linux-toradex.git/drivers/rtc/class.c, branch v6.3-rc5

rtc: class: Fix potential memleak in devm_rtc_allocate_device()

2022-11-15T20:01:51+00:00

devm_rtc_allocate_device() will alloc a rtc_device first, and then run
dev_set_name(). If dev_set_name() failed, the rtc_device will memleak.
Move devm_add_action_or_reset() in front of dev_set_name() to prevent
memleak.

unreferenced object 0xffff888110a53000 (size 2048):
  comm "python3", pid 470, jiffies 4296078308 (age 58.882s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 08 30 a5 10 81 88 ff ff  .........0......
    08 30 a5 10 81 88 ff ff 00 00 00 00 00 00 00 00  .0..............
  backtrace:
    [<000000004aac0364>] kmalloc_trace+0x21/0x110
    [<000000000ff02202>] devm_rtc_allocate_device+0xd4/0x400
    [<000000001bdf5639>] devm_rtc_device_register+0x1a/0x80
    [<00000000351bf81c>] rx4581_probe+0xdd/0x110 [rtc_rx4581]
    [<00000000f0eba0ae>] spi_probe+0xde/0x130
    [<00000000bff89ee8>] really_probe+0x175/0x3f0
    [<00000000128e8d84>] __driver_probe_device+0xe6/0x170
    [<00000000ee5bf913>] device_driver_attach+0x32/0x80
    [<00000000f3f28f92>] bind_store+0x10b/0x1a0
    [<000000009ff812d8>] drv_attr_store+0x49/0x70
    [<000000008139c323>] sysfs_kf_write+0x8d/0xb0
    [<00000000b6146e01>] kernfs_fop_write_iter+0x214/0x2d0
    [<00000000ecbe3895>] vfs_write+0x61a/0x7d0
    [<00000000aa2196ea>] ksys_write+0xc8/0x190
    [<0000000046a600f5>] do_syscall_64+0x37/0x90
    [<00000000541a336f>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fixes: 24d23181e43d ("rtc: class: check return value when calling dev_set_name()")
Signed-off-by: Shang XiaoJing 
Reviewed-by: Yang Yingliang 
Link: https://lore.kernel.org/r/20221110090810.11225-1-shangxiaojing@huawei.com
Signed-off-by: Alexandre Belloni

rtc: Directly use ida_alloc()/free()

2022-06-24T19:44:53+00:00

Use ida_alloc()/ida_free() instead of deprecated
ida_simple_get()/ida_simple_remove() .

Signed-off-by: keliu 
Signed-off-by: Alexandre Belloni 
Link: https://lore.kernel.org/r/20220527073636.2474546-1-liuke94@huawei.com

rtc: remove uie_unsupported

2022-03-23T18:58:41+00:00

uie_unsupported is not used by any drivers anymore, remove it.

Signed-off-by: Alexandre Belloni 
Link: https://lore.kernel.org/r/20220309162301.61679-29-alexandre.belloni@bootlin.com

rtc: fix use-after-free on device removal

2022-02-15T22:06:19+00:00

If the irqwork is still scheduled or running while the RTC device is
removed, a use-after-free occurs in rtc_timer_do_work().  Cleanup the
timerqueue and ensure the work is stopped to fix this.

 BUG: KASAN: use-after-free in mutex_lock+0x94/0x110
 Write of size 8 at addr ffffff801d846338 by task kworker/3:1/41

 Workqueue: events rtc_timer_do_work
 Call trace:
  mutex_lock+0x94/0x110
  rtc_timer_do_work+0xec/0x630
  process_one_work+0x5fc/0x1344
  ...

 Allocated by task 551:
  kmem_cache_alloc_trace+0x384/0x6e0
  devm_rtc_allocate_device+0xf0/0x574
  devm_rtc_device_register+0x2c/0x12c
  ...

 Freed by task 572:
  kfree+0x114/0x4d0
  rtc_device_release+0x64/0x80
  device_release+0x8c/0x1f4
  kobject_put+0x1c4/0x4b0
  put_device+0x20/0x30
  devm_rtc_release_device+0x1c/0x30
  devm_action_release+0x54/0x90
  release_nodes+0x124/0x310
  devres_release_group+0x170/0x240
  i2c_device_remove+0xd8/0x314
  ...

