[PATCH] clk: qcom: rcg2: validate frequency table entry in __clk_rcg2_shared_set_rate()

[PATCH] clk: qcom: rcg2: validate frequency table entry in __clk_rcg2_shared_set_rate()

[Gabor Juhos]

Commit aec8c0e28ce4 ("clk: qcom: rcg2: add clk_rcg2_shared_floor_ops")
removed validating of the frequency table entry pointer returned by the
qcom_find_freq() or the qcom_find_freq_floor() functions.

Since both functions can return NULL and the pointer is passed directly
to the __clk_rcg2_configure() function where it gets dereferenced
unconditionally, it could cause a panic.

Restore the sanity check removed by the mentioned commit in order to avoid
a possible NULL pointer dereference.

Compile tested only.

Fixes: aec8c0e28ce4 ("clk: qcom: rcg2: add clk_rcg2_shared_floor_ops")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
---
 drivers/clk/qcom/clk-rcg2.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
index d7914e59129f..260e90f53461 100644
--- a/drivers/clk/qcom/clk-rcg2.c
+++ b/drivers/clk/qcom/clk-rcg2.c
@@ -1385,6 +1385,9 @@ static int __clk_rcg2_shared_set_rate(struct clk_hw *hw, unsigned long rate,
 		return -EINVAL;
 	}
 
+	if (!f)
+		return -EINVAL;
+
 	/*
 	 * In case clock is disabled, update the M, N and D registers, cache
 	 * the CFG value in parked_cfg and don't hit the update bit of CMD

---
base-commit: 55981579b27b6541aeeab81c768f248dba0491ac
change-id: 20261027-rcg2-avoid-null-ptr-deref-0885433584af

Best regards,
-- 
Gabor Juhos <j4g8y7@gmail.com>

Re: [PATCH] clk: qcom: rcg2: validate frequency table entry in __clk_rcg2_shared_set_rate()

[Taniya Das]

On 10/27/2026 11:35 PM, Gabor Juhos wrote:
> Commit aec8c0e28ce4 ("clk: qcom: rcg2: add clk_rcg2_shared_floor_ops")
> removed validating of the frequency table entry pointer returned by the
> qcom_find_freq() or the qcom_find_freq_floor() functions.
> 
> Since both functions can return NULL and the pointer is passed directly
> to the __clk_rcg2_configure() function where it gets dereferenced
> unconditionally, it could cause a panic.
> 
> Restore the sanity check removed by the mentioned commit in order to avoid
> a possible NULL pointer dereference.
> 
> Compile tested only.
> 
> Fixes: aec8c0e28ce4 ("clk: qcom: rcg2: add clk_rcg2_shared_floor_ops")
> Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
> ---
>  drivers/clk/qcom/clk-rcg2.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
> index d7914e59129f..260e90f53461 100644
> --- a/drivers/clk/qcom/clk-rcg2.c
> +++ b/drivers/clk/qcom/clk-rcg2.c
> @@ -1385,6 +1385,9 @@ static int __clk_rcg2_shared_set_rate(struct clk_hw *hw, unsigned long rate,
>  		return -EINVAL;
>  	}
>  
> +	if (!f)
> +		return -EINVAL;
> +

Normally, the CCF calls .determine_rate before .set_rate. The floor
determination helper already rejects a request below the lowest supported
 frequency:

 ```c
   if (!f)
      return -EINVAL;
 ```

So an ordinary clk_set_rate() request below the table minimum should
fail during rate determination and typically not reach
 __clk_rcg2_shared_set_rate().


-- 
Thanks,
Taniya Das

Re: [PATCH] clk: qcom: rcg2: validate frequency table entry in __clk_rcg2_shared_set_rate()

[Gabor Juhos]

2026. 10. 27. 19:24 keltezéssel, Taniya Das írta:
> 
> 
> On 10/27/2026 11:35 PM, Gabor Juhos wrote:
>> Commit aec8c0e28ce4 ("clk: qcom: rcg2: add clk_rcg2_shared_floor_ops")
>> removed validating of the frequency table entry pointer returned by the
>> qcom_find_freq() or the qcom_find_freq_floor() functions.
>>
>> Since both functions can return NULL and the pointer is passed directly
>> to the __clk_rcg2_configure() function where it gets dereferenced
>> unconditionally, it could cause a panic.
>>
>> Restore the sanity check removed by the mentioned commit in order to avoid
>> a possible NULL pointer dereference.
>>
>> Compile tested only.
>>
>> Fixes: aec8c0e28ce4 ("clk: qcom: rcg2: add clk_rcg2_shared_floor_ops")
>> Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
>> ---
>>  drivers/clk/qcom/clk-rcg2.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
>> index d7914e59129f..260e90f53461 100644
>> --- a/drivers/clk/qcom/clk-rcg2.c
>> +++ b/drivers/clk/qcom/clk-rcg2.c
>> @@ -1385,6 +1385,9 @@ static int __clk_rcg2_shared_set_rate(struct clk_hw *hw, unsigned long rate,
>>  		return -EINVAL;
>>  	}
>>  
>> +	if (!f)
>> +		return -EINVAL;
>> +
> 
> Normally, the CCF calls .determine_rate before .set_rate. The floor
> determination helper already rejects a request below the lowest supported
>  frequency:
> 
>  ```c
>    if (!f)
>       return -EINVAL;
>  ```
> 
> So an ordinary clk_set_rate() request below the table minimum should
> fail during rate determination and typically not reach
>  __clk_rcg2_shared_set_rate().
> 
> 

Thank you for the explanation, it makes sense.
In this case, we don't need the patch.

Regards,
Gabor