| Message ID | 20250212183253.509771-1-willmcvicker@google.com (mailing list archive) |
|---|---|
| State | Awaiting Upstream, archived |
| Headers | show |
| Series | clk: samsung: Fix UBSAN panic in samsung_clk_init() | expand |
On Wed, 12 Feb 2025 10:32:52 -0800, Will McVicker wrote: > With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to > dereferencing `ctx->clk_data.hws` before setting > `ctx->clk_data.num = nr_clks`. Move that up to fix the crash. > > UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP > <snip> > Call trace: > samsung_clk_init+0x110/0x124 (P) > samsung_clk_init+0x48/0x124 (L) > samsung_cmu_register_one+0x3c/0xa0 > exynos_arm64_register_cmu+0x54/0x64 > __gs101_cmu_top_of_clk_init_declare+0x28/0x60 > ... > > [...] Applied, thanks! [1/1] clk: samsung: Fix UBSAN panic in samsung_clk_init() https://git.kernel.org/krzk/linux/c/d19d7345a7bcdb083b65568a11b11adffe0687af Best regards,
diff --git a/drivers/clk/samsung/clk.c b/drivers/clk/samsung/clk.c index 283c523763e6..8d440cf56bd4 100644 --- a/drivers/clk/samsung/clk.c +++ b/drivers/clk/samsung/clk.c @@ -74,12 +74,12 @@ struct samsung_clk_provider * __init samsung_clk_init(struct device *dev, if (!ctx) panic("could not allocate clock provider context.\n"); + ctx->clk_data.num = nr_clks; for (i = 0; i < nr_clks; ++i) ctx->clk_data.hws[i] = ERR_PTR(-ENOENT); ctx->dev = dev; ctx->reg_base = base; - ctx->clk_data.num = nr_clks; spin_lock_init(&ctx->lock); return ctx;
With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to dereferencing `ctx->clk_data.hws` before setting `ctx->clk_data.num = nr_clks`. Move that up to fix the crash. UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP <snip> Call trace: samsung_clk_init+0x110/0x124 (P) samsung_clk_init+0x48/0x124 (L) samsung_cmu_register_one+0x3c/0xa0 exynos_arm64_register_cmu+0x54/0x64 __gs101_cmu_top_of_clk_init_declare+0x28/0x60 ... Fixes: e620a1e061c4 ("drivers/clk: convert VL struct to struct_size") Signed-off-by: Will McVicker <willmcvicker@google.com> --- drivers/clk/samsung/clk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) base-commit: 2014c95afecee3e76ca4a56956a936e23283f05b