* [PATCH v1] clk: microchip: mpfs-ccc: fix out of bounds access during output registration
@ 2026-02-24 9:35 Conor Dooley
2026-02-25 22:56 ` Brian Masney
0 siblings, 1 reply; 6+ messages in thread
From: Conor Dooley @ 2026-02-24 9:35 UTC (permalink / raw)
To: linux-clk
Cc: Conor Dooley, stable, Daire McNamara, Michael Turquette,
Stephen Boyd, Claudiu Beznea, linux-riscv, linux-kernel
UBSAN reported an out of bounds access during registration of the last
two outputs. This out of bounds access occurs because space is only
allocated in the hws array for two PLLs and the four output dividers
that each has, but the defined IDs contain two DLLS and their two
outputs each, which are not supported by the driver. The ID order is
PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs
by two while adding them to the array to avoid the problem.
Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support")
CC: stable@vger.kernel.org
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
---
CC: Conor Dooley <conor.dooley@microchip.com>
CC: Daire McNamara <daire.mcnamara@microchip.com>
CC: Michael Turquette <mturquette@baylibre.com>
CC: Stephen Boyd <sboyd@kernel.org>
CC: Claudiu Beznea <claudiu.beznea@tuxon.dev>
CC: linux-riscv@lists.infradead.org
CC: linux-clk@vger.kernel.org
CC: linux-kernel@vger.kernel.org
---
drivers/clk/microchip/clk-mpfs-ccc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/microchip/clk-mpfs-ccc.c b/drivers/clk/microchip/clk-mpfs-ccc.c
index 3a3ea2d142f8a..54cfbb8be8ab5 100644
--- a/drivers/clk/microchip/clk-mpfs-ccc.c
+++ b/drivers/clk/microchip/clk-mpfs-ccc.c
@@ -178,7 +178,7 @@ static int mpfs_ccc_register_outputs(struct device *dev, struct mpfs_ccc_out_hw_
return dev_err_probe(dev, ret, "failed to register clock id: %d\n",
out_hw->id);
- data->hw_data.hws[out_hw->id] = &out_hw->divider.hw;
+ data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw;
}
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v1] clk: microchip: mpfs-ccc: fix out of bounds access during output registration 2026-02-24 9:35 [PATCH v1] clk: microchip: mpfs-ccc: fix out of bounds access during output registration Conor Dooley @ 2026-02-25 22:56 ` Brian Masney 2026-02-25 23:14 ` Conor Dooley 0 siblings, 1 reply; 6+ messages in thread From: Brian Masney @ 2026-02-25 22:56 UTC (permalink / raw) To: Conor Dooley Cc: linux-clk, stable, Daire McNamara, Michael Turquette, Stephen Boyd, Claudiu Beznea, linux-riscv, linux-kernel Hi Conor, On Tue, Feb 24, 2026 at 09:35:25AM +0000, Conor Dooley wrote: > UBSAN reported an out of bounds access during registration of the last > two outputs. This out of bounds access occurs because space is only > allocated in the hws array for two PLLs and the four output dividers > that each has, but the defined IDs contain two DLLS and their two > outputs each, which are not supported by the driver. The ID order is > PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs > by two while adding them to the array to avoid the problem. > > Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support") > CC: stable@vger.kernel.org > Signed-off-by: Conor Dooley <conor.dooley@microchip.com> > --- > CC: Conor Dooley <conor.dooley@microchip.com> > CC: Daire McNamara <daire.mcnamara@microchip.com> > CC: Michael Turquette <mturquette@baylibre.com> > CC: Stephen Boyd <sboyd@kernel.org> > CC: Claudiu Beznea <claudiu.beznea@tuxon.dev> > CC: linux-riscv@lists.infradead.org > CC: linux-clk@vger.kernel.org > CC: linux-kernel@vger.kernel.org > --- > drivers/clk/microchip/clk-mpfs-ccc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/clk/microchip/clk-mpfs-ccc.c b/drivers/clk/microchip/clk-mpfs-ccc.c > index 3a3ea2d142f8a..54cfbb8be8ab5 100644 > --- a/drivers/clk/microchip/clk-mpfs-ccc.c > +++ b/drivers/clk/microchip/clk-mpfs-ccc.c > @@ -178,7 +178,7 @@ static int mpfs_ccc_register_outputs(struct device *dev, struct mpfs_ccc_out_hw_ > return dev_err_probe(dev, ret, "failed to register clock id: %d\n", > out_hw->id); > > - data->hw_data.hws[out_hw->id] = &out_hw->divider.hw; > + data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw; What happens when / if the DLLs are supported by this driver in the future? This seems like a trap for the future. According to include/dt-bindings/clock/microchip,mpfs-clock.h, there are only 16 clock IDs. Could hws be initialized to have enough room for all 16 structures, and would it be ok if it was a sparse array? At the very least, I think it would be nice to include a comment here. Brian ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1] clk: microchip: mpfs-ccc: fix out of bounds access during output registration 2026-02-25 22:56 ` Brian Masney @ 2026-02-25 23:14 ` Conor Dooley 2026-02-25 23:24 ` Conor Dooley 0 siblings, 1 reply; 6+ messages in thread From: Conor Dooley @ 2026-02-25 23:14 UTC (permalink / raw) To: Brian Masney Cc: Conor Dooley, linux-clk, stable, Daire McNamara, Michael Turquette, Stephen Boyd, Claudiu Beznea, linux-riscv, linux-kernel [-- Attachment #1: Type: text/plain, Size: 2448 bytes --] On Wed, Feb 25, 2026 at 05:56:53PM -0500, Brian Masney wrote: > Hi Conor, > > On Tue, Feb 24, 2026 at 09:35:25AM +0000, Conor Dooley wrote: > > UBSAN reported an out of bounds access during registration of the last > > two outputs. This out of bounds access occurs because space is only > > allocated in the hws array for two PLLs and the four output dividers > > that each has, but the defined IDs contain two DLLS and their two > > outputs each, which are not supported by the driver. The ID order is > > PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs > > by two while adding them to the array to avoid the problem. > > > > Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support") > > CC: stable@vger.kernel.org > > Signed-off-by: Conor Dooley <conor.dooley@microchip.com> > > --- > > CC: Conor Dooley <conor.dooley@microchip.com> > > CC: Daire McNamara <daire.mcnamara@microchip.com> > > CC: Michael Turquette <mturquette@baylibre.com> > > CC: Stephen Boyd <sboyd@kernel.org> > > CC: Claudiu Beznea <claudiu.beznea@tuxon.dev> > > CC: linux-riscv@lists.infradead.org > > CC: linux-clk@vger.kernel.org > > CC: linux-kernel@vger.kernel.org > > --- > > drivers/clk/microchip/clk-mpfs-ccc.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/clk/microchip/clk-mpfs-ccc.c b/drivers/clk/microchip/clk-mpfs-ccc.c > > index 3a3ea2d142f8a..54cfbb8be8ab5 100644 > > --- a/drivers/clk/microchip/clk-mpfs-ccc.c > > +++ b/drivers/clk/microchip/clk-mpfs-ccc.c > > @@ -178,7 +178,7 @@ static int mpfs_ccc_register_outputs(struct device *dev, struct mpfs_ccc_out_hw_ > > return dev_err_probe(dev, ret, "failed to register clock id: %d\n", > > out_hw->id); > > > > - data->hw_data.hws[out_hw->id] = &out_hw->divider.hw; > > + data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw; > > What happens when / if the DLLs are supported by this driver in the > future? This seems like a trap for the future. > > According to include/dt-bindings/clock/microchip,mpfs-clock.h, there are > only 16 clock IDs. Could hws be initialized to have enough room for all > 16 structures, and would it be ok if it was a sparse array? > > At the very least, I think it would be nice to include a comment here. I think I'd rather add a comment, I know it's at most only 24 extra allocations, but just feels bad to do it. [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 228 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1] clk: microchip: mpfs-ccc: fix out of bounds access during output registration 