diff options
| author | Alexandre Belloni <alexandre.belloni@bootlin.com> | 2019-03-20 12:30:09 +0100 |
|---|---|---|
| committer | Alexandre Belloni <alexandre.belloni@bootlin.com> | 2019-04-04 10:07:09 +0200 |
| commit | 1097998d27da39578542e79ff865b4d74e755cd0 (patch) | |
| tree | dbaf06cbb95fd81e353363c4a45c3bd8bb50f9c5 /drivers/rtc/rtc-sh.c | |
| parent | rtc: sh: stop resetting time to epoch (diff) | |
| download | linux-1097998d27da39578542e79ff865b4d74e755cd0.tar.xz linux-1097998d27da39578542e79ff865b4d74e755cd0.zip | |
rtc: sh: fix possible race condition
The IRQ is requested before the struct rtc is allocated and registered, but
this struct is used in the IRQ handler. This may lead to a NULL pointer
dereference.
Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
struct before requesting the IRQ.
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Diffstat (limited to 'drivers/rtc/rtc-sh.c')
| -rw-r--r-- | drivers/rtc/rtc-sh.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c index 7fffe6da9478..d9e67ca4b7b9 100644 --- a/drivers/rtc/rtc-sh.c +++ b/drivers/rtc/rtc-sh.c @@ -530,6 +530,10 @@ static int __init sh_rtc_probe(struct platform_device *pdev) rtc->clk = NULL; } + rtc->rtc_dev = devm_rtc_allocate_device(&pdev->dev); + if (IS_ERR(rtc->rtc_dev)) + return PTR_ERR(rtc->rtc_dev); + clk_enable(rtc->clk); rtc->capabilities = RTC_DEF_CAPABILITIES; @@ -593,15 +597,13 @@ static int __init sh_rtc_probe(struct platform_device *pdev) sh_rtc_setaie(&pdev->dev, 0); sh_rtc_setcie(&pdev->dev, 0); - rtc->rtc_dev = devm_rtc_device_register(&pdev->dev, "sh", - &sh_rtc_ops, THIS_MODULE); - if (IS_ERR(rtc->rtc_dev)) { - ret = PTR_ERR(rtc->rtc_dev); - goto err_unmap; - } - + rtc->rtc_dev->ops = &sh_rtc_ops; rtc->rtc_dev->max_user_freq = 256; + ret = rtc_register_device(rtc->rtc_dev); + if (ret) + goto err_unmap; + device_init_wakeup(&pdev->dev, 1); return 0; |