[PATCH 0/3] media: Make sure clk_init_data is fully initialized

[PATCH 0/3] media: Make sure clk_init_data is fully initialized

[Geert Uytterhoeven]

	Hi all,

The clk_init_data structure contains several mutually-exclusive members
for different methods to specify the possible parents of a clock,
prompting drivers to initialize only the members they need.  However,
not initializing all members may cause subtle issues, which are only
exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is
enabled.

Hence this series aims to make sure all members are fully initialized,
to avoid such bugs, and to prevent future breakage when converting
drivers to a different method for specifying the parents.

Part One[1] fixed all cases that I identified to be real bugs, in
response to a crash I saw on BeagleBone Black.

This series is the media subpart of Part Two, which fixes remaining
cases that are currently harmless.  These are still fragile, and may
cause future breakage when converting drivers to a different method for
specifying the parents.

Thanks for your comments!

[1] "[PATCH treewide 0/5] clk: Make sure clk_init_data is fully
     initialized (part 1)"
    https://lore.kernel.org/cover.1787165329.git.geert+renesas@glider.be

Geert Uytterhoeven (3):
  media: cec: meson: ao-cec-g12a: Make sure clk_init_data is fully
    initialized
  media: microchip: Make sure clk_init_data is fully initialized
  media: samsung: exynos4-is: Make sure clk_init_data is fully
    initialized

 drivers/media/cec/platform/meson/ao-cec-g12a.c        | 2 +-
 drivers/media/platform/microchip/microchip-isc-clk.c  | 2 +-
 drivers/media/platform/samsung/exynos4-is/media-dev.c | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

-- 
2.43.0

Gr{oetje,eeting}s,

						Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
							    -- Linus Torvalds

[PATCH 1/3] media: cec: meson: ao-cec-g12a: Make sure clk_init_data is fully initialized

[Geert Uytterhoeven]

The clk_init_data structure contains several mutually-exclusive members
for different methods to specify the possible parents of a clock,
prompting drivers to initialize only the members they need.  However,
not initializing all members may cause subtle issues, which are only
exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is
enabled.

Make sure all members are fully initialized, to avoid such bugs, and to
prevent future breakage when converting drivers to a different method
for specifying the parents.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
Compile-tested only.
---
 drivers/media/cec/platform/meson/ao-cec-g12a.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/cec/platform/meson/ao-cec-g12a.c b/drivers/media/cec/platform/meson/ao-cec-g12a.c
index b175be3f2bf4de87..55bd0d416460f820 100644
--- a/drivers/media/cec/platform/meson/ao-cec-g12a.c
+++ b/drivers/media/cec/platform/meson/ao-cec-g12a.c
@@ -334,7 +334,7 @@ static int meson_ao_cec_g12a_setup_clk(struct meson_ao_cec_g12a_device *ao_cec)
 {
 	struct meson_ao_cec_g12a_dualdiv_clk *dualdiv_clk;
 	struct device *dev = &ao_cec->pdev->dev;
-	struct clk_init_data init;
+	struct clk_init_data init = {};
 	const char *parent_name;
 	struct clk *clk;
 	char *name;
-- 
2.43.0

[PATCH 2/3] media: microchip: Make sure clk_init_data is fully initialized

[Geert Uytterhoeven]

The clk_init_data structure contains several mutually-exclusive members
for different methods to specify the possible parents of a clock,
prompting drivers to initialize only the members they need.  However,
not initializing all members may cause subtle issues, which are only
exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is
enabled.

Make sure all members are fully initialized, to avoid such bugs, and to
prevent future breakage when converting drivers to a different method
for specifying the parents.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
Compile-tested only.
---
 drivers/media/platform/microchip/microchip-isc-clk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/microchip/microchip-isc-clk.c b/drivers/media/platform/microchip/microchip-isc-clk.c
index 24358d804e75d75c..65d5fb8019b341b8 100644
--- a/drivers/media/platform/microchip/microchip-isc-clk.c
+++ b/drivers/media/platform/microchip/microchip-isc-clk.c
@@ -231,7 +231,7 @@ static int isc_clk_register(struct isc_device *isc, unsigned int id)
 	struct regmap *regmap = isc->regmap;
 	struct device_node *np = isc->dev->of_node;
 	struct isc_clk *isc_clk;
-	struct clk_init_data init;
+	struct clk_init_data init = {};
 	const char *clk_name = np->name;
 	const char *parent_names[3];
 	int num_parents;
-- 
2.43.0

[PATCH 3/3] media: samsung: exynos4-is: Make sure clk_init_data is fully initialized

[Geert Uytterhoeven]

The clk_init_data structure contains several mutually-exclusive members
for different methods to specify the possible parents of a clock,
prompting drivers to initialize only the members they need.  However,
not initializing all members may cause subtle issues, which are only
exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is
enabled.

