diff options
| author | Dmitry Baryshkov <dmitry.baryshkov@linaro.org> | 2021-04-07 02:06:06 +0300 |
|---|---|---|
| committer | Stephen Boyd <sboyd@kernel.org> | 2021-04-07 16:01:25 -0700 |
| commit | 50ce6826a48f119baf2794fa384a64efe9bd84a5 (patch) | |
| tree | a4c3ef684fff6552015fb03fd6742ca5e2f01f0c | |
| parent | 7045465500e465b09f09d6e5bdc260a9f1aab97b (diff) | |
| download | misc-50ce6826a48f119baf2794fa384a64efe9bd84a5.tar.gz | |
clk: fixed: fix double free in resource managed fixed-factor clock
devm_clk_hw_register_fixed_factor_release(), the release function for
the devm_clk_hw_register_fixed_factor(), calls
clk_hw_unregister_fixed_factor(), which will kfree() the clock. However
after that the devres functions will also kfree the allocated data,
resulting in double free/memory corruption. Just call
clk_hw_unregister() instead, leaving kfree() to devres code.
Reported-by: Rob Clark <robdclark@chromium.org>
Cc: Daniel Palmer <daniel@0x0f.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20210406230606.3007138-1-dmitry.baryshkov@linaro.org
Fixes: 0b9266d295ce ("clk: fixed: add devm helper for clk_hw_register_fixed_factor()")
[sboyd@kernel.org: Remove ugly cast]
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
| -rw-r--r-- | drivers/clk/clk-fixed-factor.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c index 4f7bf3929d6d9..4e4b6d3676126 100644 --- a/drivers/clk/clk-fixed-factor.c +++ b/drivers/clk/clk-fixed-factor.c @@ -66,7 +66,14 @@ EXPORT_SYMBOL_GPL(clk_fixed_factor_ops); static void devm_clk_hw_register_fixed_factor_release(struct device *dev, void *res) { - clk_hw_unregister_fixed_factor(&((struct clk_fixed_factor *)res)->hw); + struct clk_fixed_factor *fix = res; + + /* + * We can not use clk_hw_unregister_fixed_factor, since it will kfree() + * the hw, resulting in double free. Just unregister the hw and let + * devres code kfree() it. + */ + clk_hw_unregister(&fix->hw); } static struct clk_hw * |