mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-24 01:09:38 -05:00
Code Activity

rtc: mt6397: fix possible race condition

Browse source 
The IRQ is requested before the struct rtc is allocated and registered, but
this struct is used in the IRQ handler. This may lead to a NULL pointer
dereference.

Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
before requesting the IRQ.

Acked-by: Eddie Huang <eddie.huang@mediatek.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
This commit is contained in:
Alexandre Belloni 2018-09-09 22:38:46 +02:00
parent 05a0a34418
commit babab2f864
1 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/rtc/rtc-mt6397.c
View file

@ -332,6 +332,10 @@ static int mtk_rtc_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, rtc); platform_set_drvdata(pdev, rtc);
rtc->rtc_dev = devm_rtc_allocate_device(rtc->dev);
if (IS_ERR(rtc->rtc_dev))
return PTR_ERR(rtc->rtc_dev);
ret = request_threaded_irq(rtc->irq, NULL, ret = request_threaded_irq(rtc->irq, NULL,
mtk_rtc_irq_handler_thread, mtk_rtc_irq_handler_thread,
IRQF_ONESHOT | IRQF_TRIGGER_HIGH, IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
@ -344,11 +348,11 @@ static int mtk_rtc_probe(struct platform_device *pdev)
device_init_wakeup(&pdev->dev, 1); device_init_wakeup(&pdev->dev, 1);
rtc->rtc_dev = rtc_device_register("mt6397-rtc", &pdev->dev, rtc->rtc_dev->ops = &mtk_rtc_ops;
&mtk_rtc_ops, THIS_MODULE);
if (IS_ERR(rtc->rtc_dev)) { ret = rtc_register_device(rtc->rtc_dev);
if (ret) {
dev_err(&pdev->dev, "register rtc device failed\n"); dev_err(&pdev->dev, "register rtc device failed\n");
ret = PTR_ERR(rtc->rtc_dev);
goto out_free_irq; goto out_free_irq;
} }
@ -365,7 +369,6 @@ static int mtk_rtc_remove(struct platform_device *pdev)
{ {
struct mt6397_rtc *rtc = platform_get_drvdata(pdev); struct mt6397_rtc *rtc = platform_get_drvdata(pdev);
rtc_device_unregister(rtc->rtc_dev);
free_irq(rtc->irq, rtc->rtc_dev); free_irq(rtc->irq, rtc->rtc_dev);
irq_dispose_mapping(rtc->irq); irq_dispose_mapping(rtc->irq);