Re: [PATCH 2/4] pmdomain: qcom: rpmhpd: Add NMXC power domain for Nord

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing cleanup of previously initialized genpds on error paths in rpmhpd_probe() leading to Use-After-Free list corruption.
--

commit fffeb8f7d724849238dff1efcb31a1c3a8c540a4
Author: Anurag Pateriya <anurag.pateriya@oss.qualcomm.com>

pmdomain: qcom: rpmhpd: Add NMXC power domain for Nord
    
Add the nmxc.lvl RPMh resource and register it in the Nord power domain
table. Nord supplies the NSP memory rail from this dedicated resource
rather than from the shared MX rail, so consumers need it exposed as its
own power domain.

> diff --git a/drivers/pmdomain/qcom/rpmhpd.c b/drivers/pmdomain/qcom/rpmhpd.c
> index 90743275942db..28cc8825eee45 100644
> --- a/drivers/pmdomain/qcom/rpmhpd.c
> +++ b/drivers/pmdomain/qcom/rpmhpd.c
> @@ -198,6 +198,11 @@ static struct rpmhpd mxc_ao = {
>  	.res_name = "mxc.lvl",
>  };
>  
> +static struct rpmhpd nmxc = {
> +	.pd = { .name = "nmxc", },
> +	.res_name = "nmxc.lvl",
> +};
> +
>  static struct rpmhpd nsp = {
>  	.pd = { .name = "nsp", },
>  	.res_name = "nsp.lvl",
> @@ -327,6 +332,7 @@ static struct rpmhpd *nord_rpmhpds[] = {
>  	[RPMHPD_MX_AO] = &mx_ao,
>  	[RPMHPD_MXC] = &mxc,
>  	[RPMHPD_MXC_AO] = &mxc_ao,
> +	[RPMHPD_NMXC] = &nmxc,

[Severity: High]
This is a pre-existing issue, but I noticed a potential use-after-free issue
in the error paths of rpmhpd_probe() when adding new power domains.

If rpmhpd_probe() fails midway during its initialization loop:

rpmhpd_probe() {
    for (i = 0; i < num_pds; i++) {
        ...
        ret = rpmhpd_update_level_mapping(rpmhpds[i]);
        if (ret)
            return ret;
        ...
        pm_genpd_init(&rpmhpds[i]->pd, NULL, true);
        ...
    }
}

Or if it fails at the very end when registering the provider:

    return of_genpd_add_provider_onecell(pdev->dev.of_node, data);

The function directly returns an error without calling pm_genpd_remove() for
the previously initialized domains. Because pm_genpd_init() links the
statically allocated domain structures into the global genpd list, does this
leave dangling pointers?

Since this driver can be built as a module, if the module is unloaded after a
probe failure, its data section is freed. Could this result in the global
list pointing to freed memory, causing a crash the next time the list is
traversed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826102746.633076-1-shengchao.guo@oss.qualcomm.com?part=2