vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

clk: airoha: fix off-by-one in clock ID boundary check

Browse Source 
The boundary checks in airoha_clk_enable(), airoha_clk_get_rate(), and
airoha_clk_set_rate() use "id > data->num_clocks" which allows id equal
to num_clocks to pass. Since data->descs[] has exactly num_clocks entries
(indices 0 to num_clocks-1), id=num_clocks results in an out-of-bounds
array access.

This is currently not triggered because the device tree clock IDs are
within bounds, but the check should be defensive. Fix by changing the
comparison from ">" to ">=".

Fixes: d0b81afb5e ("clk: airoha: Add support for Airoha AN7581 SoC clock")
Signed-off-by: Wayen Yan <win847@gmail.com>
This commit is contained in:
Wayen Yan
2026-07-17 14:50:35 -06:00
committed by Tom Rini
parent a1a944f25c
commit fdfe2ec48d
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/clk/airoha/clk-airoha.c
+3 -3
View File
@@ -327,7 +327,7 @@ static int airoha_clk_enable(struct clk *clk)
struct airoha_clk_soc_data *data = priv->data;
int id = clk->id;
if (id > data->num_clocks)
if (id >= data->num_clocks)
return -EINVAL;
return 0;
@@ -349,7 +349,7 @@ static ulong airoha_clk_get_rate(struct clk *clk)
ulong rate;
int ret;
if (id > data->num_clocks) {
if (id >= data->num_clocks) {
dev_err(clk->dev, "Invalid clk ID %d\n", id);
return 0;
}
@@ -412,7 +412,7 @@ static ulong airoha_clk_set_rate(struct clk *clk, ulong rate)
int div;
int ret;
if (id > data->num_clocks) {
if (id >= data->num_clocks) {
dev_err(clk->dev, "Invalid clk ID %d\n", id);
return 0;
}