Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 142513a2 authored by Alexandre Belloni's avatar Alexandre Belloni Committed by Greg Kroah-Hartman
Browse files

rtc: ds1374: fix possible race condition 

[ Upstream commit c11af8131a4e7ba1960faed731ee7e84c2c13c94 ]

The RTC IRQ is requested before the struct rtc_device is allocated,
this may lead to a NULL pointer dereference in the IRQ handler.

To fix this issue, allocating the rtc_device struct before requesting
the RTC IRQ using devm_rtc_allocate_device, and use rtc_register_device
to register the RTC device.

Link: https://lore.kernel.org/r/20200306073404.56921-1-alexandre.belloni@bootlin.com


Signed-off-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent e934a66d

drivers/rtc/rtc-ds1374.c

+9 −6
Original line number Diff line number Diff line
@@ -620,6 +620,10 @@ static int ds1374_probe(struct i2c_client *client, 
	if (!ds1374)

		return -ENOMEM;



	ds1374->rtc = devm_rtc_allocate_device(&client->dev);

	if (IS_ERR(ds1374->rtc))

		return PTR_ERR(ds1374->rtc);



	ds1374->client = client;

	i2c_set_clientdata(client, ds1374);
@@ -641,12 +645,11 @@ static int ds1374_probe(struct i2c_client *client, 
		device_set_wakeup_capable(&client->dev, 1);

	}



	ds1374->rtc = devm_rtc_device_register(&client->dev, client->name,

						&ds1374_rtc_ops, THIS_MODULE);

	if (IS_ERR(ds1374->rtc)) {

		dev_err(&client->dev, "unable to register the class device\n");

		return PTR_ERR(ds1374->rtc);

	}

	ds1374->rtc->ops = &ds1374_rtc_ops;



	ret = rtc_register_device(ds1374->rtc);

	if (ret)

		return ret;



#ifdef CONFIG_RTC_DRV_DS1374_WDT

	save_client = client;