Re: [PATCH v3 6/7] clk: Add support for clock nexus dt bindings

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unconditional dereference of optional `out_args` pointer in `of_parse_phandle_with_args_map()`.
--

--- Patch [6]: [PATCH v3 6/7] clk: Add support for clock nexus dt bindings ---
commit 6c00bcac0a2f79ec97235472147341c2654575cc
Author: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com>

clk: Add support for clock nexus dt bindings

This commit introduces support for clock nexus device tree bindings, allowing
inner clocks to be mapped to inlet clocks via the clock-map property. It
accomplishes this by transitioning the clock subsystem to use
of_parse_phandle_with_args_map() instead of of_parse_phandle_with_args().

> diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c
> --- a/drivers/clk/clk-conf.c
> +++ b/drivers/clk/clk-conf.c
> @@ -25,8 +25,8 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier)
>  		       node);
>  
>  	for (index = 0; index < num_parents; index++) {
> -		rc = of_parse_phandle_with_args(node, "assigned-clock-parents",
> -					"#clock-cells",	index, &clkspec);
> +		rc = of_parse_phandle_with_args_map(node, "assigned-clock-parents",
> +						    "clock", index, &clkspec);

[Severity: High]
This is a pre-existing issue, but since this patch transitions the subsystem
to use of_parse_phandle_with_args_map(), it seems worth noting a flaw in the
underlying API.

Looking at of_parse_phandle_with_args_map() in drivers/of/base.c, there is an
unconditional dereference of the out_args pointer:

drivers/of/base.c:of_parse_phandle_with_args_map() {
	...
	ret = __of_parse_phandle_with_args(np, list_name, cells_name, -1, index,
					   out_args);
	if (ret)
		return ret;

	/* Get the #<list>-cells property */
	cur = out_args->np;
	...
}

Since out_args is documented as an optional pointer for this exported symbol,
would a caller passing null immediately trigger a kernel panic here due to a
null pointer dereference?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716-schneider-v7-2-rc1-eip201-upstream-v3-0-98454e83845c@bootlin.com?part=6