tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

clk: microchip: mpfs-ccc: fix out of bounds access during output registration

UBSAN reported an out of bounds access during registration of the last
two outputs. This out of bounds access occurs because space is only
allocated in the hws array for two PLLs and the four output dividers
that each has, but the defined IDs contain two DLLS and their two
outputs each, which are not supported by the driver. The ID order is
PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs
by two while adding them to the array to avoid the problem.

Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support")
CC: stable@vger.kernel.org
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>

Conor Dooley 2f7ae8ab 6de23f81

+5 -1
+5 -1
drivers/clk/microchip/clk-mpfs-ccc.c
··· 178 178 return dev_err_probe(dev, ret, "failed to register clock id: %d\n", 179 179 out_hw->id); 180 180 181 - data->hw_data.hws[out_hw->id] = &out_hw->divider.hw; 181 + data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw; 182 182 } 183 183 184 184 return 0; ··· 234 234 unsigned int num_clks; 235 235 int ret; 236 236 237 + /* 238 + * If DLLs get added here, mpfs_ccc_register_outputs() currently packs 239 + * sparse clock IDs in the hws array 240 + */ 237 241 num_clks = ARRAY_SIZE(mpfs_ccc_pll_clks) + ARRAY_SIZE(mpfs_ccc_pll0out_clks) + 238 242 ARRAY_SIZE(mpfs_ccc_pll1out_clks); 239 243