ce788f930b
alarmtimer_late_init() uses class_find_device() to find a alarm capable rtc device. The match callback stores a pointer to the name in the char pointer handed in from the call site. alarmtimer_late_init() checks the char pointer for NULL, but the pointer is on the stack and not initialized to NULL before the call. So it can have random content when the match function did not identify a device, which leads to random access in the following rtc_open() call where the pointer is dereferenced Instead of relying on the char pointer, check the return value of class_find_device. If a device is found then the name pointer is valid as well. Reported-by: Ingo Molnar <mingo@elte.hu> Cc: John Stultz <john.stultz@linaro.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> |
||
|---|---|---|
| .. | ||
| alarmtimer.c | ||
| clockevents.c | ||
| clocksource.c | ||
| jiffies.c | ||
| Kconfig | ||
| Makefile | ||
| ntp.c | ||
| posix-clock.c | ||
| tick-broadcast.c | ||
| tick-common.c | ||
| tick-internal.h | ||
| tick-oneshot.c | ||
| tick-sched.c | ||
| timecompare.c | ||
| timeconv.c | ||
| timekeeping.c | ||
| timer_list.c | ||
| timer_stats.c | ||