Re: [PATCH v13 04/11] clk: realtek: Introduce common probe() and remove()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] rtk_clk_remove() manually clears regmap pointers before devres unregisters the clocks, creating a fatal window for NULL pointer dereferences.
--

--- Patch [4]: [PATCH v13 04/11] clk: realtek: Introduce common probe() and remove() ---
commit 85dc7ea7ea58332e5239ff20ff6e6669d56fbb6a
Author: Cheng-Yu Lee <[email protected]>

clk: realtek: Introduce common probe() and remove()

This commit introduces common probe and remove functions for Realtek clock
drivers. It handles setting up a shared regmap, registering clock hardware,
and optionally creating an auxiliary device for the reset controller.

> diff --git a/drivers/clk/realtek/clk-rtk-common.c b/drivers/clk/realtek/clk-rtk-common.c
> new file mode 100644
> --- /dev/null
> +++ b/drivers/clk/realtek/clk-rtk-common.c
[ ... ]
> +void rtk_clk_remove(struct platform_device *pdev)
> +{
> +	const struct rtk_clk_desc *desc = platform_get_drvdata(pdev);
> +
> +	if (!desc)
> +		return;
> +
> +	for (int i = 0; i < desc->num_clks; i++)
> +		desc->clks[i]->regmap = NULL;

[Severity: High]
Could this clear operation introduce a NULL pointer dereference window?

Since the clocks are registered using devm_clk_hw_register() in
rtk_clk_probe(), they remain active and visible to the Common Clock Framework
until the devres release callbacks execute. This devres cleanup happens
after rtk_clk_remove() returns.

If a consumer or an interrupt invokes a clock operation while the device is
being unbound, the callback might attempt to access the hardware using this
newly cleared NULL regmap pointer.

Because the regmap is obtained via device_node_to_regmap(), which returns a
syscon regmap that is never freed, is it necessary to clear these pointers
during driver unbind?

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4