mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 22:26:55 +00:00
clk: visconti: prevent array overflow in visconti_clk_register_gates()
[ Upstream commitc5601e0720
] This code was using -1 to represent that there was no reset function. Unfortunately, the -1 was stored in u8 so the if (clks[i].rs_id >= 0) condition was always true. This lead to an out of bounds access in visconti_clk_register_gates(). Fixes:b4cbe606dc
("clk: visconti: Add support common clock driver and reset driver") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/20220316083533.GA30941@kili Acked-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp> Signed-off-by: Stephen Boyd <sboyd@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
0374913ec0
commit
2723543c1d
3 changed files with 5 additions and 2 deletions
|
@ -176,7 +176,7 @@ static const struct visconti_clk_gate_table clk_gate_tables[] = {
|
||||||
{ TMPV770X_CLK_WRCK, "wrck",
|
{ TMPV770X_CLK_WRCK, "wrck",
|
||||||
clks_parent_data, ARRAY_SIZE(clks_parent_data),
|
clks_parent_data, ARRAY_SIZE(clks_parent_data),
|
||||||
0, 0x68, 0x168, 9, 32,
|
0, 0x68, 0x168, 9, 32,
|
||||||
-1, }, /* No reset */
|
NO_RESET, },
|
||||||
{ TMPV770X_CLK_PICKMON, "pickmon",
|
{ TMPV770X_CLK_PICKMON, "pickmon",
|
||||||
clks_parent_data, ARRAY_SIZE(clks_parent_data),
|
clks_parent_data, ARRAY_SIZE(clks_parent_data),
|
||||||
0, 0x10, 0x110, 8, 4,
|
0, 0x10, 0x110, 8, 4,
|
||||||
|
|
|
@ -147,7 +147,7 @@ int visconti_clk_register_gates(struct visconti_clk_provider *ctx,
|
||||||
if (!dev_name)
|
if (!dev_name)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
|
|
||||||
if (clks[i].rs_id >= 0) {
|
if (clks[i].rs_id != NO_RESET) {
|
||||||
rson_offset = reset[clks[i].rs_id].rson_offset;
|
rson_offset = reset[clks[i].rs_id].rson_offset;
|
||||||
rsoff_offset = reset[clks[i].rs_id].rsoff_offset;
|
rsoff_offset = reset[clks[i].rs_id].rsoff_offset;
|
||||||
rs_idx = reset[clks[i].rs_id].rs_idx;
|
rs_idx = reset[clks[i].rs_id].rs_idx;
|
||||||
|
|
|
@ -73,4 +73,7 @@ int visconti_clk_register_gates(struct visconti_clk_provider *data,
|
||||||
int num_gate,
|
int num_gate,
|
||||||
const struct visconti_reset_data *reset,
|
const struct visconti_reset_data *reset,
|
||||||
spinlock_t *lock);
|
spinlock_t *lock);
|
||||||
|
|
||||||
|
#define NO_RESET 0xFF
|
||||||
|
|
||||||
#endif /* _VISCONTI_CLKC_H_ */
|
#endif /* _VISCONTI_CLKC_H_ */
|
||||||
|
|
Loading…
Reference in a new issue