hw_data->hws[] is annotated with __counted_by(num), so hw_data->num
must hold the element count before the array is accessed.
ipq_cmn_pll_register_clks() assigns it only after storing the fixed
rate output clocks and the CMN PLL, and the unwind loop under
unregister_fixed_clk reads .hws[] with .num still zero. Both are
out-of-bounds accesses under CONFIG_UBSAN_BOUNDS.
Move the assignment to right after the allocation.
Fixes: f81715a4c87c ("clk: qcom: Add CMN PLL clock controller driver for IPQ
SoC")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <[email protected]>
Reviewed-by: Luo Jie <[email protected]>
Reviewed-by: Konrad Dybcio <[email protected]>
Reviewed-by: Gustavo A. R. Silva <[email protected]>
Reviewed-by: Abel Vesa <[email protected]>
---
v2:
- cut the commit message down (Bjorn)
- collect Reviewed-by tags
v1:
https://lore.kernel.org/linux-clk/as8p251mb0001b905088748016a0965f1c8...@as8p251mb0001.eurp251.prod.outlook.com/
Compile-tested only; I have no IPQ hardware.
drivers/clk/qcom/ipq-cmn-pll.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/qcom/ipq-cmn-pll.c b/drivers/clk/qcom/ipq-cmn-pll.c
index dafe8c1738df..a9abad9ff4e5 100644
--- a/drivers/clk/qcom/ipq-cmn-pll.c
+++ b/drivers/clk/qcom/ipq-cmn-pll.c
@@ -380,6 +380,8 @@ static int ipq_cmn_pll_register_clks(struct platform_device
*pdev)
if (!hw_data)
return -ENOMEM;
+ hw_data->num = num_clks + 1;
+
/*
* Register the CMN PLL clock, which is the parent clock of
* the fixed rate output clocks.
@@ -406,7 +408,6 @@ static int ipq_cmn_pll_register_clks(struct platform_device
*pdev)
* is configured to 12 GHZ by DT property assigned-clock-rates-u64.
*/
hw_data->hws[CMN_PLL_CLK] = cmn_pll_hw;
- hw_data->num = num_clks + 1;
ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get, hw_data);
if (ret)
base-commit: df2908090cda368b01ff43709f51890076c56157
--
2.55.0
