From 53cf1dc480a5bdebad457cf6754ed3018b2533ba Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 11 Sep 2024 10:39:15 +0300 Subject: [PATCH] clk: ep93xx: Fix off by one in ep93xx_div_recalc_rate() The psc->div[] array has psc->num_div elements. These values come from when we call clk_hw_register_div(). It's adc_divisors and ARRAY_SIZE(adc_divisors)) and so on. So this condition needs to be >= instead of > to prevent an out of bounds read. Fixes: 9645ccc7bd7a ("ep93xx: clock: convert in-place to COMMON_CLK") Signed-off-by: Dan Carpenter Acked-by: Alexander Sverdlin Reviewed-by: Nikita Shubin Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/1caf01ad4c0a8069535813c26c7f0b8ea011155e.camel@linaro.org [arnd: the original patch was for arch/arm/mach-ep93xx/clock.c, but the same bug ended up in arch/arm/mach-ep93xx/clock.c. Signed-off-by: Arnd Bergmann --- drivers/clk/clk-ep93xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/clk/clk-ep93xx.c b/drivers/clk/clk-ep93xx.c index 26317623d9d5..f888aed79b11 100644 --- a/drivers/clk/clk-ep93xx.c +++ b/drivers/clk/clk-ep93xx.c @@ -383,7 +383,7 @@ static unsigned long ep93xx_div_recalc_rate(struct clk_hw *hw, regmap_read(priv->map, clk->reg, &val); index = (val & clk->mask) >> clk->shift; - if (index > clk->num_div) + if (index >= clk->num_div) return 0; return DIV_ROUND_CLOSEST(parent_rate, clk->div[index]);