Re: [PATCH v13 10/11] clk: realtek: Add RTD1625-ISO clock controller driver

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The driver's remove path introduces a NULL pointer dereference window by nullifying the shared syscon regmap while devres-managed clock instances remain globally accessible.
--

--- Patch [10]: [PATCH v13 10/11] clk: realtek: Add RTD1625-ISO clock controller driver ---
commit b3740f40262849e43095598baf79bbd91f8f86bc
Author: Cheng-Yu Lee <[email protected]>

clk: realtek: Add RTD1625-ISO clock controller driver

This commit adds support for the ISO domain clock controller on the Realtek
RTD1625 SoC. The controller manages always-on clocks and also registers the
shared reset controller as an auxiliary device.

> diff --git a/drivers/clk/realtek/clk-rtd1625-iso.c b/drivers/clk/realtek/clk-rtd1625-iso.c
> new file mode 100644
> index 0000000000000..6025c148adf83
> --- /dev/null
> +++ b/drivers/clk/realtek/clk-rtd1625-iso.c

[ ... ]

> +static struct platform_driver rtd1625_iso_driver = {
> +	.probe = rtd1625_iso_probe,
> +	.remove = rtk_clk_remove,

[Severity: High]
Could this lead to a NULL pointer dereference during module unload?

When the module is removed, the driver calls rtk_clk_remove(), which clears
the regmap pointers for all clocks:

drivers/clk/realtek/clk-rtk-common.c:rtk_clk_remove() {
    ...
    for (i = 0; i < desc->num_clks; i++)
        desc->clks[i]->regmap = NULL;
    ...
}

Because the clocks are registered using devres via devm_clk_hw_register(),
they remain registered with the Common Clock Framework until after the remove
function returns.

If something queries the clock state during this window, such as reading from
debugfs (clk_summary), the framework can invoke callbacks that dereference
the nullified regmap pointer:

drivers/clk/realtek/clk-regmap-gate.c:rtk_clk_regmap_gate_is_enabled() {
    ...
    ret = regmap_read(clkg->clkr.regmap, clkg->gate_ofs, &val);
    ...
}

> +	.driver = {
> +		.name = "rtk-rtd1625-iso-clk",
> +		.of_match_table = rtd1625_iso_match,
> +		.suppress_bind_attrs = true,
> +	},
> +};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=10