[PATCH] nios2: time: Read timer in get_cycles only if initialized

[PATCH] nios2: time: Read timer in get_cycles only if initialized

[Guenter Roeck]

Mainline crashes as follows when running nios2 images.

On node 0 totalpages: 65536
free_area_init_node: node 0, pgdat c8408fa0, node_mem_map c8726000
  Normal zone: 512 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 65536 pages, LIFO batch:15
Unable to handle kernel NULL pointer dereference at virtual address 00000000
ea = c8003cb0, ra = c81cbf40, cause = 15
Kernel panic - not syncing: Oops

Problem is seen because get_cycles() is called before the timer it depends
on is initialized. Returning 0 in that situation fixes the problem.

Fixes: 33d72f3822d7 ("init/main.c: extract early boot entropy from the ..")
Cc: Laura Abbott <labbott@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
Taking a stab at the problem. Fix works for my qemu test.

 arch/nios2/kernel/time.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/nios2/kernel/time.c b/arch/nios2/kernel/time.c
index 645129aaa9a0..20e86209ef2e 100644
--- a/arch/nios2/kernel/time.c
+++ b/arch/nios2/kernel/time.c
@@ -107,7 +107,10 @@ static struct nios2_clocksource nios2_cs = {
 
 cycles_t get_cycles(void)
 {
-	return nios2_timer_read(&nios2_cs.cs);
+	/* Only read timer if it has been initialized */
+	if (nios2_cs.timer.base)
+		return nios2_timer_read(&nios2_cs.cs);
+	return 0;
 }
 EXPORT_SYMBOL(get_cycles);
 
-- 
2.7.4

Re: [PATCH] nios2: time: Read timer in get_cycles only if initialized

[Kees Cook]

On Mon, Sep 11, 2017 at 8:45 PM, Guenter Roeck <linux@roeck-us.net> wrote:
> Mainline crashes as follows when running nios2 images.
>
> On node 0 totalpages: 65536
> free_area_init_node: node 0, pgdat c8408fa0, node_mem_map c8726000
>   Normal zone: 512 pages used for memmap
>   Normal zone: 0 pages reserved
>   Normal zone: 65536 pages, LIFO batch:15
> Unable to handle kernel NULL pointer dereference at virtual address 00000000
> ea = c8003cb0, ra = c81cbf40, cause = 15
> Kernel panic - not syncing: Oops
>
> Problem is seen because get_cycles() is called before the timer it depends
> on is initialized. Returning 0 in that situation fixes the problem.
>
> Fixes: 33d72f3822d7 ("init/main.c: extract early boot entropy from the ..")
> Cc: Laura Abbott <labbott@redhat.com>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Daniel Micay <danielmicay@gmail.com>
> Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Reviewed-by: Kees Cook <keescook@chromium.org>

-Kees

> ---
> Taking a stab at the problem. Fix works for my qemu test.
>
>  arch/nios2/kernel/time.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/arch/nios2/kernel/time.c b/arch/nios2/kernel/time.c
> index 645129aaa9a0..20e86209ef2e 100644
> --- a/arch/nios2/kernel/time.c
> +++ b/arch/nios2/kernel/time.c
> @@ -107,7 +107,10 @@ static struct nios2_clocksource nios2_cs = {
>
>  cycles_t get_cycles(void)
>  {
> -       return nios2_timer_read(&nios2_cs.cs);
> +       /* Only read timer if it has been initialized */
> +       if (nios2_cs.timer.base)
> +               return nios2_timer_read(&nios2_cs.cs);
> +       return 0;
>  }
>  EXPORT_SYMBOL(get_cycles);
>
> --
> 2.7.4
>



-- 
Kees Cook
Pixel Security