Re: [PATCH v6 19/27] clk: mediatek: Add MT8189 topckgen clock support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-after-free of `struct clk` and `struct clk_core` due to mismatched devres unregistration order during device remove or probe error.
--

commit c9fccf00f7b65c99304902dc0b7804332954da0c
Author: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>

clk: mediatek: Add MT8189 topckgen clock support

Add support for the MT8189 topckgen clock controller, which provides
muxes and dividers for clock selection in other IP blocks.

> diff --git a/drivers/clk/mediatek/clk-mt8189-topckgen.c b/drivers/clk/mediatek/clk-mt8189-topckgen.c
> new file mode 100644
> index 0000000000000..6ed7661119b82
> --- /dev/null
> +++ b/drivers/clk/mediatek/clk-mt8189-topckgen.c
[ ... ]
> +/* Register mux notifier for MFG mux */
> +static int clk_mt8189_reg_mfg_mux_notifier(struct device *dev,
> +					   struct clk *clk)
> +{
> +	struct mtk_mux_nb *mfg_mux_nb;
> +
> +	mfg_mux_nb = devm_kzalloc(dev, sizeof(*mfg_mux_nb), GFP_KERNEL);
> +	if (!mfg_mux_nb)
> +		return -ENOMEM;
> +
> +	mfg_mux_nb->ops = &mtk_mux_clr_set_upd_ops;
> +	mfg_mux_nb->bypass_index = 0; /* Bypass to CLK_TOP_MFG_REF_SEL */
> +
> +	return devm_mtk_clk_mux_notifier_register(dev, clk, mfg_mux_nb);

[Severity: High]
This isn't a bug introduced by this patch, but does this devres registration
cause a use-after-free during device removal?

The clock notifier is registered using devres via
devm_mtk_clk_mux_notifier_register(). During device unbind (e.g., via sysfs or
rmmod) or when probe fails after the notifier is registered, the driver
manually unregisters the clock via mtk_clk_unregister_muxes(), which
internally calls clk_hw_unregister(). This unconditionally frees the struct
clk instance.

Afterward, the devres framework automatically runs cleanup callbacks and
invokes devm_clk_notifier_release(). This devres callback passes the
already-freed clk pointer to clk_notifier_unregister(), which dereferences
the freed memory to access clk->core->notifier_count.

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904-mt8189-clocks-system-base-v6-0-5df247f56938@collabora.com?part=19