From patchwork Mon Nov 14 08:13:41 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 13041923 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 07E94C3A5A3 for ; Mon, 14 Nov 2022 08:14:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=lmFZKSFlluX/0xY3BNAAE9yw3AGyftjfMAxUsp0cfgI=; b=Sg1ycna3k4DjMU aXS1Yp61BmwlJ1o/lFXbVYHYU76kRG6625/FzdYSx4GQz63ldM3NgoHurIVIh+l1J2ZTcaZz5SXun iwDEEYZK8qyYu+57DFN8vMy77nL7YMBwj9+mTFu4U3HtLj21GFcJK8sWVZGELb6kSlRRj25b/b0d7 XYwh9+1FKa/3Bz6Jv+2Hlniy34Vdwe1+91roLUIDWeJkSS8p1zTeE1FnLtCsc6QGsO56dopaf3zb8 PpkJ1qI6jdqDX+FSYoJ8AvLIrZC/t9rQc5zRiRJ+RiTba6anmLjK0t26SAbPLmlsjyFk+nSsYZC6t a/K0xaA+ts3uLR66bZdQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1ouUbz-00GhxZ-Cy; Mon, 14 Nov 2022 08:14:35 +0000 Received: from ams.source.kernel.org ([2604:1380:4601:e00::1]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1ouUbv-00Ghrc-Py for linux-phy@lists.infradead.org; Mon, 14 Nov 2022 08:14:34 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4EEF9B80D35; Mon, 14 Nov 2022 08:14:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F2967C433C1; Mon, 14 Nov 2022 08:14:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1668413669; bh=7DSO9Gw0gcP3qm2ojYnCecGJVIZo7r1rdwoBiR4mUlE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NYZ7QyZynJDa3KOfDTKvV0O41UPk+gMW0rphp7pSC2N3OMEq1GlWYBRhVkA61rRGH e5M1CA8+MzsTgK8LjmK9riGUP0EnGqpKUOrlG/Dp1URt4Q552UiSRVfZW0K8/IE4qS Z+UueWeqRkWI4S9PUlEWRoIPmiN1z2X1lZj1fG8T4uTgtvFynx02IewAh44U8GuJN/ DEmb4NNMKPko1BmUv84RvJ7kJlCMjH0iPV9AJOZFwgBcXfNelr0rTR2Ad6HnY8UHCA yIP4rvNXJv1pVQWbtZqQ3u+TWitvvjW1sDaKP4glf9LllRh/XR1UMmw0uaNlgLdGMw UfvgOhDbmIN7w== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1ouUbM-0001Ky-LB; Mon, 14 Nov 2022 09:13:56 +0100 From: Johan Hovold To: Vinod Koul Cc: Andy Gross , Bjorn Andersson , Konrad Dybcio , Dmitry Baryshkov , linux-arm-msm@vger.kernel.org, linux-phy@lists.infradead.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH v2 1/6] phy: qcom-qmp-combo: fix out-of-bounds clock access Date: Mon, 14 Nov 2022 09:13:41 +0100 Message-Id: <20221114081346.5116-2-johan+linaro@kernel.org> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221114081346.5116-1-johan+linaro@kernel.org> References: <20221114081346.5116-1-johan+linaro@kernel.org> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20221114_001431_997410_07FDCED6 X-CRM114-Status: GOOD ( 12.39 ) X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org The SM8250 only uses three clocks but the DP configuration erroneously described four clocks. In case the DP part of the PHY is initialised before the USB part, this would lead to uninitialised memory beyond the bulk-clocks array to be treated as a clock pointer as the clocks are requested based on the USB configuration. Fixes: aff188feb5e1 ("phy: qcom-qmp: add support for sm8250-usb3-dp phy") Cc: stable@vger.kernel.org # 5.13 Reviewed-by: Dmitry Baryshkov Signed-off-by: Johan Hovold --- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c index 5e11b6a1d189..bb38b18258ca 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c @@ -1270,8 +1270,8 @@ static const struct qmp_phy_cfg sm8250_dpphy_cfg = { .swing_hbr3_hbr2 = &qmp_dp_v3_voltage_swing_hbr3_hbr2, .pre_emphasis_hbr3_hbr2 = &qmp_dp_v3_pre_emphasis_hbr3_hbr2, - .clk_list = qmp_v4_phy_clk_l, - .num_clks = ARRAY_SIZE(qmp_v4_phy_clk_l), + .clk_list = qmp_v4_sm8250_usbphy_clk_l, + .num_clks = ARRAY_SIZE(qmp_v4_sm8250_usbphy_clk_l), .reset_list = msm8996_usb3phy_reset_l, .num_resets = ARRAY_SIZE(msm8996_usb3phy_reset_l), .vreg_list = qmp_phy_vreg_l,