[PATCH] clk: samsung: exynos5410: fix refcount leak

[PATCH] clk: samsung: exynos5410: fix refcount leak

[Alexander A. Klimov]

Every value returned from of_clk_get() is supposed to be cleaned up
via clk_put() once not needed anymore.

Fixes: be95d2c7d918 ("clk: samsung: Add support for EPLL on exynos5410")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 drivers/clk/samsung/clk-exynos5410.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/samsung/clk-exynos5410.c b/drivers/clk/samsung/clk-exynos5410.c
index baa9988c7bb7..0cd9b0392cf5 100644
--- a/drivers/clk/samsung/clk-exynos5410.c
+++ b/drivers/clk/samsung/clk-exynos5410.c
@@ -269,8 +269,12 @@ static void __init exynos5410_clk_init(struct device_node *np)
 {
 	struct clk *xxti = of_clk_get(np, 0);
 
-	if (!IS_ERR(xxti) && clk_get_rate(xxti) == 24 * MHZ)
-		exynos5410_plls[epll].rate_table = exynos5410_pll2550x_24mhz_tbl;
+	if (!IS_ERR(xxti)) {
+		if (clk_get_rate(xxti) == 24 * MHZ)
+			exynos5410_plls[epll].rate_table =
+				exynos5410_pll2550x_24mhz_tbl;
+		clk_put(xxti);
+	}
 
 	samsung_cmu_register_one(np, &cmu);
 
-- 
2.54.0

[PATCH] clk: tegra: tegra124-emc: fix krealloc() memory leak

[Alexander A. Klimov]

Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:

    MEM = krealloc(MEM, SZ, GFP);

If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:

    TMP = krealloc(MEM, SZ, GFP);
    if (!TMP) return;
    MEM = TMP;

Fixes: 888ca40e2843 ("clk: tegra: emc: Support multiple RAM codes")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 drivers/clk/tegra/clk-tegra124-emc.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
index f3b2c96fdcfc..8053fbbb06c8 100644
--- a/drivers/clk/tegra/clk-tegra124-emc.c
+++ b/drivers/clk/tegra/clk-tegra124-emc.c
@@ -446,14 +446,13 @@ static int load_timings_from_dt(struct tegra_clk_emc *tegra,
 	struct emc_timing *timings_ptr;
 	int child_count = of_get_child_count(node);
 	int i = 0, err;
-	size_t size;
+	size_t size = (tegra->num_timings + child_count) * sizeof(struct emc_timing);
+	void *mem = krealloc(tegra->timings, size, GFP_KERNEL);
 
-	size = (tegra->num_timings + child_count) * sizeof(struct emc_timing);
-
-	tegra->timings = krealloc(tegra->timings, size, GFP_KERNEL);
-	if (!tegra->timings)
+	if (!mem)
 		return -ENOMEM;
 
+	tegra->timings = mem;
 	timings_ptr = tegra->timings + tegra->num_timings;
 	tegra->num_timings += child_count;
 
-- 
2.54.0

[PATCH] dmaengine: ioatdma: use !kstrtoint(), not sscanf()!=-1

[Alexander A. Klimov]

Depending on the user input, sscanf() may return 0 for 0 success.
But intr_coalesce_store() wants sscanf() to parse one number,
so expect 1 from sscanf(), not any int except -1.

While on it, fix typo in %du by using just %d,
as this interface expects %d or %d\n.
Latter made scripts/checkpatch.pl complain,
so use kstrtoint() instead of sscanf().

