Re: [PATCH v3 26/47] clk: qcom: gcc-sm8350: Tie the CX power domain to controller

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but missing pm_genpd_remove cleanup on error paths in gdsc_register leads to leaked PM domains and global list corruption upon reprobe.
--

--- Patch [26]: [PATCH v3 26/47] clk: qcom: gcc-sm8350: Tie the CX power domain to controller ---
commit 463c8123d4d3a81e488b69352069b211c58bd412
Author: Abel Vesa <abel.vesa@oss.qualcomm.com>

clk: qcom: gcc-sm8350: Tie the CX power domain to controller

Enable runtime PM for the controller, allowing CX to be powered down
once all GCC consumers have released their clocks and GDSCs.

> diff --git a/drivers/clk/qcom/gcc-sm8350.c b/drivers/clk/qcom/gcc-sm8350.c
> index 2d94f3046b711..996ee8592fabe 100644
> --- a/drivers/clk/qcom/gcc-sm8350.c
> +++ b/drivers/clk/qcom/gcc-sm8350.c
> @@ -3786,6 +3786,7 @@ static const struct qcom_cc_desc gcc_sm8350_desc = {
>  	.resets = gcc_sm8350_resets,
>  	.num_resets = ARRAY_SIZE(gcc_sm8350_resets),
>  	.gdscs = gcc_sm8350_gdscs,
> +	.use_rpm = true,

[Severity: High]
This is a pre-existing issue, but missing pm_genpd_remove cleanup on error
paths in gdsc_register() leads to leaked PM domains and global list corruption
upon reprobe.

If gdsc_init() or subsequent subdomain additions fail in gdsc_register(),
the function returns without calling pm_genpd_remove() for the successfully
initialized domains:

drivers/clk/qcom/gdsc.c:gdsc_register() {
    ...
		ret = gdsc_init(scs[i]);
		if (ret)
			return ret;
    ...
	err_pm_subdomain_remove:
	gdsc_pm_subdomain_remove(desc, i);

	return ret;
}

Because the gdsc structures are statically allocated (like gcc_sm8350_gdscs),
the leaked PM domains remain permanently linked in the kernel's global
gpd_list.

If the driver is reprobed (e.g., via sysfs bind/unbind or late probe
deferral), pm_genpd_init() is called again on the same static objects,
triggering a list_add() on nodes already present in the list.

Does this break the list pointers and cause a kernel panic due to list
corruption?

>  	.num_gdscs = ARRAY_SIZE(gcc_sm8350_gdscs),
>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824-qcom-tie-cx-to-gcc-v3-0-f1205a92682b@oss.qualcomm.com?part=26