From patchwork Fri Nov 11 08:42:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 625811 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 438F5C43219 for ; Fri, 11 Nov 2022 08:45:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233308AbiKKIo7 (ORCPT ); Fri, 11 Nov 2022 03:44:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35000 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233294AbiKKIo5 (ORCPT ); Fri, 11 Nov 2022 03:44:57 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 89C58748EC; Fri, 11 Nov 2022 00:44:56 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 47C9BB82456; Fri, 11 Nov 2022 08:44:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D6260C433B5; Fri, 11 Nov 2022 08:44:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1668156293; bh=I4u+iA9wG+mse/x7qapE0EwSlmwdaRWKqs47dh11hNs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LMsnzaTo8wn929aBHWk99K0FyRSzj+oelLX7Pfj+NXjWhRvgrsskrqaXuZZTHAfAd Zr25+FET+uCUswqjZLmkQ1WTcppq4Obgu+7RYbezg+obKgo3rVwWCX1YCcQWcv1vt+ umhAUZM9WBPy+5CCgJL8huMIMPEYis4JilKab0cK7+sKXpqh9NgPi/21R/xFLS83Lm B886jhZG+aZQdkr30DTcNzH4m/78ShiitzIwTCTU5FpP9ZdVYJFNuT3xvayLcnz/wA 47s4xxmSoeFB78oz3oI/DYhcKCkkdfyuhJ2wqgykwC9qTkaW5BJei1Q8qV7e+GZyYz EcjRRC/WVKm6w== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1otPeD-0002Mg-JA; Fri, 11 Nov 2022 09:44:25 +0100 From: Johan Hovold To: Vinod Koul Cc: Andy Gross , Bjorn Andersson , Konrad Dybcio , Dmitry Baryshkov , linux-arm-msm@vger.kernel.org, linux-phy@lists.infradead.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 1/6] phy: qcom-qmp-combo: fix out-of-bounds clock access Date: Fri, 11 Nov 2022 09:42:50 +0100 Message-Id: <20221111084255.8963-2-johan+linaro@kernel.org> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221111084255.8963-1-johan+linaro@kernel.org> References: <20221111084255.8963-1-johan+linaro@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org The SM8250 only uses three clocks but the DP configuration erroneously described four clocks. In case the DP part of the PHY is initialised before the USB part, this would lead to uninitialised memory beyond the bulk-clocks array to be treated as a clock pointer as the clocks are requested based on the USB configuration. Fixes: aff188feb5e1 ("phy: qcom-qmp: add support for sm8250-usb3-dp phy") Cc: stable@vger.kernel.org # 5.13 Signed-off-by: Johan Hovold --- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c index 5e11b6a1d189..bb38b18258ca 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c @@ -1270,8 +1270,8 @@ static const struct qmp_phy_cfg sm8250_dpphy_cfg = { .swing_hbr3_hbr2 = &qmp_dp_v3_voltage_swing_hbr3_hbr2, .pre_emphasis_hbr3_hbr2 = &qmp_dp_v3_pre_emphasis_hbr3_hbr2, - .clk_list = qmp_v4_phy_clk_l, - .num_clks = ARRAY_SIZE(qmp_v4_phy_clk_l), + .clk_list = qmp_v4_sm8250_usbphy_clk_l, + .num_clks = ARRAY_SIZE(qmp_v4_sm8250_usbphy_clk_l), .reset_list = msm8996_usb3phy_reset_l, .num_resets = ARRAY_SIZE(msm8996_usb3phy_reset_l), .vreg_list = qmp_phy_vreg_l,