Re: [PATCH] rtc: atcrtc100: drain the alarm work before the RTC device is freed

[sashiko-bot@kernel.org]

> From: Hyunjung Ko <hj351016@gmail.com>
> 
> atcrtc_alarm_isr() schedules atcrtc_dev->rtc_work (atcrtc_alarm_clear),
> whose handler obtains the atcrtc_dev via container_of() and dereferences
> rtc->rtc_dev (guard(rtc_ops)(rtc->rtc_dev)).
> 
> atcrtc_probe() requested the alarm IRQ with devm_request_irq() *before*
> allocating rtc_dev with devm_rtc_allocate_device(), and INIT_WORK()'d
> rtc_work last with no teardown cancel.  Because devres unwinds in reverse
> registration order, on unbind the RTC device is freed before the IRQ, and
> rtc_work is never cancelled at all: an alarm interrupt arriving around
> unbind can run atcrtc_alarm_clear() after rtc->rtc_dev (and the devm
> driver data) have been freed -> use-after-free.
> 
> Allocate the RTC device first, then register rtc_work for device-managed
> cancellation with devm_work_autocancel(), and only then request the IRQ.
> devres now frees the IRQ first (so it can no longer schedule the work),
> then drains the work while rtc_dev is still valid, then frees rtc_dev and
> the driver data.
> 
> Found by code review; not reproduced (requires ATCRTC100 hardware and an
> alarm interrupt racing device unbind).
> 
> Fixes: 7adca706fe16 ("rtc: atcrtc100: Add ATCRTC100 RTC driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunjung Ko <hj351016@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107063711.3388440-1-hj351016@gmail.com?part=1