Re: [PATCH v2 3/3] clk: samsung: exynos5-subcmu: Defer probe until power domains are available

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] clk: samsung: exynos5-subcmu: section mismatch and init UAF in exynos5_subcmu_probe()
--

commit dee821466f03d766741ba105807d778f3d7a60f1
Author: Marek Szyprowski <m.szyprowski@samsung.com>

clk: samsung: exynos5-subcmu: Defer probe until power domains are available

This commit defers exynos5_clk_probe() until all available power domain
platform devices are instantiated so that sub-CMU devices can be properly
added to their power domains. To support deferred probing, it also drops the
__init and __refdata annotations from the probe functions and platform
drivers in clk-exynos5-subcmu.c.

> diff --git a/drivers/clk/samsung/clk-exynos5-subcmu.c b/drivers/clk/samsung/clk-exynos5-subcmu.c
> index 1d7eb98b72cf8..fe67c3066f2ef 100644
> --- a/drivers/clk/samsung/clk-exynos5-subcmu.c
> +++ b/drivers/clk/samsung/clk-exynos5-subcmu.c

[ ... ]

> @@ -96,7 +97,7 @@ static int __maybe_unused exynos5_subcmu_resume(struct device *dev)
>  	return 0;
>  }
>  
> -static int __init exynos5_subcmu_probe(struct platform_device *pdev)
> +static int exynos5_subcmu_probe(struct platform_device *pdev)
>  {
>  	struct device *dev = &pdev->dev;
>  	struct exynos5_subcmu_info *info = dev_get_drvdata(dev);

[Severity: High]
Does removing __init from exynos5_subcmu_probe() introduce a section mismatch
and a potential use-after-free of init memory if probing is deferred past
free_initmem()?

In drivers/clk/samsung/clk-exynos5-subcmu.c, exynos5_subcmu_probe() calls
samsung_clk_register_div() and samsung_clk_register_gate(), passing
info->div_clks and info->gate_clks:

    ctx->dev = dev;
    samsung_clk_register_div(ctx, info->div_clks, info->nr_div_clks);
    samsung_clk_register_gate(ctx, info->gate_clks, info->nr_gate_clks);
    ctx->dev = NULL;

However, in drivers/clk/samsung/clk.c, both registration helpers are still
marked __init:

    void __init samsung_clk_register_div(struct samsung_clk_provider *ctx,
                    const struct samsung_div_clock *list,
                    unsigned int nr_clk)

    void __init samsung_clk_register_gate(struct samsung_clk_provider *ctx,
                    const struct samsung_gate_clock *list,
                    unsigned int nr_clk)

In addition, the sub-CMU clock arrays passed through info->div_clks and
info->gate_clks in drivers/clk/samsung/clk-exynos5250.c
(exynos5250_disp_gate_clks) and drivers/clk/samsung/clk-exynos5420.c
(exynos5x_disp_div_clks, exynos5x_disp_gate_clks, exynos5x_gsc_div_clks,
exynos5x_gsc_gate_clks, exynos5x_g3d_gate_clks, exynos5x_mfc_div_clks,
exynos5x_mfc_gate_clks, exynos5x_mscl_gate_clks, exynos5x_mscl_div_clks, and
exynos5800_mau_gate_clks) are still marked __initconst.

Should the __init and __initconst annotations also be removed from those
registration functions and clock tables so they remain valid when
exynos5_subcmu_probe() runs from normal .text or after init memory is freed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261029125118.3191455-1-m.szyprowski@samsung.com?part=3