Re: [PATCH v3 16/18] clk: mediatek: Add MT8189 i2c clock support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free due to missing of_clk_del_provider() on error path.
--

--- Patch [16]: [PATCH v3 16/18] clk: mediatek: Add MT8189 i2c clock support ---
commit d3f05e8828a2749801c71cd758adfe9c139d7e3f
Author: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>

clk: mediatek: Add MT8189 i2c clock support

Add support for the MT8189 i2c clock controller,
which provides clock gate control for i2c.

> diff --git a/drivers/clk/mediatek/clk-mt8189-iic.c b/drivers/clk/mediatek/clk-mt8189-iic.c
> index 0000000000000..80a01706791a4 100644
> --- /dev/null
> +++ b/drivers/clk/mediatek/clk-mt8189-iic.c

[ ... ]

> +static struct platform_driver clk_mt8189_iic_drv = {
> +	.probe = mtk_clk_simple_probe,

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing this probe
assignment, I noticed a pre-existing issue in __mtk_clk_simple_probe() (which
mtk_clk_simple_probe wraps).

If mtk_register_reset_controller_with_dev() fails, the error path jumps to
unregister_clks and frees clk_data, but it forgets to unregister the provider:

drivers/clk/mediatek/clk-mtk.c:__mtk_clk_simple_probe() {
	...
	r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
	...
	if (mcd->rst_desc) {
		r = mtk_register_reset_controller_with_dev(&pdev->dev,
							   mcd->rst_desc);
		if (r)
			goto unregister_clks;
	}
	...
unregister_clks:
	...
free_data:
	mtk_free_clk_data(clk_data);
	...
}

Because of_clk_del_provider(node) is not called on this error path, does this
leave the clock provider registered in the system with a dangling pointer to
the freed clk_data memory? Could this lead to a Use-After-Free if another
driver attempts to look up a clock from this provider?

> +	.remove = mtk_clk_simple_remove,
> +	.driver = {
> +		.name = "clk-mt8189-iic",
> +		.of_match_table = of_match_clk_mt8189_iic,
> +	},
> +};
> +module_platform_driver(clk_mt8189_iic_drv);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-mt8189-clocks-system-base-v3-0-8e6d99ab3ad2@collabora.com?part=16