From nobody Tue Apr 7 20:07:30 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D63A7332629; Wed, 11 Mar 2026 15:06:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773241582; cv=none; b=ZX+cjQoL8ekoJw7tOUZ98pxvsPQTACZGeOYHx3v7k71vgLj6i4tPaY4dGyI0RdIKR+SSRUC/unioIN2mmgNehmJneZcWLTJnbMWqq+hir2/zIAqJarRBKUt5ieD/L3KYNS5V4N+jSawwl8utZ/cSVth33Y26bxaCSg8jQkIOqkc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773241582; c=relaxed/simple; bh=WeaBlNAe/LnZ0Tb2ElBEjWdxRGJTXqXTubsDUVzm+sA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=J9xuOGBhvXqy8keTjU+t82Avj/uPCCXCzMbTlF1qkaC/7/lhg0u4H6hwdA3Pg0deG4XMxCJvp//5ATRDgaEWdmWqrx1Be9/KAq0lMENHbz9mdHoT08aJEUvFnSpEyuxnN0yP4CoY8ue0hs0vRunDlI+6KwbgVHEhMJVarCYzVvU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 429E6C19425; Wed, 11 Mar 2026 15:06:21 +0000 (UTC) From: Geert Uytterhoeven To: Michael Turquette , Stephen Boyd , Marek Vasut Cc: linux-clk@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Geert Uytterhoeven Subject: [PATCH v4 1/2] clk: rs9: Add clock index range check to rs9_of_clk_get() Date: Wed, 11 Mar 2026 16:06:10 +0100 Message-ID: <9b4e40b1d543e11bfdf229a6a8af1b836f79df16.1773241119.git.geert+renesas@glider.be> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" rs9_of_clk_get() does not validate the clock index in the passed DT clock specifier. If DT specifies an incorrect and out-of-range index, this will access memory beyond the end of the clk_dif[] array. Fix by this adding a range check to rs9_of_clk_get(). Fixes: 892e0ddea1aa6f70 ("clk: rs9: Add Renesas 9-series PCIe clock generat= or driver") Signed-off-by: Geert Uytterhoeven Reviewed-by: Marek Vasut --- v4: - Put in a series, v3: - Add error message, v2: - Just add the missing range check; the conversion to of_clk_hw_onecell_get() can be done later. v1: "[PATCH] clk: rs9: Convert to clk_hw_onecell_data and of_clk_hw_onecell_get()" https://lore.kernel.org/a6dce17b15d29a257d09fe0edc199a14c297f1a8.176883= 6042.git.geert+renesas@glider.be --- drivers/clk/clk-renesas-pcie.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/clk/clk-renesas-pcie.c b/drivers/clk/clk-renesas-pcie.c index aa108df12e44fb9f..b9bee616afe8d4ef 100644 --- a/drivers/clk/clk-renesas-pcie.c +++ b/drivers/clk/clk-renesas-pcie.c @@ -277,6 +277,11 @@ rs9_of_clk_get(struct of_phandle_args *clkspec, void *= data) struct rs9_driver_data *rs9 =3D data; unsigned int idx =3D clkspec->args[0]; =20 + if (idx >=3D rs9->chip_info->num_clks) { + pr_err("%s: Invalid clock index %u\n", __func__, idx); + return ERR_PTR(-EINVAL); + } + return rs9->clk_dif[idx]; } =20 --=20 2.43.0 From nobody Tue Apr 7 20:07:30 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30518362130; Wed, 11 Mar 2026 15:06:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773241585; cv=none; b=Iz1TvJHTz9+urKywLp7WptPwc5qQ2lTmawye+Q/Mf7Xr3TgAHWIFtrKEIDZ3lUZ8Z2d3GnYXACLKQOIyZ4+mo5cA52yQHH+HlFu/shHxqkg0v68rXXYdlp7CtRKCb0o1Bh2yq9RglGvdossLPDVxIJVvNpCUu84jd4Yz4eag/cE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773241585; c=relaxed/simple; bh=1ZmxNSzK5y4YYwYPaZmtT/LizhAKrRlUbwYPaZ+wJAE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MnvpAare0c5H2/8xNuPmPv0PCM4QfZcsbjococ0jDMg1w3RCIFCJW5hFq9YJh81hAPQR0SZxKKNMEWU9dbgpoN14avO+JsNgEDnEEh3RLzJ+oX7LjuzTdXgMX7zioMmYpo6hW09IWkEU/VpgBhvMIUaQm2Hn1CRT3yKy3HV/kjc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D43AC19424; Wed, 11 Mar 2026 15:06:23 +0000 (UTC) From: Geert Uytterhoeven To: Michael Turquette , Stephen Boyd , Marek Vasut Cc: linux-clk@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Geert Uytterhoeven , Marek Vasut Subject: [PATCH v4 2/2] clk: rs9: Convert to clk_hw_onecell_data and of_clk_hw_onecell_get() Date: Wed, 11 Mar 2026 16:06:11 +0100 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Convert the rs9 clock driver