The hws array of mpll->clk_data is allocated with struct_size() using
ARRAY_SIZE(output_dividers) as the element count, giving it 7 elements.
But the probe function stores the MPLL clock at hws[0] and one
fixed-factor clock for each output divider at hws[i + 1] for i in
[0, ARRAY_SIZE(output_dividers)), writing 8 elements in total.  The
final write to hws[7] is past the end of the allocation.

clk_data->num is also set to NUMOUTPUTS (8), so the clock framework
reads hws[0..7], again accessing hws[7] out of bounds.

Use NUMOUTPUTS as the element count so the allocation matches the
number of clocks actually stored and exposed.

Found by smatch:
  drivers/clk/mstar/clk-msc313-mpll.c:134 msc313_mpll_probe()
  error: buffer overflow 'mpll->clk_data->hws' 7 <= 7

Fixes: bef7a78da716 ("clk: mstar: MStar/SigmaStar MPLL driver")
Cc: stable@vger.kernel.org
Signed-off-by: hanzhijian <hanzhijian1991@gmail.com>
---
v2: add Fixes: and Cc: stable tags

 drivers/clk/mstar/clk-msc313-mpll.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/mstar/clk-msc313-mpll.c b/drivers/clk/mstar/clk-msc313-mpll.c
index 61beb4e87..bd45aa0ae 100644
--- a/drivers/clk/mstar/clk-msc313-mpll.c
+++ b/drivers/clk/mstar/clk-msc313-mpll.c
@@ -105,7 +105,7 @@ static int msc313_mpll_probe(struct platform_device *pdev)
 		return PTR_ERR(mpll->loop_div_second);
 
 	mpll->clk_data = devm_kzalloc(dev, struct_size(mpll->clk_data, hws,
-			ARRAY_SIZE(output_dividers)), GFP_KERNEL);
+				NUMOUTPUTS), GFP_KERNEL);
 	if (!mpll->clk_data)
 		return -ENOMEM;
 
-- 
2.43.0

On Mon, 24 Aug 2026 22:28:00 +0800, hanzhijian wrote:
> clk: mstar: msc313-mpll: fix off-by-one in clock array allocation

Applied, thanks!

[1/1] clk: mstar: msc313-mpll: fix off-by-one in clock array allocation
      commit: 712b75152c00a8ab0c56dbfe34caf88e3870ddde

Best regards,
-- 
Brian Masney <bmasney@redhat.com>

On Mon, Aug 24, 2026 at 10:28:00PM +0800, hanzhijian wrote:
> The hws array of mpll->clk_data is allocated with struct_size() using
> ARRAY_SIZE(output_dividers) as the element count, giving it 7 elements.
> But the probe function stores the MPLL clock at hws[0] and one
> fixed-factor clock for each output divider at hws[i + 1] for i in
> [0, ARRAY_SIZE(output_dividers)), writing 8 elements in total.  The
> final write to hws[7] is past the end of the allocation.
> 
> clk_data->num is also set to NUMOUTPUTS (8), so the clock framework
> reads hws[0..7], again accessing hws[7] out of bounds.
> 
> Use NUMOUTPUTS as the element count so the allocation matches the
> number of clocks actually stored and exposed.
> 
> Found by smatch:
>   drivers/clk/mstar/clk-msc313-mpll.c:134 msc313_mpll_probe()
>   error: buffer overflow 'mpll->clk_data->hws' 7 <= 7
> 
> Fixes: bef7a78da716 ("clk: mstar: MStar/SigmaStar MPLL driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: hanzhijian <hanzhijian1991@gmail.com>

Reviewed-by: Brian Masney <bmasney@redhat.com>