Re: [PATCH v2] clocksource/drivers/timer-imx-gpt: fix resource leak on init error paths

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] clocksource: timer-imx-gpt: system hang on error path due to clk_put() on active clocks
- [High] timer-imx-gpt: ID Use-After-Free of IRQ number on initialization error path
- [Medium] clocksource: memory and ioremap leak on early timer init failure
--

commit cb103e21afbdcd2ca471ec6f0a4a7ac98ff0a6eb
Author: Haotian Zhang <vulab@iscas.ac.cn>

clocksource/drivers/timer-imx-gpt: fix resource leak on init error paths

This commit attempts to fix a memory and mapping leak in the initialization
error paths of the i.MX GPT timer driver by reorganizing the cleanup
labels. It leaves the timer mapping intact if late initialization fails
because subsystems may already be registered and actively using it.

> diff --git a/drivers/clocksource/timer-imx-gpt.c b/drivers/clocksource/timer-imx-gpt.c
> --- a/drivers/clocksource/timer-imx-gpt.c
> +++ b/drivers/clocksource/timer-imx-gpt.c

[ ... ]

> @@ -455,12 +455,22 @@ static int __init mxc_timer_init_dt(struct device_node *np,  enum imx_gpt_type t
>  
>  	ret = _mxc_timer_init(imxtm);
>  	if (ret)
> -		goto err_kfree;
> +		goto err_irq;
>  
>  	initialized = 1;
>  
>  	return 0;
>  
> +err_irq:
> +	if (!IS_ERR_OR_NULL(imxtm->clk_per))
> +		clk_put(imxtm->clk_per);

[Severity: High]
Could this lead to a system hang if the provider module is unloaded?

If _mxc_timer_init() fails late (after sched_clock_register() or
clockevents_config_and_register()), the clocks are still actively in use
by those subsystems.

Calling clk_put() will drop the module reference to the clock provider,
potentially allowing it to be unloaded and disabling the hardware clocks
while the registered subsystems are still accessing them.

> +	if (!IS_ERR_OR_NULL(imxtm->clk_ipg))
> +		clk_put(imxtm->clk_ipg);
> +	irq_dispose_mapping(imxtm->irq);

[Severity: High]
Is it safe to dispose the IRQ mapping here if mxc_clockevent_init() has
already registered the clockevent device?

The clockevent device remains registered and the clockevents core retains
a reference to this IRQ.

If this virq is freed and subsequently reallocated to another driver via
irq_create_mapping(), could core operations like irq_set_affinity()
inadvertently alter the unrelated driver's IRQ state?

> +	return ret;

[Severity: Medium]
If _mxc_timer_init() fails early (for example, if it fails to get clk_per
and returns before registering any subsystems), does this return path leak
the imxtm allocation and the ioremap mapping?

The new err_irq label returns directly without cascading down to err_unmap
and err_kfree.

> +
> +err_unmap:
> +	iounmap(imxtm->base);
>  err_kfree:
>  	kfree(imxtm);
>  	return ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009022818.3025610-1-vulab@iscas.ac.cn?part=1