rtc: sa1100: fix possible race condition
[ Upstream commit f2997775b1
]
Both RTC IRQs are requested before the struct rtc_device is allocated,
this may lead to a NULL pointer dereference in the IRQ handler.
To fix this issue, allocating the rtc_device struct before requesting
the IRQs using devm_rtc_allocate_device, and use rtc_register_device
to register the RTC device.
Link: https://lore.kernel.org/r/20200306010146.39762-1-alexandre.belloni@bootlin.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
22de4a5d57
commit
45c1212d91
|
@ -182,7 +182,6 @@ static const struct rtc_class_ops sa1100_rtc_ops = {
|
||||||
|
|
||||||
int sa1100_rtc_init(struct platform_device *pdev, struct sa1100_rtc *info)
|
int sa1100_rtc_init(struct platform_device *pdev, struct sa1100_rtc *info)
|
||||||
{
|
{
|
||||||
struct rtc_device *rtc;
|
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
spin_lock_init(&info->lock);
|
spin_lock_init(&info->lock);
|
||||||
|
@ -211,15 +210,14 @@ int sa1100_rtc_init(struct platform_device *pdev, struct sa1100_rtc *info)
|
||||||
writel_relaxed(0, info->rcnr);
|
writel_relaxed(0, info->rcnr);
|
||||||
}
|
}
|
||||||
|
|
||||||
rtc = devm_rtc_device_register(&pdev->dev, pdev->name, &sa1100_rtc_ops,
|
info->rtc->ops = &sa1100_rtc_ops;
|
||||||
THIS_MODULE);
|
info->rtc->max_user_freq = RTC_FREQ;
|
||||||
if (IS_ERR(rtc)) {
|
|
||||||
clk_disable_unprepare(info->clk);
|
|
||||||
return PTR_ERR(rtc);
|
|
||||||
}
|
|
||||||
info->rtc = rtc;
|
|
||||||
|
|
||||||
rtc->max_user_freq = RTC_FREQ;
|
ret = rtc_register_device(info->rtc);
|
||||||
|
if (ret) {
|
||||||
|
clk_disable_unprepare(info->clk);
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
/* Fix for a nasty initialization problem the in SA11xx RTSR register.
|
/* Fix for a nasty initialization problem the in SA11xx RTSR register.
|
||||||
* See also the comments in sa1100_rtc_interrupt().
|
* See also the comments in sa1100_rtc_interrupt().
|
||||||
|
@ -268,6 +266,10 @@ static int sa1100_rtc_probe(struct platform_device *pdev)
|
||||||
info->irq_1hz = irq_1hz;
|
info->irq_1hz = irq_1hz;
|
||||||
info->irq_alarm = irq_alarm;
|
info->irq_alarm = irq_alarm;
|
||||||
|
|
||||||
|
info->rtc = devm_rtc_allocate_device(&pdev->dev);
|
||||||
|
if (IS_ERR(info->rtc))
|
||||||
|
return PTR_ERR(info->rtc);
|
||||||
|
|
||||||
ret = devm_request_irq(&pdev->dev, irq_1hz, sa1100_rtc_interrupt, 0,
|
ret = devm_request_irq(&pdev->dev, irq_1hz, sa1100_rtc_interrupt, 0,
|
||||||
"rtc 1Hz", &pdev->dev);
|
"rtc 1Hz", &pdev->dev);
|
||||||
if (ret) {
|
if (ret) {
|
||||||
|
|
Loading…
Reference in New Issue