Re: [PATCH] clk: qcom: rcg2: validate frequency table entry in __clk_rcg2_shared_set_rate()

[Taniya Das <taniya.das@oss.qualcomm.com>]

On 10/27/2026 11:35 PM, Gabor Juhos wrote:
> Commit aec8c0e28ce4 ("clk: qcom: rcg2: add clk_rcg2_shared_floor_ops")
> removed validating of the frequency table entry pointer returned by the
> qcom_find_freq() or the qcom_find_freq_floor() functions.
> 
> Since both functions can return NULL and the pointer is passed directly
> to the __clk_rcg2_configure() function where it gets dereferenced
> unconditionally, it could cause a panic.
> 
> Restore the sanity check removed by the mentioned commit in order to avoid
> a possible NULL pointer dereference.
> 
> Compile tested only.
> 
> Fixes: aec8c0e28ce4 ("clk: qcom: rcg2: add clk_rcg2_shared_floor_ops")
> Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
> ---
>  drivers/clk/qcom/clk-rcg2.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
> index d7914e59129f..260e90f53461 100644
> --- a/drivers/clk/qcom/clk-rcg2.c
> +++ b/drivers/clk/qcom/clk-rcg2.c
> @@ -1385,6 +1385,9 @@ static int __clk_rcg2_shared_set_rate(struct clk_hw *hw, unsigned long rate,
>  		return -EINVAL;
>  	}
>  
> +	if (!f)
> +		return -EINVAL;
> +

Normally, the CCF calls .determine_rate before .set_rate. The floor
determination helper already rejects a request below the lowest supported
 frequency:

 ```c
   if (!f)
      return -EINVAL;
 ```

So an ordinary clk_set_rate() request below the table minimum should
fail during rate determination and typically not reach
 __clk_rcg2_shared_set_rate().


-- 
Thanks,
Taniya Das