Commit c5601e07 authored by Dan Carpenter's avatar Dan Carpenter Committed by Stephen Boyd
Browse files

clk: visconti: prevent array overflow in visconti_clk_register_gates() 



This code was using -1 to represent that there was no reset function.
Unfortunately, the -1 was stored in u8 so the if (clks[i].rs_id >= 0)
condition was always true.  This lead to an out of bounds access in
visconti_clk_register_gates().

Fixes: b4cbe606 ("clk: visconti: Add support common clock driver and reset driver")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220316083533.GA30941@kili


Acked-by: default avatarNobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: default avatarStephen Boyd <sboyd@kernel.org>
parent e783362e

drivers/clk/visconti/clkc-tmpv770x.c

+1 −1
Original line number Diff line number Diff line
@@ -176,7 +176,7 @@ static const struct visconti_clk_gate_table clk_gate_tables[] = { 
	{ TMPV770X_CLK_WRCK, "wrck",

		clks_parent_data, ARRAY_SIZE(clks_parent_data),

		0, 0x68, 0x168, 9, 32,

		-1, }, /* No reset */

		NO_RESET, },

	{ TMPV770X_CLK_PICKMON, "pickmon",

		clks_parent_data, ARRAY_SIZE(clks_parent_data),

		0, 0x10, 0x110, 8, 4,

drivers/clk/visconti/clkc.c

+1 −1
Original line number Diff line number Diff line
@@ -147,7 +147,7 @@ int visconti_clk_register_gates(struct visconti_clk_provider *ctx, 
		if (!dev_name)

			return -ENOMEM;



		if (clks[i].rs_id >= 0) {

		if (clks[i].rs_id != NO_RESET) {

			rson_offset = reset[clks[i].rs_id].rson_offset;

			rsoff_offset = reset[clks[i].rs_id].rsoff_offset;

			rs_idx = reset[clks[i].rs_id].rs_idx;

drivers/clk/visconti/clkc.h

+3 −0
Original line number Diff line number Diff line
@@ -73,4 +73,7 @@ int visconti_clk_register_gates(struct visconti_clk_provider *data, 
				 int num_gate,

				 const struct visconti_reset_data *reset,

				 spinlock_t *lock);



#define NO_RESET 0xFF



#endif /* _VISCONTI_CLKC_H_ */