Re: [PATCH v6 19/27] clk: mediatek: Add MT8189 topckgen clock support
From: sashiko-bot@kernel.org
Date: 2026-09-04 16:20:37
Also in:
linux-clk
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] Use-after-free of `struct clk` and `struct clk_core` due to mismatched devres unregistration order during device remove or probe error. -- commit c9fccf00f7b65c99304902dc0b7804332954da0c Author: Louis-Alexis Eyraud [off-list ref] clk: mediatek: Add MT8189 topckgen clock support Add support for the MT8189 topckgen clock controller, which provides muxes and dividers for clock selection in other IP blocks.
quoted hunk ↗ jump to hunk
diff --git a/drivers/clk/mediatek/clk-mt8189-topckgen.c b/drivers/clk/mediatek/clk-mt8189-topckgen.c new file mode 100644 index 0000000000000..6ed7661119b82 --- /dev/null +++ b/drivers/clk/mediatek/clk-mt8189-topckgen.c
[ ... ]
+/* Register mux notifier for MFG mux */
+static int clk_mt8189_reg_mfg_mux_notifier(struct device *dev,
+ struct clk *clk)
+{
+ struct mtk_mux_nb *mfg_mux_nb;
+
+ mfg_mux_nb = devm_kzalloc(dev, sizeof(*mfg_mux_nb), GFP_KERNEL);
+ if (!mfg_mux_nb)
+ return -ENOMEM;
+
+ mfg_mux_nb->ops = &mtk_mux_clr_set_upd_ops;
+ mfg_mux_nb->bypass_index = 0; /* Bypass to CLK_TOP_MFG_REF_SEL */
+
+ return devm_mtk_clk_mux_notifier_register(dev, clk, mfg_mux_nb);[Severity: High] This isn't a bug introduced by this patch, but does this devres registration cause a use-after-free during device removal? The clock notifier is registered using devres via devm_mtk_clk_mux_notifier_register(). During device unbind (e.g., via sysfs or rmmod) or when probe fails after the notifier is registered, the driver manually unregisters the clock via mtk_clk_unregister_muxes(), which internally calls clk_hw_unregister(). This unconditionally frees the struct clk instance. Afterward, the devres framework automatically runs cleanup callbacks and invokes devm_clk_notifier_release(). This devres callback passes the already-freed clk pointer to clk_notifier_unregister(), which dereferences the freed memory to access clk->core->notifier_count.
+}
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260904-mt8189-clocks-system-base-v6-0-5df247f56938@collabora.com?part=19