Re: [PATCH v9 05/10] clk: nuvoton: ma35d1: Use device managed helpers for fixed rate clocks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] clk: nuvoton: UAF on unbind due to unmanaged mux clocks holding devm-managed parents
--

commit cdff8376e12bb7360642c4498d1f771077f9d948
Author: Miquel Raynal <miquel.raynal@bootlin.com>

clk: nuvoton: ma35d1: Use device managed helpers for fixed rate clocks

Most of the clocks are already registered with device managed helpers,
except the fixed clocks. Harmonize the driver by using the already
available managed helper for that.

> diff --git a/drivers/clk/nuvoton/clk-ma35d1.c b/drivers/clk/nuvoton/clk-ma35d1.c
> index 75b7e2a84bfd9..4a745b169778d 100644
> --- a/drivers/clk/nuvoton/clk-ma35d1.c
> +++ b/drivers/clk/nuvoton/clk-ma35d1.c
> @@ -139,9 +139,9 @@ static const struct clk_div_table eadc_div_table[] = {
>  	{13, 28}, {14, 30}, {15, 32}, {0, 0},
>  };
>  
> -static struct clk_hw *ma35d1_clk_fixed(const char *name, int rate)
> +static struct clk_hw *ma35d1_clk_fixed(struct device *dev, const char *name, int rate)
>  {
> -	return clk_hw_register_fixed_rate(NULL, name, NULL, 0, rate);
> +	return devm_clk_hw_register_fixed_rate(dev, name, NULL, 0, rate);

[Severity: High]
Does this change introduce a use-after-free on driver unbind?

Mux clocks in this driver are registered using clk_hw_register_mux_hws() in
ma35d1_clk_mux(), which is not devm-managed:

drivers/clk/nuvoton/clk-ma35d1.c:ma35d1_clk_mux() {
...
	return clk_hw_register_mux_hws(dev, name, parent_hws, num_parents,
				       CLK_SET_RATE_NO_REPARENT, reg, shift,
				       width, 0, &ma35d1_lock);
}

Because these mux clocks are not devm-managed, they will remain in the clock
framework after probe failure or driver unbind. Since this patch makes their
fixed-rate parent clocks devm-managed, those parents will now be freed on
unbind.

Will the orphaned mux clocks retain dangling pointers to the freed fixed-rate
parents, causing a use-after-free if the clock tree is traversed later (e.g.,
via /sys/kernel/debug/clk/clk_possible_parents)?

>  }
>  
>  static struct clk_hw *ma35d1_clk_mux(struct device *dev, const char *name,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015-perso-ma35d1-upstream-clk-v9-0-1f548fa2002e@bootlin.com?part=5