Fixes: 268e2519f5b7 ("dmaengine: ioatdma: Add intr_coalesce sysfs entry")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 drivers/dma/ioat/sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c
index e796ddb5383f..f59df569956a 100644
--- a/drivers/dma/ioat/sysfs.c
+++ b/drivers/dma/ioat/sysfs.c
@@ -144,7 +144,7 @@ size_t count)
 	int intr_coalesce = 0;
 	struct ioatdma_chan *ioat_chan = to_ioat_chan(c);
 
-	if (sscanf(page, "%du", &intr_coalesce) != -1) {
+	if (!kstrtoint(page, 10, &intr_coalesce)) {
 		if ((intr_coalesce < 0) ||
 		    (intr_coalesce > IOAT_INTRDELAY_MASK))
 			return -EINVAL;
-- 
2.54.0

[PATCH] tlclk: if sscanf() fails, fall back to 0, not random value

[Alexander A. Klimov]

If sscanf(IN, FMT, &OUT) fails, OUT may be unchanged.
So if OUT was never initialized, it may be still uninitialized memory.
To prevent such, initialize OUT=0 first.

Fixes: 648bf4fb21f5 ("[PATCH] tlclk driver update")
Fixes: 1a80ba882730 ("[PATCH] Telecom Clock Driver for MPCBL0010 ATCA computer blade")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 drivers/char/tlclk.c | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 677d230a226c..1d0fcf87449d 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -327,7 +327,7 @@ static DEVICE_ATTR(alarms, S_IRUGO, show_alarms, NULL);
 static ssize_t store_received_ref_clk3a(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 	unsigned long flags;
 
@@ -349,7 +349,7 @@ static DEVICE_ATTR(received_ref_clk3a, (S_IWUSR|S_IWGRP), NULL,
 static ssize_t store_received_ref_clk3b(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 	unsigned long flags;
 
@@ -371,7 +371,7 @@ static DEVICE_ATTR(received_ref_clk3b, (S_IWUSR|S_IWGRP), NULL,
 static ssize_t store_enable_clk3b_output(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 	unsigned long flags;
 
@@ -393,7 +393,7 @@ static ssize_t store_enable_clk3a_output(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
 	unsigned long flags;
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 
 	sscanf(buf, "%lX", &tmp);
@@ -414,7 +414,7 @@ static ssize_t store_enable_clkb1_output(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
 	unsigned long flags;
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 
 	sscanf(buf, "%lX", &tmp);
@@ -436,7 +436,7 @@ static ssize_t store_enable_clka1_output(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
 	unsigned long flags;
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 
 	sscanf(buf, "%lX", &tmp);
@@ -457,7 +457,7 @@ static ssize_t store_enable_clkb0_output(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
 	unsigned long flags;
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 
 	sscanf(buf, "%lX", &tmp);
@@ -478,7 +478,7 @@ static ssize_t store_enable_clka0_output(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
 	unsigned long flags;
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 
 	sscanf(buf, "%lX", &tmp);
@@ -499,7 +499,7 @@ static ssize_t store_select_amcb2_transmit_clock(struct device *d,
 		struct device_attribute *attr, const char *buf, size_t count)
 {
 	unsigned long flags;
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 
 	sscanf(buf, "%lX", &tmp);
@@ -540,7 +540,7 @@ static DEVICE_ATTR(select_amcb2_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
 static ssize_t store_select_amcb1_transmit_clock(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 	unsigned long flags;
 
@@ -582,7 +582,7 @@ static DEVICE_ATTR(select_amcb1_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
 static ssize_t store_select_redundant_clock(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 	unsigned long flags;
 
@@ -603,7 +603,7 @@ static DEVICE_ATTR(select_redundant_clock, (S_IWUSR|S_IWGRP), NULL,
 static ssize_t store_select_ref_frequency(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 	unsigned long flags;
 
@@ -624,7 +624,7 @@ static DEVICE_ATTR(select_ref_frequency, (S_IWUSR|S_IWGRP), NULL,
 static ssize_t store_filter_select(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 	unsigned long flags;
 
@@ -644,7 +644,7 @@ static DEVICE_ATTR(filter_select, (S_IWUSR|S_IWGRP), NULL, store_filter_select);
 static ssize_t store_hardware_switching_mode(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 	unsigned long flags;
 
