[PATCH v2] clocksource/drivers/timer-imx-gpt: fix resource leak on init error paths

[PATCH v2] clocksource/drivers/timer-imx-gpt: fix resource leak on init error paths

[Haotian Zhang]

mxc_timer_init_dt() maps the timer registers with of_iomap() and obtains
the ipg and per clocks with of_clk_get_by_name(), but every error path
jumps to err_kfree, which only frees the imx_timer structure.  The
ioremap'd mapping, the clock references and the mapping created by
irq_of_parse_and_map() are leaked when irq_of_parse_and_map() or
_mxc_timer_init() fails.

Release the ioremap mapping when irq_of_parse_and_map() fails, and drop
the clock references and the IRQ mapping when _mxc_timer_init() fails.

_mxc_timer_init() can fail after mxc_clocksource_init() has registered
the sched_clock and the clocksource, and after mxc_clockevent_init() has
registered the clock event device.  Those subsystems keep using
imxtm->base and imxtm, so neither the mapping nor imxtm itself may be
released on that path; request_irq() cannot have succeeded there, so
disposing the IRQ mapping is safe.

Fixes: 8051a993ce22 ("clocksource/drivers/timer-imx-gpt: Fix potential memory leak")
Assisted-by: DeepSeek-V4.1-Flash
Suggested-by: Frank Li <Frank.li@oss.nxp.com>
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
Changes in v2:
 - Dispose the IRQ mapping and drop the clock references when
   _mxc_timer_init() fails, instead of leaking the IRQ mapping.
 - Do not unmap imxtm->base nor free imxtm on that path: the sched_clock,
   the clocksource and the clock event device may already have been
   registered and keep using them.

 drivers/clocksource/timer-imx-gpt.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/clocksource/timer-imx-gpt.c b/drivers/clocksource/timer-imx-gpt.c
index 8335bd7f8c6c..8050f3b449ba 100644
--- a/drivers/clocksource/timer-imx-gpt.c
+++ b/drivers/clocksource/timer-imx-gpt.c
@@ -441,7 +441,7 @@ static int __init mxc_timer_init_dt(struct device_node *np,  enum imx_gpt_type t
 	imxtm->irq = irq_of_parse_and_map(np, 0);
 	if (imxtm->irq <= 0) {
 		ret = -EINVAL;
-		goto err_kfree;
+		goto err_unmap;
 	}
 
 	imxtm->clk_ipg = of_clk_get_by_name(np, "ipg");
@@ -455,12 +455,22 @@ static int __init mxc_timer_init_dt(struct device_node *np,  enum imx_gpt_type t
 
 	ret = _mxc_timer_init(imxtm);
 	if (ret)
-		goto err_kfree;
+		goto err_irq;
 
 	initialized = 1;
 
 	return 0;
 
+err_irq:
+	if (!IS_ERR_OR_NULL(imxtm->clk_per))
+		clk_put(imxtm->clk_per);
+	if (!IS_ERR_OR_NULL(imxtm->clk_ipg))
+		clk_put(imxtm->clk_ipg);
+	irq_dispose_mapping(imxtm->irq);
+	return ret;
+
+err_unmap:
+	iounmap(imxtm->base);
 err_kfree:
 	kfree(imxtm);
 	return ret;
-- 
2.25.1

Re: [PATCH v2] clocksource/drivers/timer-imx-gpt: fix resource leak on init error paths

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] clocksource: timer-imx-gpt: system hang on error path due to clk_put() on active clocks
- [High] timer-imx-gpt: ID Use-After-Free of IRQ number on initialization error path
- [Medium] clocksource: memory and ioremap leak on early timer init failure
--

commit cb103e21afbdcd2ca471ec6f0a4a7ac98ff0a6eb
Author: Haotian Zhang <vulab@iscas.ac.cn>

clocksource/drivers/timer-imx-gpt: fix resource leak on init error paths

This commit attempts to fix a memory and mapping leak in the initialization
error paths of the i.MX GPT timer driver by reorganizing the cleanup
labels. It leaves the timer mapping intact if late initialization fails
because subsystems may already be registered and actively using it.

