[PATCH] clk: Guard clk_round_rate() against error pointers

From: Praveen Talari

Date: Thu Jul 23 2026 - 02:11:06 EST


clk_round_rate() only checks for a NULL clk pointer before
dereferencing it, but callers such as dev_pm_opp_set_rate() can pass
it an error pointer (e.g. ERR_PTR(-ENOENT) left behind by
clk_get() when a device has no Linux clock and is instead managed by
firmware via a genpd/OPP performance domain).

Dereferencing that error pointer to read clk->exclusive_count
crashes with an unhandled kernel NULL pointer dereference, since
ERR_PTR(-ENOENT) plus the field's offset lands on a small, unmapped
address:

Unable to handle kernel NULL pointer dereference at virtual
address 000000000000002e
...
pc : clk_round_rate+0x3c/0x188
...
Call trace:
clk_round_rate+0x3c/0x188 (P)
dev_pm_opp_set_rate+0x114/0x33c

Change the guard from "if (!clk)" to "if (IS_ERR_OR_NULL(clk))",
matching the pattern already used by other clk consumer API
functions such as clk_unprepare(), so an error pointer is rejected
the same way a NULL pointer is.

Signed-off-by: Praveen Talari <praveen.talari@xxxxxxxxxxxxxxxx>
---
drivers/clk/clk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 048adfa86a5d..8c1ad3d10284 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1780,7 +1780,7 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
struct clk_rate_request req;
int ret;

- if (!clk)
+ if (IS_ERR_OR_NULL(clk))
return 0;

clk_prepare_lock();

---
base-commit: b4515cf4156356e8f4fe6e0fdc17f59adab9772f
change-id: 20260723-fix_ptr_check_on_clk-603605c3e350

Best regards,
--
Praveen Talari <praveen.talari@xxxxxxxxxxxxxxxx>