github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

rtc: ftrtc010: use devm clock APIs to fix use-after-disable in remove

Browse Source 
The driver mixes devm_rtc_register_device() with manual clock
disabling in ftrtc010_rtc_remove(). Because the RTC device was
registered via devm, it remains registered until devres cleanup
runs after .remove() returns. An unprivileged process holding an
open /dev/rtc0 file descriptor could issue ioctl(RTC_RD_TIME)
during this window, triggering MMIO reads on clock-gated hardware
and causing a synchronous external abort.

Replace devm_clk_get() + clk_prepare_enable() with
devm_clk_get_enabled() to tie clock lifecycle to devres. Remove
the manual .remove() callback and the corresponding error handling
labels in ftrtc010_rtc_probe().

Fixes: 1d61d2592c ("rtc: ftrtc010: Rename to Faraday FTRTC010")
Assisted-by: Sashiko AI [static analysis]
Signed-off-by: Liu Dalin <liudalin@kylinsec.com.cn>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Tested-by: Liu Dalin <liudalin@kylinsec.com.cn>
Link: https://patch.msgid.link/0238203A74C9B9F6+20260827080320.3351155-3-liudalin@kylinsec.com.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
This commit is contained in:
Liu Dalin 2026-08-27 16:03:19 +08:00 committed by Alexandre Belloni
parent c60478875a
commit d41ee317c9
1 changed files with 16 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
drivers/rtc/rtc-ftrtc010.c
View File

@ -119,51 +119,33 @@ static int ftrtc010_rtc_probe(struct platform_device *pdev)
return -ENOMEM;
platform_set_drvdata(pdev, rtc);
rtc->pclk = devm_clk_get(dev, "PCLK");
if (IS_ERR(rtc->pclk)) {
rtc->pclk = devm_clk_get_enabled(dev, "PCLK");
if (IS_ERR_OR_NULL(rtc->pclk)) {
dev_err(dev, "could not get PCLK\n");
} else {
ret = clk_prepare_enable(rtc->pclk);
if (ret) {
dev_err(dev, "failed to enable PCLK\n");
return ret;
}
return PTR_ERR_OR_ZERO(rtc->pclk);
}
rtc->extclk = devm_clk_get(dev, "EXTCLK");
if (IS_ERR(rtc->extclk)) {
rtc->extclk = devm_clk_get_enabled(dev, "EXTCLK");
if (IS_ERR_OR_NULL(rtc->extclk)) {
dev_err(dev, "could not get EXTCLK\n");
} else {
ret = clk_prepare_enable(rtc->extclk);
if (ret) {
dev_err(dev, "failed to enable EXTCLK\n");
goto err_disable_pclk;
}
return PTR_ERR_OR_ZERO(rtc->extclk);
}
rtc->rtc_irq = platform_get_irq(pdev, 0);
if (rtc->rtc_irq < 0) {
ret = rtc->rtc_irq;
goto err_disable_extclk;
}
if (rtc->rtc_irq < 0)
return rtc->rtc_irq;
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!res) {
ret = -ENODEV;
goto err_disable_extclk;
}
if (!res)
return -ENODEV;
rtc->rtc_base = devm_ioremap(dev, res->start,
resource_size(res));
if (!rtc->rtc_base) {
ret = -ENOMEM;
goto err_disable_extclk;
}
if (!rtc->rtc_base)
return -ENOMEM;
rtc_dev = devm_rtc_allocate_device(dev);
if (IS_ERR(rtc_dev)) {
ret = PTR_ERR(rtc_dev);
goto err_disable_extclk;
}
if (IS_ERR(rtc_dev))
return PTR_ERR(rtc_dev);
rtc_dev->ops = &ftrtc010_rtc_ops;
@ -178,29 +160,13 @@ static int ftrtc010_rtc_probe(struct platform_device *pdev)
ret = devm_request_irq(dev, rtc->rtc_irq, ftrtc010_rtc_interrupt,
IRQF_SHARED, pdev->name, dev);
if (unlikely(ret))
goto err_disable_extclk;
return ret;
ret = devm_rtc_register_device(rtc_dev);
if (ret)
goto err_disable_extclk;
return ret;
return 0;
err_disable_extclk:
clk_disable_unprepare(rtc->extclk);
err_disable_pclk:
clk_disable_unprepare(rtc->pclk);
return ret;
}
static void ftrtc010_rtc_remove(struct platform_device *pdev)
{
struct ftrtc010_rtc *rtc = platform_get_drvdata(pdev);
if (!IS_ERR(rtc->extclk))
clk_disable_unprepare(rtc->extclk);
if (!IS_ERR(rtc->pclk))
clk_disable_unprepare(rtc->pclk);
}
static const struct of_device_id ftrtc010_rtc_dt_match[] = {
@ -216,7 +182,6 @@ static struct platform_driver ftrtc010_rtc_driver = {
.of_match_table = ftrtc010_rtc_dt_match,
},
.probe = ftrtc010_rtc_probe,
.remove = ftrtc010_rtc_remove,
};
module_platform_driver_probe(ftrtc010_rtc_driver, ftrtc010_rtc_probe);