1. 05 5月, 2011 1 次提交
  2. 04 5月, 2011 2 次提交
    • T
      alarmtimer: Drop device refcount after rtc_open() · 179eb032
      Thomas Gleixner 提交于
      class_find_device() takes a refcount on the rtc device. rtc_open()
      takes another one, so we can drop it after the rtc_open() call.
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      Cc: John Stultz <john.stultz@linaro.org>
      179eb032
    • T
      alarmtimer: Check return value of class_find_device() · ce788f93
      Thomas Gleixner 提交于
      alarmtimer_late_init() uses class_find_device() to find a alarm
      capable rtc device. The match callback stores a pointer to the name in
      the char pointer handed in from the call site. alarmtimer_late_init()
      checks the char pointer for NULL, but the pointer is on the stack and
      not initialized to NULL before the call. So it can have random content
      when the match function did not identify a device, which leads to
      random access in the following rtc_open() call where the pointer is
      dereferenced
      
      Instead of relying on the char pointer, check the return value of
      class_find_device. If a device is found then the name pointer is valid
      as well.
      Reported-by: NIngo Molnar <mingo@elte.hu>
      Cc: John Stultz <john.stultz@linaro.org>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      ce788f93
  3. 03 5月, 2011 7 次提交
  4. 02 5月, 2011 9 次提交
  5. 01 5月, 2011 1 次提交
  6. 30 4月, 2011 6 次提交
  7. 29 4月, 2011 14 次提交