2019-10-10 01:31:55

by Navid Emamdoost

Subject: [PATCH] clk: bcm2835: Fix memory leak in bcm2835_register_pll

In the implementation of bcm2835_register_pll(), the allocated memory
for pll should be released if devm_clk_hw_register() fails.

Fixes: b19f009d4510 ("clk: bcm2835: Migrate to clk_hw based registration and OF APIs")
Signed-off-by: Navid Emamdoost <[email protected]>
---
drivers/clk/bcm/clk-bcm2835.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 802e488fd3c3..99549642110a 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -1320,8 +1320,10 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
pll->hw.init = &init;

ret = devm_clk_hw_register(cprman->dev, &pll->hw);
- if (ret)
+ if (ret) {
+ kfree(pll);
return NULL;
+ }
return &pll->hw;
}

--
2.17.1

2019-10-10 07:08:19

by Alexander Stein

Subject: Re: [PATCH] clk: bcm2835: Fix memory leak in bcm2835_register_pll

Hello,

On Thursday, October 10, 2019, 3:30:58 AM CEST Navid Emamdoost wrote:
> In the implementation of bcm2835_register_pll(), the allocated memory
> for pll should be released if devm_clk_hw_register() fails.
>
> Fixes: b19f009d4510 ("clk: bcm2835: Migrate to clk_hw based registration and OF APIs")
> Signed-off-by: Navid Emamdoost <[email protected]>
> ---
> drivers/clk/bcm/clk-bcm2835.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
> index 802e488fd3c3..99549642110a 100644
> --- a/drivers/clk/bcm/clk-bcm2835.c
> +++ b/drivers/clk/bcm/clk-bcm2835.c
> @@ -1320,8 +1320,10 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
> pll->hw.init = &init;
>
> ret = devm_clk_hw_register(cprman->dev, &pll->hw);
> - if (ret)
> + if (ret) {
> + kfree(pll);
> return NULL;
> + }
> return &pll->hw;
> }

Eh, is pll freed at all, even in successful case? I failed to find a corresponding kfree().
The pointer itself is lost once the function returns.
The solution would rather be to use devm_kzalloc instead of kzalloc, like the other clocks
in e.g. bcm2835_register_pll()

Best regards,
Alexander