Re: [PATCH 3/3] rtc: Add Qualcomm GIO RTC driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] soc: qcom: devm-allocated auxiliary_device in
  pmic_glink_gio_add_consumer()
--

commit d5c1d09a8c9a83fd69f16467e16b3f0ae413a0cd
Author: Fenglin Wu <fenglin.wu@oss.qualcomm.com>

rtc: Add Qualcomm GIO RTC driver

This commit adds an auxiliary RTC driver for the Qualcomm GIO interface
and registers the "pmic_gio.rtc" auxiliary device from the PMIC GLINK GIO
driver.

> diff --git a/drivers/soc/qcom/pmic_glink_gio.c b/drivers/soc/qcom/pmic_glink_gio.c
> index f222c0d59220f..83656a5758b81 100644
> --- a/drivers/soc/qcom/pmic_glink_gio.c
> +++ b/drivers/soc/qcom/pmic_glink_gio.c

[ ... ]

> @@ -318,6 +320,28 @@ static void pmic_glink_gio_enable_alerts(struct pmic_glink_gio *pgio)
>  		dev_err(pgio->dev, "GIO turn on global alert failed: %d\n", ret);
>  }
>  
> +static int pmic_glink_gio_add_consumer(struct pmic_glink_gio *pgio,
> +				       struct auxiliary_device **aux,
> +				       const char *name)
> +{
> +	struct auxiliary_device *new_aux;
> +	int ret;
> +
> +	new_aux = devm_kzalloc(pgio->dev, sizeof(*new_aux), GFP_KERNEL);
> +	if (!new_aux)
> +		return -ENOMEM;
> +
> +	ret = devm_pmic_gio_add_consumer(pgio->gio, new_aux, name);
> +	if (ret) {
> +		devm_kfree(pgio->dev, new_aux);
> +		return ret;
> +	}

[Severity: Medium]
Can allocating new_aux with devm_kzalloc() cause a use-after-free when
pgio->dev unbinds or when devm_pmic_gio_add_consumer() fails after
auxiliary_device_init()?

devm_pmic_gio_add_consumer() initializes new_aux->dev with
auxiliary_device_init():

drivers/soc/qcom/pmic_gio.c:devm_pmic_gio_add_consumer() {
	...
	aux->dev.release = pmic_gio_aux_release;
	aux->dev.platform_data = gio;
	device_set_of_node_from_dev(&aux->dev, gio->dev);
	ret = auxiliary_device_init(aux);
	...
	ret = auxiliary_device_add(aux);
	if (ret) {
		auxiliary_device_uninit(aux);
		return ret;
	}

	return devm_add_action_or_reset(gio->dev, pmic_gio_del_aux_device, aux);
}

Once auxiliary_device_init() has been called, the lifetime of new_aux is
governed by the embedded struct device reference count and its memory may
only be freed from the dev.release callback.  Instead, devres frees
new_aux as soon as pgio->dev unbinds (or immediately via devm_kfree() if
auxiliary_device_add() fails), while references to new_aux->dev are still
held or before delayed kobject release runs.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110-gio-framework-rtc-driver-2026-10-12-v1-0-e4164178183a@oss.qualcomm.com?part=3