linux-kernel - RE: [PATCH] rtc: snvs: fix possible race condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AM0PR04MB421167283C950557E231181480C90@AM0PR04MB4211.eurprd04.prod.outlook.com>
Date:   Wed, 17 Jul 2019 10:54:06 +0000
From:   Aisheng Dong <aisheng.dong@....com>
To:     Anson Huang <anson.huang@....com>,
        "a.zummo@...ertech.it" <a.zummo@...ertech.it>,
        "alexandre.belloni@...tlin.com" <alexandre.belloni@...tlin.com>,
        "linux-rtc@...r.kernel.org" <linux-rtc@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:     dl-linux-imx <linux-imx@....com>
Subject: RE: [PATCH] rtc: snvs: fix possible race condition

> From: Anson.Huang@....com <Anson.Huang@....com>
> Sent: Tuesday, July 16, 2019 3:19 PM
> 
> The RTC IRQ is requested before the struct rtc_device is allocated, this may
> lead to a NULL pointer dereference in IRQ handler.
> 
> To fix this issue, allocating the rtc_device struct before requesting the RTC IRQ
> using devm_rtc_allocate_device, and use rtc_register_device to register the
> RTC device.
> 

I saw other rtc drivers did the same way as us, so this looks like a common problem.
My question is if we can clear interrupt status before register to avoid this issue as
other rtc drivers?

Regards
Aisheng

> Signed-off-by: Anson Huang <Anson.Huang@....com>
> ---
>  drivers/rtc/rtc-snvs.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c index
> 7ee673a2..4f9a107 100644
> --- a/drivers/rtc/rtc-snvs.c
> +++ b/drivers/rtc/rtc-snvs.c
> @@ -279,6 +279,10 @@ static int snvs_rtc_probe(struct platform_device
> *pdev)
>  	if (!data)
>  		return -ENOMEM;
> 
> +	data->rtc = devm_rtc_allocate_device(&pdev->dev);
> +	if (IS_ERR(data->rtc))
> +		return PTR_ERR(data->rtc);
> +
>  	data->regmap = syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
> "regmap");
> 
>  	if (IS_ERR(data->regmap)) {
> @@ -343,10 +347,9 @@ static int snvs_rtc_probe(struct platform_device
> *pdev)
>  		goto error_rtc_device_register;
>  	}
> 
> -	data->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
> -					&snvs_rtc_ops, THIS_MODULE);
> -	if (IS_ERR(data->rtc)) {
> -		ret = PTR_ERR(data->rtc);
> +	data->rtc->ops = &snvs_rtc_ops;
> +	ret = rtc_register_device(data->rtc);
> +	if (ret) {
>  		dev_err(&pdev->dev, "failed to register rtc: %d\n", ret);
>  		goto error_rtc_device_register;
>  	}
> --
> 2.7.4