From: Stephen Boyd <sboyd@kernel.org>
To: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Cc: Rob Clark <robdclark@chromium.org>,
DRM DRIVER FOR MSM ADRENO GPU <linux-arm-msm@vger.kernel.org>,
Michael Turquette <mturquette@baylibre.com>,
Daniel Palmer <daniel@0x0f.com>,
DRM DRIVER FOR MSM ADRENO GPU <dri-devel@lists.freedesktop.org>,
Bjorn Andersson <bjorn.andersson@linaro.org>,
Andy Gross <agross@kernel.org>,
freedreno <freedreno@lists.freedesktop.org>,
COMMON CLK FRAMEWORK <linux-clk@vger.kernel.org>
Subject: Re: [PATCH] clk: fixed: fix double free in resource managed fixed-factor clock
Date: Wed, 07 Apr 2021 16:27:13 -0700 [thread overview]
Message-ID: <161783803315.3790633.10829887417379757624@swboyd.mtv.corp.google.com> (raw)
In-Reply-To: <CAA8EJppsM1sP=OTiMY8jsLLgU=+p3qgZDD7M+M5naJhfFEF_Zg@mail.gmail.com>
Quoting Dmitry Baryshkov (2021-04-07 15:57:01)
> On Thu, 8 Apr 2021 at 01:41, Stephen Boyd <sboyd@kernel.org> wrote:
> >
> > Quoting Dmitry Baryshkov (2021-04-06 16:06:06)
> > > devm_clk_hw_register_fixed_factor_release(), the release function for
> > > the devm_clk_hw_register_fixed_factor(), calls
> > > clk_hw_unregister_fixed_factor(), which will kfree() the clock. However
> > > after that the devres functions will also kfree the allocated data,
> > > resulting in double free/memory corruption. Just call
> > > clk_hw_unregister() instead, leaving kfree() to devres code.
> > >
> > > Reported-by: Rob Clark <robdclark@chromium.org>
> > > Cc: Daniel Palmer <daniel@0x0f.com>
> > > Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > > ---
> > >
> > > Stephen, this fix affects the DSI PHY rework. Do we have a chance of
> > > getting it into 5.12, otherwise there will be a cross-dependency between
> > > msm-next and clk-next.
> >
> > Think I can get this into the last fixes PR. One question though, I
> > think this follows the pattern that things like clk-divider.c use for
> > devm. Are those also broken?
>
> It looks so. See e.g. the devres_release() function. It calls
> (*release) callback, then it will kfree the resource.
> Also see Documentation/driver-api/driver-model/devres.rst, which does
> not kfree() in release functions.
>
> Do you wish for me to send all the fixes?
>
Yes please send more fixes. They're not high priority though so I'll
probably leave them to bake in next for a week or so.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2021-04-07 23:27 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-06 23:06 [PATCH] clk: fixed: fix double free in resource managed fixed-factor clock Dmitry Baryshkov
2021-04-06 23:06 ` Dmitry Baryshkov
2021-04-07 9:00 ` Dmitry Baryshkov
2021-04-07 9:00 ` Dmitry Baryshkov
2021-04-07 11:38 ` Daniel Palmer
2021-04-07 11:38 ` Daniel Palmer
2021-04-07 22:41 ` Stephen Boyd
2021-04-07 22:41 ` Stephen Boyd
2021-04-07 22:57 ` Dmitry Baryshkov
2021-04-07 22:57 ` Dmitry Baryshkov
2021-04-07 23:27 ` Stephen Boyd [this message]
2021-04-08 0:52 ` Dmitry Baryshkov
2021-04-08 7:32 ` Stephen Boyd
2021-04-07 23:01 ` Stephen Boyd
2021-04-07 23:01 ` Stephen Boyd
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=161783803315.3790633.10829887417379757624@swboyd.mtv.corp.google.com \
--to=sboyd@kernel.org \
--cc=agross@kernel.org \
--cc=bjorn.andersson@linaro.org \
--cc=daniel@0x0f.com \
--cc=dmitry.baryshkov@linaro.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=freedreno@lists.freedesktop.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-clk@vger.kernel.org \
--cc=mturquette@baylibre.com \
--cc=robdclark@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.