R0dn3yS/android_kernel_xiaomi_sm7250
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rtc: armada38x: fix possible race condition

Browse Source 
[ Upstream commit 7d61cbb945a753af08e247b5f10bdd5dbb8d6c80 ]

The IRQ is requested before the struct rtc is allocated and registered, but
this struct is used in the IRQ handler. This may lead to a NULL pointer
dereference.

Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
before requesting the IRQ.

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Alexandre Belloni 2018-09-24 16:25:34 +02:00 committed by Greg Kroah-Hartman
parent 44bb1b1256
commit ba8c4cc746
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/rtc/rtc-armada38x.c
View File

@ -514,7 +514,6 @@ MODULE_DEVICE_TABLE(of, armada38x_rtc_of_match_table);
static __init int armada38x_rtc_probe(struct platform_device *pdev) static __init int armada38x_rtc_probe(struct platform_device *pdev)
{ {
const struct rtc_class_ops *ops;
struct resource *res; struct resource *res;
struct armada38x_rtc *rtc; struct armada38x_rtc *rtc;
const struct of_device_id *match; const struct of_device_id *match;
@ -551,6 +550,11 @@ static __init int armada38x_rtc_probe(struct platform_device *pdev)
dev_err(&pdev->dev, "no irq\n"); dev_err(&pdev->dev, "no irq\n");
return rtc->irq; return rtc->irq;
} }
rtc->rtc_dev = devm_rtc_allocate_device(&pdev->dev);
if (IS_ERR(rtc->rtc_dev))
return PTR_ERR(rtc->rtc_dev);
if (devm_request_irq(&pdev->dev, rtc->irq, armada38x_rtc_alarm_irq, if (devm_request_irq(&pdev->dev, rtc->irq, armada38x_rtc_alarm_irq,
0, pdev->name, rtc) < 0) { 0, pdev->name, rtc) < 0) {
dev_warn(&pdev->dev, "Interrupt not available.\n"); dev_warn(&pdev->dev, "Interrupt not available.\n");
@ -560,28 +564,24 @@ static __init int armada38x_rtc_probe(struct platform_device *pdev)
if (rtc->irq != -1) { if (rtc->irq != -1) {
device_init_wakeup(&pdev->dev, 1); device_init_wakeup(&pdev->dev, 1);
ops = &armada38x_rtc_ops; rtc->rtc_dev->ops = &armada38x_rtc_ops;
} else { } else {
/* /*
* If there is no interrupt available then we can't * If there is no interrupt available then we can't
* use the alarm * use the alarm
*/ */
ops = &armada38x_rtc_ops_noirq; rtc->rtc_dev->ops = &armada38x_rtc_ops_noirq;
} }
rtc->data = (struct armada38x_rtc_data *)match->data; rtc->data = (struct armada38x_rtc_data *)match->data;
/* Update RTC-MBUS bridge timing parameters */ /* Update RTC-MBUS bridge timing parameters */
rtc->data->update_mbus_timing(rtc); rtc->data->update_mbus_timing(rtc);
rtc->rtc_dev = devm_rtc_device_register(&pdev->dev, pdev->name, ret = rtc_register_device(rtc->rtc_dev);
ops, THIS_MODULE); if (ret)
if (IS_ERR(rtc->rtc_dev)) {
ret = PTR_ERR(rtc->rtc_dev);
dev_err(&pdev->dev, "Failed to register RTC device: %d\n", ret); dev_err(&pdev->dev, "Failed to register RTC device: %d\n", ret);
return ret;
} return ret;
return 0;
} }
#ifdef CONFIG_PM_SLEEP #ifdef CONFIG_PM_SLEEP