Re: [PATCH v3 3/6] dt-bindings: clock: ma35d1: Add missing WDT/WWDT parent clocks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] clk: nuvoton: ma35d1: missing MA35D1_CLK_COUNT increment causes latent OOB array write
--

commit fa4195c8a4eac6a0140746768ad2e5ab623b88e4
Author: Miquel Raynal <miquel.raynal@bootlin.com>

dt-bindings: clock: ma35d1: Add missing WDT/WWDT parent clocks

This commit adds PCLK3_DIV4096 and PCLK4_DIV4096 to the dt-bindings header
to describe the clock tree for WDT and WWDT muxes.

> diff --git a/include/dt-bindings/clock/nuvoton,ma35d1-clk.h b/include/dt-bindings/clock/nuvoton,ma35d1-clk.h
> index 2d6a44a7e55c4..764d837d6162a 100644
> --- a/include/dt-bindings/clock/nuvoton,ma35d1-clk.h
> +++ b/include/dt-bindings/clock/nuvoton,ma35d1-clk.h
> @@ -248,5 +248,7 @@
>  #define ADC_GATE	233
>  #define EADC_DIV	234
>  #define EADC_GATE	235
> +#define PCLK3_DIV4096	236
> +#define PCLK4_DIV4096	237

[Severity: High]
Does this introduction of clock IDs 236 and 237 require a corresponding
update to MA35D1_CLK_COUNT in the clock driver?

In drivers/clk/nuvoton/clk-ma35d1.c, MA35D1_CLK_COUNT is currently hardcoded
to 236:

drivers/clk/nuvoton/clk-ma35d1.c:
#define MA35D1_CLK_COUNT        236

The driver's ma35d1_clocks_probe() function uses this count to allocate the
hardware clock pointer array:

drivers/clk/nuvoton/clk-ma35d1.c:ma35d1_clocks_probe()
    ma35d1_hw_data = devm_kzalloc(dev,
                                  struct_size(ma35d1_hw_data, hws, MA35D1_CLK_COUNT),
                                  GFP_KERNEL);

If subsequent patches instantiate these new fixed factor clocks and write to
hws[PCLK3_DIV4096] or hws[PCLK4_DIV4096], it appears it will write out of
bounds into adjacent heap memory because the array only holds 236 elements
(indices 0 to 235).

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925-perso-ma35d1-upstream-clk-v3-0-ffbae7e020a8@bootlin.com?part=3