| Message ID | 20220531124554.275682-3-nuno.sa@analog.com (mailing list archive) |
|---|---|
| State | Superseded, archived |
| Headers | show |
| Series | Dynamic OF and use after free related fixes | expand |
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c index f00d4c1158d7..536c3915de71 100644 --- a/drivers/clk/clk.c +++ b/drivers/clk/clk.c @@ -4191,6 +4191,7 @@ void clk_unregister(struct clk *clk) pr_warn("%s: unregistering protected clock: %s\n", __func__, clk->core->name); + clk_core_unlink_consumer(clk); kref_put(&clk->core->ref, __clk_release); free_clk(clk); unlock:
When a clk_hw is registered we add a struct clk handle to it's consumers list. This handle is created in '__clk_register()' per the 'alloc_clk()' call. As such, we need to remove this handle when unregistering the clk_hw. This can actually lead to a use after free if a provider gets removed before a consumer. When removing the consumer, '__clk_put()' is called and that will do 'hlist_del(&clk->clks_node)' which will touch in already freed memory. Fixes: 1df4046a93e08 ("clk: Combine __clk_get() and __clk_create_clk()") Signed-off-by: Nuno Sá <nuno.sa@analog.com> --- drivers/clk/clk.c | 1 + 1 file changed, 1 insertion(+)