From: Brian Masney <bmasney@redhat.com>
To: kdamaski <kostas.damaskinakis@gmail.com>
Cc: Yifeng Huang <huangyifeng@eswincomputing.com>,
Xuyang Dong <dongxuyang@eswincomputing.com>,
Michael Turquette <mturquette@baylibre.com>,
Stephen Boyd <sboyd@kernel.org>,
linux-clk@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] clk: eswin: Zero-initialize stack-allocated clk_init_data
Date: Tue, 14 Jul 2026 10:17:49 -0400 [thread overview]
Message-ID: <alZFDWYkt_ydsKL5@redhat.com> (raw)
In-Reply-To: <20260710141520.285132-1-kostas.damaskinakis@gmail.com>
On Fri, Jul 10, 2026 at 05:15:20PM +0300, kdamaski wrote:
> From: Kostas Damaskinakis <kostas.damaskinakis@gmail.com>
>
> eswin_clk_register_pll() and eswin_register_clkdiv() declare a struct
> clk_init_data on the stack and only initialize some of its fields
> (parent_data respectively parent_hws). clk_core_populate_parent_map()
> checks parent_names first and parent_data second before falling back
> to parent_hws, so leftover stack garbage in the uninitialized fields
> hijacks parent resolution and the clk core dereferences a bogus
> pointer:
>
> Unable to handle kernel NULL pointer dereference at virtual address 000000000000000c
> Oops [#1]
> epc : __clk_register+0x31a/0x7f0
> [<ffffffff805dc774>] __clk_register+0x31a/0x7f0
> [<ffffffff805dcd76>] devm_clk_hw_register+0x2a/0x94
> [<ffffffff805e319a>] eswin_register_clkdiv+0x80/0xd0
> [<ffffffff805e34a0>] eswin_clk_register_clks+0x162/0x1a0
> [<ffffffff805e3736>] eic7700_clk_probe+0x146/0x180
> [<ffffffff8065d23c>] platform_probe+0x3c/0x7a
>
> Observed on EIC7700 hardware (with the driver backported to a 6.17
> tree); whether the bug triggers depends entirely on what the stack
> happens to contain when the registration helpers run.
>
> Zero-initialize both structures.
>
> Fixes: cd44f127c1d4 ("clk: eswin: Add eic7700 clock driver")
> Signed-off-by: Kostas Damaskinakis <kostas.damaskinakis@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
prev parent reply other threads:[~2026-07-14 14:17 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-10 14:15 [PATCH] clk: eswin: Zero-initialize stack-allocated clk_init_data kdamaski
2026-07-13 2:33 ` Xuyang Dong
2026-07-14 14:17 ` Brian Masney [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alZFDWYkt_ydsKL5@redhat.com \
--to=bmasney@redhat.com \
--cc=dongxuyang@eswincomputing.com \
--cc=huangyifeng@eswincomputing.com \
--cc=kostas.damaskinakis@gmail.com \
--cc=linux-clk@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mturquette@baylibre.com \
--cc=sboyd@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.