From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 337A4C4332F for ; Wed, 4 Jan 2023 16:16:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239727AbjADQP7 (ORCPT ); Wed, 4 Jan 2023 11:15:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37626 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239919AbjADQPk (ORCPT ); Wed, 4 Jan 2023 11:15:40 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 35DE242E1A for ; Wed, 4 Jan 2023 08:15:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C76296179F for ; Wed, 4 Jan 2023 16:15:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97F84C433EF; Wed, 4 Jan 2023 16:15:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1672848914; bh=r6yvBeFbds1YEWpwfD/9LHlsc+lMwYeCu9F4msfA7Zs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iXyfio+I8hCwzwXXIUXOkMmTkxkPbJNl8oLCUt+XDlQxNsEC9BV0wsMK/Dhszfgbs nlrxBNntlz4A4pXF0LMGo0IjjI3kmD1Bdb3+9i/xnBQtKtatM9tchGYmrjaEeWlVZr jFuZHO9JvPuL809vf2Lujfx9x1F7+GQ1XPIbWp88= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Dmitry Baryshkov , Johan Hovold , Vinod Koul Subject: [PATCH 6.0 016/177] phy: qcom-qmp-combo: fix out-of-bounds clock access Date: Wed, 4 Jan 2023 17:05:07 +0100 Message-Id: <20230104160508.149096439@linuxfoundation.org> X-Mailer: git-send-email 2.39.0 In-Reply-To: <20230104160507.635888536@linuxfoundation.org> References: <20230104160507.635888536@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johan Hovold commit d8a5b59c5fc75c99ba17e3eb1a8f580d8d172b28 upstream. The SM8250 only uses three clocks but the DP configuration erroneously described four clocks. In case the DP part of the PHY is initialised before the USB part, this would lead to uninitialised memory beyond the bulk-clocks array to be treated as a clock pointer as the clocks are requested based on the USB configuration. Fixes: aff188feb5e1 ("phy: qcom-qmp: add support for sm8250-usb3-dp phy") Cc: stable@vger.kernel.org # 5.13 Reviewed-by: Dmitry Baryshkov Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20221114081346.5116-2-johan+linaro@kernel.org Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman --- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c @@ -1032,8 +1032,8 @@ static const struct qmp_phy_cfg sm8250_d .serdes_tbl_hbr3 = qmp_v4_dp_serdes_tbl_hbr3, .serdes_tbl_hbr3_num = ARRAY_SIZE(qmp_v4_dp_serdes_tbl_hbr3), - .clk_list = qmp_v4_phy_clk_l, - .num_clks = ARRAY_SIZE(qmp_v4_phy_clk_l), + .clk_list = qmp_v4_sm8250_usbphy_clk_l, + .num_clks = ARRAY_SIZE(qmp_v4_sm8250_usbphy_clk_l), .reset_list = msm8996_usb3phy_reset_l, .num_resets = ARRAY_SIZE(msm8996_usb3phy_reset_l), .vreg_list = qmp_phy_vreg_l,