lkml.org 
[lkml]   [2015]   [Feb]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 1/2] clk: Fix __clk_get access to already freed owner field.
Date
On the second call to __set_clk_parents from of_clk_set_defaults, here
when registering the second fimc device the kernel OOPS in an "unhandled
paging request at virtual address 6b6b6b77". This in __clk_get when
dereferencing clk->owner.

Move the clk free in the kref managed _clk_release call instead of
plain __clk_put.

Fixes: 035a61c314eb ("clk: Make clk API return per-user struct clk
instances)

Signed-off-by: Alban Browaeys <prahal@yahoo.com>
---
drivers/clk/clk.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index df94668..8f33722 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -2485,15 +2485,18 @@ EXPORT_SYMBOL_GPL(clk_register);
*/
static void __clk_release(struct kref *ref)
{
- struct clk_core *clk = container_of(ref, struct clk_core, ref);
- int i = clk->num_parents;
+ struct clk_core *core = container_of(ref, struct clk_core, ref);
+ struct clk *clk = container_of(&core, struct clk, core);
+ int i = core->num_parents;

- kfree(clk->parents);
+ kfree(core->parents);
while (--i >= 0)
- kfree_const(clk->parent_names[i]);
+ kfree_const(core->parent_names[i]);
+
+ kfree(core->parent_names);
+ kfree_const(core->name);
+ kfree(core);

- kfree(clk->parent_names);
- kfree_const(clk->name);
kfree(clk);
}

@@ -2671,8 +2674,6 @@ void __clk_put(struct clk *clk)
clk_prepare_unlock();

module_put(owner);
-
- kfree(clk);
}

/*** clk rate change notifiers ***/
--
2.1.4


\
 
 \ /
  Last update: 2015-02-05 19:41    [W:0.058 / U:0.764 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site