If of_clk_add_provider() fails in ca8210_register_ext_clock(), it calls clk_unregister() to release priv->clk and returns an error. However, the caller ca8210_probe() then calls ca8210_remove(), where priv->clk is freed again in ca8210_unregister_ext_clock(). In this case, a use-after-free may happen in the second time we call clk_unregister(). Fix this by removing the first clk_unregister(). Also, priv->clk could be an error code on failure of clk_register_fixed_rate(). Use IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock(). Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") Signed-off-by: Dinghao Liu <dinghao.liu@xxxxxxxxxx> --- Changelog: v2: -Remove the first clk_unregister() instead of nulling priv->clk. --- drivers/net/ieee802154/ca8210.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c index aebb19f1b3a4..b35c6f59bd1a 100644 --- a/drivers/net/ieee802154/ca8210.c +++ b/drivers/net/ieee802154/ca8210.c @@ -2759,7 +2759,6 @@ static int ca8210_register_ext_clock(struct spi_device *spi) } ret = of_clk_add_provider(np, of_clk_src_simple_get, priv->clk); if (ret) { - clk_unregister(priv->clk); dev_crit( &spi->dev, "Failed to register external clock as clock provider\n" @@ -2780,7 +2779,7 @@ static void ca8210_unregister_ext_clock(struct spi_device *spi) { struct ca8210_priv *priv = spi_get_drvdata(spi); - if (!priv->clk) + if (IS_ERR_OR_NULL(priv->clk)) return of_clk_del_provider(spi->dev.of_node); -- 2.17.1