From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> To: Andy Gross <agross@kernel.org>, Bjorn Andersson <bjorn.andersson@linaro.org>, Stephen Boyd <sboyd@kernel.org>, Michael Turquette <mturquette@baylibre.com> Cc: linux-arm-msm@vger.kernel.org, linux-clk@vger.kernel.org, dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, Rob Clark <robdclark@chromium.org>, Daniel Palmer <daniel@0x0f.com> Subject: [PATCH] clk: fixed: fix double free in resource managed fixed-factor clock Date: Wed, 7 Apr 2021 02:06:06 +0300 [thread overview] Message-ID: <20210406230606.3007138-1-dmitry.baryshkov@linaro.org> (raw) devm_clk_hw_register_fixed_factor_release(), the release function for the devm_clk_hw_register_fixed_factor(), calls clk_hw_unregister_fixed_factor(), which will kfree() the clock. However after that the devres functions will also kfree the allocated data, resulting in double free/memory corruption. Just call clk_hw_unregister() instead, leaving kfree() to devres code. Reported-by: Rob Clark <robdclark@chromium.org> Cc: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> --- Stephen, this fix affects the DSI PHY rework. Do we have a chance of getting it into 5.12, otherwise there will be a cross-dependency between msm-next and clk-next. --- drivers/clk/clk-fixed-factor.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c index 4f7bf3929d6d..390c16f321a6 100644 --- a/drivers/clk/clk-fixed-factor.c +++ b/drivers/clk/clk-fixed-factor.c @@ -66,7 +66,12 @@ EXPORT_SYMBOL_GPL(clk_fixed_factor_ops); static void devm_clk_hw_register_fixed_factor_release(struct device *dev, void *res) { - clk_hw_unregister_fixed_factor(&((struct clk_fixed_factor *)res)->hw); + /* + * We can not use clk_hw_unregister_fixed_factor, since it will kfree() + * the hw, resulting in double free. Just unregister the hw and let + * devres code kfree() it. + */ + clk_hw_unregister(&((struct clk_fixed_factor *)res)->hw); } static struct clk_hw * -- 2.30.2
WARNING: multiple messages have this Message-ID (diff)
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> To: Andy Gross <agross@kernel.org>, Bjorn Andersson <bjorn.andersson@linaro.org>, Stephen Boyd <sboyd@kernel.org>, Michael Turquette <mturquette@baylibre.com> Cc: Rob Clark <robdclark@chromium.org>, linux-arm-msm@vger.kernel.org, Daniel Palmer <daniel@0x0f.com>, dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, linux-clk@vger.kernel.org Subject: [PATCH] clk: fixed: fix double free in resource managed fixed-factor clock Date: Wed, 7 Apr 2021 02:06:06 +0300 [thread overview] Message-ID: <20210406230606.3007138-1-dmitry.baryshkov@linaro.org> (raw) devm_clk_hw_register_fixed_factor_release(), the release function for the devm_clk_hw_register_fixed_factor(), calls clk_hw_unregister_fixed_factor(), which will kfree() the clock. However after that the devres functions will also kfree the allocated data, resulting in double free/memory corruption. Just call clk_hw_unregister() instead, leaving kfree() to devres code. Reported-by: Rob Clark <robdclark@chromium.org> Cc: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> --- Stephen, this fix affects the DSI PHY rework. Do we have a chance of getting it into 5.12, otherwise there will be a cross-dependency between msm-next and clk-next. --- drivers/clk/clk-fixed-factor.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c index 4f7bf3929d6d..390c16f321a6 100644 --- a/drivers/clk/clk-fixed-factor.c +++ b/drivers/clk/clk-fixed-factor.c @@ -66,7 +66,12 @@ EXPORT_SYMBOL_GPL(clk_fixed_factor_ops); static void devm_clk_hw_register_fixed_factor_release(struct device *dev, void *res) { - clk_hw_unregister_fixed_factor(&((struct clk_fixed_factor *)res)->hw); + /* + * We can not use clk_hw_unregister_fixed_factor, since it will kfree() + * the hw, resulting in double free. Just unregister the hw and let + * devres code kfree() it. + */ + clk_hw_unregister(&((struct clk_fixed_factor *)res)->hw); } static struct clk_hw * -- 2.30.2 _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel
next reply other threads:[~2021-04-06 23:06 UTC|newest] Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-04-06 23:06 Dmitry Baryshkov [this message] 2021-04-06 23:06 ` [PATCH] clk: fixed: fix double free in resource managed fixed-factor clock Dmitry Baryshkov 2021-04-07 9:00 ` Dmitry Baryshkov 2021-04-07 9:00 ` Dmitry Baryshkov 2021-04-07 11:38 ` Daniel Palmer 2021-04-07 11:38 ` Daniel Palmer 2021-04-07 22:41 ` Stephen Boyd 2021-04-07 22:41 ` Stephen Boyd 2021-04-07 22:57 ` Dmitry Baryshkov 2021-04-07 22:57 ` Dmitry Baryshkov 2021-04-07 23:27 ` Stephen Boyd 2021-04-08 0:52 ` Dmitry Baryshkov 2021-04-08 7:32 ` Stephen Boyd 2021-04-07 23:01 ` Stephen Boyd 2021-04-07 23:01 ` Stephen Boyd
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210406230606.3007138-1-dmitry.baryshkov@linaro.org \ --to=dmitry.baryshkov@linaro.org \ --cc=agross@kernel.org \ --cc=bjorn.andersson@linaro.org \ --cc=daniel@0x0f.com \ --cc=dri-devel@lists.freedesktop.org \ --cc=freedreno@lists.freedesktop.org \ --cc=linux-arm-msm@vger.kernel.org \ --cc=linux-clk@vger.kernel.org \ --cc=mturquette@baylibre.com \ --cc=robdclark@chromium.org \ --cc=sboyd@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.