@@ -665,7 +665,7 @@ static DEVICE_ATTR(hardware_switching_mode, (S_IWUSR|S_IWGRP), NULL,
 static ssize_t store_hardware_switching(struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 	unsigned long flags;
 
@@ -686,7 +686,7 @@ static DEVICE_ATTR(hardware_switching, (S_IWUSR|S_IWGRP), NULL,
 static ssize_t store_refalign (struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned long flags;
 
 	sscanf(buf, "%lX", &tmp);
@@ -705,7 +705,7 @@ static DEVICE_ATTR(refalign, (S_IWUSR|S_IWGRP), NULL, store_refalign);
 static ssize_t store_mode_select (struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 	unsigned long flags;
 
@@ -725,7 +725,7 @@ static DEVICE_ATTR(mode_select, (S_IWUSR|S_IWGRP), NULL, store_mode_select);
 static ssize_t store_reset (struct device *d,
 		 struct device_attribute *attr, const char *buf, size_t count)
 {
-	unsigned long tmp;
+	unsigned long tmp = 0;
 	unsigned char val;
 	unsigned long flags;
 
-- 
2.54.0

Re: [PATCH] dmaengine: ioatdma: use !kstrtoint(), not sscanf()!=-1

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The sysfs store function silently ignores parsing errors and incorrectly returns success (`count`) when given invalid input.
--

commit fe01246cf60369a73aac5e63b92278079b4417aa
Author: Alexander A. Klimov <grandmaster@al2klimov.de>
dmaengine: ioatdma: use !kstrtoint(), not sscanf()!=-1

The commit replaces the use of sscanf() with kstrtoint() in the sysfs store
function to parse user input. It also addresses a checkpatch.pl warning
regarding the formatting string.

> diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c
> index e796ddb5383f8..f59df569956ae 100644
> --- a/drivers/dma/ioat/sysfs.c
> +++ b/drivers/dma/ioat/sysfs.c
> @@ -144,7 +144,7 @@ size_t count)
>  	int intr_coalesce = 0;
>  	struct ioatdma_chan *ioat_chan = to_ioat_chan(c);
>  
> -	if (sscanf(page, "%du", &intr_coalesce) != -1) {
> +	if (!kstrtoint(page, 10, &intr_coalesce)) {
>  		if ((intr_coalesce < 0) ||
>  		    (intr_coalesce > IOAT_INTRDELAY_MASK))
>  			return -EINVAL;

[Severity: Medium]
If kstrtoint() fails to parse the input and returns a negative error code,
the condition evaluates to false and the function skips the block.

Looking at the remainder of intr_coalesce_store(), execution then jumps
directly to the end of the function:

	if (!kstrtoint(page, 10, &intr_coalesce)) {
		...
		ioat_chan->intr_coalesce = intr_coalesce;
	}

	return count;

Does this silently ignore parsing errors and incorrectly indicate to userspace
that the write was successful when given invalid input?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260526061321.6123-3-grandmaster@al2klimov.de?part=1

Re: [PATCH] dmaengine: ioatdma: use !kstrtoint(), not sscanf()!=-1

[Dave Jiang]

On 5/25/26 11:13 PM, Alexander A. Klimov wrote:
> Depending on the user input, sscanf() may return 0 for 0 success.
> But intr_coalesce_store() wants sscanf() to parse one number,
> so expect 1 from sscanf(), not any int except -1.
> 
> While on it, fix typo in %du by using just %d,
> as this interface expects %d or %d\n.
> Latter made scripts/checkpatch.pl complain,
> so use kstrtoint() instead of sscanf().
> 
> Fixes: 268e2519f5b7 ("dmaengine: ioatdma: Add intr_coalesce sysfs entry")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
> ---
>  drivers/dma/ioat/sysfs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c
> index e796ddb5383f..f59df569956a 100644
> --- a/drivers/dma/ioat/sysfs.c
> +++ b/drivers/dma/ioat/sysfs.c
> @@ -144,7 +144,7 @@ size_t count)
>  	int intr_coalesce = 0;
>  	struct ioatdma_chan *ioat_chan = to_ioat_chan(c);
>  
> -	if (sscanf(page, "%du", &intr_coalesce) != -1) {
> +	if (!kstrtoint(page, 10, &intr_coalesce)) {

looks good. We can probably use kstrtouint() since we are expecting a positive number always.

