* [PATCH] rtc: fix RTC removal
@ 2020-12-05 23:14 Alexandre Belloni
2020-12-07 9:51 ` Bartosz Golaszewski
0 siblings, 1 reply; 2+ messages in thread
From: Alexandre Belloni @ 2020-12-05 23:14 UTC (permalink / raw)
To: Alessandro Zummo, Alexandre Belloni, Bartosz Golaszewski
Cc: linux-rtc, linux-kernel
Since the rtc_register_device, removing an RTC device will end with a
refcount_t: underflow; use-after-free warning since put_device is called
twice in the device tear down path.
Fixes: fdcfd854333b ("rtc: rework rtc_register_device() resource management")
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
---
drivers/rtc/class.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index e6b44b7c4ad3..5c6748dfa55d 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -335,7 +335,6 @@ static void devm_rtc_unregister_device(void *data)
cdev_device_del(&rtc->char_dev, &rtc->dev);
rtc->ops = NULL;
mutex_unlock(&rtc->ops_lock);
- put_device(&rtc->dev);
}
static void devm_rtc_release_device(void *res)
--
2.28.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] rtc: fix RTC removal
2020-12-05 23:14 [PATCH] rtc: fix RTC removal Alexandre Belloni
@ 2020-12-07 9:51 ` Bartosz Golaszewski
0 siblings, 0 replies; 2+ messages in thread
From: Bartosz Golaszewski @ 2020-12-07 9:51 UTC (permalink / raw)
To: Alexandre Belloni; +Cc: Alessandro Zummo, linux-rtc, LKML
On Sun, Dec 6, 2020 at 12:14 AM Alexandre Belloni
<alexandre.belloni@bootlin.com> wrote:
>
> Since the rtc_register_device, removing an RTC device will end with a
> refcount_t: underflow; use-after-free warning since put_device is called
> twice in the device tear down path.
>
> Fixes: fdcfd854333b ("rtc: rework rtc_register_device() resource management")
> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
> ---
> drivers/rtc/class.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
> index e6b44b7c4ad3..5c6748dfa55d 100644
> --- a/drivers/rtc/class.c
> +++ b/drivers/rtc/class.c
> @@ -335,7 +335,6 @@ static void devm_rtc_unregister_device(void *data)
> cdev_device_del(&rtc->char_dev, &rtc->dev);
> rtc->ops = NULL;
> mutex_unlock(&rtc->ops_lock);
> - put_device(&rtc->dev);
> }
>
> static void devm_rtc_release_device(void *res)
> --
> 2.28.0
>
Eek! Thanks for fixing that.
Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-12-07 9:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-05 23:14 [PATCH] rtc: fix RTC removal Alexandre Belloni
2020-12-07 9:51 ` Bartosz Golaszewski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).