Quoting Dmitry Baryshkov (2021-04-06 16:06:06)
devm_clk_hw_register_fixed_factor_release(), the release function for the devm_clk_hw_register_fixed_factor(), calls clk_hw_unregister_fixed_factor(), which will kfree() the clock. However after that the devres functions will also kfree the allocated data, resulting in double free/memory corruption. Just call clk_hw_unregister() instead, leaving kfree() to devres code.
Reported-by: Rob Clark robdclark@chromium.org Cc: Daniel Palmer daniel@0x0f.com Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org
Applied to clk-fixes. I also squashed this in to cleanup that ugly cast.
---8<----
diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c index 390c16f321a6..4e4b6d367612 100644 --- a/drivers/clk/clk-fixed-factor.c +++ b/drivers/clk/clk-fixed-factor.c @@ -66,12 +66,14 @@ EXPORT_SYMBOL_GPL(clk_fixed_factor_ops);
static void devm_clk_hw_register_fixed_factor_release(struct device *dev, void *res) { + struct clk_fixed_factor *fix = res; + /* * We can not use clk_hw_unregister_fixed_factor, since it will kfree() * the hw, resulting in double free. Just unregister the hw and let * devres code kfree() it. */ - clk_hw_unregister(&((struct clk_fixed_factor *)res)->hw); + clk_hw_unregister(&fix->hw); }
static struct clk_hw *