From: Dan Carpenter dan.carpenter@oracle.com
[ Upstream commit c5601e0720ce1a3ad895f94a5838530edde01ed3 ]
This code was using -1 to represent that there was no reset function. Unfortunately, the -1 was stored in u8 so the if (clks[i].rs_id >= 0) condition was always true. This lead to an out of bounds access in visconti_clk_register_gates().
Fixes: b4cbe606dc36 ("clk: visconti: Add support common clock driver and reset driver") Signed-off-by: Dan Carpenter dan.carpenter@oracle.com Link: https://lore.kernel.org/r/20220316083533.GA30941@kili Acked-by: Nobuhiro Iwamatsu nobuhiro1.iwamatsu@toshiba.co.jp Signed-off-by: Stephen Boyd sboyd@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/clk/visconti/clkc-tmpv770x.c | 2 +- drivers/clk/visconti/clkc.c | 2 +- drivers/clk/visconti/clkc.h | 3 +++ 3 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/visconti/clkc-tmpv770x.c b/drivers/clk/visconti/clkc-tmpv770x.c index c2b2f41a85a4..6c753b2cb558 100644 --- a/drivers/clk/visconti/clkc-tmpv770x.c +++ b/drivers/clk/visconti/clkc-tmpv770x.c @@ -176,7 +176,7 @@ static const struct visconti_clk_gate_table clk_gate_tables[] = { { TMPV770X_CLK_WRCK, "wrck", clks_parent_data, ARRAY_SIZE(clks_parent_data), 0, 0x68, 0x168, 9, 32, - -1, }, /* No reset */ + NO_RESET, }, { TMPV770X_CLK_PICKMON, "pickmon", clks_parent_data, ARRAY_SIZE(clks_parent_data), 0, 0x10, 0x110, 8, 4, diff --git a/drivers/clk/visconti/clkc.c b/drivers/clk/visconti/clkc.c index 56a8a4ffebca..d0b193b5d0b3 100644 --- a/drivers/clk/visconti/clkc.c +++ b/drivers/clk/visconti/clkc.c @@ -147,7 +147,7 @@ int visconti_clk_register_gates(struct visconti_clk_provider *ctx, if (!dev_name) return -ENOMEM;
- if (clks[i].rs_id >= 0) { + if (clks[i].rs_id != NO_RESET) { rson_offset = reset[clks[i].rs_id].rson_offset; rsoff_offset = reset[clks[i].rs_id].rsoff_offset; rs_idx = reset[clks[i].rs_id].rs_idx; diff --git a/drivers/clk/visconti/clkc.h b/drivers/clk/visconti/clkc.h index 09ed82ff64e4..8756a1ec42ef 100644 --- a/drivers/clk/visconti/clkc.h +++ b/drivers/clk/visconti/clkc.h @@ -73,4 +73,7 @@ int visconti_clk_register_gates(struct visconti_clk_provider *data, int num_gate, const struct visconti_reset_data *reset, spinlock_t *lock); + +#define NO_RESET 0xFF + #endif /* _VISCONTI_CLKC_H_ */