> diff --git a/drivers/clocksource/timer-imx-gpt.c b/drivers/clocksource/timer-imx-gpt.c
> --- a/drivers/clocksource/timer-imx-gpt.c
> +++ b/drivers/clocksource/timer-imx-gpt.c

[ ... ]

> @@ -455,12 +455,22 @@ static int __init mxc_timer_init_dt(struct device_node *np,  enum imx_gpt_type t
>  
>  	ret = _mxc_timer_init(imxtm);
>  	if (ret)
> -		goto err_kfree;
> +		goto err_irq;
>  
>  	initialized = 1;
>  
>  	return 0;
>  
> +err_irq:
> +	if (!IS_ERR_OR_NULL(imxtm->clk_per))
> +		clk_put(imxtm->clk_per);

[Severity: High]
Could this lead to a system hang if the provider module is unloaded?

If _mxc_timer_init() fails late (after sched_clock_register() or
clockevents_config_and_register()), the clocks are still actively in use
by those subsystems.

Calling clk_put() will drop the module reference to the clock provider,
potentially allowing it to be unloaded and disabling the hardware clocks
while the registered subsystems are still accessing them.

> +	if (!IS_ERR_OR_NULL(imxtm->clk_ipg))
> +		clk_put(imxtm->clk_ipg);
> +	irq_dispose_mapping(imxtm->irq);

[Severity: High]
Is it safe to dispose the IRQ mapping here if mxc_clockevent_init() has
already registered the clockevent device?

The clockevent device remains registered and the clockevents core retains
a reference to this IRQ.

If this virq is freed and subsequently reallocated to another driver via
irq_create_mapping(), could core operations like irq_set_affinity()
inadvertently alter the unrelated driver's IRQ state?

> +	return ret;

[Severity: Medium]
If _mxc_timer_init() fails early (for example, if it fails to get clk_per
and returns before registering any subsystems), does this return path leak
the imxtm allocation and the ioremap mapping?

The new err_irq label returns directly without cascading down to err_unmap
and err_kfree.

> +
> +err_unmap:
> +	iounmap(imxtm->base);
>  err_kfree:
>  	kfree(imxtm);
>  	return ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009022818.3025610-1-vulab@iscas.ac.cn?part=1

Re: [PATCH v2] clocksource/drivers/timer-imx-gpt: fix resource leak on init error paths

[Krzysztof Kozlowski]

On Fri, 09 Oct 2026 10:28:18 +0800, Haotian Zhang wrote:
> mxc_timer_init_dt() maps the timer registers with of_iomap() and obtains
> the ipg and per clocks with of_clk_get_by_name(), but every error path
> jumps to err_kfree, which only frees the imx_timer structure.  The
> ioremap'd mapping, the clock references and the mapping created by
> irq_of_parse_and_map() are leaked when irq_of_parse_and_map() or
> _mxc_timer_init() fails.
> 
> Release the ioremap mapping when irq_of_parse_and_map() fails, and drop
> the clock references and the IRQ mapping when _mxc_timer_init() fails.
> 
> _mxc_timer_init() can fail after mxc_clocksource_init() has registered
> the sched_clock and the clocksource, and after mxc_clockevent_init() has
> registered the clock event device.  Those subsystems keep using
> imxtm->base and imxtm, so neither the mapping nor imxtm itself may be
> released on that path; request_irq() cannot have succeeded there, so
> disposing the IRQ mapping is safe.
> 
> Fixes: 8051a993ce22 ("clocksource/drivers/timer-imx-gpt: Fix potential memory leak")
> Assisted-by: DeepSeek-V4.1-Flash
> Suggested-by: Frank Li <Frank.li@oss.nxp.com>
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
> ---
> Changes in v2:
>  - Dispose the IRQ mapping and drop the clock references when
>    _mxc_timer_init() fails, instead of leaking the IRQ mapping.
>  - Do not unmap imxtm->base nor free imxtm on that path: the sched_clock,
>    the clocksource and the clock event device may already have been
>    registered and keep using them.
> 
>  drivers/clocksource/timer-imx-gpt.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 



Multiple things here:
1. Your team ignored completely previous feedback.

2. You use multiple identities with this email, thus I actually doubt we speak
   with actual person.

3. Finally, same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document usage of LLM and how what you should not do
if this was posted in a good faith.

Best regards,
Krzysztof