2026-02-25 23:14 ` Conor Dooley @ 2026-02-25 23:24 ` Conor Dooley 2026-02-26 15:38 ` Brian Masney 0 siblings, 1 reply; 6+ messages in thread From: Conor Dooley @ 2026-02-25 23:24 UTC (permalink / raw) To: Brian Masney Cc: Conor Dooley, linux-clk, stable, Daire McNamara, Michael Turquette, Stephen Boyd, Claudiu Beznea, linux-riscv, linux-kernel [-- Attachment #1: Type: text/plain, Size: 3078 bytes --] On Wed, Feb 25, 2026 at 11:14:47PM +0000, Conor Dooley wrote: > On Wed, Feb 25, 2026 at 05:56:53PM -0500, Brian Masney wrote: > > Hi Conor, > > > > On Tue, Feb 24, 2026 at 09:35:25AM +0000, Conor Dooley wrote: > > > UBSAN reported an out of bounds access during registration of the last > > > two outputs. This out of bounds access occurs because space is only > > > allocated in the hws array for two PLLs and the four output dividers > > > that each has, but the defined IDs contain two DLLS and their two > > > outputs each, which are not supported by the driver. The ID order is > > > PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs > > > by two while adding them to the array to avoid the problem. > > > > > > Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support") > > > CC: stable@vger.kernel.org > > > Signed-off-by: Conor Dooley <conor.dooley@microchip.com> > > > --- > > > CC: Conor Dooley <conor.dooley@microchip.com> > > > CC: Daire McNamara <daire.mcnamara@microchip.com> > > > CC: Michael Turquette <mturquette@baylibre.com> > > > CC: Stephen Boyd <sboyd@kernel.org> > > > CC: Claudiu Beznea <claudiu.beznea@tuxon.dev> > > > CC: linux-riscv@lists.infradead.org > > > CC: linux-clk@vger.kernel.org > > > CC: linux-kernel@vger.kernel.org > > > --- > > > drivers/clk/microchip/clk-mpfs-ccc.c | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/drivers/clk/microchip/clk-mpfs-ccc.c b/drivers/clk/microchip/clk-mpfs-ccc.c > > > index 3a3ea2d142f8a..54cfbb8be8ab5 100644 > > > --- a/drivers/clk/microchip/clk-mpfs-ccc.c > > > +++ b/drivers/clk/microchip/clk-mpfs-ccc.c > > > @@ -178,7 +178,7 @@ static int mpfs_ccc_register_outputs(struct device *dev, struct mpfs_ccc_out_hw_ > > > return dev_err_probe(dev, ret, "failed to register clock id: %d\n", > > > out_hw->id); > > > > > > - data->hw_data.hws[out_hw->id] = &out_hw->divider.hw; > > > + data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw; > > > > What happens when / if the DLLs are supported by this driver in the > > future? This seems like a trap for the future. > > > > According to include/dt-bindings/clock/microchip,mpfs-clock.h, there are > > only 16 clock IDs. Could hws be initialized to have enough room for all > > 16 structures, and would it be ok if it was a sparse array? > > > > At the very least, I think it would be nice to include a comment here. > > I think I'd rather add a comment, I know it's at most only 24 extra > allocations, but just feels bad to do it. I'll add this, maybe on application. @@ -234,6 +234,10 @@ static int mpfs_ccc_probe(struct platform_device *pdev) unsigned int num_clks; int ret; + /* + * If DLLs get added here, mpfs_ccc_register_outputs() currently packs + * sparse clock IDs in the hws array + */ num_clks = ARRAY_SIZE(mpfs_ccc_pll_clks) + ARRAY_SIZE(mpfs_ccc_pll0out_clks) + ARRAY_SIZE(mpfs_ccc_pll1out_clks); [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 228 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1] clk: microchip: mpfs-ccc: fix out of bounds access during output registration 2026-02-25 23:24 ` Conor Dooley @ 2026-02-26 15:38 ` Brian Masney 2026-03-02 17:13 ` Conor Dooley 0 siblings, 1 reply; 6+ messages in thread From: Brian Masney @ 2026-02-26 15:38 UTC (permalink / raw) To: Conor Dooley Cc: Conor Dooley, linux-clk, stable, Daire McNamara, Michael Turquette, Stephen Boyd, Claudiu