Commit f2997775 authored by Alexandre Belloni's avatar Alexandre Belloni
Browse files

rtc: sa1100: fix possible race condition 

Both RTC IRQs are requested before the struct rtc_device is allocated,
this may lead to a NULL pointer dereference in the IRQ handler.

To fix this issue, allocating the rtc_device struct before requesting
the IRQs using devm_rtc_allocate_device, and use rtc_register_device
to register the RTC device.

Link: https://lore.kernel.org/r/20200306010146.39762-1-alexandre.belloni@bootlin.com


Signed-off-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
parent 0a22bd6f

drivers/rtc/rtc-sa1100.c

+10 −8
Original line number Diff line number Diff line
@@ -182,7 +182,6 @@ static const struct rtc_class_ops sa1100_rtc_ops = { 


int sa1100_rtc_init(struct platform_device *pdev, struct sa1100_rtc *info)

{

	struct rtc_device *rtc;

	int ret;



	spin_lock_init(&info->lock);
@@ -211,15 +210,14 @@ int sa1100_rtc_init(struct platform_device *pdev, struct sa1100_rtc *info) 
		writel_relaxed(0, info->rcnr);

	}



	rtc = devm_rtc_device_register(&pdev->dev, pdev->name, &sa1100_rtc_ops,

					THIS_MODULE);

	if (IS_ERR(rtc)) {

	info->rtc->ops = &sa1100_rtc_ops;

	info->rtc->max_user_freq = RTC_FREQ;



	ret = rtc_register_device(info->rtc);

	if (ret) {

		clk_disable_unprepare(info->clk);

		return PTR_ERR(rtc);

		return ret;

	}

	info->rtc = rtc;



	rtc->max_user_freq = RTC_FREQ;



	/* Fix for a nasty initialization problem the in SA11xx RTSR register.

	 * See also the comments in sa1100_rtc_interrupt().
@@ -267,6 +265,10 @@ static int sa1100_rtc_probe(struct platform_device *pdev) 
	info->irq_1hz = irq_1hz;

	info->irq_alarm = irq_alarm;



	info->rtc = devm_rtc_allocate_device(&pdev->dev);

	if (IS_ERR(info->rtc))

		return PTR_ERR(info->rtc);



	ret = devm_request_irq(&pdev->dev, irq_1hz, sa1100_rtc_interrupt, 0,

			       "rtc 1Hz", &pdev->dev);

	if (ret) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE