From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 91F3DEE0218 for ; Wed, 11 Sep 2024 08:15:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:MIME-Version: Content-Transfer-Encoding:Content-Type:References:In-Reply-To:Date:Cc:To:From :Subject:Message-ID:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=9ncGzqtpiWgjyq35hElyjIoVwEnaH+a6wWns+spW8Jc=; b=Wg9R9Jtr9JrnaxbsbQCsVQUzvK kw1PVVAnrj0pHWA4z7Vc6H4ixBfNyrIdw3PdDM7ySsXMt73DVmAI8rrJEnZi3dkSgCyoRpyQ1eXx5 nXPVlV/UJKeywTzN+Wp83/R1/l3l/F2aU6AvZ9TZMXixS4N04MZC4EZOaTvh04tNXnxPZ51hSdMl4 hTrieJGvtcZB2sNwmZrD5K+qXDYo0yf6mLo3bzhAWHqF/BgK4GnAYxpTXG0qwG2cwLA9d9w4OpAz0 NmnFgbqB2QlbzfAzV2Nr0PQGBBCcKYRHUzRqfKDv1DyGzPRXKBC+s2hwM22/k4Ep+CrnEnC5LItke aK50ClIw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1soIVm-00000008akQ-2OsV; Wed, 11 Sep 2024 08:15:38 +0000 Received: from forward501d.mail.yandex.net ([2a02:6b8:c41:1300:1:45:d181:d501]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1soIUj-00000008aXa-03hc for linux-arm-kernel@lists.infradead.org; Wed, 11 Sep 2024 08:14:35 +0000 Received: from mail-nwsmtp-smtp-production-main-23.myt.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-23.myt.yp-c.yandex.net [IPv6:2a02:6b8:c12:51a0:0:640:3bf:0]) by forward501d.mail.yandex.net (Yandex) with ESMTPS id 0B9F4614F7; Wed, 11 Sep 2024 11:14:25 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-23.myt.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id NEer0R0Of8c0-w1ouJzf4; Wed, 11 Sep 2024 11:14:24 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=maquefel.me; s=mail; t=1726042464; bh=9ncGzqtpiWgjyq35hElyjIoVwEnaH+a6wWns+spW8Jc=; h=References:Date:In-Reply-To:Cc:To:From:Subject:Message-ID; b=Xj3wITdQtKiEe4f6xbwAU/AQXN4qH3xLcTgo3KdQhAp8z/Ex0Rr5FZN2z772f8Zqg wZNpHTyJR5/gX5XPOW2tUKLZKtqo8zOho31m913ek4l458jxaTCu06wFgJWvnBIB0P YGrMumDa9SgVDO5G1sqB5QFjy1tijTyltW/7Oabo= Authentication-Results: mail-nwsmtp-smtp-production-main-23.myt.yp-c.yandex.net; dkim=pass header.i=@maquefel.me Message-ID: <246de2986dce9d867894bb006a1b2b3601e94a4e.camel@maquefel.me> Subject: Re: [PATCH] ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate() From: Nikita Shubin To: Dan Carpenter , Alexander Sverdlin , Arnd Bergmann Cc: Hartley Sweeten , Russell King , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Date: Wed, 11 Sep 2024 11:14:23 +0300 In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.48.4 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240911_011433_592346_530027EA X-CRM114-Status: GOOD ( 15.61 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Dan! Reviewed-by: Nikita Shubin Alexander, Arnd unfortunately, the ep93xx DT conversion series is also affected by this bug. On Wed, 2024-09-11 at 10:39 +0300, Dan Carpenter wrote: > The psc->div[] array has psc->num_div elements.=C2=A0 These values come > from > when we call clk_hw_register_div().=C2=A0 It's adc_divisors and > ARRAY_SIZE(adc_divisors)) and so on.=C2=A0 So this condition needs to be > >=3D > instead of > to prevent an out of bounds read. >=20 > Fixes: 9645ccc7bd7a ("ep93xx: clock: convert in-place to COMMON_CLK") > Signed-off-by: Dan Carpenter > --- > =C2=A0arch/arm/mach-ep93xx/clock.c | 2 +- > =C2=A01 file changed, 1 insertion(+), 1 deletion(-) >=20 > diff --git a/arch/arm/mach-ep93xx/clock.c b/arch/arm/mach- > ep93xx/clock.c > index 85a496ddc619..e9f72a529b50 100644 > --- a/arch/arm/mach-ep93xx/clock.c > +++ b/arch/arm/mach-ep93xx/clock.c > @@ -359,7 +359,7 @@ static unsigned long > ep93xx_div_recalc_rate(struct clk_hw *hw, > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0u32 val =3D __raw_readl(p= sc->reg); > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0u8 index =3D (val & psc->= mask) >> psc->shift; > =C2=A0 > -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (index > psc->num_div) > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (index >=3D psc->num_div) > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0return 0; > =C2=A0 > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0return DIV_ROUND_UP_ULL(p= arent_rate, psc->div[index]);