All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Nuno Sá" <nuno.sa@analog.com>
To: <linux-clk@vger.kernel.org>
Cc: Michael Turquette <mturquette@baylibre.com>,
	Stephen Boyd <sboyd@kernel.org>
Subject: [RESEND RFC PATCH v2 2/4] clk: fix clk not being unlinked from consumers list
Date: Thu, 23 Jun 2022 14:18:55 +0200	[thread overview]
Message-ID: <20220623121857.886-3-nuno.sa@analog.com> (raw)
In-Reply-To: <20220623121857.886-1-nuno.sa@analog.com>

When a clk_hw is registered we add a struct clk handle to it's
consumers list. This handle is created in '__clk_register()' per the
'alloc_clk()' call.

As such, we need to remove this handle when unregistering the
clk_hw. This can actually lead to a use after free if a provider gets
removed before a consumer. When removing the consumer, '__clk_put()' is
called and that will do 'hlist_del(&clk->clks_node)' which will touch in
already freed memory.

Fixes: 1df4046a93e08 ("clk: Combine __clk_get() and __clk_create_clk()")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
---
 drivers/clk/clk.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 7fc191c15507..fdc711e53fb7 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -4191,6 +4191,7 @@ void clk_unregister(struct clk *clk)
 		pr_warn("%s: unregistering protected clock: %s\n",
 					__func__, clk->core->name);
 
+	clk_core_unlink_consumer(clk);
 	kref_put(&clk->core->ref, __clk_release);
 	free_clk(clk);
 unlock:
-- 
2.17.1


  parent reply	other threads:[~2022-06-23 12:19 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-23 12:18 [RESEND RFC PATCH v2 0/4] Dynamic OF and use after free related fixes Nuno Sá
2022-06-23 12:18 ` [RESEND RFC PATCH v2 1/4] clk: clk-conf: properly release of nodes Nuno Sá
2022-06-23 12:18 ` Nuno Sá [this message]
2022-06-23 12:18 ` [RESEND RFC PATCH v2 3/4] clk: refcount the active parent clk_core Nuno Sá
2022-06-23 12:18 ` [RESEND RFC PATCH v2 4/4] clk: use clk_core_unlink_consumer() helper Nuno Sá
2022-07-13 13:24 ` [RESEND RFC PATCH v2 0/4] Dynamic OF and use after free related fixes Nuno Sá
2022-09-12  7:12   ` Nuno Sá

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220623121857.886-3-nuno.sa@analog.com \
    --to=nuno.sa@analog.com \
    --cc=linux-clk@vger.kernel.org \
    --cc=mturquette@baylibre.com \
    --cc=sboyd@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.