Re: [PATCH v3 13/18] clk: mediatek: Add MT8189 bus clock support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] In `__mtk_clk_simple_probe()`, failing to register a reset controller leaks the clock provider, leading to a Use-After-Free.
--

--- Patch [13]: [PATCH v3 13/18] clk: mediatek: Add MT8189 bus clock support ---
commit d3c19cc0c5f63d9545bd23ef786acfaedbc92bed
Author: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>

clk: mediatek: Add MT8189 bus clock support
    
Add support for the MT8189 bus clock controller, which provides clock gate
control for infra/peri IPs.

> diff --git a/drivers/clk/mediatek/clk-mt8189-bus.c b/drivers/clk/mediatek/clk-mt8189-bus.c
> new file mode 100644
> index 0000000000000..494f25e85d11c
> --- /dev/null
> +++ b/drivers/clk/mediatek/clk-mt8189-bus.c

[ ... ]

> +static const struct of_device_id of_match_clk_mt8189_bus[] = {
> +	{ .compatible = "mediatek,mt8189-infra-ao", .data = &ifrao_mcd },
> +	{ .compatible = "mediatek,mt8189-peri-ao", .data = &perao_mcd },
> +	{ /* sentinel */ }
> +};
> +MODULE_DEVICE_TABLE(of, of_match_clk_mt8189_bus);
> +
> +static struct platform_driver clk_mt8189_bus_drv = {
> +	.probe = mtk_clk_simple_probe,

[Severity: High]
This is a pre-existing issue, but since this new driver uses
mtk_clk_simple_probe(), it might be affected by an error handling bug in
the shared probe code.

Does the error path in drivers/clk/mediatek/clk-mtk.c:__mtk_clk_simple_probe()
miss deregistering the OF clock provider when reset controller registration
fails?

drivers/clk/mediatek/clk-mtk.c:__mtk_clk_simple_probe() {
    ...
			r = mtk_register_reset_controller_with_dev(&pdev->dev,
							   mcd->rst_desc);
			if (r)
				goto unregister_clks;
    ...
}

If mtk_register_reset_controller_with_dev() fails (e.g., due to memory
allocation failure), the code jumps to the unregister_clks label and frees
the clk_data structure without calling of_clk_del_provider().

Could this lead to a use-after-free if a subsequent clock lookup dereferences
the freed clk_data memory?

> +	.remove = mtk_clk_simple_remove,
> +	.driver = {
> +		.name = "clk-mt8189-bus",
> +		.of_match_table = of_match_clk_mt8189_bus,
> +	},
> +};
> +module_platform_driver(clk_mt8189_bus_drv);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-mt8189-clocks-system-base-v3-0-8e6d99ab3ad2@collabora.com?part=13