clkdev: use clk_hw internally

clk_add_alias() calls clk_get() followed by clk_put() but in between
those two calls it saves away the struct clk pointer to a clk_lookup
structure. This leaves the 'clk' member of the clk_lookup pointing at
freed memory on configurations where CONFIG_COMMON_CLK=y. This is a
problem because clk_get_sys() will eventually try to dereference the
freed pointer by calling __clk_get_hw() on it. Fix this by saving away
the struct clk_hw pointer instead of the struct clk pointer so that when
we try to create a per-user struct clk in clk_get_sys() we don't
dereference a junk pointer.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

diff --git a/drivers/clk/clkdev.c b/drivers/clk/clkdev.c
index 1fcb6ef2cdacd75afe77257eec3da8d769052505..1bb120a3855f493ff3da739539347ef65ebfe2b1 100644 (file)
--- a/drivers/clk/clkdev.c
+++ b/drivers/clk/clkdev.c
@@ -177,7 +177,7 @@ struct clk *clk_get_sys(const char *dev_id, const char *con_id)
        if (!cl)
                goto out;
 
-       clk = __clk_create_clk(__clk_get_hw(cl->clk), dev_id, con_id);
+       clk = __clk_create_clk(cl->clk_hw, dev_id, con_id);
        if (IS_ERR(clk))
                goto out;
 
@@ -215,18 +215,26 @@ void clk_put(struct clk *clk)
 }
 EXPORT_SYMBOL(clk_put);
 
-void clkdev_add(struct clk_lookup *cl)
+static void __clkdev_add(struct clk_lookup *cl)
 {
        mutex_lock(&clocks_mutex);
        list_add_tail(&cl->node, &clocks);
        mutex_unlock(&clocks_mutex);
 }
+
+void clkdev_add(struct clk_lookup *cl)
+{
+       if (!cl->clk_hw)
+               cl->clk_hw = __clk_get_hw(cl->clk);
+       __clkdev_add(cl);
+}
 EXPORT_SYMBOL(clkdev_add);
 
 void __init clkdev_add_table(struct clk_lookup *cl, size_t num)
 {
        mutex_lock(&clocks_mutex);
        while (num--) {
+               cl->clk_hw = __clk_get_hw(cl->clk);
                list_add_tail(&cl->node, &clocks);
                cl++;
        }
@@ -243,7 +251,7 @@ struct clk_lookup_alloc {
 };
 
 static struct clk_lookup * __init_refok
-vclkdev_alloc(struct clk *clk, const char *con_id, const char *dev_fmt,
+vclkdev_alloc(struct clk_hw *hw, const char *con_id, const char *dev_fmt,
        va_list ap)
 {
        struct clk_lookup_alloc *cla;
@@ -252,7 +260,7 @@ vclkdev_alloc(struct clk *clk, const char *con_id, const char *dev_fmt,
        if (!cla)
                return NULL;
 
-       cla->cl.clk = clk;
+       cla->cl.clk_hw = hw;
        if (con_id) {
                strlcpy(cla->con_id, con_id, sizeof(cla->con_id));
                cla->cl.con_id = cla->con_id;
@@ -273,7 +281,7 @@ clkdev_alloc(struct clk *clk, const char *con_id, const char *dev_fmt, ...)
        va_list ap;
 
        va_start(ap, dev_fmt);
-       cl = vclkdev_alloc(clk, con_id, dev_fmt, ap);
+       cl = vclkdev_alloc(__clk_get_hw(clk), con_id, dev_fmt, ap);
        va_end(ap);
 
        return cl;
@@ -334,7 +342,7 @@ int clk_register_clkdev(struct clk *clk, const char *con_id,
                return PTR_ERR(clk);
 
        va_start(ap, dev_fmt);
-       cl = vclkdev_alloc(clk, con_id, dev_fmt, ap);
+       cl = vclkdev_alloc(__clk_get_hw(clk), con_id, dev_fmt, ap);
        va_end(ap);
 
        if (!cl)
@@ -365,8 +373,8 @@ int clk_register_clkdevs(struct clk *clk, struct clk_lookup *cl, size_t num)
                return PTR_ERR(clk);
 
        for (i = 0; i < num; i++, cl++) {
-               cl->clk = clk;
-               clkdev_add(cl);
+               cl->clk_hw = __clk_get_hw(clk);
+               __clkdev_add(cl);
        }
 
        return 0;

diff --git a/include/linux/clkdev.h b/include/linux/clkdev.h
index 94bad77eeb4a19d4fbfeef6461a103f5b7e9dbcc..3003afad46c9ab28f5c2b03688e27e0e6e8ff968 100644 (file)
--- a/include/linux/clkdev.h
+++ b/include/linux/clkdev.h
@@ -22,6 +22,7 @@ struct clk_lookup {
        const char              *dev_id;
        const char              *con_id;
        struct clk              *clk;
+       struct clk_hw           *clk_hw;
 };
 
 #define CLKDEV_INIT(d, n, c)   \