diff options
| author | Alexandre Belloni <alexandre.belloni@bootlin.com> | 2018-09-09 22:48:58 +0200 |
|---|---|---|
| committer | Lee Jones <lee.jones@linaro.org> | 2018-09-11 16:40:21 +0100 |
| commit | 9612f8f503804d2fd2f63aa6ba1e58bba4612d96 (patch) | |
| tree | 2e5fa8e95045ecc72252dbe21a67c4837b6bfc82 /drivers/mfd | |
| parent | 5b394b2ddf0347bef56e50c69a58773c94343ff3 (diff) | |
| download | linux-9612f8f503804d2fd2f63aa6ba1e58bba4612d96.tar.gz linux-9612f8f503804d2fd2f63aa6ba1e58bba4612d96.tar.bz2 linux-9612f8f503804d2fd2f63aa6ba1e58bba4612d96.zip | |
mfd: menelaus: Fix possible race condition and leak
The IRQ work is added before the struct rtc is allocated and registered,
but this struct is used in the IRQ handler. This may lead to a NULL pointer
dereference.
Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
before calling menelaus_add_irq_work.
Also, this solves a possible leak as the RTC is never released.
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Diffstat (limited to 'drivers/mfd')
| -rw-r--r-- | drivers/mfd/menelaus.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/drivers/mfd/menelaus.c b/drivers/mfd/menelaus.c index 29b7164a823b..d28ebe7ecd21 100644 --- a/drivers/mfd/menelaus.c +++ b/drivers/mfd/menelaus.c @@ -1094,6 +1094,7 @@ static void menelaus_rtc_alarm_work(struct menelaus_chip *m) static inline void menelaus_rtc_init(struct menelaus_chip *m) { int alarm = (m->client->irq > 0); + int err; /* assume 32KDETEN pin is pulled high */ if (!(menelaus_read_reg(MENELAUS_OSC_CTRL) & 0x80)) { @@ -1101,6 +1102,12 @@ static inline void menelaus_rtc_init(struct menelaus_chip *m) return; } + m->rtc = devm_rtc_allocate_device(&m->client->dev); + if (IS_ERR(m->rtc)) + return; + + m->rtc->ops = &menelaus_rtc_ops; + /* support RTC alarm; it can issue wakeups */ if (alarm) { if (menelaus_add_irq_work(MENELAUS_RTCALM_IRQ, @@ -1125,10 +1132,8 @@ static inline void menelaus_rtc_init(struct menelaus_chip *m) menelaus_write_reg(MENELAUS_RTC_CTRL, m->rtc_control); } - m->rtc = rtc_device_register(DRIVER_NAME, - &m->client->dev, - &menelaus_rtc_ops, THIS_MODULE); - if (IS_ERR(m->rtc)) { + err = rtc_register_device(m->rtc); + if (err) { if (alarm) { menelaus_remove_irq_work(MENELAUS_RTCALM_IRQ); device_init_wakeup(&m->client->dev, 0); |