clk: microchip: mpfs-ccc: fix out of bounds access during output registration

UBSAN reported an out of bounds access during registration of the last
two outputs. This out of bounds access occurs because space is only
allocated in the hws array for two PLLs and the four output dividers
that each has, but the defined IDs contain two DLLS and their two
outputs each, which are not supported by the driver. The ID order is
PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs
by two while adding them to the array to avoid the problem.

Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support")
CC: stable@vger.kernel.org
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>

diff --git a/drivers/clk/microchip/clk-mpfs-ccc.c b/drivers/clk/microchip/clk-mpfs-ccc.c
index 3a3ea2d142f8a2a39c5f5aef2e506a96039f7400..0a76a1aaa50f7f3950057d99ddab0ae7a040dc7c 100644 (file)
--- a/drivers/clk/microchip/clk-mpfs-ccc.c
+++ b/drivers/clk/microchip/clk-mpfs-ccc.c
@@ -178,7 +178,7 @@ static int mpfs_ccc_register_outputs(struct device *dev, struct mpfs_ccc_out_hw_
                        return dev_err_probe(dev, ret, "failed to register clock id: %d\n",
                                             out_hw->id);
 
-               data->hw_data.hws[out_hw->id] = &out_hw->divider.hw;
+               data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw;
        }
 
        return 0;
@@ -234,6 +234,10 @@ static int mpfs_ccc_probe(struct platform_device *pdev)
        unsigned int num_clks;
        int ret;
 
+       /*
+        * If DLLs get added here, mpfs_ccc_register_outputs() currently packs
+        * sparse clock IDs in the hws array
+        */
        num_clks = ARRAY_SIZE(mpfs_ccc_pll_clks) + ARRAY_SIZE(mpfs_ccc_pll0out_clks) +
                   ARRAY_SIZE(mpfs_ccc_pll1out_clks);