From 81f4ddc9f7e0c11d3e9d24d0f30023845a02f7ee Mon Sep 17 00:00:00 2001 From: Jerome Brunet Date: Mon, 6 Jul 2026 11:32:11 +0200 Subject: [PATCH] clk: sunxi-ng: fix ccu probe clock unregister on error When registering clocks with sunxi_ccu_probe(), the number of ccu_clocks and the number of hw clocks might be different, eventhough they usually are the same. If they are different, it could lead to out-of-bound access or registered clock left behind on error. Use a different variable when iterating on hw clocks so every registered clock, and only those, gets unregistered on error. Reported-by: Sashiko Closes: https://lore.kernel.org/r/20260629131254.7E34C1F00A3A@smtp.kernel.org Reviewed-by: Chen-Yu Tsai Signed-off-by: Jerome Brunet Link: https://patch.msgid.link/20260706-a733-rtc-v4-3-f330728db3d3@baylibre.com Signed-off-by: Chen-Yu Tsai --- drivers/clk/sunxi-ng/ccu_common.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c index 1c083b4d0b7e..43d8eca6abee 100644 --- a/drivers/clk/sunxi-ng/ccu_common.c +++ b/drivers/clk/sunxi-ng/ccu_common.c @@ -114,7 +114,7 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev, const struct sunxi_ccu_desc *desc) { struct ccu_reset *reset; - int i, ret; + int i, j, ret; ccu->desc = desc; @@ -130,8 +130,8 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev, cclk->lock = &ccu->lock; } - for (i = 0; i < desc->hw_clks->num ; i++) { - struct clk_hw *hw = desc->hw_clks->hws[i]; + for (j = 0; j < desc->hw_clks->num ; j++) { + struct clk_hw *hw = desc->hw_clks->hws[j]; const char *name; if (!hw) @@ -143,7 +143,7 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev, else ret = of_clk_hw_register(node, hw); if (ret) { - pr_err("Couldn't register clock %d - %s\n", i, name); + pr_err("Couldn't register clock %d - %s\n", j, name); goto err_clk_unreg; } } @@ -186,8 +186,8 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev, err_del_provider: of_clk_del_provider(node); err_clk_unreg: - while (--i >= 0) { - struct clk_hw *hw = desc->hw_clks->hws[i]; + while (--j >= 0) { + struct clk_hw *hw = desc->hw_clks->hws[j]; if (!hw) continue;