q3k/linux
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
linux/drivers/rtc
History
Marcin Slusarz 2e4a75cdcb rtc: fix kernel panic on second use of SIGIO nofitication 
When userspace uses SIGIO notification and forgets to disable it before
closing file descriptor, rtc->async_queue contains stale pointer to struct
file.  When user space enables again SIGIO notification in different
process, kernel dereferences this (poisoned) pointer and crashes.

So disable SIGIO notification on close.

Kernel panic:
(second run of qemu (requires echo 1024 > /sys/class/rtc/rtc0/max_user_freq))

general protection fault: 0000 [1] PREEMPT
CPU 0
Modules linked in: af_packet snd_pcm_oss snd_mixer_oss snd_seq_oss snd_seq_midi_event snd_seq usbhid tuner tea5767 tda8290 tuner_xc2028 xc5000 tda9887 tuner_simple tuner_types mt20xx tea5761 tda9875 uhci_hcd ehci_hcd usbcore bttv snd_via82xx snd_ac97_codec ac97_bus snd_pcm snd_timer ir_common compat_ioctl32 snd_page_alloc videodev v4l1_compat snd_mpu401_uart snd_rawmidi v4l2_common videobuf_dma_sg videobuf_core snd_seq_device snd btcx_risc soundcore tveeprom i2c_viapro
Pid: 5781, comm: qemu-system-x86 Not tainted 2.6.27-rc6 #363
RIP: 0010:[<ffffffff8024f891>]  [<ffffffff8024f891>] __lock_acquire+0x3db/0x73f
RSP: 0000:ffffffff80674cb8  EFLAGS: 00010002
RAX: ffff8800224c62f0 RBX: 0000000000000046 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800224c62f0
RBP: ffffffff80674d08 R08: 0000000000000002 R09: 0000000000000001
R10: ffffffff80238941 R11: 0000000000000001 R12: 0000000000000000
R13: 6b6b6b6b6b6b6b6b R14: ffff88003a450080 R15: 0000000000000000
FS:  00007f98b69516f0(0000) GS:ffffffff80623200(0000) knlGS:00000000f7cc86d0
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000a87000 CR3: 0000000022598000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process qemu-system-x86 (pid: 5781, threadinfo ffff880028812000, task ffff88003a450080)
Stack:  ffffffff80674cf8 0000000180238440 0000000200000002 0000000000000000
 ffff8800224c62f0 0000000000000046 0000000000000000 0000000000000002
 0000000000000002 0000000000000000 ffffffff80674d68 ffffffff8024fc7a
Call Trace:
 <IRQ>  [<ffffffff8024fc7a>] lock_acquire+0x85/0xa9
 [<ffffffff8029cb62>] ? send_sigio+0x2a/0x184
 [<ffffffff80491d1f>] _read_lock+0x3e/0x4a
 [<ffffffff8029cb62>] ? send_sigio+0x2a/0x184
 [<ffffffff8029cb62>] send_sigio+0x2a/0x184
 [<ffffffff8024fb97>] ? __lock_acquire+0x6e1/0x73f
 [<ffffffff8029cd4d>] ? kill_fasync+0x2c/0x4e
 [<ffffffff8029cd10>] __kill_fasync+0x54/0x65
 [<ffffffff8029cd5b>] kill_fasync+0x3a/0x4e
 [<ffffffff80402896>] rtc_update_irq+0x9c/0xa5
 [<ffffffff80404640>] cmos_interrupt+0xae/0xc0
 [<ffffffff8025d1c1>] handle_IRQ_event+0x25/0x5a
 [<ffffffff8025e5e4>] handle_edge_irq+0xdd/0x123
 [<ffffffff8020da34>] do_IRQ+0xe4/0x144
 [<ffffffff8020bad6>] ret_from_intr+0x0/0xf
 <EOI>  [<ffffffff8026fdc2>] ? __alloc_pages_internal+0xe7/0x3ad
 [<ffffffff8033fe67>] ? clear_page_c+0x7/0x10
 [<ffffffff8026fc10>] ? get_page_from_freelist+0x385/0x450
 [<ffffffff8026fdc2>] ? __alloc_pages_internal+0xe7/0x3ad
 [<ffffffff80280aac>] ? anon_vma_prepare+0x2e/0xf6
 [<ffffffff80279400>] ? handle_mm_fault+0x227/0x6a5
 [<ffffffff80494716>] ? do_page_fault+0x494/0x83f
 [<ffffffff8049251d>] ? error_exit+0x0/0xa9

