Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

rtc: digicolor: fix possible race condition

The IRQ is requested before the struct rtc is allocated and registered, but
this struct is used in the IRQ handler. This may lead to a NULL pointer
dereference.

Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
struct before requesting the IRQ.

Acked-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

+7 -5
+7 -5
drivers/rtc/rtc-digicolor.c
··· 192 192 if (IS_ERR(rtc->regs)) 193 193 return PTR_ERR(rtc->regs); 194 194 195 + rtc->rtc_dev = devm_rtc_allocate_device(&pdev->dev); 196 + if (IS_ERR(rtc->rtc_dev)) 197 + return PTR_ERR(rtc->rtc_dev); 198 + 195 199 irq = platform_get_irq(pdev, 0); 196 200 if (irq < 0) 197 201 return irq; ··· 204 200 return ret; 205 201 206 202 platform_set_drvdata(pdev, rtc); 207 - rtc->rtc_dev = devm_rtc_device_register(&pdev->dev, pdev->name, 208 - &dc_rtc_ops, THIS_MODULE); 209 - if (IS_ERR(rtc->rtc_dev)) 210 - return PTR_ERR(rtc->rtc_dev); 211 203 212 - return 0; 204 + rtc->rtc_dev->ops = &dc_rtc_ops; 205 + 206 + return rtc_register_device(rtc->rtc_dev); 213 207 } 214 208 215 209 static const struct of_device_id dc_dt_ids[] = {