Re: [PATCH v2 2/2] interconnect: qcom: add Maili interconnect provider driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free on driver unbind/rebind due to stale pointers in statically allocated driver structures.
--

commit 9266119e904a5c675879f8849d752743c3590271
Author: Raviteja Laggyshetty <raviteja.laggyshetty@oss.qualcomm.com>

interconnect: qcom: add Maili interconnect provider driver
    
Add driver for the Qualcomm interconnect buses found in Maili
based platforms. The topology consists of several NoCs that are
controlled by a remote processor that collects the aggregated
bandwidth for each master-slave pairs.

> diff --git a/drivers/interconnect/qcom/maili.c b/drivers/interconnect/qcom/maili.c
> new file mode 100644
> --- /dev/null
> +++ b/drivers/interconnect/qcom/maili.c

[ ... ]

> +static struct platform_driver qnoc_driver = {
> +	.probe = qcom_icc_rpmh_probe,
> +	.remove = qcom_icc_rpmh_remove,

[Severity: High]
This isn't a bug introduced by this patch, but I noticed the framework
functions used here might leave dangling pointers in the static data structures
introduced by this patch.

During a driver unbind, qcom_icc_rpmh_remove() frees the dynamically allocated
nodes associated with the provider:

qcom_icc_rpmh_remove() {
    ...
    icc_nodes_remove(&qp->provider);
}

However, the qn->node pointers in the statically allocated driver structures
added in this patch are never cleared. If the driver is subsequently rebound
via sysfs, qcom_icc_rpmh_probe() sees the stale pointer and skips allocation:

qcom_icc_rpmh_probe() {
    ...
    if (!qn->node)
        qn->node = icc_node_create_dyn();
            
    node = qn->node;
    ...
}

Does this code result in a use-after-free when the freed node memory is
accessed during the rebind?

> +	.driver = {
> +		.name = "qnoc-maili",
> +		.of_match_table = qnoc_of_match,
> +		.sync_state = icc_sync_state,
> +	},
> +};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260622-maili_icc-v2-0-18b5ac08c04f@oss.qualcomm.com?part=2