DJ

>  		if ((intr_coalesce < 0) ||
>  		    (intr_coalesce > IOAT_INTRDELAY_MASK))
>  			return -EINVAL;

Re: [PATCH] clk: samsung: exynos5410: fix refcount leak

[Brian Masney]

On Tue, May 26, 2026 at 08:13:12AM +0200, Alexander A. Klimov wrote:
> Every value returned from of_clk_get() is supposed to be cleaned up
> via clk_put() once not needed anymore.
> 
> Fixes: be95d2c7d918 ("clk: samsung: Add support for EPLL on exynos5410")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>

Reviewed-by: Brian Masney <bmasney@redhat.com>

Re: [PATCH] clk: tegra: tegra124-emc: fix krealloc() memory leak

[Brian Masney]

On Tue, May 26, 2026 at 08:13:13AM +0200, Alexander A. Klimov wrote:
> Don't just overwrite the original pointer passed to krealloc()
> with its return value without checking latter:
> 
>     MEM = krealloc(MEM, SZ, GFP);
> 
> If krealloc() returns NULL, that erases the pointer
> to the still allocated memory, hence leaks this memory.
> Instead, use a temporary variable, check it's not NULL
> and only then assign it to the original pointer:
> 
>     TMP = krealloc(MEM, SZ, GFP);
>     if (!TMP) return;
>     MEM = TMP;
> 
> Fixes: 888ca40e2843 ("clk: tegra: emc: Support multiple RAM codes")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>

Reviewed-by: Brian Masney <bmasney@redhat.com>

Re: [PATCH] dmaengine: ioatdma: use !kstrtoint(), not sscanf()!=-1

[Alexander A. Klimov]

On 5/26/26 16:49, Dave Jiang wrote:
> 
> 
> On 5/25/26 11:13 PM, Alexander A. Klimov wrote:
>> Depending on the user input, sscanf() may return 0 for 0 success.
>> But intr_coalesce_store() wants sscanf() to parse one number,
>> so expect 1 from sscanf(), not any int except -1.
>>
>> While on it, fix typo in %du by using just %d,
>> as this interface expects %d or %d\n.
>> Latter made scripts/checkpatch.pl complain,
>> so use kstrtoint() instead of sscanf().
>>
>> Fixes: 268e2519f5b7 ("dmaengine: ioatdma: Add intr_coalesce sysfs entry")
>> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
>> ---
>>   drivers/dma/ioat/sysfs.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c
>> index e796ddb5383f..f59df569956a 100644
>> --- a/drivers/dma/ioat/sysfs.c
>> +++ b/drivers/dma/ioat/sysfs.c
>> @@ -144,7 +144,7 @@ size_t count)
>>   	int intr_coalesce = 0;
>>   	struct ioatdma_chan *ioat_chan = to_ioat_chan(c);
>>   
>> -	if (sscanf(page, "%du", &intr_coalesce) != -1) {
>> +	if (!kstrtoint(page, 10, &intr_coalesce)) {
> 
> looks good. We can probably use kstrtouint() since we are expecting a positive number always.

