diff options
| author | Will McVicker <willmcvicker@google.com> | 2025-02-12 10:32:52 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-04-10 14:33:34 +0200 |
| commit | 0fef48f4a70e45a93e73c39023c3a6ea624714d6 (patch) | |
| tree | 1a8c6aaa64729de8deef2deee5bc96c128d68b4f /drivers | |
| parent | 54380eea1f7f3ba8f32372aa00c7e92a5e425db9 (diff) | |
| download | linux-0fef48f4a70e45a93e73c39023c3a6ea624714d6.tar.gz linux-0fef48f4a70e45a93e73c39023c3a6ea624714d6.tar.bz2 linux-0fef48f4a70e45a93e73c39023c3a6ea624714d6.zip | |
clk: samsung: Fix UBSAN panic in samsung_clk_init()
[ Upstream commit d19d7345a7bcdb083b65568a11b11adffe0687af ]
With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to
dereferencing `ctx->clk_data.hws` before setting
`ctx->clk_data.num = nr_clks`. Move that up to fix the crash.
UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP
<snip>
Call trace:
samsung_clk_init+0x110/0x124 (P)
samsung_clk_init+0x48/0x124 (L)
samsung_cmu_register_one+0x3c/0xa0
exynos_arm64_register_cmu+0x54/0x64
__gs101_cmu_top_of_clk_init_declare+0x28/0x60
...
Fixes: e620a1e061c4 ("drivers/clk: convert VL struct to struct_size")
Signed-off-by: Will McVicker <willmcvicker@google.com>
Link: https://lore.kernel.org/r/20250212183253.509771-1-willmcvicker@google.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/clk/samsung/clk.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/clk/samsung/clk.c b/drivers/clk/samsung/clk.c index bca4731b14ea..a95047319fcb 100644 --- a/drivers/clk/samsung/clk.c +++ b/drivers/clk/samsung/clk.c @@ -64,11 +64,11 @@ struct samsung_clk_provider *__init samsung_clk_init(struct device_node *np, if (!ctx) panic("could not allocate clock provider context.\n"); + ctx->clk_data.num = nr_clks; for (i = 0; i < nr_clks; ++i) ctx->clk_data.hws[i] = ERR_PTR(-ENOENT); ctx->reg_base = base; - ctx->clk_data.num = nr_clks; spin_lock_init(&ctx->lock); return ctx; |
