Re: [PATCH v11 3/5] clocksource/timer-econet-en751221: Disable IRQ until cevt registered

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] timers: NULL pointer dereference of dev->cpumask in early spurious interrupt
--

commit be0c6a6a32c2acd59113d1e62f6e59c3c3a35579
Author: Caleb James DeLisle <cjd@cjdns.fr>

clocksource/timer-econet-en751221: Disable IRQ until cevt registered

Eliminate a race condition where cevt_interrupt may trigger before
clockevents_config_and_register has been called, and dev->event_handler
is at that point NULL. Additionally, NULL check dev->event_handler in
interrupt callback just in case clockevents_config_and_register failed.

> diff --git a/drivers/clocksource/timer-econet-en751221.c b/drivers/clocksource/timer-econet-en751221.c
> index 714702b9ef128..f2c4c1ee0a56b 100644
> --- a/drivers/clocksource/timer-econet-en751221.c
> +++ b/drivers/clocksource/timer-econet-en751221.c
> @@ -75,7 +75,10 @@ static irqreturn_t cevt_interrupt(int irq, void *dev_id)
>  		return IRQ_NONE;
>  
>  	iowrite32(ioread32(reg_count(cpu)), reg_compare(cpu));
> -	dev->event_handler(dev);
> +
> +	if (dev->event_handler)
> +		dev->event_handler(dev);
> +
>  	return IRQ_HANDLED;
>  }

[Severity: High]
Does this code still have a NULL pointer dereference earlier in the
function?

If a spurious or bootloader-pending interrupt fires immediately after
request_percpu_irq() is called in timer_init(), the generic IRQ layer
(handle_percpu_devid_irq) bypasses irq_can_handle_actions() checks for
percpu interrupts and invokes cevt_interrupt() unconditionally.

This would lead to a NULL pointer dereference when cevt_interrupt()
attempts to read dev->cpumask:

cevt_interrupt() {
	struct clock_event_device *dev = this_cpu_ptr(&econet_timer_pcpu);
	int cpu = cpumask_first(dev->cpumask);
    ...

Since cevt_init() has not yet run to initialize the timer state,
dev->cpumask remains NULL. This could cause cpumask_first() to crash
before it ever reaches the new dev->event_handler check.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015165404.519741-1-cjd@cjdns.fr?part=3