Code: cc 41 39 45 28 74 24 e8 5e 1d 0f 00 85 c0 0f 84 6a 03 00 00 83 3d 8f a9 aa 00 00 be 47 03 00 00 0f 84 6a 02 00 00 e9 53 03 00 00 <41> ff 85 38 01 00 00 45 8b be 90 06 00 00 41 83 ff 2f 76 24 e8
RIP  [<ffffffff8024f891>] __lock_acquire+0x3db/0x73f
 RSP <ffffffff80674cb8>
---[ end trace 431877d860448760 ]---
Kernel panic - not syncing: Aiee, killing interrupt handler!

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Acked-by: Alessandro Zummo <alessandro.zummo@towertech.it>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-10-03 18:22:17 -07:00
..
class.c RTC: periodic irq fix 2007-10-16 09:43:13 -07:00
hctosys.c rtc_hctosys expects RTCs in UTC (doc) 2007-11-14 18:45:36 -08:00
interface.c rtc: don't return -EBUSY when mutex_lock_interruptible() fails 2008-07-30 09:41:45 -07:00
Kconfig Blackfin RTC Driver: BF561 not have on-chip RTC 2008-08-20 15:40:30 -07:00
Makefile rtc: ds1305/ds1306 driver 2008-07-24 10:47:33 -07:00
rtc-at32ap700x.c rtc-at32ap700x: Enable wakeup 2008-07-02 11:05:01 +02:00
rtc-at91rm9200.c [ARM] Move include/asm-arm/arch-* to arch/arm/*/include/mach 2008-08-07 09:55:48 +01:00
rtc-at91sam9.c [ARM] Move include/asm-arm/arch-* to arch/arm/*/include/mach 2008-08-07 09:55:48 +01:00
rtc-bfin.c Blackfin RTC Driver: dont let RTC programming in bootloaders randomly cause ~5 second boot delays 2008-08-20 15:40:30 -07:00
rtc-cmos.c rtc-cmos: wake again from S5 2008-09-02 19:21:40 -07:00
rtc-core.h rtc: update to class device removal patches 2007-05-08 11:15:18 -07:00
rtc-dev.c rtc: fix kernel panic on second use of SIGIO nofitication 2008-10-03 18:22:17 -07:00
rtc-ds1216.c rtc: fix platform driver hotplug/coldplug 2008-04-11 08:06:44 -07:00
rtc-ds1302.c rtc: replace remaining __FUNCTION__ occurrences 2008-04-28 08:58:17 -07:00
rtc-ds1305.c rtc: ds1305/ds1306 driver 2008-07-24 10:47:33 -07:00
rtc-ds1307.c i2c: Convert most new-style drivers to use module aliasing 2008-04-29 23:11:40 +02:00
rtc-ds1374.c rtc: rtc-ds1374: fix 'no irq' case handling 2008-08-20 15:40:32 -07:00
rtc-ds1511.c fix irq flags in rtc-ds1511 2008-05-08 10:46:55 -07:00
rtc-ds1553.c rtc: fix platform driver hotplug/coldplug 2008-04-11 08:06:44 -07:00
rtc-ds1672.c rtc: replace remaining __FUNCTION__ occurrences 2008-04-28 08:58:17 -07:00
rtc-ds1742.c rtc: fix platform driver hotplug/coldplug 2008-04-11 08:06:44 -07:00
rtc-ep93xx.c [ARM] Move include/asm-arm/arch-* to arch/arm/*/include/mach 2008-08-07 09:55:48 +01:00
rtc-fm3130.c rtc-fm3130: fix chip naming 2008-07-12 14:33:41 -07:00
