linux-kernel - [PATCH] clocksource: timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251219-fix_timersp804-v1-1-020e3cde7cf5@gmail.com>
Date: Fri, 19 Dec 2025 12:59:59 +0800
From: Stephen Eta Zhou <stephen.eta.zhou@...il.com>
To: Daniel Lezcano <daniel.lezcano@...aro.org>, 
 Thomas Gleixner <tglx@...utronix.de>
Cc: linux-kernel@...r.kernel.org, groeck7@...il.com, 
 Stephen Eta Zhou <stephen.eta.zhou@...il.com>
Subject: [PATCH] clocksource: timer-sp804: Fix an Oops when
 read_current_timer is called on ARM32 platforms where the SP804 is not
 registered as the sched_clock.

On SP804, the delay timer shares the same clkevt instance with
sched_clock.
On some platforms, when sp804_clocksource_and_sched_clock_init
is called with use_sched_clock not set to 1,
sched_clkevt is not properly initialized. However,
sp804_register_delay_timer is invoked unconditionally,
and read_current_timer() subsequently calls sp804_read
on an uninitialized sched_clkevt, leading to a kernel
Oops when accessing sched_clkevt->value.

Declare a dedicated clkevt instance exclusively for delay timer,
instead of sharing the same clkevt with sched_clock.
This ensures that read_current_timer continues to work correctly
regardless of whether SP804 is selected as the sched_clock.

Fixes: 640594a04f11 ("clocksource/drivers/timer-sp804: Fix read_current_timer() issue when clock source is not registered")
Signed-off-by: Stephen Eta Zhou <stephen.eta.zhou@...il.com>
---
 drivers/clocksource/timer-sp804.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/clocksource/timer-sp804.c b/drivers/clocksource/timer-sp804.c
index e82a95ea472478ae096b2bf7abea0d65a7bca480..bf4d40058a2a54899804dc97744bf1255ceb4eb3 100644
--- a/drivers/clocksource/timer-sp804.c
+++ b/drivers/clocksource/timer-sp804.c
@@ -106,21 +106,25 @@ static u64 notrace sp804_read(void)
 	return ~readl_relaxed(sched_clkevt->value);
 }

+/* Register delay timer backed by the hardware counter */
 #ifdef CONFIG_ARM
 static struct delay_timer delay;
+struct sp804_clkevt *delay_clkevt;
+
 static unsigned long sp804_read_delay_timer_read(void)
 {
-	return sp804_read();
+	return ~readl_relaxed(delay_clkevt->value);
 }

-static void sp804_register_delay_timer(int freq)
+static void sp804_register_delay_timer(struct sp804_clkevt *clk, int freq)
 {
+	delay_clkevt = clk;
 	delay.freq = freq;
 	delay.read_current_timer = sp804_read_delay_timer_read;
 	register_current_timer_delay(&delay);
 }
 #else
-static inline void sp804_register_delay_timer(int freq) {}
+static inline void sp804_register_delay_timer(struct sp804_clkevt *clk, int freq) {}
 #endif

 static int __init sp804_clocksource_and_sched_clock_init(void __iomem *base,
@@ -135,8 +139,6 @@ static int __init sp804_clocksource_and_sched_clock_init(void __iomem *base,
 	if (rate < 0)
 		return -EINVAL;

-	sp804_register_delay_timer(rate);
-
 	clkevt = sp804_clkevt_get(base);

 	writel(0, clkevt->ctrl);
@@ -152,6 +154,8 @@ static int __init sp804_clocksource_and_sched_clock_init(void __iomem *base,
 	clocksource_mmio_init(clkevt->value, name,
 		rate, 200, 32, clocksource_mmio_readl_down);

+	sp804_register_delay_timer(clkevt, rate);
+
 	if (use_sched_clock) {
 		sched_clkevt = clkevt;
 		sched_clock_register(sp804_read, 32, rate);

---
base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
change-id: 20251217-fix_timersp804-7910e1c471d4

Best regards,
-- 
Stephen Eta Zhou <stephen.eta.zhou@...il.com>