clk: fixed: fix double free in resource managed fixed-factor clock

devm_clk_hw_register_fixed_factor_release(), the release function for
the devm_clk_hw_register_fixed_factor(), calls
clk_hw_unregister_fixed_factor(), which will kfree() the clock. However
after that the devres functions will also kfree the allocated data,
resulting in double free/memory corruption. Just call
clk_hw_unregister() instead, leaving kfree() to devres code.

Reported-by: Rob Clark <>
Cc: Daniel Palmer <>
Signed-off-by: Dmitry Baryshkov <>
Fixes: 0b9266d295ce ("clk: fixed: add devm helper for clk_hw_register_fixed_factor()")
[ Remove ugly cast]
Signed-off-by: Stephen Boyd <>
diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c
index 4f7bf39..4e4b6d36 100644
--- a/drivers/clk/clk-fixed-factor.c
+++ b/drivers/clk/clk-fixed-factor.c
@@ -66,7 +66,14 @@
 static void devm_clk_hw_register_fixed_factor_release(struct device *dev, void *res)
-	clk_hw_unregister_fixed_factor(&((struct clk_fixed_factor *)res)->hw);
+	struct clk_fixed_factor *fix = res;
+	/*
+	 * We can not use clk_hw_unregister_fixed_factor, since it will kfree()
+	 * the hw, resulting in double free. Just unregister the hw and let
+	 * devres code kfree() it.
+	 */
+	clk_hw_unregister(&fix->hw);
 static struct clk_hw *