Re: [PATCH v2 15/18] clk: mediatek: Add MT8189 dvfsrc clock support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-after-free in `__mtk_clk_simple_probe` error path due to missing `of_clk_del_provider()`.
--

--- Patch [15]: [PATCH v2 15/18] clk: mediatek: Add MT8189 dvfsrc clock support ---
commit 5ea7dacd6f8e27b2d8c56bae31053477a67a2318
Author: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>

clk: mediatek: Add MT8189 dvfsrc clock support
    
This patch adds support for the MT8189 dvfsrc clock controller. This controller
provides clock gate control for DRAM DVFS.

> diff --git a/drivers/clk/mediatek/clk-mt8189-dvfsrc.c b/drivers/clk/mediatek/clk-mt8189-dvfsrc.c
> new file mode 100644
> index 0000000000000..37b81dc0b8824
> --- /dev/null
> +++ b/drivers/clk/mediatek/clk-mt8189-dvfsrc.c

[ ... ]

> +static struct platform_driver clk_mt8189_dvfsrc_drv = {
> +	.probe = mtk_clk_simple_probe,

[Severity: High]
This is a pre-existing issue, but does the error path in
__mtk_clk_simple_probe() leave a dangling pointer?

When mtk_clk_simple_probe() is called, it wraps __mtk_clk_simple_probe(). If
the clock provider is successfully added, but resetting the controller fails:

drivers/clk/mediatek/clk-mtk.c:__mtk_clk_simple_probe() {
...
	r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
	if (r)
		goto unregister_clks;

	platform_set_drvdata(pdev, clk_data);

	if (mcd->rst_desc) {
		r = mtk_register_reset_controller_with_dev(&pdev->dev,
							   mcd->rst_desc);
		if (r)
			goto unregister_clks;
	}
...

It jumps to unregister_clks which eventually frees the clk_data:

unregister_clks:
...
free_data:
	mtk_free_clk_data(clk_data);
...
}

Since of_clk_del_provider() is never called in this error path, doesn't this
leave a freed clk_data pointer in the global of_clk_providers list, leading
to a use-after-free on the next clock lookup?

> +	.remove = mtk_clk_simple_remove,
> +	.driver = {
> +		.name = "clk-mt8189-dvfsrc",
> +		.of_match_table = of_match_clk_mt8189_dvfsrc,
> +	},
> +};
> +module_platform_driver(clk_mt8189_dvfsrc_drv);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-mt8189-clocks-system-base-v2-0-2926da3db6cf@collabora.com?part=15