Re: [PATCH v6 27/27] clk: mediatek: Add MT8189 ufs clock support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Preexisting Use-After-Free risk when reset controller registration fails in `__mtk_clk_simple_probe`.
--

commit b8b3345488c1f0eb6db7c64bd2d428ce6c86087f
Author: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>

clk: mediatek: Add MT8189 ufs clock support
    
Add support for the MT8189 ufs clock controller, which provides clock gate 
control for Universal Flash Storage.

> diff --git a/drivers/clk/mediatek/clk-mt8189-ufs.c b/drivers/clk/mediatek/clk-mt8189-ufs.c
> new file mode 100644
> index 0000000000000..ec98fe01a5989
> --- /dev/null
> +++ b/drivers/clk/mediatek/clk-mt8189-ufs.c

[ ... ]

> +static const struct mtk_clk_desc ufscfg_ao_reg_mcd = {
> +	.clks = ufscfg_ao_reg_clks,
> +	.num_clks = ARRAY_SIZE(ufscfg_ao_reg_clks),
> +	.rst_desc = &ufscfg_ao_rst_desc,
> +};

[ ... ]

> +static struct platform_driver clk_mt8189_ufs_drv = {
> +	.probe = mtk_clk_simple_probe,

[Severity: High]
This isn't a bug introduced by this patch, but does the inclusion of 
rst_desc expose a use-after-free risk in the Mediatek clock framework?

Looking at __mtk_clk_simple_probe() in drivers/clk/mediatek/clk-mtk.c, the 
framework registers the OF clock provider before the reset controller:

	r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
	if (r)
		goto unregister_clks;

	if (mcd->rst_desc) {
		r = mtk_register_reset_controller_with_dev(&pdev->dev,
							   mcd->rst_desc);
		if (r)
			goto unregister_clks;
	}

If mtk_register_reset_controller_with_dev() fails, the error path jumps to 
unregister_clks and frees clk_data via mtk_free_clk_data(). 

Since it doesn't call of_clk_del_provider(node) during this teardown, does 
this leave a dangling pointer in the OF clock framework? Any subsequent OF 
clock lookup for this device would likely dereference the freed clk_data.

> +	.remove = mtk_clk_simple_remove,
> +	.driver = {
> +		.name = "clk-mt8189-ufs",
> +		.of_match_table = of_match_clk_mt8189_ufs,
> +	},
> +};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904-mt8189-clocks-system-base-v6-0-5df247f56938@collabora.com?part=27