]> git.baikalelectronics.ru Git - kernel.git/commit
rtc: class: don't call cdev_device_del() when cdev_device_add() failed
authorYang Yingliang <yangyingliang@huawei.com>
Mon, 11 Oct 2021 13:21:14 +0000 (21:21 +0800)
committerAlexandre Belloni <alexandre.belloni@bootlin.com>
Fri, 15 Oct 2021 19:05:33 +0000 (21:05 +0200)
commitf8785adec5b0e61b34ce2844aa9973a0d628867b
tree65076af5708f1c12ef9eb2926237bb62ee30800b
parentfe6563a9c93adba34490d28447ec3d18e7c390cd
rtc: class: don't call cdev_device_del() when cdev_device_add() failed

I got a null-ptr-deref report when doing fault injection test:

general protection fault, probably for non-canonical address 0xdffffc0000000022: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000110-0x0000000000000117]
RIP: 0010:device_del+0x132/0xdc0
Call Trace:
 cdev_device_del+0x1a/0x80
 devm_rtc_unregister_device+0x37/0x80
 release_nodes+0xc3/0x3b0

If cdev_device_add() fails, 'dev->p' is not set, it causes
null-ptr-deref when calling cdev_device_del(). Registering
character device is optional, we don't return error code
here, so introduce a new flag 'RTC_NO_CDEV' to indicate
if it has character device, cdev_device_del() is called
when this bit is not set.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20211011132114.3663509-1-yangyingliang@huawei.com
drivers/rtc/class.c
include/linux/rtc.h