• T
    alarmtimer: Check return value of class_find_device() · ce788f93
    Thomas Gleixner 提交于
    alarmtimer_late_init() uses class_find_device() to find a alarm
    capable rtc device. The match callback stores a pointer to the name in
    the char pointer handed in from the call site. alarmtimer_late_init()
    checks the char pointer for NULL, but the pointer is on the stack and
    not initialized to NULL before the call. So it can have random content
    when the match function did not identify a device, which leads to
    random access in the following rtc_open() call where the pointer is
    dereferenced
    
    Instead of relying on the char pointer, check the return value of
    class_find_device. If a device is found then the name pointer is valid
    as well.
    Reported-by: NIngo Molnar <mingo@elte.hu>
    Cc: John Stultz <john.stultz@linaro.org>
    Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
    ce788f93
alarmtimer.c 17.4 KB