diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2022-03-16 11:35:33 +0300 |
|---|---|---|
| committer | Stephen Boyd <sboyd@kernel.org> | 2022-03-17 22:21:28 +0300 |
| commit | c5601e0720ce1a3ad895f94a5838530edde01ed3 (patch) | |
| tree | f843def20384524c009457bf8aaea0190ad243a0 /drivers/clk/visconti/clkc-tmpv770x.c | |
| parent | e783362eb54cd99b2cac8b3a9aeac942e6f6ac07 (diff) | |
| download | linux-c5601e0720ce1a3ad895f94a5838530edde01ed3.tar.xz | |
clk: visconti: prevent array overflow in visconti_clk_register_gates()
This code was using -1 to represent that there was no reset function.
Unfortunately, the -1 was stored in u8 so the if (clks[i].rs_id >= 0)
condition was always true. This lead to an out of bounds access in
visconti_clk_register_gates().
Fixes: b4cbe606dc36 ("clk: visconti: Add support common clock driver and reset driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220316083533.GA30941@kili
Acked-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Diffstat (limited to 'drivers/clk/visconti/clkc-tmpv770x.c')
| -rw-r--r-- | drivers/clk/visconti/clkc-tmpv770x.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/clk/visconti/clkc-tmpv770x.c b/drivers/clk/visconti/clkc-tmpv770x.c index c2b2f41a85a4..6c753b2cb558 100644 --- a/drivers/clk/visconti/clkc-tmpv770x.c +++ b/drivers/clk/visconti/clkc-tmpv770x.c @@ -176,7 +176,7 @@ static const struct visconti_clk_gate_table clk_gate_tables[] = { { TMPV770X_CLK_WRCK, "wrck", clks_parent_data, ARRAY_SIZE(clks_parent_data), 0, 0x68, 0x168, 9, 32, - -1, }, /* No reset */ + NO_RESET, }, { TMPV770X_CLK_PICKMON, "pickmon", clks_parent_data, ARRAY_SIZE(clks_parent_data), 0, 0x10, 0x110, 8, 4, |