Re: [PATCH 2/3] pmdomain: amlogic: Add support for A9 power domains controller

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free due to missing .remove callback for meson_secure_pwrc driver
--

--- Patch [2]: [PATCH 2/3] pmdomain: amlogic: Add support for A9 power domains controller ---
commit 0074a5ab9b85f84325bfc2bf14c8fb48fcd14fb0
Author: Xianwei Zhao <xianwei.zhao@amlogic.com>

pmdomain: amlogic: Add support for A9 power domains controller

This commit adds support for the A9 power controller in the Amlogic
secure power domain driver. It introduces the A9 domain descriptors
and adds the corresponding compatible string to the match table.

> diff --git a/drivers/pmdomain/amlogic/meson-secure-pwrc.c b/drivers/pmdomain/amlogic/meson-secure-pwrc.c
> index 1d2f371d2d7f0..133549956efa4 100644
> --- a/drivers/pmdomain/amlogic/meson-secure-pwrc.c
> +++ b/drivers/pmdomain/amlogic/meson-secure-pwrc.c

[ ... ]

> @@ -468,6 +533,10 @@ static const struct of_device_id meson_secure_pwrc_match_table[] = {
>  		.compatible = "amlogic,a5-pwrc",
>  		.data = &amlogic_secure_a5_pwrc_data,
>  	},
> +	{
> +		.compatible = "amlogic,a9-pwrc",
> +		.data = &amlogic_secure_a9_pwrc_data,
> +	},
>  	{
>  		.compatible = "amlogic,c3-pwrc",
>  		.data = &amlogic_secure_c3_pwrc_data,
>  	},

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing these
changes I noticed a pre-existing issue with the platform driver registration:

static struct platform_driver meson_secure_pwrc_driver = {
        .probe = meson_secure_pwrc_probe,
        .driver = {
                .name           = "meson_secure_pwrc",
                .of_match_table = meson_secure_pwrc_match_table,
        },
};

Does meson_secure_pwrc_driver lack a .remove callback?

If this driver is unbound via sysfs or unloaded as a module, it seems 
pm_genpd_remove(), pm_genpd_remove_subdomain(), and of_genpd_del_provider() 
are never called to deregister the domains.

Since the driver core's devres cleanup will free the memory allocated for 
the generic power domains upon removal, couldn't this leave dangling pointers 
in the global gpd_list and of_genpd_providers lists, causing a Use-After-Free 
when the power domain framework traverses them?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722-a9-pm-v1-0-1fe20a44bf2d@amlogic.com?part=2

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic