From ebc2ec4ecf1893b9afaecc59fbd04b2bdf34f7c2 Mon Sep 17 00:00:00 2001 From: Alexandre Belloni Date: Tue, 16 Apr 2019 10:30:43 +0200 Subject: [PATCH] rtc: mxc: fix possible race condition The IRQ is requested before the struct rtc is allocated and registered, but this struct is used in the IRQ handler. This may lead to a NULL pointer dereference. Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc struct before requesting the IRQ. Signed-off-by: Alexandre Belloni --- drivers/rtc/rtc-mxc.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/rtc/rtc-mxc.c b/drivers/rtc/rtc-mxc.c index 708b9e9b86a6..d9a038afedf0 100644 --- a/drivers/rtc/rtc-mxc.c +++ b/drivers/rtc/rtc-mxc.c @@ -340,6 +340,13 @@ static int mxc_rtc_probe(struct platform_device *pdev) if (IS_ERR(pdata->ioaddr)) return PTR_ERR(pdata->ioaddr); + rtc = devm_rtc_allocate_device(&pdev->dev); + if (IS_ERR(rtc)) + return PTR_ERR(rtc); + + pdata->rtc = rtc; + rtc->ops = &mxc_rtc_ops; + pdata->clk_ipg = devm_clk_get(&pdev->dev, "ipg"); if (IS_ERR(pdata->clk_ipg)) { dev_err(&pdev->dev, "unable to get ipg clock!\n"); @@ -402,14 +409,9 @@ static int mxc_rtc_probe(struct platform_device *pdev) dev_err(&pdev->dev, "failed to enable irq wake\n"); } - rtc = devm_rtc_device_register(&pdev->dev, pdev->name, &mxc_rtc_ops, - THIS_MODULE); - if (IS_ERR(rtc)) { - ret = PTR_ERR(rtc); + ret = rtc_register_device(rtc); + if (ret) goto exit_put_clk_ref; - } - - pdata->rtc = rtc; return 0;