kernel.git/drivers/clk/clk-devres.c, branch linux-4.19.y

clk: Fix slab-out-of-bounds error in devm_clk_release()

2024-11-08T15:19:20Z

commit 66fbfb35da47f391bdadf9fa7ceb88af4faa9022 upstream. Problem can be reproduced by unloading snd_soc_simple_card, because in devm_get_clk_from_child() devres data is allocated as `struct clk`, but devm_clk_release() expects devres data to be `struct devm_clk_state`. KASAN report: ================================================================== BUG: KASAN: slab-out-of-bounds in devm_clk_release+0x20/0x54 Read of size 8 at addr ffffff800ee09688 by task (udev-worker)/287 Call trace: dump_backtrace+0xe8/0x11c show_stack+0x1c/0x30 dump_stack_lvl+0x60/0x78 print_report+0x150/0x450 kasan_report+0xa8/0xf0 __asan_load8+0x78/0xa0 devm_clk_release+0x20/0x54 release_nodes+0x84/0x120 devres_release_all+0x144/0x210 device_unbind_cleanup+0x1c/0xac really_probe+0x2f0/0x5b0 __driver_probe_device+0xc0/0x1f0 driver_probe_device+0x68/0x120 __driver_attach+0x140/0x294 bus_for_each_dev+0xec/0x160 driver_attach+0x38/0x44 bus_add_driver+0x24c/0x300 driver_register+0xf0/0x210 __platform_driver_register+0x48/0x54 asoc_simple_card_init+0x24/0x1000 [snd_soc_simple_card] do_one_initcall+0xac/0x340 do_init_module+0xd0/0x300 load_module+0x2ba4/0x3100 __do_sys_init_module+0x2c8/0x300 __arm64_sys_init_module+0x48/0x5c invoke_syscall+0x64/0x190 el0_svc_common.constprop.0+0x124/0x154 do_el0_svc+0x44/0xdc el0_svc+0x14/0x50 el0t_64_sync_handler+0xec/0x11c el0t_64_sync+0x14c/0x150 Allocated by task 287: kasan_save_stack+0x38/0x60 kasan_set_track+0x28/0x40 kasan_save_alloc_info+0x20/0x30 __kasan_kmalloc+0xac/0xb0 __kmalloc_node_track_caller+0x6c/0x1c4 __devres_alloc_node+0x44/0xb4 devm_get_clk_from_child+0x44/0xa0 asoc_simple_parse_clk+0x1b8/0x1dc [snd_soc_simple_card_utils] simple_parse_node.isra.0+0x1ec/0x230 [snd_soc_simple_card] simple_dai_link_of+0x1bc/0x334 [snd_soc_simple_card] __simple_for_each_link+0x2ec/0x320 [snd_soc_simple_card] asoc_simple_probe+0x468/0x4dc [snd_soc_simple_card] platform_probe+0x90/0xf0 really_probe+0x118/0x5b0 __driver_probe_device+0xc0/0x1f0 driver_probe_device+0x68/0x120 __driver_attach+0x140/0x294 bus_for_each_dev+0xec/0x160 driver_attach+0x38/0x44 bus_add_driver+0x24c/0x300 driver_register+0xf0/0x210 __platform_driver_register+0x48/0x54 asoc_simple_card_init+0x24/0x1000 [snd_soc_simple_card] do_one_initcall+0xac/0x340 do_init_module+0xd0/0x300 load_module+0x2ba4/0x3100 __do_sys_init_module+0x2c8/0x300 __arm64_sys_init_module+0x48/0x5c invoke_syscall+0x64/0x190 el0_svc_common.constprop.0+0x124/0x154 do_el0_svc+0x44/0xdc el0_svc+0x14/0x50 el0t_64_sync_handler+0xec/0x11c el0t_64_sync+0x14c/0x150 The buggy address belongs to the object at ffffff800ee09600 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 136 bytes inside of 256-byte region [ffffff800ee09600, ffffff800ee09700) The buggy address belongs to the physical page: page:000000002d97303b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4ee08 head:000000002d97303b order:1 compound_mapcount:0 compound_pincount:0 flags: 0x10200(slab|head|zone=0) raw: 0000000000010200 0000000000000000 dead000000000122 ffffff8002c02480 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff800ee09580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff800ee09600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffff800ee09680: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff800ee09700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff800ee09780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Fixes: abae8e57e49a ("clk: generalize devm_clk_get() a bit") Signed-off-by: Andrey Skvortsov Link: https://lore.kernel.org/r/20230805084847.3110586-1-andrej.skvortzov@gmail.com Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman

clk: Fix pointer casting to prevent oops in devm_clk_release()