This would break `return -EINVAL;` below

> 
> DJ
> 
>>   		if ((intr_coalesce < 0) ||
>>   		    (intr_coalesce > IOAT_INTRDELAY_MASK))
>>   			return -EINVAL;
> 

Re: [PATCH] clk: samsung: exynos5410: fix refcount leak

[Alexey Klimov]

On Tue May 26, 2026 at 7:13 AM BST, Alexander A. Klimov wrote:
> Every value returned from of_clk_get() is supposed to be cleaned up
> via clk_put() once not needed anymore.
>
> Fixes: be95d2c7d918 ("clk: samsung: Add support for EPLL on exynos5410")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>

Reviewed-by: Alexey Klimov <alexey.klimov@linaro.org>

> ---
>  drivers/clk/samsung/clk-exynos5410.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/clk/samsung/clk-exynos5410.c b/drivers/clk/samsung/clk-exynos5410.c
> index baa9988c7bb7..0cd9b0392cf5 100644
> --- a/drivers/clk/samsung/clk-exynos5410.c
> +++ b/drivers/clk/samsung/clk-exynos5410.c
> @@ -269,8 +269,12 @@ static void __init exynos5410_clk_init(struct device_node *np)
>  {
>  	struct clk *xxti = of_clk_get(np, 0);
>  
> -	if (!IS_ERR(xxti) && clk_get_rate(xxti) == 24 * MHZ)
> -		exynos5410_plls[epll].rate_table = exynos5410_pll2550x_24mhz_tbl;
> +	if (!IS_ERR(xxti)) {
> +		if (clk_get_rate(xxti) == 24 * MHZ)
> +			exynos5410_plls[epll].rate_table =
> +				exynos5410_pll2550x_24mhz_tbl;
> +		clk_put(xxti);
> +	}
>  
>  	samsung_cmu_register_one(np, &cmu);

Best regards,
Alexey Klimov

Re: [PATCH] clk: samsung: exynos5410: fix refcount leak

[Peter Griffin]

On Tue, 26 May 2026 at 07:13, Alexander A. Klimov
<grandmaster@al2klimov.de> wrote:
>
> Every value returned from of_clk_get() is supposed to be cleaned up
> via clk_put() once not needed anymore.
>
> Fixes: be95d2c7d918 ("clk: samsung: Add support for EPLL on exynos5410")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
> ---

Reviewed-by: Peter Griffin <peter.griffin@linaro.org>

>  drivers/clk/samsung/clk-exynos5410.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/clk/samsung/clk-exynos5410.c b/drivers/clk/samsung/clk-exynos5410.c
> index baa9988c7bb7..0cd9b0392cf5 100644
> --- a/drivers/clk/samsung/clk-exynos5410.c
> +++ b/drivers/clk/samsung/clk-exynos5410.c
> @@ -269,8 +269,12 @@ static void __init exynos5410_clk_init(struct device_node *np)
>  {
>         struct clk *xxti = of_clk_get(np, 0);
>
> -       if (!IS_ERR(xxti) && clk_get_rate(xxti) == 24 * MHZ)
> -               exynos5410_plls[epll].rate_table = exynos5410_pll2550x_24mhz_tbl;
> +       if (!IS_ERR(xxti)) {
> +               if (clk_get_rate(xxti) == 24 * MHZ)
> +                       exynos5410_plls[epll].rate_table =
> +                               exynos5410_pll2550x_24mhz_tbl;
> +               clk_put(xxti);
> +       }
>
>         samsung_cmu_register_one(np, &cmu);
>
> --
> 2.54.0
>
>

Re: [PATCH] dmaengine: ioatdma: use !kstrtoint(), not sscanf()!=-1

[Dave Jiang]

On 5/26/26 11:06 AM, Alexander A. Klimov wrote:
> 
> 
> On 5/26/26 16:49, Dave Jiang wrote:
>>
>>
>> On 5/25/26 11:13 PM, Alexander A. Klimov wrote:
>>> Depending on the user input, sscanf() may return 0 for 0 success.
>>> But intr_coalesce_store() wants sscanf() to parse one number,
>>> so expect 1 from sscanf(), not any int except -1.
>>>
>>> While on it, fix typo in %du by using just %d,
>>> as this interface expects %d or %d\n.
>>> Latter made scripts/checkpatch.pl complain,
>>> so use kstrtoint() instead of sscanf().
>>>
>>> Fixes: 268e2519f5b7 ("dmaengine: ioatdma: Add intr_coalesce sysfs entry")
>>> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
>>> ---
>>>   drivers/dma/ioat/sysfs.c | 2 +-
>>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c
>>> index e796ddb5383f..f59df569956a 100644
>>> --- a/drivers/dma/ioat/sysfs.c
>>> +++ b/drivers/dma/ioat/sysfs.c
>>> @@ -144,7 +144,7 @@ size_t count)
>>>       int intr_coalesce = 0;
>>>       struct ioatdma_chan *ioat_chan = to_ioat_chan(c);
>>>   -    if (sscanf(page, "%du", &intr_coalesce) != -1) {
>>> +    if (!kstrtoint(page, 10, &intr_coalesce)) {
>>
>> looks good. We can probably use kstrtouint() since we are expecting a positive number always.
> 
> This would break `return -EINVAL;` below

Shouldn't we just drop the < 0 compare since it's no longer needed?

> 
>>
>> DJ
>>
>>>           if ((intr_coalesce < 0) ||
>>>               (intr_coalesce > IOAT_INTRDELAY_MASK))
>>>               return -EINVAL;
>>
> 

Re: [PATCH] clk: tegra: tegra124-emc: fix krealloc() memory leak

[Thierry Reding]

[-- Attachment #1: Type: text/plain, Size: 1698 bytes --]

On Tue, May 26, 2026 at 08:13:13AM +0200, Alexander A. Klimov wrote:
> Don't just overwrite the original pointer passed to krealloc()
> with its return value without checking latter:
> 
>     MEM = krealloc(MEM, SZ, GFP);
> 
> If krealloc() returns NULL, that erases the pointer
> to the still allocated memory, hence leaks this memory.
> Instead, use a temporary variable, check it's not NULL
> and only then assign it to the original pointer:
> 
>     TMP = krealloc(MEM, SZ, GFP);
>     if (!TMP) return;
>     MEM = TMP;
> 
> Fixes: 888ca40e2843 ("clk: tegra: emc: Support multiple RAM codes")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
> ---
>  drivers/clk/tegra/clk-tegra124-emc.c | 9 ++++-----
>  1 file changed, 4 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
> index f3b2c96fdcfc..8053fbbb06c8 100644
> --- a/drivers/clk/tegra/clk-tegra124-emc.c
> +++ b/drivers/clk/tegra/clk-tegra124-emc.c
> @@ -446,14 +446,13 @@ static int load_timings_from_dt(struct tegra_clk_emc *tegra,
>  	struct emc_timing *timings_ptr;
>  	int child_count = of_get_child_count(node);
>  	int i = 0, err;
> -	size_t size;
> +	size_t size = (tegra->num_timings + child_count) * sizeof(struct emc_timing);
> +	void *mem = krealloc(tegra->timings, size, GFP_KERNEL);
>  
> -	size = (tegra->num_timings + child_count) * sizeof(struct emc_timing);

This looks really wild now. I think it'd be better to follow the
original style:

	size_t size;
	void *mem;

	size = ...;

	mem = krealloc(...);
	if (!mem)
		...

With that:

Acked-by: Thierry Reding <treding@nvidia.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] clk: samsung: exynos5410: fix refcount leak

[Krzysztof Kozlowski]

On 26/05/2026 08:13, Alexander A. Klimov wrote:
> Every value returned from of_clk_get() is supposed to be cleaned up
> via clk_put() once not needed anymore.
> 
> Fixes: be95d2c7d918 ("clk: samsung: Add support for EPLL on exynos5410")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>


Does not apply - you messed somehow sending these.

