Received-SPF: pass (google.com: domain of linux-kernel+bounces-97709-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID: <b809a691de642231b687358eb4bc03aa.sboyd@kernel.org>
Content-Type: text/plain; charset="utf-8"
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
In-Reply-To: <20240302-linux-next-24-03-01-simple-clock-fixes-v1-1-25f348a5982b@linaro.org>
References: <20240302-linux-next-24-03-01-simple-clock-fixes-v1-0-25f348a5982b@linaro.org> <20240302-linux-next-24-03-01-simple-clock-fixes-v1-1-25f348a5982b@linaro.org>
Subject: Re: [PATCH 1/2] clk: Fix clk_core_get NULL dereference
From: Stephen Boyd <sboyd@kernel.org>
Cc: linux-clk@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-msm@vger.kernel.org, Bryan O'Donoghue <bryan.odonoghue@linaro.org>
To: Abel Vesa <abel.vesa@linaro.org>, Bjorn Andersson <andersson@kernel.org>, Bryan O'Donoghue <bryan.odonoghue@linaro.org>, Konrad Dybcio <konrad.dybcio@linaro.org>, Michael Turquette <mturquette@baylibre.com>, Rajendra Nayak <quic_rjendra@quicinc.com>
Date: Fri, 08 Mar 2024 16:36:13 -0800
User-Agent: alot/0.10

Quoting Bryan O'Donoghue (2024-03-01 16:52:14)
> It is possible for clk_core_get to dereference a NULL in the following
> sequence:
>=20
> clk_core_get()
>     of_clk_get_hw_from_clkspec()
>         __of_clk_get_hw_from_provider()
>             __clk_get_hw()
>=20
> __clk_get_hw() can return NULL which is dereferenced by clk_core_get() at
> hw->core.
>=20
> Prior to commit dde4eff47c82 ("clk: Look for parents with clkdev based
> clk_lookups") the check IS_ERR_OR_NULL() was performed which would have
> caught the NULL.
>=20
> Reading the description of this function it talks about returning NULL but
> that cannot be so at the moment.
>=20
> Update the function to check for hw before dereferencing it and return NU=
LL
> if hw is NULL.
>=20
> Fixes: dde4eff47c82 ("clk: Look for parents with clkdev based clk_lookups=
")
> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
> ---

I dug through a bunch of old patches and this looks right. I'm not sure
why a provider would ever return NULL though. A NULL pointer means that
the parent is never going to appear so we shouldn't treat this clk as
orphaned in case the clk needs to be clk_get()able and change parents.
This was all part of my plan to introduce a clk_parent_hw() clk op that
returns a pointer and then implement probe defer through clk_get() when
a clk is orphaned. A NULL clk also means a clk is optional and not
there.

Anyway, I've applied this to clk-next. I hope to send out the
clk_parent_hw clk op series soon.