Re: [PATCH v2 10/18] clk: mediatek: Add MT8189 topckgen clock support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free in the clock notifier unregistration path on driver removal.
--

--- Patch [10]: [PATCH v2 10/18] clk: mediatek: Add MT8189 topckgen clock support ---
commit 5d23b090dfc84556b649dbc1711e28c8f0b06604
Author: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>

clk: mediatek: Add MT8189 topckgen clock support

Add support for the MT8189 topckgen clock controller, which provides
muxes and dividers for clock selection in other IP blocks.

> diff --git a/drivers/clk/mediatek/clk-mt8189-topckgen.c b/drivers/clk/mediatek/clk-mt8189-topckgen.c
> new file mode 100644
> index 0000000000000..2473b617e9d62
> --- /dev/null
> +++ b/drivers/clk/mediatek/clk-mt8189-topckgen.c

[ ... ]

> +static int clk_mt8189_reg_mfg_mux_notifier(struct device *dev,
> +					   struct clk *clk)
> +{
> +	struct mtk_mux_nb *mfg_mux_nb;
> +
> +	mfg_mux_nb = devm_kzalloc(dev, sizeof(*mfg_mux_nb), GFP_KERNEL);
> +	if (!mfg_mux_nb)
> +		return -ENOMEM;
> +
> +	mfg_mux_nb->ops = &mtk_mux_clr_set_upd_ops;
> +	mfg_mux_nb->bypass_index = 0; /* Bypass to CLK_TOP_MFG_REF_SEL */
> +
> +	return devm_mtk_clk_mux_notifier_register(dev, clk, mfg_mux_nb);
> +}

[ ... ]

> +static struct platform_driver clk_mt8189_topck_drv = {
> +	.probe = mtk_clk_simple_probe,
> +	.remove = mtk_clk_simple_remove,

[Severity: High]
This is a pre-existing issue, but does combining
devm_mtk_clk_mux_notifier_register() with mtk_clk_simple_remove() lead to a
use-after-free on driver unbind?

When the driver is unbound, the .remove callback (mtk_clk_simple_remove) is
executed first, which manually unregisters and frees the clocks.

After .remove completes, the devres framework executes its teardown routines.
This triggers the release of the notifier registered via
devm_mtk_clk_mux_notifier_register(), causing clk_notifier_unregister() to be
called with the already-freed clk pointer.

Can this sequence cause memory corruption when the freed clock pointer is
dereferenced?

> +	.driver = {
> +		.name = "clk-mt8189-topck",
> +		.of_match_table = of_match_clk_mt8189_topck,
> +	},
> +};
> +module_platform_driver(clk_mt8189_topck_drv);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-mt8189-clocks-system-base-v2-0-2926da3db6cf@collabora.com?part=10