2024-11-08T15:19:20Z

commit 8b3d743fc9e2542822826890b482afabf0e7522a upstream. The release function is called with a pointer to the memory returned by devres_alloc(). I was confused about that by the code before the generalization that used a struct clk **ptr. Reported-by: Marek Szyprowski Fixes: abae8e57e49a ("clk: generalize devm_clk_get() a bit") Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20220620171815.114212-1-u.kleine-koenig@pengutronix.de Tested-by: Marek Szyprowski Tested-by: Linux Kernel Functional Testing Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman

clk: Provide new devm_clk helpers for prepared and enabled clocks

2024-11-08T15:19:18Z

[ Upstream commit 7ef9651e9792b08eb310c6beb202cbc947f43cab ] When a driver keeps a clock prepared (or enabled) during the whole lifetime of the driver, these helpers allow to simplify the drivers. Reviewed-by: Jonathan Cameron Reviewed-by: Alexandru Ardelean Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20220520075737.758761-4-u.kleine-koenig@pengutronix.de Signed-off-by: Stephen Boyd Stable-dep-of: a6191a3d1811 ("gpio: aspeed: Use devm_clk api to manage clock source") Signed-off-by: Sasha Levin

clk: generalize devm_clk_get() a bit

2024-11-08T15:19:18Z

[ Upstream commit abae8e57e49aa75f6db76aa866c775721523908f ] Allow to add an exit hook to devm managed clocks. Also use clk_get_optional() in devm_clk_get_optional instead of open coding it. The generalisation will be used in the next commit to add some more devm_clk helpers. Reviewed-by: Jonathan Cameron Reviewed-by: Alexandru Ardelean Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20220520075737.758761-3-u.kleine-koenig@pengutronix.de Signed-off-by: Stephen Boyd Stable-dep-of: a6191a3d1811 ("gpio: aspeed: Use devm_clk api to manage clock source") Signed-off-by: Sasha Levin

clk: Add (devm_)clk_get_optional() functions

2024-11-08T15:19:18Z

[ Upstream commit 60b8f0ddf1a927ef02141a6610fd52575134f821 ] This adds clk_get_optional() and devm_clk_get_optional() functions to get optional clocks. They behave the same as (devm_)clk_get() except where there is no clock producer. In this case, instead of returning -ENOENT, the function returns NULL. This makes error checking simpler and allows clk_prepare_enable, etc to be called on the returned reference without additional checks. Signed-off-by: Phil Edworthy Reviewed-by: Andy Shevchenko Cc: Russell King [sboyd@kernel.org: Document in devres.txt] Signed-off-by: Stephen Boyd Stable-dep-of: a6191a3d1811 ("gpio: aspeed: Use devm_clk api to manage clock source") Signed-off-by: Sasha Levin

clk: add managed version of clk_bulk_get

2017-06-02T22:37:49Z

This patch introduces the managed version of clk_bulk_get. Cc: Michael Turquette Cc: Stephen Boyd Cc: Russell King Cc: Geert Uytterhoeven Cc: "Rafael J. Wysocki" Cc: Viresh Kumar Cc: Mark Brown Cc: Shawn Guo Cc: Fabio Estevam Cc: Sascha Hauer Cc: Anson Huang Cc: Robin Gong Cc: Bai Ping Cc: Leonard Crestez Cc: Octavian Purdila Signed-off-by: Dong Aisheng Signed-off-by: Stephen Boyd

clk: add devm_get_clk_from_child() API

2016-12-09T00:37:33Z

Some driver is using this type of DT bindings for clock (more detail, see ${LINUX}/Documentation/devicetree/bindings/sound/simple-card.txt). sound_soc { ... cpu { clocks = <&xxx>; ... }; codec { clocks = <&xxx>; ... }; }; Current driver in this case uses of_clk_get() for each node, but there is no devm_of_clk_get() today. OTOH, the problem of having devm_of_clk_get() is that it encourages the use of of_clk_get() when clk_get() is more desirable. Thus, this patch adds new devm_get_clk_from_chile() which explicitly reads as get a clock from a child node of this device. By this function, we can also use this type of DT bindings sound_soc { clocks = <&xxx>, <&xxx>; clock-names = "cpu", "codec"; clock-ranges; ... cpu { ... }; codec { ... }; }; Signed-off-by: Kuninori Morimoto [sboyd@codeurora.org: Rename subject to clk + add API] Signed-off-by: Stephen Boyd

ARM: 7537/1: clk: Fix release in devm_clk_put()

2012-09-19T20:51:27Z

Surprisingly devres_destroy() doesn't call the destructor for the resource it is destroying, use the newly added devres_release() instead to fix this. Signed-off-by: Mark Brown Signed-off-by: Russell King

ARM: 7534/1: clk: Make the managed clk functions generically available

2012-09-15T20:55:27Z

The managed clk functions are currently only available when the generic clk lookup framework is build. But the managed clk functions are merely wrappers around clk_get and clk_put and do not depend on any specifics of the generic lookup functions and there are still quite a few custom implementations of the clk API. So make the managed functions available whenever the clk API is implemented. The patch also removes the custom implementation of devm_clk_get for the coldfire platform. Signed-off-by: Lars-Peter Clausen Acked-by: Greg Ungerer Signed-off-by: Russell King