Beznea, linux-riscv, linux-kernel On Wed, Feb 25, 2026 at 11:24:59PM +0000, Conor Dooley wrote: > On Wed, Feb 25, 2026 at 11:14:47PM +0000, Conor Dooley wrote: > > On Wed, Feb 25, 2026 at 05:56:53PM -0500, Brian Masney wrote: > > > Hi Conor, > > > > > > On Tue, Feb 24, 2026 at 09:35:25AM +0000, Conor Dooley wrote: > > > > UBSAN reported an out of bounds access during registration of the last > > > > two outputs. This out of bounds access occurs because space is only > > > > allocated in the hws array for two PLLs and the four output dividers > > > > that each has, but the defined IDs contain two DLLS and their two > > > > outputs each, which are not supported by the driver. The ID order is > > > > PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs > > > > by two while adding them to the array to avoid the problem. > > > > > > > > Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support") > > > > CC: stable@vger.kernel.org > > > > Signed-off-by: Conor Dooley <conor.dooley@microchip.com> > > > > --- > > > > CC: Conor Dooley <conor.dooley@microchip.com> > > > > CC: Daire McNamara <daire.mcnamara@microchip.com> > > > > CC: Michael Turquette <mturquette@baylibre.com> > > > > CC: Stephen Boyd <sboyd@kernel.org> > > > > CC: Claudiu Beznea <claudiu.beznea@tuxon.dev> > > > > CC: linux-riscv@lists.infradead.org > > > > CC: linux-clk@vger.kernel.org > > > > CC: linux-kernel@vger.kernel.org > > > > --- > > > > drivers/clk/microchip/clk-mpfs-ccc.c | 2 +- > > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > > > diff --git a/drivers/clk/microchip/clk-mpfs-ccc.c b/drivers/clk/microchip/clk-mpfs-ccc.c > > > > index 3a3ea2d142f8a..54cfbb8be8ab5 100644 > > > > --- a/drivers/clk/microchip/clk-mpfs-ccc.c > > > > +++ b/drivers/clk/microchip/clk-mpfs-ccc.c > > > > @@ -178,7 +178,7 @@ static int mpfs_ccc_register_outputs(struct device *dev, struct mpfs_ccc_out_hw_ > > > > return dev_err_probe(dev, ret, "failed to register clock id: %d\n", > > > > out_hw->id); > > > > > > > > - data->hw_data.hws[out_hw->id] = &out_hw->divider.hw; > > > > + data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw; > > > > > > What happens when / if the DLLs are supported by this driver in the > > > future? This seems like a trap for the future. > > > > > > According to include/dt-bindings/clock/microchip,mpfs-clock.h, there are > > > only 16 clock IDs. Could hws be initialized to have enough room for all > > > 16 structures, and would it be ok if it was a sparse array? > > > > > > At the very least, I think it would be nice to include a comment here. > > > > I think I'd rather add a comment, I know it's at most only 24 extra > > allocations, but just feels bad to do it. > > I'll add this, maybe on application. > > @@ -234,6 +234,10 @@ static int mpfs_ccc_probe(struct platform_device *pdev) > unsigned int num_clks; > int ret; > > + /* > + * If DLLs get added here, mpfs_ccc_register_outputs() currently packs > + * sparse clock IDs in the hws array > + */ > num_clks = ARRAY_SIZE(mpfs_ccc_pll_clks) + ARRAY_SIZE(mpfs_ccc_pll0out_clks) + > ARRAY_SIZE(mpfs_ccc_pll1out_clks); That makes sense. Reviewed-by: Brian Masney <bmasney@redhat.com> ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1] clk: microchip: mpfs-ccc: fix out of bounds access during output registration 2026-02-26 15:38 ` Brian Masney @ 2026-03-02 17:13 ` Conor Dooley 0 siblings, 0 replies; 6+ messages in thread From: Conor Dooley @ 2026-03-02 17:13 UTC (permalink / raw) To: Brian Masney Cc: Conor Dooley, linux-clk, stable, Daire McNamara, Michael Turquette, Stephen Boyd, Claudiu Beznea, linux-riscv, linux-kernel [-- Attachment #1: Type: text/plain, Size: 3589 bytes --] On Thu, Feb 26, 2026 at 10:38:45AM -0500, Brian Masney wrote: > On Wed, Feb 25, 2026 at 11:24:59PM +0000, Conor