Re: [PATCH 2/2] clk: renesas: rzv2h: Convert to clk_hw based provider API

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing OF genpd provider cleanup on the probe error path leads to a Use-After-Free.
--

commit a63d8b10a46c55aa614df9d149b0a17736dc2cc5
Author: John Madieu <john.madieu.xa@bp.renesas.com>

clk: renesas: rzv2h: Convert to clk_hw based provider API

The driver mixes the clk consumer API with the clk_hw provider API for its
internal clock storage and OF lookup callback. Convert it to use clk_hw
consistently.

> diff --git a/drivers/clk/renesas/rzv2h-cpg.c b/drivers/clk/renesas/rzv2h-cpg.c
> index 86f6f2f700a65..9b0d691b1f5d0 100644
> --- a/drivers/clk/renesas/rzv2h-cpg.c
> +++ b/drivers/clk/renesas/rzv2h-cpg.c
[ ... ]
> @@ -1547,19 +1542,13 @@ static int __init rzv2h_cpg_add_pm_domains(struct rzv2h_cpg_priv *priv)
>  	return of_genpd_add_provider_simple(np, &pd->genpd);

[Severity: High]
This is a pre-existing issue, but does this missing OF genpd provider cleanup
on the probe error path lead to a Use-After-Free?

If a subsequent operation in rzv2h_cpg_probe() (such as
rzv2h_cpg_reset_controller_register()) fails, the devm framework automatically
frees the struct rzv2h_cpg_pd that was allocated with devm_kzalloc().

However, the cleanup action pm_genpd_remove() returns -EBUSY and aborts
because of_genpd_add_provider_simple() sets genpd->has_provider = true.
Because of_genpd_del_provider() is never called to unset this flag and
remove the provider, the domain remains registered in the global
of_genpd_providers list, gpd_list, and the device core.

When a consumer device subsequently probes and looks up its PM domain, or
when the PM domain core walks the lists, it could dereference the freed
pd->genpd memory.

>  }
>  
> -static void rzv2h_cpg_del_clk_provider(void *data)
> -{
> -	of_clk_del_provider(data);
> -}
> -

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902104939.25522-1-ovidiu.panait.rb@renesas.com?part=2