From fdfe2ec48d5c1c2ed03073d73edd3fdd3fe1ffa1 Mon Sep 17 00:00:00 2001 From: Wayen Yan Date: Wed, 8 Jul 2026 12:06:08 +0800 Subject: clk: airoha: fix off-by-one in clock ID boundary check The boundary checks in airoha_clk_enable(), airoha_clk_get_rate(), and airoha_clk_set_rate() use "id > data->num_clocks" which allows id equal to num_clocks to pass. Since data->descs[] has exactly num_clocks entries (indices 0 to num_clocks-1), id=num_clocks results in an out-of-bounds array access. This is currently not triggered because the device tree clock IDs are within bounds, but the check should be defensive. Fix by changing the comparison from ">" to ">=". Fixes: d0b81afb5ec9 ("clk: airoha: Add support for Airoha AN7581 SoC clock") Signed-off-by: Wayen Yan --- drivers/clk/airoha/clk-airoha.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/clk/airoha/clk-airoha.c b/drivers/clk/airoha/clk-airoha.c index 49dbca82135..89a8b4cb1cf 100644 --- a/drivers/clk/airoha/clk-airoha.c +++ b/drivers/clk/airoha/clk-airoha.c @@ -327,7 +327,7 @@ static int airoha_clk_enable(struct clk *clk) struct airoha_clk_soc_data *data = priv->data; int id = clk->id; - if (id > data->num_clocks) + if (id >= data->num_clocks) return -EINVAL; return 0; @@ -349,7 +349,7 @@ static ulong airoha_clk_get_rate(struct clk *clk) ulong rate; int ret; - if (id > data->num_clocks) { + if (id >= data->num_clocks) { dev_err(clk->dev, "Invalid clk ID %d\n", id); return 0; } @@ -412,7 +412,7 @@ static ulong airoha_clk_set_rate(struct clk *clk, ulong rate) int div; int ret; - if (id > data->num_clocks) { + if (id >= data->num_clocks) { dev_err(clk->dev, "Invalid clk ID %d\n", id); return 0; } -- cgit v1.3.1