Grabbing thread from
lore.kernel.org/all/20260526061321.6123-1-grandmaster@al2klimov.de/t.mbox.gz
Checking for newer revisions
Grabbing search results from lore.kernel.org
Analyzing 13 messages in the thread
WARNING: duplicate messages found at index 1
   Subject 1: dmaengine: ioatdma: use !kstrtoint(), not sscanf()!=-1
   Subject 2: tlclk: if sscanf() fails, fall back to 0, not random value
  2 is not a reply... assume additional patch
WARNING: duplicate messages found at index 1
   Subject 1: clk: samsung: exynos5410: fix refcount leak
   Subject 2: dmaengine: ioatdma: use !kstrtoint(), not sscanf()!=-1
  2 is not a reply... assume additional patch
Assuming new revision: v2 ([PATCH] clk: tegra: tegra124-emc: fix
krealloc() memory leak)


Best regards,
Krzysztof

Re: [PATCH] dmaengine: ioatdma: use !kstrtoint(), not sscanf()!=-1

[Alexander A. Klimov]

On 5/28/26 22:06, Dave Jiang wrote:
> 
> 
> On 5/26/26 11:06 AM, Alexander A. Klimov wrote:
>>
>>
>> On 5/26/26 16:49, Dave Jiang wrote:
>>>
>>>
>>> On 5/25/26 11:13 PM, Alexander A. Klimov wrote:
>>>> Depending on the user input, sscanf() may return 0 for 0 success.
>>>> But intr_coalesce_store() wants sscanf() to parse one number,
>>>> so expect 1 from sscanf(), not any int except -1.
>>>>
>>>> While on it, fix typo in %du by using just %d,
>>>> as this interface expects %d or %d\n.
>>>> Latter made scripts/checkpatch.pl complain,
>>>> so use kstrtoint() instead of sscanf().
>>>>
>>>> Fixes: 268e2519f5b7 ("dmaengine: ioatdma: Add intr_coalesce sysfs entry")
>>>> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
>>>> ---
>>>>    drivers/dma/ioat/sysfs.c | 2 +-
>>>>    1 file changed, 1 insertion(+), 1 deletion(-)
>>>>
>>>> diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c
>>>> index e796ddb5383f..f59df569956a 100644
>>>> --- a/drivers/dma/ioat/sysfs.c
>>>> +++ b/drivers/dma/ioat/sysfs.c
>>>> @@ -144,7 +144,7 @@ size_t count)
>>>>        int intr_coalesce = 0;
>>>>        struct ioatdma_chan *ioat_chan = to_ioat_chan(c);
>>>>    -    if (sscanf(page, "%du", &intr_coalesce) != -1) {
>>>> +    if (!kstrtoint(page, 10, &intr_coalesce)) {
>>>
>>> looks good. We can probably use kstrtouint() since we are expecting a positive number always.
>>
>> This would break `return -EINVAL;` below
> 
> Shouldn't we just drop the < 0 compare since it's no longer needed?

Wouldn't that change behavior shown to userspace from return -EINVAL
on negative int input to return count?

Re: [PATCH] clk: samsung: exynos5410: fix refcount leak

[Alexander A. Klimov]

On 5/30/26 18:26, Krzysztof Kozlowski wrote:
> On 26/05/2026 08:13, Alexander A. Klimov wrote:
>> Every value returned from of_clk_get() is supposed to be cleaned up
>> via clk_put() once not needed anymore.
>>
>> Fixes: be95d2c7d918 ("clk: samsung: Add support for EPLL on exynos5410")
>> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
> 
> 
> Does not apply - you messed somehow sending these.

Strange... copy&paste from
https://lore.kernel.org/all/20260526061321.6123-1-grandmaster@al2klimov.de/
(From: ... 2.54.0) applies to Linus' master.

