* [PATCH] clk: mvebu: Off by one bugs in cp110_of_clk_get()
@ 2018-12-03 14:50 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2018-12-03 14:50 UTC (permalink / raw)
To: Michael Turquette, Thomas Petazzoni
Cc: Stephen Boyd, Gregory CLEMENT, linux-clk, kernel-janitors
These > comparisons should be >= to prevent reading beyond the end of
of the clk_data->hws[] buffer.
The clk_data->hws[] array is allocated in cp110_syscon_common_probe()
when we do:
cp110_clk_data = devm_kzalloc(dev, sizeof(*cp110_clk_data) +
sizeof(struct clk_hw *) * CP110_CLK_NUM,
GFP_KERNEL);
As you can see, it has CP110_CLK_NUM elements which is equivalent to
CP110_MAX_CORE_CLOCKS + CP110_MAX_GATABLE_CLOCKS.
Fixes: d3da3eaef7f4 ("clk: mvebu: new driver for Armada CP110 system controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/clk/mvebu/cp110-system-controller.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
index 9781b1bf5998..9235a331b588 100644
--- a/drivers/clk/mvebu/cp110-system-controller.c
+++ b/drivers/clk/mvebu/cp110-system-controller.c
@@ -200,11 +200,11 @@ static struct clk_hw *cp110_of_clk_get(struct of_phandle_args *clkspec,
unsigned int idx = clkspec->args[1];
if (type = CP110_CLK_TYPE_CORE) {
- if (idx > CP110_MAX_CORE_CLOCKS)
+ if (idx >= CP110_MAX_CORE_CLOCKS)
return ERR_PTR(-EINVAL);
return clk_data->hws[idx];
} else if (type = CP110_CLK_TYPE_GATABLE) {
- if (idx > CP110_MAX_GATABLE_CLOCKS)
+ if (idx >= CP110_MAX_GATABLE_CLOCKS)
return ERR_PTR(-EINVAL);
return clk_data->hws[CP110_MAX_CORE_CLOCKS + idx];
}
--
2.11.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH] clk: mvebu: Off by one bugs in cp110_of_clk_get()
@ 2018-12-03 14:50 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2018-12-03 14:50 UTC (permalink / raw)
To: Michael Turquette, Thomas Petazzoni
Cc: Stephen Boyd, Gregory CLEMENT, linux-clk, kernel-janitors
These > comparisons should be >= to prevent reading beyond the end of
of the clk_data->hws[] buffer.
The clk_data->hws[] array is allocated in cp110_syscon_common_probe()
when we do:
cp110_clk_data = devm_kzalloc(dev, sizeof(*cp110_clk_data) +
sizeof(struct clk_hw *) * CP110_CLK_NUM,
GFP_KERNEL);
As you can see, it has CP110_CLK_NUM elements which is equivalent to
CP110_MAX_CORE_CLOCKS + CP110_MAX_GATABLE_CLOCKS.
Fixes: d3da3eaef7f4 ("clk: mvebu: new driver for Armada CP110 system controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/clk/mvebu/cp110-system-controller.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
index 9781b1bf5998..9235a331b588 100644
--- a/drivers/clk/mvebu/cp110-system-controller.c
+++ b/drivers/clk/mvebu/cp110-system-controller.c
@@ -200,11 +200,11 @@ static struct clk_hw *cp110_of_clk_get(struct of_phandle_args *clkspec,
unsigned int idx = clkspec->args[1];
if (type == CP110_CLK_TYPE_CORE) {
- if (idx > CP110_MAX_CORE_CLOCKS)
+ if (idx >= CP110_MAX_CORE_CLOCKS)
return ERR_PTR(-EINVAL);
return clk_data->hws[idx];
} else if (type == CP110_CLK_TYPE_GATABLE) {
- if (idx > CP110_MAX_GATABLE_CLOCKS)
+ if (idx >= CP110_MAX_GATABLE_CLOCKS)
return ERR_PTR(-EINVAL);
return clk_data->hws[CP110_MAX_CORE_CLOCKS + idx];
}
--
2.11.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] clk: mvebu: Off by one bugs in cp110_of_clk_get()
2018-12-03 14:50 ` Dan Carpenter
@ 2018-12-03 17:55 ` Stephen Boyd
-1 siblings, 0 replies; 4+ messages in thread
From: Stephen Boyd @ 2018-12-03 17:55 UTC (permalink / raw)
To: Dan Carpenter, Michael Turquette, Thomas Petazzoni
Cc: Gregory CLEMENT, linux-clk, kernel-janitors
Quoting Dan Carpenter (2018-12-03 06:50:55)
> These > comparisons should be >= to prevent reading beyond the end of
> of the clk_data->hws[] buffer.
>
> The clk_data->hws[] array is allocated in cp110_syscon_common_probe()
> when we do:
> cp110_clk_data = devm_kzalloc(dev, sizeof(*cp110_clk_data) +
> sizeof(struct clk_hw *) * CP110_CLK_NUM,
> GFP_KERNEL);
> As you can see, it has CP110_CLK_NUM elements which is equivalent to
> CP110_MAX_CORE_CLOCKS + CP110_MAX_GATABLE_CLOCKS.
>
> Fixes: d3da3eaef7f4 ("clk: mvebu: new driver for Armada CP110 system controller")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
Applied to clk-fixes
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] clk: mvebu: Off by one bugs in cp110_of_clk_get()
@ 2018-12-03 17:55 ` Stephen Boyd
0 siblings, 0 replies; 4+ messages in thread
From: Stephen Boyd @ 2018-12-03 17:55 UTC (permalink / raw)
To: Dan Carpenter, Michael Turquette, Thomas Petazzoni
Cc: Gregory CLEMENT, linux-clk, kernel-janitors
Quoting Dan Carpenter (2018-12-03 06:50:55)
> These > comparisons should be >= to prevent reading beyond the end of
> of the clk_data->hws[] buffer.
>
> The clk_data->hws[] array is allocated in cp110_syscon_common_probe()
> when we do:
> cp110_clk_data = devm_kzalloc(dev, sizeof(*cp110_clk_data) +
> sizeof(struct clk_hw *) * CP110_CLK_NUM,
> GFP_KERNEL);
> As you can see, it has CP110_CLK_NUM elements which is equivalent to
> CP110_MAX_CORE_CLOCKS + CP110_MAX_GATABLE_CLOCKS.
>
> Fixes: d3da3eaef7f4 ("clk: mvebu: new driver for Armada CP110 system controller")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
Applied to clk-fixes
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-12-03 17:55 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-12-03 14:50 [PATCH] clk: mvebu: Off by one bugs in cp110_of_clk_get() Dan Carpenter
2018-12-03 14:50 ` Dan Carpenter
2018-12-03 17:55 ` Stephen Boyd
2018-12-03 17:55 ` Stephen Boyd
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.