rtc-isl1208.c rtc-isl1208: fix double removal of a sysfs entry 2008-08-12 16:07:28 -07:00
rtc-lib.c rtc_time_to_tm: fix signed/unsigned arithmetic 2008-09-02 19:21:40 -07:00
rtc-m41t80.c rtc: m41t80: use pr_info() as appropriate 2008-07-24 10:47:33 -07:00
rtc-m41t94.c rtc: add support for ST M41T94 SPI RTC 2008-07-24 10:47:33 -07:00
rtc-m48t59.c rtc: fix platform driver hotplug/coldplug 2008-04-11 08:06:44 -07:00
rtc-m48t86.c rtc: fix platform driver hotplug/coldplug 2008-04-11 08:06:44 -07:00
rtc-max6900.c rtc: replace remaining __FUNCTION__ occurrences 2008-04-28 08:58:17 -07:00
rtc-max6902.c removed unused #include <linux/version.h>'s 2008-08-23 12:14:12 -07:00
rtc-omap.c rtc: rtc-omap footprint shrinkage 2008-07-24 10:47:33 -07:00
rtc-pcf8563.c rtc-pcf8563: add chip id 2008-07-12 14:33:42 -07:00
rtc-pcf8583.c rtc: convert the PCF8583 driver to the new I2C style framework with device_ids 2008-07-24 10:47:34 -07:00
rtc-pl030.c [RTC] rtc-pl030: add driver, remove old non-rtc lib driver 2008-05-22 14:56:38 +01:00
rtc-pl031.c [RTC] rtc-pl031: use proper resources, use proper apis, clean up includes 2008-05-22 14:56:36 +01:00
rtc-ppc.c rtc: class driver for ppc_md RTC functions 2008-06-06 11:29:13 -07:00
rtc-proc.c drivers: use non-racy method for proc entries creation (2) 2008-04-29 08:06:22 -07:00
rtc-r9701.c removed unused #include <linux/version.h>'s 2008-08-23 12:14:12 -07:00
rtc-rs5c313.c rtc: replace remaining __FUNCTION__ occurrences 2008-04-28 08:58:17 -07:00
rtc-rs5c348.c [PATCH] rtc: Make rtc-rs5c348 driver hotplug-aware 2007-08-27 02:16:58 +01:00
rtc-rs5c372.c i2c: Convert most new-style drivers to use module aliasing 2008-04-29 23:11:40 +02:00
rtc-s3c.c [ARM] Move include/asm-arm/arch-* to arch/arm/*/include/mach 2008-08-07 09:55:48 +01:00
rtc-s35390a.c i2c: Match dummy devices by type 2008-05-11 20:37:06 +02:00
rtc-sa1100.c [ARM] Move include/asm-arm/arch-* to arch/arm/*/include/mach 2008-08-07 09:55:48 +01:00
rtc-sh.c rtc: rtc-sh: Fixup for 64-bit resources. 2008-05-08 19:51:45 +09:00
rtc-stk17ta8.c rtc: fix platform driver hotplug/coldplug 2008-04-11 08:06:44 -07:00
rtc-sysfs.c rtc: add the support for alarm time relative to current time in sysfs 2008-04-28 08:58:17 -07:00
rtc-test.c rtc: silence section mismatch warning in rtc-test 2008-04-28 08:58:16 -07:00
rtc-v3020.c rtc: replace remaining __FUNCTION__ occurrences 2008-04-28 08:58:17 -07:00
rtc-vr41xx.c rtc-vr41xx: add irq_set_freq() and irq_set_state() 2008-07-24 10:47:34 -07:00
rtc-x1205.c rtc-x1205: Fix alarm set 2008-07-04 10:40:05 -07:00