Bug#1121211: UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/drivers/clk/samsung/clk-exynos-clkout.c:178:18

DISCUSSION Salvatore Bonaccorso 3 participants 4 messages Nov 22, 2025 – Nov 23, 2025 1 message not in the archive

Subsystems (3)

Common clk Arm Samsung Exynos Samsung SoC clock drivers

Share & tools

A message that is not in the archive (sent off-list or not yet received): 176383554642.17713.6408785381758213911.reportbug@vis

Salvatore Bonaccorso

author

2025-11-22 20:08 UTC #1 lore raw

Hi,

Jochen reported the folowing while booting 6.17.8 based kernel in Debian:

Quoted 55 lines · Jochen Sprickerhof

Package: src:linux
Version: 6.17.8-1
Severity: normal

First time booting into 6.17.8-1 and first time I see UBSAN in my logs:

[Nov21 08:31] Booting Linux on physical CPU 0x100

[  +0,012977] ------------[ cut here ]------------
[  +0,000017] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/drivers/clk/samsung/clk-exynos-clkout.c:178:18
[  +0,000038] index 0 is out of range for type 'clk_hw *[*]'
[  +0,000025] CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.8+deb14-armmp #1 NONE  Debian 6.17.8-1
[  +0,000018] Hardware name: Samsung Exynos (Flattened Device Tree)
[  +0,000007] Call trace:
[  +0,000009]  unwind_backtrace from show_stack+0x18/0x1c
[  +0,000042]  show_stack from dump_stack_lvl+0x54/0x68
[  +0,000036]  dump_stack_lvl from ubsan_epilogue+0x8/0x34
[  +0,000025]  ubsan_epilogue from __ubsan_handle_out_of_bounds+0x88/0x8c
[  +0,000024]  __ubsan_handle_out_of_bounds from exynos_clkout_probe+0x38c/0x428
[  +0,000029]  exynos_clkout_probe from platform_probe+0x64/0x98
[  +0,000034]  platform_probe from really_probe+0xd8/0x3ac
[  +0,000031]  really_probe from __driver_probe_device+0x94/0x1dc
[  +0,000027]  __driver_probe_device from driver_probe_device+0x3c/0xd8
[  +0,000027]  driver_probe_device from __driver_attach+0xd8/0x1d8
[  +0,000028]  __driver_attach from bus_for_each_dev+0x84/0xd4
[  +0,000026]  bus_for_each_dev from bus_add_driver+0xf4/0x218
[  +0,000023]  bus_add_driver from driver_register+0x8c/0x140
[  +0,000027]  driver_register from do_one_initcall+0x50/0x24c
[  +0,000023]  do_one_initcall from kernel_init_freeable+0x288/0x2fc
[  +0,000022]  kernel_init_freeable from kernel_init+0x24/0x140
[  +0,000022]  kernel_init from ret_from_fork+0x14/0x28
[  +0,000015] Exception stack(0xf0835fb0 to 0xf0835ff8)
[  +0,000012] 5fa0:                                     00000000 00000000 00000000 00000000
[  +0,000011] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  +0,000009] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[  +0,000007] ---[ end trace ]---
[  +0,000226] ------------[ cut here ]------------
[  +0,000012] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/drivers/clk/samsung/clk-exynos-clkout.c:183:29
[  +0,000032] index 0 is out of range for type 'clk_hw *[*]'
[  +0,000021] CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.8+deb14-armmp #1 NONE  Debian 6.17.8-1
[  +0,000014] Hardware name: Samsung Exynos (Flattened Device Tree)
[  +0,000006] Call trace:
[  +0,000006]  unwind_backtrace from show_stack+0x18/0x1c
[  +0,000032]  show_stack from dump_stack_lvl+0x54/0x68
[  +0,000033]  dump_stack_lvl from ubsan_epilogue+0x8/0x34
[  +0,000023]  ubsan_epilogue from __ubsan_handle_out_of_bounds+0x88/0x8c
[  +0,000020]  __ubsan_handle_out_of_bounds from exynos_clkout_probe+0x354/0x428
[  +0,000024]  exynos_clkout_probe from platform_probe+0x64/0x98
[  +0,000031]  platform_probe from really_probe+0xd8/0x3ac
[  +0,000031]  really_probe from __driver_probe_device+0x94/0x1dc
[  +0,000031]  __driver_probe_device from driver_probe_device+0x3c/0xd8
[  +0,000028]  driver_probe_device from __driver_attach+0xd8/0x1d8
[  +0,000027]  __driver_attach from bus_for_each_dev+0x84/0xd4
[  +0,000025]  bus_for_each_dev from bus_add_driver+0xf4/0x218
[  +0,000023]  bus_add_driver from driver_register+0x8c/0x140
[  +0,000027]  driver_register from do_one_initcall+0x50/0x24c

