Re: [PATCH RFC v5 08/12] clk: zte: Introduce a driver for zx297520v3 top clocks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Double free of `adev` in the error path of `auxiliary_device_add()`.
--

commit 5d8045f8cc5525227ffeb82da9b3791181d56dbb
Author: Stefan Dösinger <stefandoesinger@gmail.com>

clk: zte: Introduce a driver for zx297520v3 top clocks

This commit introduces a clock driver for the ZTE zx297520v3 basic top clocks.
It registers the PLLs, muxes, dividers, and gates for core devices such as
the AHB bus, timers, and the USB controller.

> diff --git a/drivers/clk/zte/clk-zx297520v3.c b/drivers/clk/zte/clk-zx297520v3.c
> new file mode 100644
> index 0000000000000..bb3d64eff9096
> --- /dev/null
> +++ b/drivers/clk/zte/clk-zx297520v3.c
[ ... ]
> +static int zx297520v3_topclk_probe(struct platform_device *pdev)
> +{
> +	return zx_clk_common_probe(&pdev->dev, pdev->dev.parent->of_node, &zx297520v3_topclk_data);

[Severity: High]
This isn't a bug introduced by this patch, but calling zx_clk_common_probe()
can trigger a double free in its error handling path.

Looking at zx_clk_common_probe() in drivers/clk/zte/clk-zx.c, if
auxiliary_device_add() fails, it jumps to the following error path:

adev_uninit:
	auxiliary_device_uninit(adev);
adev_free:
	kfree(adev);
	return res;

Since auxiliary_device_uninit() drops the final reference and triggers the
zx_adev_release() callback which frees adev, doesn't the fall-through to
kfree(adev) result in a double free?

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260628-zx29clk-v5-0-79ff044e4192@gmail.com?part=8