Make sure all members are fully initialized, to avoid such bugs, and to
prevent future breakage when converting drivers to a different method
for specifying the parents.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
Compile-tested only.
---
 drivers/media/platform/samsung/exynos4-is/media-dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/samsung/exynos4-is/media-dev.c b/drivers/media/platform/samsung/exynos4-is/media-dev.c
index 2e08c4435859e8d2..638babf52822113c 100644
--- a/drivers/media/platform/samsung/exynos4-is/media-dev.c
+++ b/drivers/media/platform/samsung/exynos4-is/media-dev.c
@@ -1313,7 +1313,7 @@ static int fimc_md_register_clk_provider(struct fimc_md *fmd)
 
 	for (i = 0; i < FIMC_MAX_CAMCLKS; i++) {
 		struct cam_clk *camclk = &cp->camclk[i];
-		struct clk_init_data init;
+		struct clk_init_data init = {};
 		const char *p_name;
 
 		ret = of_property_read_string_index(dev->of_node,
-- 
2.43.0

Re: [PATCH 3/3] media: samsung: exynos4-is: Make sure clk_init_data is fully initialized

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Double free and use-after-free of device node references in OF iterator loop.
--

--- Patch [3]: [PATCH 3/3] media: samsung: exynos4-is: Make sure clk_init_data is fully initialized ---
commit f3a10ad891243d9b897aed17537077a8bb8725bc
Author: Geert Uytterhoeven <geert+renesas@glider.be>

    media: samsung: exynos4-is: Make sure clk_init_data is fully initialized
    
    The clk_init_data structure contains mutually-exclusive members for
    specifying clock parents. This commit ensures all members are fully
    initialized to zero, preventing subtle bugs with uninitialized data.

> diff --git a/drivers/media/platform/samsung/exynos4-is/media-dev.c b/drivers/media/platform/samsung/exynos4-is/media-dev.c
> index 2e08c4435859e..638babf528221 100644
> --- a/drivers/media/platform/samsung/exynos4-is/media-dev.c
> +++ b/drivers/media/platform/samsung/exynos4-is/media-dev.c
> @@ -1313,7 +1313,7 @@ static int fimc_md_register_clk_provider(struct fimc_md *fmd)
>  
>  	for (i = 0; i < FIMC_MAX_CAMCLKS; i++) {
>  		struct cam_clk *camclk = &cp->camclk[i];
> -		struct clk_init_data init;
> +		struct clk_init_data init = {};
>  		const char *p_name;
>  
>  		ret = of_property_read_string_index(dev->of_node,

[Severity: High]
This is a pre-existing issue, but I noticed a potential double-free of device
node references elsewhere in this file.

Looking at fimc_md_parse_port_node(), it iterates over child nodes using the
scoped iterator macro:

drivers/media/platform/samsung/exynos4-is/media-dev.c:fimc_md_parse_port_node() {
    ...
	for_each_child_of_node_scoped(port, ep) {
		ret = fimc_md_parse_one_endpoint(fmd, ep);
		if (ret < 0)
			return ret;
	}
    ...
}

This macro automatically manages the reference counting for ep, dropping it
implicitly when the loop advances or exits.

However, inside fimc_md_parse_one_endpoint(), the code explicitly calls
of_node_put(ep) on all paths:

drivers/media/platform/samsung/exynos4-is/media-dev.c:fimc_md_parse_one_endpoint() {
    ...
	asd = v4l2_async_nf_add_fwnode_remote(&fmd->subdev_notifier,
					      of_fwnode_handle(ep),
					      struct v4l2_async_connection);

	of_node_put(ep);
    ...
}

Because the reference is already dropped in the helper function, wouldn't the
subsequent put by the iterator's loop advance or scope exit result in a
double-free and a use-after-free of the device node?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1787240035.git.geert+renesas@glider.be?part=3