From: Dan Carpenter Date: Wed, 11 Sep 2024 07:39:15 +0000 (+0300) Subject: clk: ep93xx: Fix off by one in ep93xx_div_recalc_rate() X-Git-Tag: v6.12-rc1~34^2~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=53cf1dc480a5bdebad457cf6754ed3018b2533ba;p=thirdparty%2Fkernel%2Flinux.git clk: ep93xx: Fix off by one in ep93xx_div_recalc_rate() The psc->div[] array has psc->num_div elements. These values come from when we call clk_hw_register_div(). It's adc_divisors and ARRAY_SIZE(adc_divisors)) and so on. So this condition needs to be >= instead of > to prevent an out of bounds read. Fixes: 9645ccc7bd7a ("ep93xx: clock: convert in-place to COMMON_CLK") Signed-off-by: Dan Carpenter Acked-by: Alexander Sverdlin Reviewed-by: Nikita Shubin Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/1caf01ad4c0a8069535813c26c7f0b8ea011155e.camel@linaro.org [arnd: the original patch was for arch/arm/mach-ep93xx/clock.c, but the same bug ended up in arch/arm/mach-ep93xx/clock.c. Signed-off-by: Arnd Bergmann --- diff --git a/drivers/clk/clk-ep93xx.c b/drivers/clk/clk-ep93xx.c index 26317623d9d57..f888aed79b11b 100644 --- a/drivers/clk/clk-ep93xx.c +++ b/drivers/clk/clk-ep93xx.c @@ -383,7 +383,7 @@ static unsigned long ep93xx_div_recalc_rate(struct clk_hw *hw, regmap_read(priv->map, clk->reg, &val); index = (val & clk->mask) >> clk->shift; - if (index > clk->num_div) + if (index >= clk->num_div) return 0; return DIV_ROUND_CLOSEST(parent_rate, clk->div[index]);