[PATCH v2] clk: Free the parent map only in __clk_release()

[Nickolai Zeldovich]

Since commit 9d05ae531c2c ("clk: Initialize struct clk_core kref
earlier"), every failure in __clk_register() frees the parent map
through __clk_release().  clk_core_populate_parent_map() still cleans up
after itself on failure, so an allocation failure while registering a
clock with parents either dereferences a NULL map (core->parents is NULL
while core->num_parents is set) or frees the parent names and the map a
second time.

Leave the cleanup to __clk_release(): return the error without freeing
anything, and have clk_core_free_parent_map() check for a missing map
instead of num_parents == 0.  The map is zero-allocated and
kfree_const(NULL) is a no-op, so a partially filled map is freed
correctly.

Fixes: 9d05ae531c2c ("clk: Initialize struct clk_core kref earlier")
Cc: stable@xxxxxxxxxxxxxxx
Reviewed-by: Jerome Brunet <jbrunet@xxxxxxxxxxxx>
Signed-off-by: Nickolai Zeldovich <nickolai@xxxxxxxxxxxxx>
---

Notes:
    Changes in v2:
    - Shortened the commit message (Jerome, Brian).
    - Added Cc: stable (Brian) and Jerome's Reviewed-by.
    - No code change; rebased onto current master.
    
    v1: https://lore.kernel.org/r/20261016164050.790594-1-nickolai@xxxxxxxxxxxxx
    
    Developed with the assistance of an LLM.
    
    Reproduced on riscv64 under QEMU by rebinding a fixed-factor clock
    provider through its sysfs bind file with failslab aimed at the parent
    map allocation: without the patch the kernel oopses with a NULL pointer
    dereference in __clk_release(); with it the bind fails with -ENOMEM and
    "failed to register clk" is logged.  The second failure path (a parent
    name copy failing) was reproduced only in a userspace transcription of
    the four functions under AddressSanitizer.  The clk KUnit suites pass on
    x86_64 and riscv64.

 drivers/clk/clk.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index fef87167a60b5..c32c3e9d62bdb 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -4353,15 +4353,8 @@ static int clk_core_populate_parent_map(struct clk_core *core,
 			WARN(1, "Must specify parents if num_parents > 0\n");
 		}
 
-		if (ret) {
-			do {
-				kfree_const(parents[i].name);
-				kfree_const(parents[i].fw_name);
-			} while (--i >= 0);
-			kfree(parents);
-
+		if (ret)
 			return ret;
-		}
 	}
 
 	return 0;
@@ -4371,7 +4364,7 @@ static void clk_core_free_parent_map(struct clk_core *core)
 {
 	int i = core->num_parents;
 
-	if (!core->num_parents)
+	if (!core->parents)
 		return;
 
 	while (--i >= 0) {

base-commit: 4da9dedf3fc59137fd86d664693776aa38cb97f5
-- 
2.53.0