[PATCH] rtc_cmos oops fix

Fix an oops on the rtc_device_unregister() path by waiting until the last
moment before nulling the rtc->ops vector.  Fix some potential oopses by
having the rtc_class_open()/rtc_class_close() interface increase the RTC's
reference count while an RTC handle is available outside the RTC framework.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index 7a0d8ee2de9c9aa95f973b86dec3d5955d348798..04aaa634723467ac90cbd8bd4d41419bdfc89647 100644 (file)
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -113,10 +113,16 @@ EXPORT_SYMBOL_GPL(rtc_device_register);
  */
 void rtc_device_unregister(struct rtc_device *rtc)
 {
-       mutex_lock(&rtc->ops_lock);
-       rtc->ops = NULL;
-       mutex_unlock(&rtc->ops_lock);
-       class_device_unregister(&rtc->class_dev);
+       if (class_device_get(&rtc->class_dev) != NULL) {
+               mutex_lock(&rtc->ops_lock);
+               /* remove innards of this RTC, then disable it, before
+                * letting any rtc_class_open() users access it again
+                */
+               class_device_unregister(&rtc->class_dev);
+               rtc->ops = NULL;
+               mutex_unlock(&rtc->ops_lock);
+               class_device_put(&rtc->class_dev);
+       }
 }
 EXPORT_SYMBOL_GPL(rtc_device_unregister);
 

diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 6f11f6dfdd9dccc699b5a1a958132d55dec5daa6..ef40df0f169d2a1039ddca745f586dd122731afa 100644 (file)
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -179,7 +179,7 @@ struct class_device *rtc_class_open(char *name)
        down(&rtc_class->sem);
        list_for_each_entry(class_dev_tmp, &rtc_class->children, node) {
                if (strncmp(class_dev_tmp->class_id, name, BUS_ID_SIZE) == 0) {
-                       class_dev = class_dev_tmp;
+                       class_dev = class_device_get(class_dev_tmp);
                        break;
                }
        }
@@ -197,6 +197,7 @@ EXPORT_SYMBOL_GPL(rtc_class_open);
 void rtc_class_close(struct class_device *class_dev)
 {
        module_put(to_rtc_device(class_dev)->owner);
+       class_device_put(class_dev);
 }
 EXPORT_SYMBOL_GPL(rtc_class_close);