From 6c839eb90d93ebc047948edc9ff815c991194c21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ale=C5=A1=20Pe=C4=8Dnik?= Date: Wed, 8 Apr 2026 07:07:34 +0200 Subject: [PATCH] clk: microchip: mpfs-ccc: fix out-of-bounds write MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue was allocated array size for clk_data. When clocks are being registered their index is taken from defines in dt-bindings. The last 2 clocks had their index outside of allocated range. Two defines (CLK_CCC_DLL0, CLK_CCC_DLL1) were not used and skipped over which was not taken into account when allocating the array. This patch is minimal change to resolve the issue. Issue was found using KASAN when debugging unrelated xdma driver issue. Consequently fixing this issue also resolved xdma driver issue. Related dmesg output: [ 0.290703] BUG: KASAN: slab-out-of-bounds in mpfs_ccc_register_outputs.constprop.0+0xd0/0x1fa [ 0.290984] Write of size 8 at addr ffffffe7be6e3ca8 by task swapper/0/1 [ 0.291253] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.43-linux4microchip+fpga-2023.09 #1 [ 0.291482] Hardware name: Skylabs HPC (DT) [ 0.291611] Call Trace: ... [ 0.292999] [] mpfs_ccc_register_outputs.constprop.0+0xd0/0x1fa [ 0.293245] [] mpfs_ccc_probe+0x174/0x30e [ 0.293437] [] platform_probe+0x74/0xba ... Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support") Signed-off-by: Aleš Pečnik Signed-off-by: Linux RISC-V bot --- drivers/clk/microchip/clk-mpfs-ccc.c | 3 +-- include/dt-bindings/clock/microchip,mpfs-clock.h | 2 ++ 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/clk/microchip/clk-mpfs-ccc.c b/drivers/clk/microchip/clk-mpfs-ccc.c index 3a3ea2d142f8a2..71fbb6265ea4a5 100644 --- a/drivers/clk/microchip/clk-mpfs-ccc.c +++ b/drivers/clk/microchip/clk-mpfs-ccc.c @@ -234,8 +234,7 @@ static int mpfs_ccc_probe(struct platform_device *pdev) unsigned int num_clks; int ret; - num_clks = ARRAY_SIZE(mpfs_ccc_pll_clks) + ARRAY_SIZE(mpfs_ccc_pll0out_clks) + - ARRAY_SIZE(mpfs_ccc_pll1out_clks); + num_clks = CLK_CCC_NUM; clk_data = devm_kzalloc(&pdev->dev, struct_size(clk_data, hw_data.hws, num_clks), GFP_KERNEL); diff --git a/include/dt-bindings/clock/microchip,mpfs-clock.h b/include/dt-bindings/clock/microchip,mpfs-clock.h index b52f19a2b480f7..8d53f2b81a54bb 100644 --- a/include/dt-bindings/clock/microchip,mpfs-clock.h +++ b/include/dt-bindings/clock/microchip,mpfs-clock.h @@ -73,4 +73,6 @@ #define CLK_CCC_DLL1_OUT0 14 #define CLK_CCC_DLL1_OUT1 15 +#define CLK_CCC_NUM 16 + #endif /* _DT_BINDINGS_CLK_MICROCHIP_MPFS_H_ */