5ad1e217a2
`struct clk_hw_onecell_data` is a flexible structure, which means that
it contains flexible-array member at the bottom, in this case array
`hws`:
include/linux/clk-provider.h:
1380 struct clk_hw_onecell_data {
1381 unsigned int num;
1382 struct clk_hw *hws[] __counted_by(num);
1383 };
This could potentially lead to an overwrite of the objects following
`clk_data` in `struct visconti_pll_provider`, in this case
`struct device_node *node;`, at run-time:
drivers/clk/visconti/pll.h:
16 struct visconti_pll_provider {
17 void __iomem *reg_base;
18 struct clk_hw_onecell_data clk_data;
19 struct device_node *node;
20 };
Notice that a total of 56 bytes are allocated for flexible-array `hws`
at line 328. See below:
include/dt-bindings/clock/toshiba,tmpv770x.h:
14 #define TMPV770X_NR_PLL 7
drivers/clk/visconti/pll-tmpv770x.c:
69 ctx = visconti_init_pll(np, reg_base, TMPV770X_NR_PLL);
drivers/clk/visconti/pll.c:
321 struct visconti_pll_provider * __init visconti_init_pll(struct device_node *np,
322 void __iomem *base,
323 unsigned long nr_plls)
324 {
325 struct visconti_pll_provider *ctx;
...
328 ctx = kzalloc(struct_size(ctx, clk_data.hws, nr_plls), GFP_KERNEL);
`struct_size(ctx, clk_data.hws, nr_plls)` above translates to
sizeof(struct visconti_pll_provider) + sizeof(struct clk_hw *) * 7 ==
24 + 8 * 7 == 24 + 56
^^^^
|
allocated bytes for flex array `hws`
$ pahole -C visconti_pll_provider drivers/clk/visconti/pll.o
struct visconti_pll_provider {
void * reg_base; /* 0 8 */
struct clk_hw_onecell_data clk_data; /* 8 8 */
struct device_node * node; /* 16 8 */
/* size: 24, cachelines: 1, members: 3 */
/* last cacheline: 24 bytes */
};
And then, after the allocation, some data is written into all members
of `struct visconti_pll_provider`:
332 for (i = 0; i < nr_plls; ++i)
333 ctx->clk_data.hws[i] = ERR_PTR(-ENOENT);
334
335 ctx->node = np;
336 ctx->reg_base = base;
337 ctx->clk_data.num = nr_plls;
Fix all these by placing the declaration of object `clk_data` at the
end of `struct visconti_pll_provider`. Also, add a comment to make it
clear that this object must always be last in the structure, and
prevent this bug from being introduced again in the future.
-Wflex-array-member-not-at-end is coming in GCC-14, and we are getting
ready to enable it globally.
Fixes: b4cbe606dc ("clk: visconti: Add support common clock driver and reset driver")
Cc: stable@vger.kernel.org
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/57a831d94ee2b3889b11525d4ad500356f89576f.1697492890.git.gustavoars@kernel.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
64 lines
1.5 KiB
C
64 lines
1.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Copyright (c) 2021 TOSHIBA CORPORATION
|
|
* Copyright (c) 2021 Toshiba Electronic Devices & Storage Corporation
|
|
*
|
|
* Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
|
|
*/
|
|
|
|
#ifndef _VISCONTI_PLL_H_
|
|
#define _VISCONTI_PLL_H_
|
|
|
|
#include <linux/clk-provider.h>
|
|
#include <linux/regmap.h>
|
|
#include <linux/spinlock.h>
|
|
|
|
struct visconti_pll_provider {
|
|
void __iomem *reg_base;
|
|
struct device_node *node;
|
|
|
|
/* Must be last */
|
|
struct clk_hw_onecell_data clk_data;
|
|
};
|
|
|
|
#define VISCONTI_PLL_RATE(_rate, _dacen, _dsmen, \
|
|
_refdiv, _intin, _fracin, _postdiv1, _postdiv2) \
|
|
{ \
|
|
.rate = _rate, \
|
|
.dacen = _dacen, \
|
|
.dsmen = _dsmen, \
|
|
.refdiv = _refdiv, \
|
|
.intin = _intin, \
|
|
.fracin = _fracin, \
|
|
.postdiv1 = _postdiv1, \
|
|
.postdiv2 = _postdiv2 \
|
|
}
|
|
|
|
struct visconti_pll_rate_table {
|
|
unsigned long rate;
|
|
unsigned int dacen;
|
|
unsigned int dsmen;
|
|
unsigned int refdiv;
|
|
unsigned long intin;
|
|
unsigned long fracin;
|
|
unsigned int postdiv1;
|
|
unsigned int postdiv2;
|
|
};
|
|
|
|
struct visconti_pll_info {
|
|
unsigned int id;
|
|
const char *name;
|
|
const char *parent;
|
|
unsigned long base_reg;
|
|
const struct visconti_pll_rate_table *rate_table;
|
|
};
|
|
|
|
struct visconti_pll_provider * __init visconti_init_pll(struct device_node *np,
|
|
void __iomem *base,
|
|
unsigned long nr_plls);
|
|
void visconti_register_plls(struct visconti_pll_provider *ctx,
|
|
const struct visconti_pll_info *list,
|
|
unsigned int nr_plls, spinlock_t *lock);
|
|
|
|
#endif /* _VISCONTI_PLL_H_ */
|