2022-05-12 12:51:52

by Genjian

Subject: [PATCH] ep93xx: clock: Do not return the address of the freed memory

Although there will be basic judgments of IS_ERR() on this return value
elsewhere,but I think it can be replaced by the actual error return
value of clk_register.

Signed-off-by: Genjian Zhang <[email protected]>
---
arch/arm/mach-ep93xx/clock.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mach-ep93xx/clock.c b/arch/arm/mach-ep93xx/clock.c
index 4fa6ea5461b7..762328de4bce 100644
--- a/arch/arm/mach-ep93xx/clock.c
+++ b/arch/arm/mach-ep93xx/clock.c
@@ -345,9 +345,10 @@ static struct clk_hw *clk_hw_register_ddiv(const char *name,
psc->hw.init = &init;

clk = clk_register(NULL, &psc->hw);
- if (IS_ERR(clk))
+ if (IS_ERR(clk)) {
kfree(psc);
-
+ return (struct clk_hw *)clk;
+ }
return &psc->hw;
}

@@ -452,9 +453,10 @@ static struct clk_hw *clk_hw_register_div(const char *name,
psc->hw.init = &init;

clk = clk_register(NULL, &psc->hw);
- if (IS_ERR(clk))
+ if (IS_ERR(clk)) {
kfree(psc);
-
+ return (struct clk_hw *)clk;
+ }
return &psc->hw;
}

--
2.25.1

2022-05-16 08:37:05

by Alexander Sverdlin

Subject: Re: [PATCH] ep93xx: clock: Do not return the address of the freed memory

Hello Genjian!

Thank you for the patch!

On 12/05/2022 09:59, Genjian Zhang wrote:
> Although there will be basic judgments of IS_ERR() on this return value
> elsewhere,but I think it can be replaced by the actual error return
> value of clk_register.

Actually this fixes very similar use-after-free which I missed in
commit 9645ccc7bd7a1.

I propose to add
Fixes: 9645ccc7bd7a1 ("ep93xx: clock: convert in-place to COMMON_CLK")

> Signed-off-by: Genjian Zhang <[email protected]>
> ---
> arch/arm/mach-ep93xx/clock.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/arch/arm/mach-ep93xx/clock.c b/arch/arm/mach-ep93xx/clock.c
> index 4fa6ea5461b7..762328de4bce 100644
> --- a/arch/arm/mach-ep93xx/clock.c
> +++ b/arch/arm/mach-ep93xx/clock.c
> @@ -345,9 +345,10 @@ static struct clk_hw *clk_hw_register_ddiv(const char *name,
> psc->hw.init = &init;
>
> clk = clk_register(NULL, &psc->hw);
> - if (IS_ERR(clk))
> + if (IS_ERR(clk)) {
> kfree(psc);
> -
> + return (struct clk_hw *)clk;

Could you please use ERR_CAST()?

> + }
> return &psc->hw;
> }
>
> @@ -452,9 +453,10 @@ static struct clk_hw *clk_hw_register_div(const char *name,
> psc->hw.init = &init;
>
> clk = clk_register(NULL, &psc->hw);
> - if (IS_ERR(clk))
> + if (IS_ERR(clk)) {
> kfree(psc);
> -
> + return (struct clk_hw *)clk;

same as above

> + }
> return &psc->hw;
> }
>