Quoted 8 lines

[  +0,000022]  do_one_initcall from kernel_init_freeable+0x288/0x2fc
[  +0,000019]  kernel_init_freeable from kernel_init+0x24/0x140
[  +0,000020]  kernel_init from ret_from_fork+0x14/0x28
[  +0,000016] Exception stack(0xf0835fb0 to 0xf0835ff8)
[  +0,000010] 5fa0:                                     00000000 00000000 00000000 00000000
[  +0,000009] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  +0,000009] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[  +0,000098] ---[ end trace ]---

Can you have a look into it? The downstream report is at
https://bugs.debian.org/1121211

Regards,
Salvatore

Nathan Chancellor

2025-11-22 20:39 UTC #2 lore raw

Quoted 70 lines · Salvatore Bonaccorso

Hi,

Jochen reported the folowing while booting 6.17.8 based kernel in Debian:

Quoted 55 lines · Jochen Sprickerhof

Package: src:linux
Version: 6.17.8-1
Severity: normal

First time booting into 6.17.8-1 and first time I see UBSAN in my logs:

[Nov21 08:31] Booting Linux on physical CPU 0x100

[  +0,012977] ------------[ cut here ]------------
[  +0,000017] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/drivers/clk/samsung/clk-exynos-clkout.c:178:18
[  +0,000038] index 0 is out of range for type 'clk_hw *[*]'
[  +0,000025] CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.8+deb14-armmp #1 NONE  Debian 6.17.8-1
[  +0,000018] Hardware name: Samsung Exynos (Flattened Device Tree)
[  +0,000007] Call trace:
[  +0,000009]  unwind_backtrace from show_stack+0x18/0x1c
[  +0,000042]  show_stack from dump_stack_lvl+0x54/0x68
[  +0,000036]  dump_stack_lvl from ubsan_epilogue+0x8/0x34
[  +0,000025]  ubsan_epilogue from __ubsan_handle_out_of_bounds+0x88/0x8c
[  +0,000024]  __ubsan_handle_out_of_bounds from exynos_clkout_probe+0x38c/0x428
[  +0,000029]  exynos_clkout_probe from platform_probe+0x64/0x98
[  +0,000034]  platform_probe from really_probe+0xd8/0x3ac
[  +0,000031]  really_probe from __driver_probe_device+0x94/0x1dc
[  +0,000027]  __driver_probe_device from driver_probe_device+0x3c/0xd8
[  +0,000027]  driver_probe_device from __driver_attach+0xd8/0x1d8
[  +0,000028]  __driver_attach from bus_for_each_dev+0x84/0xd4
[  +0,000026]  bus_for_each_dev from bus_add_driver+0xf4/0x218
[  +0,000023]  bus_add_driver from driver_register+0x8c/0x140
[  +0,000027]  driver_register from do_one_initcall+0x50/0x24c
[  +0,000023]  do_one_initcall from kernel_init_freeable+0x288/0x2fc
[  +0,000022]  kernel_init_freeable from kernel_init+0x24/0x140
[  +0,000022]  kernel_init from ret_from_fork+0x14/0x28
[  +0,000015] Exception stack(0xf0835fb0 to 0xf0835ff8)
[  +0,000012] 5fa0:                                     00000000 00000000 00000000 00000000
[  +0,000011] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  +0,000009] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[  +0,000007] ---[ end trace ]---
[  +0,000226] ------------[ cut here ]------------
[  +0,000012] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/drivers/clk/samsung/clk-exynos-clkout.c:183:29
[  +0,000032] index 0 is out of range for type 'clk_hw *[*]'
[  +0,000021] CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.8+deb14-armmp #1 NONE  Debian 6.17.8-1
[  +0,000014] Hardware name: Samsung Exynos (Flattened Device Tree)
[  +0,000006] Call trace:
[  +0,000006]  unwind_backtrace from show_stack+0x18/0x1c
[  +0,000032]  show_stack from dump_stack_lvl+0x54/0x68
[  +0,000033]  dump_stack_lvl from ubsan_epilogue+0x8/0x34
[  +0,000023]  ubsan_epilogue from __ubsan_handle_out_of_bounds+0x88/0x8c
[  +0,000020]  __ubsan_handle_out_of_bounds from exynos_clkout_probe+0x354/0x428
[  +0,000024]  exynos_clkout_probe from platform_probe+0x64/0x98
[  +0,000031]  platform_probe from really_probe+0xd8/0x3ac
[  +0,000031]  really_probe from __driver_probe_device+0x94/0x1dc
[  +0,000031]  __driver_probe_device from driver_probe_device+0x3c/0xd8
[  +0,000028]  driver_probe_device from __driver_attach+0xd8/0x1d8
[  +0,000027]  __driver_attach from bus_for_each_dev+0x84/0xd4
[  +0,000025]  bus_for_each_dev from bus_add_driver+0xf4/0x218
[  +0,000023]  bus_add_driver from driver_register+0x8c/0x140
[  +0,000027]  driver_register from do_one_initcall+0x50/0x24c

