linux-kernel - [PATCH] clockevents/drivers/timer-atmel-pit: fix double free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1458245383-9859-1-git-send-email-alexandre.belloni@free-electrons.com>
Date:	Thu, 17 Mar 2016 21:09:43 +0100
From:	Alexandre Belloni <alexandre.belloni@...e-electrons.com>
To:	bigeasy@...utronix.de, Thomas Gleixner <tglx@...utronix.de>
Cc:	Boris Brezillon <boris.brezillon@...e-electrons.com>,
	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
	linux-rt-users@...r.kernel.org,
	Nicolas Ferre <nicolas.ferre@...el.com>,
	Alexandre Belloni <alexandre.belloni@...e-electrons.com>
Subject: [PATCH] clockevents/drivers/timer-atmel-pit: fix double free_irq

clockevents_exchange_device() changes the state from detached to shutdown
and so at that point the IRQ has not yet been requested.

Signed-off-by: Alexandre Belloni <alexandre.belloni@...e-electrons.com>
---

Hi Sebastian,

This patch fixes the last warning for preempt-rt on at91. It applies on
v4.4.4-rt11. Note that the whome PIT/TCB mess will be fixed in another way in
the mainline as we are reworking the tcb driver to avoid using the pit when
booting.

 drivers/clocksource/timer-atmel-pit.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/clocksource/timer-atmel-pit.c b/drivers/clocksource/timer-atmel-pit.c
index a7abdb6638cd..7a40f7e88468 100644
--- a/drivers/clocksource/timer-atmel-pit.c
+++ b/drivers/clocksource/timer-atmel-pit.c
@@ -46,6 +46,7 @@ struct pit_data {
 	u32		cycle;
 	u32		cnt;
 	unsigned int	irq;
+	bool		irq_requested;
 	struct clk	*mck;
 };
 
@@ -96,7 +97,10 @@ static int pit_clkevt_shutdown(struct clock_event_device *dev)
 
 	/* disable irq, leaving the clocksource active */
 	pit_write(data->base, AT91_PIT_MR, (data->cycle - 1) | AT91_PIT_PITEN);
-	free_irq(data->irq, data);
+	if (data->irq_requested) {
+		free_irq(data->irq, data);
+		data->irq_requested = false;
+	}
 	return 0;
 }
 
@@ -115,6 +119,8 @@ static int pit_clkevt_set_periodic(struct clock_event_device *dev)
 	if (ret)
 		panic(pr_fmt("Unable to setup IRQ\n"));
 
+	data->irq_requested = true;
+
 	/* update clocksource counter */
 	data->cnt += data->cycle * PIT_PICNT(pit_read(data->base, AT91_PIT_PIVR));
 	pit_write(data->base, AT91_PIT_MR,
-- 
2.7.0