Re: [PATCH 2/4] pmdomain: mediatek: Respect PD relationships during error cleanup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The return value of pm_genpd_init() is ignored, which leads to a NULL pointer dereference crash during error cleanup if initialization fails.
--

commit 356604344a98472f2a371cddf8d5683735700cda
Author: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>

pmdomain: mediatek: Respect PD relationships during error cleanup

This commit allocates a temporary array during probe to track the addition
order of power domains. If an error occurs, it uses this array to clean up
the domains in the exact reverse order, avoiding system freezes.

> diff --git a/drivers/pmdomain/mediatek/mtk-pm-domains.c b/drivers/pmdomain/mediatek/mtk-pm-domains.c
> index e1cfd42234734..db543d4b1813c 100644
> --- a/drivers/pmdomain/mediatek/mtk-pm-domains.c
> +++ b/drivers/pmdomain/mediatek/mtk-pm-domains.c
[ ... ]
> @@ -906,6 +907,7 @@ generic_pm_domain *scpsys_add_one_domain(struct scpsys *scpsys, struct device_no
>  	else
>  		pm_genpd_init(&pd->genpd, NULL, false);
>  
> +	domains_idx[(*num_domains)++] = (u8) id;

[Severity: High]
This is a pre-existing issue, but does ignoring the return value of
pm_genpd_init() here lead to a NULL pointer dereference crash during error
cleanup if initialization fails?

If pm_genpd_init() fails (e.g., due to a memory allocation failure), the domain
is partially initialized and its gpd_list_node remains zero-initialized.
Because the error isn't caught, the driver still considers the domain
successfully added and tracks it in scpsys->domains.

Later during probe, if an error triggers the cleanup path,
scpsys_domain_cleanup() then invokes scpsys_remove_one_domain() ->
pm_genpd_remove() on this uninitialized domain.

pm_genpd_remove() unconditionally calls list_del(&genpd->gpd_list_node), which
attempts to access next->prev on NULL pointers, resulting in a kernel panic.

>  	scpsys->domains[id] = &pd->genpd;
>  
>  	return scpsys->pd_data.domains[id];

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260701121920.19347-1-angelogioacchino.delregno@collabora.com?part=2