1 files changed, 40 insertions, 19 deletions

diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index df68618f6db..a86f3013747 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -227,11 +227,11 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
                 alarm->time.tm_hour = now.tm_hour;
 
         /* For simplicity, only support date rollover for now */
-        if (alarm->time.tm_mday == -1) {
+        if (alarm->time.tm_mday < 1 || alarm->time.tm_mday > 31) {
                 alarm->time.tm_mday = now.tm_mday;
                 missing = day;
         }
-        if (alarm->time.tm_mon == -1) {
+        if ((unsigned)alarm->time.tm_mon >= 12) {
                 alarm->time.tm_mon = now.tm_mon;
                 if (missing == none)
                         missing = month;
@@ -636,6 +636,29 @@ void rtc_irq_unregister(struct rtc_device *rtc, struct rtc_task *task)
 }
 EXPORT_SYMBOL_GPL(rtc_irq_unregister);
 
+static int rtc_update_hrtimer(struct rtc_device *rtc, int enabled)
+{
+        /*
+         * We always cancel the timer here first, because otherwise
+         * we could run into BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);
+         * when we manage to start the timer before the callback
+         * returns HRTIMER_RESTART.
+         *
+         * We cannot use hrtimer_cancel() here as a running callback
+         * could be blocked on rtc->irq_task_lock and hrtimer_cancel()
+         * would spin forever.
+         */
+        if (hrtimer_try_to_cancel(&rtc->pie_timer) < 0)
+                return -1;
+
+        if (enabled) {
+                ktime_t period = ktime_set(0, NSEC_PER_SEC / rtc->irq_freq);
+
+                hrtimer_start(&rtc->pie_timer, period, HRTIMER_MODE_REL);
+        }
+        return 0;
+}
+
 /**
  * rtc_irq_set_state - enable/disable 2^N Hz periodic IRQs
  * @rtc: the rtc device
@@ -651,21 +674,21 @@ int rtc_irq_set_state(struct rtc_device *rtc, struct rtc_task *task, int enabled
         int err = 0;
         unsigned long flags;
 
+retry:
         spin_lock_irqsave(&rtc->irq_task_lock, flags);
         if (rtc->irq_task != NULL && task == NULL)
                 err = -EBUSY;
         if (rtc->irq_task != task)
                 err = -EACCES;
-
-        if (enabled) {
-                ktime_t period = ktime_set(0, NSEC_PER_SEC/rtc->irq_freq);
-                hrtimer_start(&rtc->pie_timer, period, HRTIMER_MODE_REL);
-        } else {
-                hrtimer_cancel(&rtc->pie_timer);
+        if (!err) {
+                if (rtc_update_hrtimer(rtc, enabled) < 0) {
+                        spin_unlock_irqrestore(&rtc->irq_task_lock, flags);
+                        cpu_relax();
+                        goto retry;
+                }
+                rtc->pie_enabled = enabled;
         }
-        rtc->pie_enabled = enabled;
         spin_unlock_irqrestore(&rtc->irq_task_lock, flags);
-
         return err;
 }
 EXPORT_SYMBOL_GPL(rtc_irq_set_state);
@@ -685,22 +708,20 @@ int rtc_irq_set_freq(struct rtc_device *rtc, struct rtc_task *task, int freq)
         int err = 0;
         unsigned long flags;
 
-        if (freq <= 0)
+        if (freq <= 0 || freq > RTC_MAX_FREQ)
                 return -EINVAL;
-
+retry:
         spin_lock_irqsave(&rtc->irq_task_lock, flags);
         if (rtc->irq_task != NULL && task == NULL)
                 err = -EBUSY;
         if (rtc->irq_task != task)
                 err = -EACCES;
-        if (err == 0) {
+        if (!err) {
                 rtc->irq_freq = freq;
-                if (rtc->pie_enabled) {
-                        ktime_t period;
-                        hrtimer_cancel(&rtc->pie_timer);
-                        period = ktime_set(0, NSEC_PER_SEC/rtc->irq_freq);
-                        hrtimer_start(&rtc->pie_timer, period,
-                                        HRTIMER_MODE_REL);
+                if (rtc->pie_enabled && rtc_update_hrtimer(rtc, 1) < 0) {
+                        spin_unlock_irqrestore(&rtc->irq_task_lock, flags);
+                        cpu_relax();
+                        goto retry;
                 }
         }
         spin_unlock_irqrestore(&rtc->irq_task_lock, flags);