Quoting Gustavo A. R. Silva (2023-10-16 15:05:27)
> `struct clk_hw_onecell_data` is a flexible structure, which means that
> it contains flexible-array member at the bottom, in this case array
> `hws`:
>
> include/linux/clk-provider.h:
> 1380 struct clk_hw_onecell_data {
> 1381 unsigned int num;
> 1382 struct clk_hw *hws[] __counted_by(num);
> 1383 };
>
> This could potentially lead to an overwrite of the objects following
> `clk_data` in `struct visconti_pll_provider`, in this case
> `struct device_node *node;`, at run-time:
>
> drivers/clk/visconti/pll.h:
> 16 struct visconti_pll_provider {
> 17 void __iomem *reg_base;
> 18 struct clk_hw_onecell_data clk_data;
> 19 struct device_node *node;
> 20 };
>
> Notice that a total of 56 bytes are allocated for flexible-array `hws`
> at line 328. See below:
>
> include/dt-bindings/clock/toshiba,tmpv770x.h:
> 14 #define TMPV770X_NR_PLL 7
>
> drivers/clk/visconti/pll-tmpv770x.c:
> 69 ctx = visconti_init_pll(np, reg_base, TMPV770X_NR_PLL);
>
> drivers/clk/visconti/pll.c:
> 321 struct visconti_pll_provider * __init visconti_init_pll(struct
> device_node *np,
> 322 void __iomem
> *base,
> 323 unsigned long
> nr_plls)
> 324 {
> 325 struct visconti_pll_provider *ctx;
> ...
> 328 ctx = kzalloc(struct_size(ctx, clk_data.hws, nr_plls),
> GFP_KERNEL);
>
> `struct_size(ctx, clk_data.hws, nr_plls)` above translates to
> sizeof(struct visconti_pll_provider) + sizeof(struct clk_hw *) * 7 ==
> 24 + 8 * 7 == 24 + 56
> ^^^^
> |
> allocated bytes for flex array `hws`
>
> $ pahole -C visconti_pll_provider drivers/clk/visconti/pll.o
> struct visconti_pll_provider {
> void * reg_base; /* 0 8 */
> struct clk_hw_onecell_data clk_data; /* 8 8 */
> struct device_node * node; /* 16 8 */
>
> /* size: 24, cachelines: 1, members: 3 */
> /* last cacheline: 24 bytes */
> };
>
> And then, after the allocation, some data is written into all members
> of `struct visconti_pll_provider`:
>
> 332 for (i = 0; i < nr_plls; ++i)
> 333 ctx->clk_data.hws[i] = ERR_PTR(-ENOENT);
> 334
> 335 ctx->node = np;
> 336 ctx->reg_base = base;
> 337 ctx->clk_data.num = nr_plls;
>
> Fix all these by placing the declaration of object `clk_data` at the
> end of `struct visconti_pll_provider`. Also, add a comment to make it
> clear that this object must always be last in the structure, and
> prevent this bug from being introduced again in the future.
>
> -Wflex-array-member-not-at-end is coming in GCC-14, and we are getting
> ready to enable it globally.
>
> Fixes: b4cbe606dc36 ("clk: visconti: Add support common clock driver and
> reset driver")
> Cc: sta...@vger.kernel.org
> Reviewed-by: Kees Cook <keesc...@chromium.org>
> Acked-by: Nobuhiro Iwamatsu <nobuhiro1.iwama...@toshiba.co.jp>
> Signed-off-by: Gustavo A. R. Silva <gustavo...@kernel.org>
> ---
Applied to clk-next
