Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753466AbbBETam (ORCPT ); Thu, 5 Feb 2015 14:30:42 -0500 Received: from smtp.codeaurora.org ([198.145.11.231]:34342 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750971AbbBETal (ORCPT ); Thu, 5 Feb 2015 14:30:41 -0500 Message-ID: <54D3C4E0.80608@codeaurora.org> Date: Thu, 05 Feb 2015 11:30:40 -0800 From: Stephen Boyd User-Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Alban Browaeys , Tomeu Vizoso , Mike Turquette CC: linux-kernel@vger.kernel.org, Alban Browaeys Subject: Re: [PATCH 1/2] clk: Fix __clk_get access to already freed owner field. References: <1423160690-7853-1-git-send-email-prahal@yahoo.com> In-Reply-To: <1423160690-7853-1-git-send-email-prahal@yahoo.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2321 Lines: 75 On 02/05/15 10:24, Alban Browaeys wrote: > On the second call to __set_clk_parents from of_clk_set_defaults, here > when registering the second fimc device the kernel OOPS in an "unhandled > paging request at virtual address 6b6b6b77". This in __clk_get when > dereferencing clk->owner. > > Move the clk free in the kref managed _clk_release call instead of > plain __clk_put. > > Fixes: 035a61c314eb ("clk: Make clk API return per-user struct clk > instances) > > Signed-off-by: Alban Browaeys > --- > drivers/clk/clk.c | 17 +++++++++-------- > 1 file changed, 9 insertions(+), 8 deletions(-) > > diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c > index df94668..8f33722 100644 > --- a/drivers/clk/clk.c > +++ b/drivers/clk/clk.c > @@ -2485,15 +2485,18 @@ EXPORT_SYMBOL_GPL(clk_register); > */ > static void __clk_release(struct kref *ref) > { > - struct clk_core *clk = container_of(ref, struct clk_core, ref); > - int i = clk->num_parents; > + struct clk_core *core = container_of(ref, struct clk_core, ref); > + struct clk *clk = container_of(&core, struct clk, core); How does this work? struct clk_core doesn't have a struct clk inside it. > + int i = core->num_parents; > > - kfree(clk->parents); > + kfree(core->parents); > while (--i >= 0) > - kfree_const(clk->parent_names[i]); > + kfree_const(core->parent_names[i]); We don't have kfree_const() in the clk-next tree so please resend based on clk-next, not linux-next. > + > + kfree(core->parent_names); > + kfree_const(core->name); > + kfree(core); > > - kfree(clk->parent_names); > - kfree_const(clk->name); > kfree(clk); > } > > @@ -2671,8 +2674,6 @@ void __clk_put(struct clk *clk) > clk_prepare_unlock(); > > module_put(owner); > - > - kfree(clk); > } > > /*** clk rate change notifiers ***/ I'm still confused. Care to send the actual backtrace and describe which hardware you're running on (perhaps some dts file to look at)? -- Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a Linux Foundation Collaborative Project -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/