Dooley wrote: > > On Wed, Feb 25, 2026 at 11:14:47PM +0000, Conor Dooley wrote: > > > On Wed, Feb 25, 2026 at 05:56:53PM -0500, Brian Masney wrote: > > > > Hi Conor, > > > > > > > > On Tue, Feb 24, 2026 at 09:35:25AM +0000, Conor Dooley wrote: > > > > > UBSAN reported an out of bounds access during registration of the last > > > > > two outputs. This out of bounds access occurs because space is only > > > > > allocated in the hws array for two PLLs and the four output dividers > > > > > that each has, but the defined IDs contain two DLLS and their two > > > > > outputs each, which are not supported by the driver. The ID order is > > > > > PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs > > > > > by two while adding them to the array to avoid the problem. > > > > > > > > > > Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support") > > > > > CC: stable@vger.kernel.org > > > > > Signed-off-by: Conor Dooley <conor.dooley@microchip.com> > > > > > --- > > > > > CC: Conor Dooley <conor.dooley@microchip.com> > > > > > CC: Daire McNamara <daire.mcnamara@microchip.com> > > > > > CC: Michael Turquette <mturquette@baylibre.com> > > > > > CC: Stephen Boyd <sboyd@kernel.org> > > > > > CC: Claudiu Beznea <claudiu.beznea@tuxon.dev> > > > > > CC: linux-riscv@lists.infradead.org > > > > > CC: linux-clk@vger.kernel.org > > > > > CC: linux-kernel@vger.kernel.org > > > > > --- > > > > > drivers/clk/microchip/clk-mpfs-ccc.c | 2 +- > > > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > > > > > diff --git a/drivers/clk/microchip/clk-mpfs-ccc.c b/drivers/clk/microchip/clk-mpfs-ccc.c > > > > > index 3a3ea2d142f8a..54cfbb8be8ab5 100644 > > > > > --- a/drivers/clk/microchip/clk-mpfs-ccc.c > > > > > +++ b/drivers/clk/microchip/clk-mpfs-ccc.c > > > > > @@ -178,7 +178,7 @@ static int mpfs_ccc_register_outputs(struct device *dev, struct mpfs_ccc_out_hw_ > > > > > return dev_err_probe(dev, ret, "failed to register clock id: %d\n", > > > > > out_hw->id); > > > > > > > > > > - data->hw_data.hws[out_hw->id] = &out_hw->divider.hw; > > > > > + data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw; > > > > > > > > What happens when / if the DLLs are supported by this driver in the > > > > future? This seems like a trap for the future. > > > > > > > > According to include/dt-bindings/clock/microchip,mpfs-clock.h, there are > > > > only 16 clock IDs. Could hws be initialized to have enough room for all > > > > 16 structures, and would it be ok if it was a sparse array? > > > > > > > > At the very least, I think it would be nice to include a comment here. > > > > > > I think I'd rather add a comment, I know it's at most only 24 extra > > > allocations, but just feels bad to do it. > > > > I'll add this, maybe on application. > > > > @@ -234,6 +234,10 @@ static int mpfs_ccc_probe(struct platform_device *pdev) > > unsigned int num_clks; > > int ret; > > > > + /* > > + * If DLLs get added here, mpfs_ccc_register_outputs() currently packs > > + * sparse clock IDs in the hws array > > + */ > > num_clks = ARRAY_SIZE(mpfs_ccc_pll_clks) + ARRAY_SIZE(mpfs_ccc_pll0out_clks) + > > ARRAY_SIZE(mpfs_ccc_pll1out_clks); > > That makes sense. > > Reviewed-by: Brian Masney <bmasney@redhat.com> I applied the patch with this comment added. [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 228 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-03-02 17:13 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-02-24 9:35 [PATCH v1] clk: microchip: mpfs-ccc: fix out of bounds access during output registration Conor Dooley 2026-02-25 22:56 ` Brian Masney 2026-02-25 23:14 ` Conor Dooley 2026-02-25 23:24 ` Conor Dooley 2026-02-26 15:38 ` Brian Masney 2026-03-02 17:13 ` Conor Dooley
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox