mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-08 10:35:54 -04:00
Code Issues Packages Projects Releases Wiki Activity

rtc: ab-b5ze-s3: fix possible race conditions

Browse Source 
The IRQ is requested before the struct rtc is allocated and registered, but
this struct is used in the IRQ handler. This may lead to a NULL pointer
dereference.

Also, the probe function is not allowed to fail after the RTC is registered
because the following may happen:

CPU0:                                CPU1:
sys_load_module()
 do_init_module()
  do_one_initcall()
   cmos_do_probe()
    rtc_device_register()
     __register_chrdev()
     cdev->owner = struct module*
                                     open("/dev/rtc0")
    rtc_device_unregister()
  module_put()
  free_module()
   module_free(mod->module_core)
   /* struct module *module is now
      freed */
                                      chrdev_open()
                                       spin_lock(cdev_lock)
                                       cdev_get()
                                        try_module_get()
                                         module_is_live()
                                         /* dereferences already
                                            freed struct module* */

Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
before requesting the IRQ and register the RTC as late as possible.

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
This commit is contained in:
Alexandre Belloni
2018-05-17 22:20:39 +02:00
parent 02f3712f1f
commit 8bde032b28
1 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
drivers/rtc/rtc-ab-b5ze-s3.c
View File

@@ -925,6 +925,14 @@ static int abb5zes3_probe(struct i2c_client *client,
if (ret)
goto err;
data->rtc = devm_rtc_allocate_device(dev);
ret = PTR_ERR_OR_ZERO(data->rtc);
if (ret) {
dev_err(dev, "%s: unable to allocate RTC device (%d)\n",
__func__, ret);
goto err;
}
if (client->irq > 0) {
ret = devm_request_threaded_irq(dev, client->irq, NULL,
_abb5zes3_rtc_interrupt,
@@ -942,14 +950,7 @@ static int abb5zes3_probe(struct i2c_client *client,
}
}
data->rtc = devm_rtc_device_register(dev, DRV_NAME, &rtc_ops,
THIS_MODULE);
ret = PTR_ERR_OR_ZERO(data->rtc);
if (ret) {
dev_err(dev, "%s: unable to register RTC device (%d)\n",
__func__, ret);
goto err;
}
data->rtc->ops = &rtc_ops;
/* Enable battery low detection interrupt if battery not already low */
if (!data->battery_low && data->irq) {
@@ -961,6 +962,8 @@ static int abb5zes3_probe(struct i2c_client *client,
}
}
ret = rtc_register_device(data->rtc);
err:
if (ret && data && data->irq)
device_init_wakeup(dev, false);