From: Stephen Boyd <sboyd@kernel.org> To: Andy Gross <agross@kernel.org>, Bjorn Andersson <bjorn.andersson@linaro.org>, Dmitry Baryshkov <dmitry.baryshkov@linaro.org>, Michael Turquette <mturquette@baylibre.com> Cc: linux-arm-msm@vger.kernel.org, linux-clk@vger.kernel.org, dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, Rob Clark <robdclark@chromium.org>, Daniel Palmer <daniel@0x0f.com> Subject: Re: [PATCH] clk: fixed: fix double free in resource managed fixed-factor clock Date: Wed, 07 Apr 2021 16:01:16 -0700 [thread overview] Message-ID: <161783647690.3790633.7004111396421583619@swboyd.mtv.corp.google.com> (raw) In-Reply-To: <20210406230606.3007138-1-dmitry.baryshkov@linaro.org> Quoting Dmitry Baryshkov (2021-04-06 16:06:06) > devm_clk_hw_register_fixed_factor_release(), the release function for > the devm_clk_hw_register_fixed_factor(), calls > clk_hw_unregister_fixed_factor(), which will kfree() the clock. However > after that the devres functions will also kfree the allocated data, > resulting in double free/memory corruption. Just call > clk_hw_unregister() instead, leaving kfree() to devres code. > > Reported-by: Rob Clark <robdclark@chromium.org> > Cc: Daniel Palmer <daniel@0x0f.com> > Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> > --- Applied to clk-fixes. I also squashed this in to cleanup that ugly cast. ---8<---- diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c index 390c16f321a6..4e4b6d367612 100644 --- a/drivers/clk/clk-fixed-factor.c +++ b/drivers/clk/clk-fixed-factor.c @@ -66,12 +66,14 @@ EXPORT_SYMBOL_GPL(clk_fixed_factor_ops); static void devm_clk_hw_register_fixed_factor_release(struct device *dev, void *res) { + struct clk_fixed_factor *fix = res; + /* * We can not use clk_hw_unregister_fixed_factor, since it will kfree() * the hw, resulting in double free. Just unregister the hw and let * devres code kfree() it. */ - clk_hw_unregister(&((struct clk_fixed_factor *)res)->hw); + clk_hw_unregister(&fix->hw); } static struct clk_hw *
WARNING: multiple messages have this Message-ID (diff)
From: Stephen Boyd <sboyd@kernel.org> To: Andy Gross <agross@kernel.org>, Bjorn Andersson <bjorn.andersson@linaro.org>, Dmitry Baryshkov <dmitry.baryshkov@linaro.org>, Michael Turquette <mturquette@baylibre.com> Cc: Rob Clark <robdclark@chromium.org>, linux-arm-msm@vger.kernel.org, Daniel Palmer <daniel@0x0f.com>, dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, linux-clk@vger.kernel.org Subject: Re: [PATCH] clk: fixed: fix double free in resource managed fixed-factor clock Date: Wed, 07 Apr 2021 16:01:16 -0700 [thread overview] Message-ID: <161783647690.3790633.7004111396421583619@swboyd.mtv.corp.google.com> (raw) In-Reply-To: <20210406230606.3007138-1-dmitry.baryshkov@linaro.org> Quoting Dmitry Baryshkov (2021-04-06 16:06:06) > devm_clk_hw_register_fixed_factor_release(), the release function for > the devm_clk_hw_register_fixed_factor(), calls > clk_hw_unregister_fixed_factor(), which will kfree() the clock. However > after that the devres functions will also kfree the allocated data, > resulting in double free/memory corruption. Just call > clk_hw_unregister() instead, leaving kfree() to devres code. > > Reported-by: Rob Clark <robdclark@chromium.org> > Cc: Daniel Palmer <daniel@0x0f.com> > Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> > --- Applied to clk-fixes. I also squashed this in to cleanup that ugly cast. ---8<---- diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c index 390c16f321a6..4e4b6d367612 100644 --- a/drivers/clk/clk-fixed-factor.c +++ b/drivers/clk/clk-fixed-factor.c @@ -66,12 +66,14 @@ EXPORT_SYMBOL_GPL(clk_fixed_factor_ops); static void devm_clk_hw_register_fixed_factor_release(struct device *dev, void *res) { + struct clk_fixed_factor *fix = res; + /* * We can not use clk_hw_unregister_fixed_factor, since it will kfree() * the hw, resulting in double free. Just unregister the hw and let * devres code kfree() it. */ - clk_hw_unregister(&((struct clk_fixed_factor *)res)->hw); + clk_hw_unregister(&fix->hw); } static struct clk_hw * _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2021-04-07 23:01 UTC|newest] Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-04-06 23:06 [PATCH] clk: fixed: fix double free in resource managed fixed-factor clock Dmitry Baryshkov 2021-04-06 23:06 ` Dmitry Baryshkov 2021-04-07 9:00 ` Dmitry Baryshkov 2021-04-07 9:00 ` Dmitry Baryshkov 2021-04-07 11:38 ` Daniel Palmer 2021-04-07 11:38 ` Daniel Palmer 2021-04-07 22:41 ` Stephen Boyd 2021-04-07 22:41 ` Stephen Boyd 2021-04-07 22:57 ` Dmitry Baryshkov 2021-04-07 22:57 ` Dmitry Baryshkov 2021-04-07 23:27 ` Stephen Boyd 2021-04-08 0:52 ` Dmitry Baryshkov 2021-04-08 7:32 ` Stephen Boyd 2021-04-07 23:01 ` Stephen Boyd [this message] 2021-04-07 23:01 ` Stephen Boyd
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=161783647690.3790633.7004111396421583619@swboyd.mtv.corp.google.com \ --to=sboyd@kernel.org \ --cc=agross@kernel.org \ --cc=bjorn.andersson@linaro.org \ --cc=daniel@0x0f.com \ --cc=dmitry.baryshkov@linaro.org \ --cc=dri-devel@lists.freedesktop.org \ --cc=freedreno@lists.freedesktop.org \ --cc=linux-arm-msm@vger.kernel.org \ --cc=linux-clk@vger.kernel.org \ --cc=mturquette@baylibre.com \ --cc=robdclark@chromium.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.