From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 162CA32B11D; Sat, 30 May 2026 17:02:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780160547; cv=none; b=GP0rLz28jTMvAdGNkd2DD2OVyqp8N0Lp9gZIX11QowulZdba4y1H3aQ331gNiOyJzZg9c1tTqjBkZuHVevyL/uoam2FihzsDrmd+OH4qKe1GLJR8X1ASpVmqgIIX5kUBgdY++f2qIKrjadjerq+Dhb+hN/hTGFqqT1X+yeYDk4c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780160547; c=relaxed/simple; bh=XIMW0pg7S5riCB+ifu8rGen/fdtSf8rwB5tnZFJ6EaQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MBh7cGz+BvU4AY0409TyoR0l7ugtbr9HM0kuJ3/4LjkKY6hGTJyyUSy6mSXdem4RwByIshOIzydlH85nZD8X9gBjd32Gf85pDQYzn6C0Y5/bkGB4ObZRcEOU/5pjPjrxoMVBfkFNlhZOXnk8B5Y/1h+VnQ+eK4LAsa8+Zbe0+ts= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=D1nNKbrB; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="D1nNKbrB" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F8241F00893; Sat, 30 May 2026 17:02:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1780160546; bh=QhyjX1KDa32pWDZ9uPN6HCPMTdQDpz0fz0do/D0qOtM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=D1nNKbrB+ACxgsJEKVp/btToYmHlBs4BEYIJoToHQHwBqhWPRqFKAJPqzAGpLxPZW VEonIUd9Sh82U5S3VioFZt2UOW8CPC8PbgwUMd0jhB751fk3G81Vd0bSgbRCS+7Yg5 OIRuDqR7ZJS/A4yUMUi+i51MuAyJ8aPPabeneJB0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Brian Masney , Conor Dooley Subject: [PATCH 6.1 340/969] clk: microchip: mpfs-ccc: fix out of bounds access during output registration Date: Sat, 30 May 2026 17:57:44 +0200 Message-ID: <20260530160309.758630904@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260530160300.485627683@linuxfoundation.org> References: <20260530160300.485627683@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Conor Dooley commit 2f7ae8ab6aa73daaf080d5332110357c29df9c36 upstream. UBSAN reported an out of bounds access during registration of the last two outputs. This out of bounds access occurs because space is only allocated in the hws array for two PLLs and the four output dividers that each has, but the defined IDs contain two DLLS and their two outputs each, which are not supported by the driver. The ID order is PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs by two while adding them to the array to avoid the problem. Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support") CC: stable@vger.kernel.org Reviewed-by: Brian Masney Signed-off-by: Conor Dooley Signed-off-by: Greg Kroah-Hartman --- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/clk/microchip/clk-mpfs-ccc.c b/drivers/clk/microchip/clk-mpfs-ccc.c index 3a3ea2d142f8..0a76a1aaa50f 100644 --- a/drivers/clk/microchip/clk-mpfs-ccc.c +++ b/drivers/clk/microchip/clk-mpfs-ccc.c @@ -178,7 +178,7 @@ static int mpfs_ccc_register_outputs(struct device *dev, struct mpfs_ccc_out_hw_ return dev_err_probe(dev, ret, "failed to register clock id: %d\n", out_hw->id); - data->hw_data.hws[out_hw->id] = &out_hw->divider.hw; + data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw; } return 0; @@ -234,6 +234,10 @@ static int mpfs_ccc_probe(struct platform_device *pdev) unsigned int num_clks; int ret; + /* + * If DLLs get added here, mpfs_ccc_register_outputs() currently packs + * sparse clock IDs in the hws array + */ num_clks = ARRAY_SIZE(mpfs_ccc_pll_clks) + ARRAY_SIZE(mpfs_ccc_pll0out_clks) + ARRAY_SIZE(mpfs_ccc_pll1out_clks); -- 2.54.0