rtc: sa1100: fix possible race condition

Both RTC IRQs are requested before the struct rtc_device is allocated,
this may lead to a NULL pointer dereference in the IRQ handler.

To fix this issue, allocating the rtc_device struct before requesting
the IRQs using devm_rtc_allocate_device, and use rtc_register_device
to register the RTC device.

Link: https://lore.kernel.org/r/20200306010146.39762-1-alexandre.belloni@bootlin.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

diff --git a/drivers/rtc/rtc-sa1100.c b/drivers/rtc/rtc-sa1100.c
index d37893f6eaee9af280fc9e49cc0f57098f7788b1..97c352594033b214f03c10c9a2d4839d97691e0f 100644 (file)
--- a/drivers/rtc/rtc-sa1100.c
+++ b/drivers/rtc/rtc-sa1100.c
@@ -182,7 +182,6 @@ static const struct rtc_class_ops sa1100_rtc_ops = {
 
 int sa1100_rtc_init(struct platform_device *pdev, struct sa1100_rtc *info)
 {
-       struct rtc_device *rtc;
        int ret;
 
        spin_lock_init(&info->lock);
@@ -211,15 +210,14 @@ int sa1100_rtc_init(struct platform_device *pdev, struct sa1100_rtc *info)
                writel_relaxed(0, info->rcnr);
        }
 
-       rtc = devm_rtc_device_register(&pdev->dev, pdev->name, &sa1100_rtc_ops,
-                                       THIS_MODULE);
-       if (IS_ERR(rtc)) {
+       info->rtc->ops = &sa1100_rtc_ops;
+       info->rtc->max_user_freq = RTC_FREQ;
+
+       ret = rtc_register_device(info->rtc);
+       if (ret) {
                clk_disable_unprepare(info->clk);
-               return PTR_ERR(rtc);
+               return ret;
        }
-       info->rtc = rtc;
-
-       rtc->max_user_freq = RTC_FREQ;
 
        /* Fix for a nasty initialization problem the in SA11xx RTSR register.
         * See also the comments in sa1100_rtc_interrupt().
@@ -267,6 +265,10 @@ static int sa1100_rtc_probe(struct platform_device *pdev)
        info->irq_1hz = irq_1hz;
        info->irq_alarm = irq_alarm;
 
+       info->rtc = devm_rtc_allocate_device(&pdev->dev);
+       if (IS_ERR(info->rtc))
+               return PTR_ERR(info->rtc);
+
        ret = devm_request_irq(&pdev->dev, irq_1hz, sa1100_rtc_interrupt, 0,
                               "rtc 1Hz", &pdev->dev);
        if (ret) {