 Last potentially related work creation:
  insert_work+0x5c/0x330
  queue_work_on+0xcc/0x154
  rtc_set_time+0x188/0x5bc
  rtc_dev_ioctl+0x2ac/0xbd0
  ...

Signed-off-by: Vincent Whitchurch 
Signed-off-by: Alexandre Belloni 
Link: https://lore.kernel.org/r/20211210160951.7718-1-vincent.whitchurch@axis.com

rtc: expose RTC_FEATURE_UPDATE_INTERRUPT

2021-10-18T15:25:52+00:00

Set RTC_FEATURE_UPDATE_INTERRUPT by default and clear it when it is not
supported.

Signed-off-by: Alexandre Belloni 
Link: https://lore.kernel.org/r/20211018152337.78732-1-alexandre.belloni@bootlin.com

rtc: expose correction feature

2021-10-18T15:20:50+00:00

Add a new feature for RTCs able to correct the oscillator imprecision. This
is also called offset or trimming. Such drivers have a .set_offset callback,
use that to set the feature bit from the core.

Signed-off-by: Alexandre Belloni 
Link: https://lore.kernel.org/r/20211018151933.76865-4-alexandre.belloni@bootlin.com

rtc: class: check return value when calling dev_set_name()

2021-10-15T19:06:10+00:00

I got a null-ptr-deref report when doing fault injection test:

BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:strcmp+0xc/0x20
Call Trace:
 __devm_rtc_register_device.cold.7+0x16a/0x2df
 rv3029_probe+0x4b1/0x770 [rtc_rv3029c2]
 rv3029_i2c_probe+0x141/0x180 [rtc_rv3029c2]
 i2c_device_probe+0xa07/0xbb0
 really_probe+0x285/0xc30

If dev_set_name() fails, dev_name() is null, it causes null-ptr-deref,
we need check the return value of dev_set_name().

Reported-by: Hulk Robot 
Signed-off-by: Yang Yingliang 
Signed-off-by: Alexandre Belloni 
Link: https://lore.kernel.org/r/20211012041629.2504158-1-yangyingliang@huawei.com

rtc: class: don't call cdev_device_del() when cdev_device_add() failed

2021-10-15T19:05:33+00:00

I got a null-ptr-deref report when doing fault injection test:

general protection fault, probably for non-canonical address 0xdffffc0000000022: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000110-0x0000000000000117]
RIP: 0010:device_del+0x132/0xdc0
Call Trace:
 cdev_device_del+0x1a/0x80
 devm_rtc_unregister_device+0x37/0x80
 release_nodes+0xc3/0x3b0

If cdev_device_add() fails, 'dev->p' is not set, it causes
null-ptr-deref when calling cdev_device_del(). Registering
character device is optional, we don't return error code
here, so introduce a new flag 'RTC_NO_CDEV' to indicate
if it has character device, cdev_device_del() is called
when this bit is not set.

Reported-by: Hulk Robot 
Signed-off-by: Yang Yingliang 
Signed-off-by: Alexandre Belloni 
Link: https://lore.kernel.org/r/20211011132114.3663509-1-yangyingliang@huawei.com

rtc: class: remove bogus documentation

2021-02-05T23:58:24+00:00

rtc_device_unregister is gone since commit fdcfd854333b ("rtc: rework
rtc_register_device() resource management"). Remove its documentation.

Signed-off-by: Alexandre Belloni 
Link: https://lore.kernel.org/r/20210202112219.3610853-2-alexandre.belloni@bootlin.com

rtc: introduce features bitfield

2021-01-16T22:19:26+00:00

Introduce a bitfield to allow the drivers to announce the available
features for an RTC.

The main use case would be to better handle alarms, that could be present
or not or have a minute resolution or may need a correct week day to be set.

Use the newly introduced RTC_FEATURE_ALARM bit to then test whether alarms
are available instead of relying on the presence of ops->set_alarm.

Signed-off-by: Alexandre Belloni 
Link: https://lore.kernel.org/r/20210110231752.1418816-2-alexandre.belloni@bootlin.com