to use the of_clk_hw_onecell_get() helper, which requires using the clk_hw_onecell_data structure. Embedding that structure in the rs9_driver_data structure has the benefit that the clock array always has the correct size, and thus can no longer become out of sync when adding support for new rs9 variants. Signed-off-by: Geert Uytterhoeven Reviewed-by: Marek Vasut --- v4: - Add Reviewed-by, - Rebase on top of "clk: rs9: Add clock index range check to rs9_of_clk_get()", so this becomes a pure refactoring instead of a fix, - Put in a series, (v3 and v2 do not exist) v1: - https://lore.kernel.org/a6dce17b15d29a257d09fe0edc199a14c297f1a8.176883= 6042.git.geert+renesas@glider.be --- drivers/clk/clk-renesas-pcie.c | 44 ++++++++++++++-------------------- 1 file changed, 18 insertions(+), 26 deletions(-) diff --git a/drivers/clk/clk-renesas-pcie.c b/drivers/clk/clk-renesas-pcie.c index b9bee616afe8d4ef..2b8b6b82250360d5 100644 --- a/drivers/clk/clk-renesas-pcie.c +++ b/drivers/clk/clk-renesas-pcie.c @@ -64,10 +64,11 @@ struct rs9_driver_data { struct i2c_client *client; struct regmap *regmap; const struct rs9_chip_info *chip_info; - struct clk_hw *clk_dif[8]; u8 pll_amplitude; u8 pll_ssc; u8 clk_dif_sr; + /* must be last */ + struct clk_hw_onecell_data onecell; }; =20 /* @@ -271,37 +272,28 @@ static void rs9_update_config(struct rs9_driver_data = *rs9) } } =20 -static struct clk_hw * -rs9_of_clk_get(struct of_phandle_args *clkspec, void *data) -{ - struct rs9_driver_data *rs9 =3D data; - unsigned int idx =3D clkspec->args[0]; - - if (idx >=3D rs9->chip_info->num_clks) { - pr_err("%s: Invalid clock index %u\n", __func__, idx); - return ERR_PTR(-EINVAL); - } - - return rs9->clk_dif[idx]; -} - static int rs9_probe(struct i2c_client *client) { + const struct rs9_chip_info *chip_info; unsigned char name[5] =3D "DIF0"; struct rs9_driver_data *rs9; unsigned int vid, did; struct clk_hw *hw; int i, ret; =20 - rs9 =3D devm_kzalloc(&client->dev, sizeof(*rs9), GFP_KERNEL); + chip_info =3D i2c_get_match_data(client); + if (!chip_info) + return -EINVAL; + + rs9 =3D devm_kzalloc(&client->dev, struct_size(rs9, onecell.hws, + chip_info->num_clks), GFP_KERNEL); if (!rs9) return -ENOMEM; =20 i2c_set_clientdata(client, rs9); rs9->client =3D client; - rs9->chip_info =3D i2c_get_match_data(client); - if (!rs9->chip_info) - return -EINVAL; + rs9->chip_info =3D chip_info; + rs9->onecell.num =3D chip_info->num_clks; =20 /* Fetch common configuration from DT (if specified) */ ret =3D rs9_get_common_config(rs9); @@ -309,7 +301,7 @@ static int rs9_probe(struct i2c_client *client) return ret; =20 /* Fetch DIFx output configuration from DT (if specified) */ - for (i =3D 0; i < rs9->chip_info->num_clks; i++) { + for (i =3D 0; i < rs9->onecell.num; i++) { ret =3D rs9_get_output_config(rs9, i); if (ret) return ret; @@ -335,24 +327,24 @@ static int rs9_probe(struct i2c_client *client) return ret; =20 vid &=3D RS9_REG_VID_MASK; - if (vid !=3D RS9_REG_VID_IDT || did !=3D rs9->chip_info->did) + if (vid !=3D RS9_REG_VID_IDT || did !=3D chip_info->did) return dev_err_probe(&client->dev, -ENODEV, "Incorrect VID/DID: %#02x, %#02x. Expected %#02x, %#02x\n", - vid, did, RS9_REG_VID_IDT, - rs9->chip_info->did); + vid, did, RS9_REG_VID_IDT, chip_info->did); =20 /* Register clock */ - for (i =3D 0; i < rs9->chip_info->num_clks; i++) { + for (i =3D 0; i < rs9->onecell.num; i++) { snprintf(name, 5, "DIF%d", i); hw =3D devm_clk_hw_register_fixed_factor_index(&client->dev, name, 0, 0, 4, 1); if (IS_ERR(hw)) return PTR_ERR(hw); =20 - rs9->clk_dif[i] =3D hw; + rs9->onecell.hws[i] =3D hw; } =20 - ret =3D devm_of_clk_add_hw_provider(&client->dev, rs9_of_clk_get, rs9); + ret =3D devm_of_clk_add_hw_provider(&client->dev, of_clk_hw_onecell_get, + &rs9->onecell); if (!ret) rs9_update_config(rs9); =20 --=20 2.43.0