random-mirrors/smaeul-u-boot
1
0
Fork 0
mirror of https://github.com/smaeul/u-boot.git synced 2025-10-14 04:46:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

clk: sunxi: Prevent out-of-bounds gate array access

Browse Source 
Because the gate arrays are not given explicit sizes, the arrays are
only as large as the highest-numbered gate described in the driver.
However, only a subset of the CCU clocks are needed by U-Boot. So there
are valid clock specifiers with indexes greater than the size of the
arrays. Referencing any of these clocks causes out-of-bounds access.
Fix this by checking the identifier against the size of the array.

Fixes: 0d47bc705651 ("clk: Add Allwinner A64 CLK driver")
Signed-off-by: Samuel Holland <samuel@sholland.org>
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
This commit is contained in:
Samuel Holland 2022-05-09 00:29:32 -05:00 committed by Andre Przywara
parent 49b2b0a2b6
commit 6827aba348
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/clk/sunxi/clk_sunxi.c
View File

@ -18,6 +18,9 @@
static const struct ccu_clk_gate *priv_to_gate(struct ccu_priv *priv, static const struct ccu_clk_gate *priv_to_gate(struct ccu_priv *priv,
unsigned long id) unsigned long id)
{ {
if (id >= priv->desc->num_gates)
return NULL;
return &priv->desc->gates[id]; return &priv->desc->gates[id];
} }
@ -27,10 +30,10 @@ static int sunxi_set_gate(struct clk *clk, bool on)
const struct ccu_clk_gate *gate = priv_to_gate(priv, clk->id); const struct ccu_clk_gate *gate = priv_to_gate(priv, clk->id);
u32 reg; u32 reg;
if ((gate->flags & CCU_CLK_F_DUMMY_GATE)) if (gate && (gate->flags & CCU_CLK_F_DUMMY_GATE))
return 0; return 0;
if (!(gate->flags & CCU_CLK_F_IS_VALID)) { if (!gate || !(gate->flags & CCU_CLK_F_IS_VALID)) {
printf("%s: (CLK#%ld) unhandled\n", __func__, clk->id); printf("%s: (CLK#%ld) unhandled\n", __func__, clk->id);
return 0; return 0;
} }