This series fixes three issues in the Faraday FTRTC010 RTC driver
found by Sashiko AI static analysis:

Patch 1: Fixes a clock resource leak when devm_rtc_register_device()
fails in ftrtc010_rtc_probe().

Patch 2: Replaces manual clock management with devm APIs to fix a
use-after-disable vulnerability in ftrtc010_rtc_remove(). The RTC
device is registered via devm_rtc_register_device() but clocks are
manually disabled in .remove() before devres cleanup, creating a
window where MMIO reads on clock-gated hardware can cause a
synchronous external abort.

Patch 3: Fixes integer overflow in ftrtc010_rtc_read_time() and
ftrtc010_rtc_set_time() where u32 arithmetic wraps for dates
beyond year 2106.

All three patches are based on v7.2-rc2 and have been verified
with checkpatch.pl --strict.

Changes since v1:
- Added reply to Sashiko AI review comments on pre-existing issues
  (shared IRQ handler, sequential read rollover, TOCTOU race)
  explaining why they are not in scope for these patches.
- Clarified that PCLK/EXTCLK are required by the hardware and
  devicetree binding, so the old "optional" behavior was a bug.
- Patch 3 received no Sashiko AI review comments, confirming the
  integer overflow fix is correct.

Liu Dalin (3):
  rtc: ftrtc010: fix clock resource leak on probe failure
  rtc: ftrtc010: use devm clock APIs to fix use-after-disable in remove
  rtc: ftrtc010: fix integer overflow in time calculation

 drivers/rtc/rtc-ftrtc010.c | 72 ++++++++++++++------------------------
 1 file changed, 25 insertions(+), 47 deletions(-)

--
2.43.0

On Thu, Aug 27, 2026 at 10:03 AM Liu Dalin <liudalin@kylinsec.com.cn> wrote:

> This series fixes three issues in the Faraday FTRTC010 RTC driver
> found by Sashiko AI static analysis:
>
> Patch 1: Fixes a clock resource leak when devm_rtc_register_device()
> fails in ftrtc010_rtc_probe().
>
> Patch 2: Replaces manual clock management with devm APIs to fix a
> use-after-disable vulnerability in ftrtc010_rtc_remove(). The RTC
> device is registered via devm_rtc_register_device() but clocks are
> manually disabled in .remove() before devres cleanup, creating a
> window where MMIO reads on clock-gated hardware can cause a
> synchronous external abort.
>
> Patch 3: Fixes integer overflow in ftrtc010_rtc_read_time() and
> ftrtc010_rtc_set_time() where u32 arithmetic wraps for dates
> beyond year 2106.
>
> All three patches are based on v7.2-rc2 and have been verified
> with checkpatch.pl --strict.

All patches:
Reviewed-by: Linus Walleij <linusw@kernel.org>

Maybe they need rebasing on v7.3-rc1 or maybe they will just
apply cleanly (I think so).

Yours,
Linus Walleij

在 2026/9/14 16:38, Linus Walleij 写道:
> On Thu, Aug 27, 2026 at 10:03 AM Liu Dalin <liudalin@kylinsec.com.cn> wrote:
>
>> This series fixes three issues in the Faraday FTRTC010 RTC driver
>> found by Sashiko AI static analysis:
>>
>> Patch 1: Fixes a clock resource leak when devm_rtc_register_device()
>> fails in ftrtc010_rtc_probe().
>>
>> Patch 2: Replaces manual clock management with devm APIs to fix a
>> use-after-disable vulnerability in ftrtc010_rtc_remove(). The RTC
>> device is registered via devm_rtc_register_device() but clocks are
>> manually disabled in .remove() before devres cleanup, creating a
>> window where MMIO reads on clock-gated hardware can cause a
>> synchronous external abort.
>>
>> Patch 3: Fixes integer overflow in ftrtc010_rtc_read_time() and
>> ftrtc010_rtc_set_time() where u32 arithmetic wraps for dates
>> beyond year 2106.
>>
>> All three patches are based on v7.2-rc2 and have been verified
>> with checkpatch.pl --strict.
> All patches:
> Reviewed-by: Linus Walleij <linusw@kernel.org>
>
> Maybe they need rebasing on v7.3-rc1 or maybe they will just
> apply cleanly (I think so).
>
> Yours,
> Linus Walleij
Hi Linus,

Confirmed: all three patches apply cleanly on v7.3-rc2 using git am.

Tested-by: Liu Dalin <liudalin@kylinsec.com.cn>