U-Boot Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Wayen Yan <win847@gmail.com>
To: Tom Rini <trini@konsulko.com>
Cc: u-boot@lists.denx.de, Christian Marangi <ansuelsmth@gmail.com>,
	Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>,
	Lukasz Majewski <lukma@denx.de>
Subject: [PATCH] clk: airoha: fix off-by-one in clock ID boundary check
Date: Wed, 8 Jul 2026 12:06:08 +0800	[thread overview]
Message-ID: <178348762707.85793.537680021676357783@gmail.com> (raw)

The boundary checks in airoha_clk_enable(), airoha_clk_get_rate(), and
airoha_clk_set_rate() use "id > data->num_clocks" which allows id equal
to num_clocks to pass. Since data->descs[] has exactly num_clocks entries
(indices 0 to num_clocks-1), id=num_clocks results in an out-of-bounds
array access.

This is currently not triggered because the device tree clock IDs are
within bounds, but the check should be defensive. Fix by changing the
comparison from ">" to ">=".

Fixes: d0b81afb5ec9 ("clk: airoha: Add support for Airoha AN7581 SoC clock")
Signed-off-by: Wayen Yan <win847@gmail.com>
---
 drivers/clk/airoha/clk-airoha.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/clk/airoha/clk-airoha.c b/drivers/clk/airoha/clk-airoha.c
index 49dbca82135..89a8b4cb1cf 100644
--- a/drivers/clk/airoha/clk-airoha.c
+++ b/drivers/clk/airoha/clk-airoha.c
@@ -327,7 +327,7 @@ static int airoha_clk_enable(struct clk *clk)
 	struct airoha_clk_soc_data *data = priv->data;
 	int id = clk->id;
 
-	if (id > data->num_clocks)
+	if (id >= data->num_clocks)
 		return -EINVAL;
 
 	return 0;
@@ -349,7 +349,7 @@ static ulong airoha_clk_get_rate(struct clk *clk)
 	ulong rate;
 	int ret;
 
-	if (id > data->num_clocks) {
+	if (id >= data->num_clocks) {
 		dev_err(clk->dev, "Invalid clk ID %d\n", id);
 		return 0;
 	}
@@ -412,7 +412,7 @@ static ulong airoha_clk_set_rate(struct clk *clk, ulong rate)
 	int div;
 	int ret;
 
-	if (id > data->num_clocks) {
+	if (id >= data->num_clocks) {
 		dev_err(clk->dev, "Invalid clk ID %d\n", id);
 		return 0;
 	}
-- 
2.51.0



             reply	other threads:[~2026-07-08 12:43 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-08  4:06 Wayen Yan [this message]
2026-07-18  0:07 ` [PATCH] clk: airoha: fix off-by-one in clock ID boundary check Tom Rini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178348762707.85793.537680021676357783@gmail.com \
    --to=win847@gmail.com \
    --cc=ansuelsmth@gmail.com \
    --cc=lukma@denx.de \
    --cc=mikhail.kshevetskiy@iopsys.eu \
    --cc=trini@konsulko.com \
    --cc=u-boot@lists.denx.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox