Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d482510f authored by Alexandre Belloni's avatar Alexandre Belloni
Browse files

rtc: st-lpc: fix possible race condition 



The IRQ is requested before the struct rtc is allocated and registered, but
this struct is used in the IRQ handler. This may lead to a NULL pointer
dereference.

Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
before requesting the IRQ.

Acked-by: default avatarPatrice Chotard <patrice.chotard@st.com>
Signed-off-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
parent b72252b6

drivers/rtc/rtc-st-lpc.c

+9 −15
Original line number Diff line number Diff line
@@ -212,6 +212,10 @@ static int st_rtc_probe(struct platform_device *pdev) 
	if (!rtc)

		return -ENOMEM;



	rtc->rtc_dev = devm_rtc_allocate_device(&pdev->dev);

	if (IS_ERR(rtc->rtc_dev))

		return PTR_ERR(rtc->rtc_dev);



	spin_lock_init(&rtc->lock);



	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -253,23 +257,14 @@ static int st_rtc_probe(struct platform_device *pdev) 


	platform_set_drvdata(pdev, rtc);



	rtc->rtc_dev = rtc_device_register("st-lpc-rtc", &pdev->dev,

					   &st_rtc_ops, THIS_MODULE);

	if (IS_ERR(rtc->rtc_dev)) {

		clk_disable_unprepare(rtc->clk);

		return PTR_ERR(rtc->rtc_dev);

	}

	rtc->rtc_dev->ops = &st_rtc_ops;



	return 0;

	ret = rtc_register_device(rtc->rtc_dev);

	if (ret) {

		clk_disable_unprepare(rtc->clk);

		return ret;

	}



static int st_rtc_remove(struct platform_device *pdev)

{

	struct st_rtc *rtc = platform_get_drvdata(pdev);



	if (likely(rtc->rtc_dev))

		rtc_device_unregister(rtc->rtc_dev);



	return 0;

}
@@ -325,7 +320,6 @@ static struct platform_driver st_rtc_platform_driver = { 
		.of_match_table = st_rtc_match,

	},

	.probe = st_rtc_probe,

	.remove = st_rtc_remove,

};



module_platform_driver(st_rtc_platform_driver);