John Stultz 1fecf3977d time: Fix clock->read(clock) race around clocksource changes ... commit ceea5e3771 upstream. In tests, which excercise switching of clocksources, a NULL pointer dereference can be observed on AMR64 platforms in the clocksource read() function: u64 clocksource_mmio_readl_down(struct clocksource *c) { return ~(u64)readl_relaxed(to_mmio_clksrc(c)->reg) & c->mask; } This is called from the core timekeeping code via: cycle_now = tkr->read(tkr->clock); tkr->read is the cached tkr->clock->read() function pointer. When the clocksource is changed then tkr->clock and tkr->read are updated sequentially. The code above results in a sequential load operation of tkr->read and tkr->clock as well. If the store to tkr->clock hits between the loads of tkr->read and tkr->clock, then the old read() function is called with the new clock pointer. As a consequence the read() function dereferences a different data structure and the resulting 'reg' pointer can point anywhere including NULL. This problem was introduced when the timekeeping code was switched over to use struct tk_read_base. Before that, it was theoretically possible as well when the compiler decided to reload clock in the code sequence: now = tk->clock->read(tk->clock); Add a helper function which avoids the issue by reading tk_read_base->clock once into a local variable clk and then issue the read function via clk->read(clk). This guarantees that the read() function always gets the proper clocksource pointer handed in. Since there is now no use for the tkr.read pointer, this patch also removes it, and to address stopping the fast timekeeper during suspend/resume, it introduces a dummy clocksource to use rather then just a dummy read function. Signed-off-by: John Stultz <john.stultz@linaro.org> Acked-by: Ingo Molnar <mingo@kernel.org> Cc: Prarit Bhargava <prarit@redhat.com> Cc: Richard Cochran <richardcochran@gmail.com> Cc: Stephen Boyd <stephen.boyd@linaro.org> Cc: Miroslav Lichvar <mlichvar@redhat.com> Cc: Daniel Mentz <danielmentz@google.com> Link: http://lkml.kernel.org/r/1496965462-20003-2-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-06-29 12:48:51 +02:00
..
acpi	Merge branch 'acpi-pci'	2015-11-07 01:30:10 +01:00
asm-generic	asm-generic: make copy_from_user() zero the destination properly	2016-09-24 10:07:45 +02:00
clocksource
crypto	crypto: ahash - Fix EINPROGRESS notification callback	2017-04-21 09:30:06 +02:00
drm	drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces	2017-04-12 12:38:33 +02:00
dt-bindings	ARM: DT updates for v4.4	2015-11-10 15:06:26 -08:00
keys
kvm	KVM: arm/arm64: arch_timer: Preserve physical dist. active state on LR.active	2015-11-24 18:07:40 +01:00
linux	time: Fix clock->read(clock) race around clocksource changes	2017-06-29 12:48:51 +02:00
math-emu
media	videobuf2-core: Check user space planes array in dqbuf	2016-05-04 14:48:50 -07:00
memory
misc
net	ipv6: fix flow labels when the traffic class is non-0	2017-06-17 06:39:37 +02:00
pcmcia
ras
rdma	RDMA/core: Fix incorrect structure packing for booleans	2017-03-12 06:37:29 +01:00
rxrpc
scsi	scsi: libiscsi: add lock around task lists to fix list corruption regression	2017-03-26 12:13:19 +02:00
soc	ARM: at91: define LPDDR types	2017-03-12 06:37:24 +01:00
sound	ALSA: rawmidi: Make snd_rawmidi_transmit() race-free	2016-02-17 12:30:58 -08:00
target	target: Convert ACL change queue_depth se_session reference usage	2017-05-20 14:26:58 +02:00
trace	tracing: Add #undef to fix compile error	2017-03-18 19:09:57 +08:00
uapi	USB: hub: fix SS max number of ports	2017-06-26 07:13:09 +02:00
video	drm/imx: Match imx-ipuv3-crtc components using device node in platform data	2016-06-07 18:14:37 -07:00
xen	xen: Fix page <-> pfn conversion on 32 bit systems	2016-05-11 11:21:14 +02:00
Kbuild