> > > > rtc_cmos 00:02: rtc core: registered rtc_cmos as rtc0
> > > > Unable to handle kernel NULL pointer dereference at 0000000000000030 RIP:
> > > > [<ffffffff804032c3>] rtc_sysfs_remove_device+0x23/0x50
The bug isn't in rtc_cmos, but that's the only driver that would currently
show the bug. (Triggered by finding the IRQ claimed by the legacy driver,
result of a "but it should still be safe!" misconfiguration.)
The following fixes this on my 2.6.21-rc1 system; same fix should apply
to MM2.
===================== CUT HERE
Fix an oops on the rtc_device_unregister() path by waiting until the
last moment before nulling the rtc->ops vector. Fix some potential
oopses by having the rtc_class_open()/rtc_class_close() interface
increase the RTC's reference count while an RTC handle is available
outside the RTC framework.
Signed-off-by: David Brownell <[email protected]>
Index: g26/drivers/rtc/class.c
===================================================================
--- g26.orig/drivers/rtc/class.c 2007-02-21 12:03:20.000000000 -0800
+++ g26/drivers/rtc/class.c 2007-02-23 08:00:52.000000000 -0800
@@ -204,10 +204,16 @@ EXPORT_SYMBOL_GPL(rtc_device_register);
*/
void rtc_device_unregister(struct rtc_device *rtc)
{
- mutex_lock(&rtc->ops_lock);
- rtc->ops = NULL;
- mutex_unlock(&rtc->ops_lock);
- class_device_unregister(&rtc->class_dev);
+ if (class_device_get(&rtc->class_dev) != NULL) {
+ mutex_lock(&rtc->ops_lock);
+ /* remove innards of this RTC, then disable it, before
+ * letting any rtc_class_open() users access it again
+ */
+ class_device_unregister(&rtc->class_dev);
+ rtc->ops = NULL;
+ mutex_unlock(&rtc->ops_lock);
+ class_device_put(&rtc->class_dev);
+ }
}
EXPORT_SYMBOL_GPL(rtc_device_unregister);
Index: g26/drivers/rtc/interface.c
===================================================================
--- g26.orig/drivers/rtc/interface.c 2006-11-27 15:37:13.000000000 -0800
+++ g26/drivers/rtc/interface.c 2007-02-23 07:45:09.000000000 -0800
@@ -179,7 +179,7 @@ struct class_device *rtc_class_open(char
down(&rtc_class->sem);
list_for_each_entry(class_dev_tmp, &rtc_class->children, node) {
if (strncmp(class_dev_tmp->class_id, name, BUS_ID_SIZE) == 0) {
- class_dev = class_dev_tmp;
+ class_dev = class_device_get(class_dev_tmp);
break;
}
}
@@ -197,6 +197,7 @@ EXPORT_SYMBOL_GPL(rtc_class_open);
void rtc_class_close(struct class_device *class_dev)
{
module_put(to_rtc_device(class_dev)->owner);
+ class_device_put(class_dev);
}
EXPORT_SYMBOL_GPL(rtc_class_close);
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
