Re: [PATCH v2 21/35] clk: mediatek: mt6797: Switch to common probe/remove helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] clk: mediatek: mt6797: heap OOB write in apmixedsys probe
--

commit 28b566b97c81bb9b4e1fed4aa54cc098337a524e
Author: Akari Tsuyukusa <akkun11.open@gmail.com>

clk: mediatek: mt6797: Switch to common probe/remove helpers

The MT6797 topckgen and infracfg drivers use clock types already
supported by the common helpers. The apmixedsys driver can also use
them now that PLL registration and unregistration are supported.

> diff --git a/drivers/clk/mediatek/clk-mt6797.c b/drivers/clk/mediatek/clk-mt6797.c
> index ebf850ac57f54..1934420375e88 100644
> --- a/drivers/clk/mediatek/clk-mt6797.c
> +++ b/drivers/clk/mediatek/clk-mt6797.c

[ ... ]

> -static int mtk_apmixedsys_init(struct platform_device *pdev)
> -{
> -	struct clk_hw_onecell_data *clk_data;
> -	struct device_node *node = pdev->dev.of_node;
> -
> -	clk_data = mtk_alloc_clk_data(CLK_APMIXED_NR);
> -	if (!clk_data)
> -		return -ENOMEM;
> -
> -	mtk_clk_register_plls(&pdev->dev, plls, ARRAY_SIZE(plls), clk_data);
> -
> -	return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
> -}
> +static const struct mtk_clk_desc apmixedsys_desc = {
> +	.plls = plls,
> +	.num_plls = ARRAY_SIZE(plls),

[Severity: High]
Does this cause an out-of-bounds write during probe?

Before this patch, mtk_alloc_clk_data(CLK_APMIXED_NR) was used to allocate
enough elements to cover the maximum clock ID. The maximum clock ID for
these PLLs is CLK_APMIXED_APLL2 (10).

With the new common probe, __mtk_clk_simple_probe() allocates the array
dynamically based strictly on the count of provided elements, which is
ARRAY_SIZE(plls) (10).

When mtk_clk_register_plls() processes CLK_APMIXED_APLL2, it stores the clock
pointer at index 10:

drivers/clk/mediatek/clk-pll.c:mtk_clk_register_plls() {
    ...
    clk_data->hws[pll->id] = hw;
    ...
}

Since the array is only allocated for 10 elements (indices 0-9), could
writing to index 10 corrupt memory?

> +};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013151734.3177690-1-akkun11.open@gmail.com?part=21