Re: [PATCH v1 3/4] clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
Sudeep Holla <[email protected]> Mon, 27 Jul 2026 21:01:53 +0100
| Newsgroups | org.kernel.vger.arm-scmi,org.infradead.lists.linux-arm-kernel,org.kernel.vger.linux-clk,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <20260727-generous-cautious-vole-829acd@sudeepholla> |
On Mon, Jul 27, 2026 at 10:19:15AM +0800, Xixin Liu wrote:
> dvfs_get_idx() may return an out-of-range index if the SCP firmware is
> buggy or returns a stale value. Only negative indexes were rejected, so a
> large index walked past info->opps and could treat garbage as a clock rate
> (KASAN OOB / wrong frequency to consumers).
>
> Treat indexes >= opp count as invalid and return 0, same as idx < 0.
>
Again this issue of out-of-bounds read is in the original SCPI clock driver.
So include the below fixes tag:
Fixes: cd52c2a4b5c4 ("clk: add support for clocks provided by SCP(System Control Processor)")
--
Regards,
Sudeep