Wait... ! Don't say because I fired all my compiled patches
at once via git-send-email(1), they assembled to one thread?
🙈

[PATCH v2] clk: tegra: tegra124-emc: fix krealloc() memory leak

[Alexander A. Klimov]

Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:

    MEM = krealloc(MEM, SZ, GFP);

If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:

    TMP = krealloc(MEM, SZ, GFP);
    if (!TMP) return;
    MEM = TMP;

Fixes: 888ca40e2843 ("clk: tegra: emc: Support multiple RAM codes")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 v2: Separate variable declaration/init
 v2: While on it, enhance variable name
 v2: While on it, explicit variable type
 v2: While on it, re-order variables (reverse Xmas tree)

 [✓] scripts/checkpatch.pl --strict
 [✓] allmodconfig compiled (i686, LLVM)
 [✓] localyesconfig booted (IBM T43)

 Note to myself: use --in-reply-to=ahilgKKwkttOd9H6@orome

 drivers/clk/tegra/clk-tegra124-emc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
index f3b2c96fdcfc..81e4c02a807c 100644
--- a/drivers/clk/tegra/clk-tegra124-emc.c
+++ b/drivers/clk/tegra/clk-tegra124-emc.c
@@ -445,15 +445,17 @@ static int load_timings_from_dt(struct tegra_clk_emc *tegra,
 {
 	struct emc_timing *timings_ptr;
 	int child_count = of_get_child_count(node);
+	struct emc_timing *timings;
 	int i = 0, err;
 	size_t size;
 
 	size = (tegra->num_timings + child_count) * sizeof(struct emc_timing);
 
-	tegra->timings = krealloc(tegra->timings, size, GFP_KERNEL);
-	if (!tegra->timings)
+	timings = krealloc(tegra->timings, size, GFP_KERNEL);
+	if (!timings)
 		return -ENOMEM;
 
+	tegra->timings = timings;
 	timings_ptr = tegra->timings + tegra->num_timings;
 	tegra->num_timings += child_count;
 
-- 
2.54.0

Re: [PATCH] dmaengine: ioatdma: use !kstrtoint(), not sscanf()!=-1

[Dave Jiang]

On 5/31/26 1:56 AM, Alexander A. Klimov wrote:
> 
> 
> On 5/28/26 22:06, Dave Jiang wrote:
>>
>>
>> On 5/26/26 11:06 AM, Alexander A. Klimov wrote:
>>>
>>>
>>> On 5/26/26 16:49, Dave Jiang wrote:
>>>>
>>>>
>>>> On 5/25/26 11:13 PM, Alexander A. Klimov wrote:
>>>>> Depending on the user input, sscanf() may return 0 for 0 success.
>>>>> But intr_coalesce_store() wants sscanf() to parse one number,
>>>>> so expect 1 from sscanf(), not any int except -1.
>>>>>
>>>>> While on it, fix typo in %du by using just %d,
>>>>> as this interface expects %d or %d\n.
>>>>> Latter made scripts/checkpatch.pl complain,
>>>>> so use kstrtoint() instead of sscanf().
>>>>>
>>>>> Fixes: 268e2519f5b7 ("dmaengine: ioatdma: Add intr_coalesce sysfs entry")
>>>>> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
>>>>> ---
>>>>>    drivers/dma/ioat/sysfs.c | 2 +-
>>>>>    1 file changed, 1 insertion(+), 1 deletion(-)
>>>>>
>>>>> diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c
>>>>> index e796ddb5383f..f59df569956a 100644
>>>>> --- a/drivers/dma/ioat/sysfs.c
>>>>> +++ b/drivers/dma/ioat/sysfs.c
>>>>> @@ -144,7 +144,7 @@ size_t count)
>>>>>        int intr_coalesce = 0;
>>>>>        struct ioatdma_chan *ioat_chan = to_ioat_chan(c);
>>>>>    -    if (sscanf(page, "%du", &intr_coalesce) != -1) {
>>>>> +    if (!kstrtoint(page, 10, &intr_coalesce)) {
>>>>
>>>> looks good. We can probably use kstrtouint() since we are expecting a positive number always.
>>>
>>> This would break `return -EINVAL;` below
>>
>> Shouldn't we just drop the < 0 compare since it's no longer needed?
> 
> Wouldn't that change behavior shown to userspace from return -EINVAL
> on negative int input to return count?

No a negative value would trigger parsing error and return -EINVAL. Same behavior for user.