From patchwork Mon Nov 14 08:13:41 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 625743 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67BBEC433FE for ; Mon, 14 Nov 2022 08:14:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236266AbiKNIOd (ORCPT ); Mon, 14 Nov 2022 03:14:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35520 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236257AbiKNIOc (ORCPT ); Mon, 14 Nov 2022 03:14:32 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ADFCE19298; Mon, 14 Nov 2022 00:14:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5C49FB80D3A; Mon, 14 Nov 2022 08:14:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F2967C433C1; Mon, 14 Nov 2022 08:14:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1668413669; bh=7DSO9Gw0gcP3qm2ojYnCecGJVIZo7r1rdwoBiR4mUlE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NYZ7QyZynJDa3KOfDTKvV0O41UPk+gMW0rphp7pSC2N3OMEq1GlWYBRhVkA61rRGH e5M1CA8+MzsTgK8LjmK9riGUP0EnGqpKUOrlG/Dp1URt4Q552UiSRVfZW0K8/IE4qS Z+UueWeqRkWI4S9PUlEWRoIPmiN1z2X1lZj1fG8T4uTgtvFynx02IewAh44U8GuJN/ DEmb4NNMKPko1BmUv84RvJ7kJlCMjH0iPV9AJOZFwgBcXfNelr0rTR2Ad6HnY8UHCA yIP4rvNXJv1pVQWbtZqQ3u+TWitvvjW1sDaKP4glf9LllRh/XR1UMmw0uaNlgLdGMw UfvgOhDbmIN7w== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1ouUbM-0001Ky-LB; Mon, 14 Nov 2022 09:13:56 +0100 From: Johan Hovold To: Vinod Koul Cc: Andy Gross , Bjorn Andersson , Konrad Dybcio , Dmitry Baryshkov , linux-arm-msm@vger.kernel.org, linux-phy@lists.infradead.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH v2 1/6] phy: qcom-qmp-combo: fix out-of-bounds clock access Date: Mon, 14 Nov 2022 09:13:41 +0100 Message-Id: <20221114081346.5116-2-johan+linaro@kernel.org> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221114081346.5116-1-johan+linaro@kernel.org> References: <20221114081346.5116-1-johan+linaro@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org The SM8250 only uses three clocks but the DP configuration erroneously described four clocks. In case the DP part of the PHY is initialised before the USB part, this would lead to uninitialised memory beyond the bulk-clocks array to be treated as a clock pointer as the clocks are requested based on the USB configuration. Fixes: aff188feb5e1 ("phy: qcom-qmp: add support for sm8250-usb3-dp phy") Cc: stable@vger.kernel.org # 5.13 Reviewed-by: Dmitry Baryshkov Signed-off-by: Johan Hovold --- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c index 5e11b6a1d189..bb38b18258ca 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c @@ -1270,8 +1270,8 @@ static const struct qmp_phy_cfg sm8250_dpphy_cfg = { .swing_hbr3_hbr2 = &qmp_dp_v3_voltage_swing_hbr3_hbr2, .pre_emphasis_hbr3_hbr2 = &qmp_dp_v3_pre_emphasis_hbr3_hbr2, - .clk_list = qmp_v4_phy_clk_l, - .num_clks = ARRAY_SIZE(qmp_v4_phy_clk_l), + .clk_list = qmp_v4_sm8250_usbphy_clk_l, + .num_clks = ARRAY_SIZE(qmp_v4_sm8250_usbphy_clk_l), .reset_list = msm8996_usb3phy_reset_l, .num_resets = ARRAY_SIZE(msm8996_usb3phy_reset_l), .vreg_list = qmp_phy_vreg_l,