[PATCH] clk: Guard clk_round_rate() against error pointers

Praveen Talari <[email protected]>
Newsgroups org.kernel.vger.linux-clk,org.kernel.vger.linux-kernel
Message-ID <[email protected]>
clk_round_rate() only checks for a NULL clk pointer before
dereferencing it, but callers such as dev_pm_opp_set_rate() can pass
it an error pointer (e.g. ERR_PTR(-ENOENT) left behind by
clk_get() when a device has no Linux clock and is instead managed by
firmware via a genpd/OPP performance domain).

Dereferencing that error pointer to read clk->exclusive_count
crashes with an unhandled kernel NULL pointer dereference, since
ERR_PTR(-ENOENT) plus the field's offset lands on a small, unmapped
address:

  Unable to handle kernel NULL pointer dereference at virtual
  address 000000000000002e
  ...
  pc : clk_round_rate+0x3c/0x188
  ...
  Call trace:
   clk_round_rate+0x3c/0x188 (P)
   dev_pm_opp_set_rate+0x114/0x33c

Change the guard from "if (!clk)" to "if (IS_ERR_OR_NULL(clk))",
matching the pattern already used by other clk consumer API
functions such as clk_unprepare(), so an error pointer is rejected
the same way a NULL pointer is.

Signed-off-by: Praveen Talari <[email protected]>
---
 drivers/clk/clk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 048adfa86a5d..8c1ad3d10284 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1780,7 +1780,7 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
 	struct clk_rate_request req;
 	int ret;
 
-	if (!clk)
+	if (IS_ERR_OR_NULL(clk))
 		return 0;
 
 	clk_prepare_lock();

---
base-commit: b4515cf4156356e8f4fe6e0fdc17f59adab9772f
change-id: 20260723-fix_ptr_check_on_clk-603605c3e350

Best regards,
--  
Praveen Talari <[email protected]>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.