)]}'
{
  "commit": "02fb4f0084331ef72c28d0c70fcb15d1bea369ec",
  "tree": "2cb7a4b252d3b1f84f70e410fe6730b0f978d995",
  "parents": [
    "25f1c96a0e841013647d788d4598e364e5c2ebb7"
  ],
  "author": {
    "name": "Gustavo A. R. Silva",
    "email": "gustavoars@kernel.org",
    "time": "Thu Nov 14 17:55:16 2024 -0600"
  },
  "committer": {
    "name": "Stephen Boyd",
    "email": "sboyd@kernel.org",
    "time": "Mon Nov 18 19:51:28 2024 -0800"
  },
  "message": "clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access\n\nFlexible-array member `hws` in `struct clk_hw_onecell_data` is annotated\nwith the `counted_by()` attribute. This means that when memory is\nallocated for this array, the _counter_, which in this case is member\n`num` in the flexible structure, should be set to the maximum number of\nelements the flexible array can contain, or fewer.\n\nIn this case, the total number of elements for the flexible array is\ndetermined by variable `clks_num` when allocating heap space via\n`devm_kzalloc()`, as shown below:\n\n289         struct loongson2_clk_provider *clp;\n\t...\n296         for (p \u003d data; p-\u003ename; p++)\n297                 clks_num++;\n298\n299         clp \u003d devm_kzalloc(dev, struct_size(clp, clk_data.hws, clks_num),\n300                            GFP_KERNEL);\n\nSo, `clp-\u003eclk_data.num` should be set to `clks_num` or less, and not\nexceed `clks_num`, as is currently the case. Otherwise, if data is\nwritten into `clp-\u003eclk_data.hws[clks_num]`, the instrumentation\nprovided by the compiler won\u0027t detect the overflow, leading to a\nmemory corruption bug at runtime.\n\nFix this issue by setting `clp-\u003eclk_data.num` to `clks_num`.\n\nFixes: 9796ec0bd04b (\"clk: clk-loongson2: Refactor driver for adding new platforms\")\nCc: stable@vger.kernel.org\nSigned-off-by: Gustavo A. R. Silva \u003cgustavoars@kernel.org\u003e\nLink: https://lore.kernel.org/r/ZzaN5MpmMr0hwHw9@kspp\nSigned-off-by: Stephen Boyd \u003csboyd@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e99ba79feec6251be8b915cc3dc69304fe590ff9",
      "old_mode": 33188,
      "old_path": "drivers/clk/clk-loongson2.c",
      "new_id": "7082b4309c6f1577530b597fbd1190c7dce51a4f",
      "new_mode": 33188,
      "new_path": "drivers/clk/clk-loongson2.c"
    }
  ]
}