Patch "clk: mediatek: fix double free in mtk_clk_register_pllfh()" has been added to the 6.6-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    clk: mediatek: fix double free in mtk_clk_register_pllfh()

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     clk-mediatek-fix-double-free-in-mtk_clk_register_pll.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit deff89507345abb19da2c893fa078de0c0cbb723
Author: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date:   Tue Oct 24 08:00:53 2023 +0300

    clk: mediatek: fix double free in mtk_clk_register_pllfh()
    
    [ Upstream commit bd54ccc0f147019dac38e7841876a7415459b875 ]
    
    The mtk_clk_register_pll_ops() currently frees the "pll" parameter.
    The function has two callers, mtk_clk_register_pll() and
    mtk_clk_register_pllfh().  The first one, the _pll() function relies on
    the free, but for the second _pllfh() function it causes a double free
    bug.
    
    Really the frees should be done in the caller because that's where
    the allocation is.
    
    Fixes: d7964de8a8ea ("clk: mediatek: Add new clock driver to handle FHCTL hardware")
    Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/cd7fa365-28cc-4c34-ac64-6da57c98baa6@moroto.mountain
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@xxxxxxxxxxxxx>
    Signed-off-by: Stephen Boyd <sboyd@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/clk/mediatek/clk-pll.c b/drivers/clk/mediatek/clk-pll.c
index a4eca5fd539c8..513ab6b1b3229 100644
--- a/drivers/clk/mediatek/clk-pll.c
+++ b/drivers/clk/mediatek/clk-pll.c
@@ -321,10 +321,8 @@ struct clk_hw *mtk_clk_register_pll_ops(struct mtk_clk_pll *pll,
 
 	ret = clk_hw_register(NULL, &pll->hw);
 
-	if (ret) {
-		kfree(pll);
+	if (ret)
 		return ERR_PTR(ret);
-	}
 
 	return &pll->hw;
 }
@@ -340,6 +338,8 @@ struct clk_hw *mtk_clk_register_pll(const struct mtk_pll_data *data,
 		return ERR_PTR(-ENOMEM);
 
 	hw = mtk_clk_register_pll_ops(pll, data, base, &mtk_pll_ops);
+	if (IS_ERR(hw))
+		kfree(pll);
 
 	return hw;
 }



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux