de8cac99a0e 100644
--- a/drivers/clocksource/cs5535-clockevt.c
+++ b/drivers/clocksource/cs5535-clockevt.c
@@ -117,7 +117,8 @@ static irqreturn_t mfgpt_tick(int irq, void *dev_id)
 	/* Turn off the clock (and clear the event) */
 	disable_timer(cs5535_event_clock);
 
-	if (clockevent_state_shutdown(&cs5535_clockevent))
+	if (clockevent_state_detached(&cs5535_clockevent) ||
+	    clockevent_state_shutdown(&cs5535_clockevent))
 		return IRQ_HANDLED;
 
 	/* Clear the counter */
-- 
2.14.2