Re: [PATCH v2 8/8] clk: clocking-wizard: Use separate notifier_block for each clock

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Incorrect `container_of` cast when reusing the same notifier callback for a new `notifier_block`, resulting in a misaligned `struct clk_wzrd` pointer and out-of-bounds memory accesses.
--

--- Patch [8]: [PATCH v2 8/8] clk: clocking-wizard: Use separate notifier_block for each clock ---
commit f1481850744c067369ec043b5f8c6bf3ee19d10b
Author: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>

clk: clocking-wizard: Use separate notifier_block for each clock

This commit introduces a dedicated notifier_block, nb_axi, for the
s_axi_aclk chain. This prevents linked list corruption that occurs
when registering a single notifier block to multiple chains.

> diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
> index 289c32ab5cd80..bcbfb4341dbab 100644
> --- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
> +++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
> @@ -137,6 +138,7 @@ enum clk_wzrd_int_clks {
>   */
>  struct clk_wzrd {
>  	struct notifier_block nb;
> +	struct notifier_block nb_axi;
>  	void __iomem *base;

[ ... ]

> @@ -1318,8 +1320,10 @@ static int clk_wzrd_probe(struct platform_device *pdev)
>  				dev_warn(&pdev->dev,
>  					 "unable to register clock notifier\n");
>  
> +			clk_wzrd->nb_axi.notifier_call = clk_wzrd_clk_notifier;
> +
>  			ret = devm_clk_notifier_register(&pdev->dev, clk_wzrd->axi_clk,
> -							 &clk_wzrd->nb);
> +							 &clk_wzrd->nb_axi);

[Severity: High]
Does sharing clk_wzrd_clk_notifier for nb_axi lead to an incorrect
container_of() cast?

Looking at clk_wzrd_clk_notifier(), it uses to_clk_wzrd(nb), which is
hardcoded to expect the original nb field:

#define to_clk_wzrd(_nb) container_of(_nb, struct clk_wzrd, nb)

Since nb_axi is at a non-zero offset in struct clk_wzrd (unlike nb), won't 
using the same callback for nb_axi result in a misaligned struct clk_wzrd 
pointer? 

It seems this would lead to out-of-bounds memory accesses and incorrectly 
skipped frequency bounds checks when the s_axi_aclk chain triggers a rate 
change.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709111403.1579159-1-shubhrajyoti.datta@amd.com?part=8