Quoted 8 lines

[  +0,000022]  do_one_initcall from kernel_init_freeable+0x288/0x2fc
[  +0,000019]  kernel_init_freeable from kernel_init+0x24/0x140
[  +0,000020]  kernel_init from ret_from_fork+0x14/0x28
[  +0,000016] Exception stack(0xf0835fb0 to 0xf0835ff8)
[  +0,000010] 5fa0:                                     00000000 00000000 00000000 00000000
[  +0,000009] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  +0,000009] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[  +0,000098] ---[ end trace ]---

Quoted 2 lines

Can you have a look into it? The downstream report is at
https://bugs.debian.org/1121211

I bet it is the same problem as the ones I fixed in

6dc445c19050 ("clk: bcm: rpi: Assign ->num before accessing ->hws") 9368cdf90f52 ("clk: bcm: dvp: Assign ->num before accessing ->hws")

So something like this?

Cheers,
Nathan

drivers/clk/samsung/clk-exynos-clkout.c +1 -1

index 5f1a4f5e2e59..5b21025338bd 100644
@@ -175,6 +175,7 @@ static int exynos_clkout_probe(struct platform_device *pdev)
 	clkout->mux.shift = EXYNOS_CLKOUT_MUX_SHIFT;
 	clkout->mux.lock = &clkout->slock;
 
+	clkout->data.num = EXYNOS_CLKOUT_NR_CLKS;
 	clkout->data.hws[0] = clk_hw_register_composite(NULL, "clkout",
 				parent_names, parent_count, &clkout->mux.hw,
 				&clk_mux_ops, NULL, NULL, &clkout->gate.hw,

@@ -185,7 +186,6 @@ static int exynos_clkout_probe(struct platform_device *pdev)
 		goto err_unmap;
 	}
 
-	clkout->data.num = EXYNOS_CLKOUT_NR_CLKS;
 	ret = of_clk_add_hw_provider(clkout->np, of_clk_hw_onecell_get, &clkout->data);
 	if (ret)
 		goto err_clk_unreg;

Salvatore Bonaccorso

author

2025-11-23 07:57 UTC #3 lore raw

Hi Nathan,

Quoted 97 lines · Nathan Chancellor

Quoted 70 lines · Salvatore Bonaccorso

Hi,

Jochen reported the folowing while booting 6.17.8 based kernel in Debian:

Quoted 55 lines · Jochen Sprickerhof

Package: src:linux
Version: 6.17.8-1
Severity: normal

First time booting into 6.17.8-1 and first time I see UBSAN in my logs:

[Nov21 08:31] Booting Linux on physical CPU 0x100

[  +0,012977] ------------[ cut here ]------------
[  +0,000017] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/drivers/clk/samsung/clk-exynos-clkout.c:178:18
[  +0,000038] index 0 is out of range for type 'clk_hw *[*]'
[  +0,000025] CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.8+deb14-armmp #1 NONE  Debian 6.17.8-1
[  +0,000018] Hardware name: Samsung Exynos (Flattened Device Tree)
[  +0,000007] Call trace:
[  +0,000009]  unwind_backtrace from show_stack+0x18/0x1c
[  +0,000042]  show_stack from dump_stack_lvl+0x54/0x68
[  +0,000036]  dump_stack_lvl from ubsan_epilogue+0x8/0x34
[  +0,000025]  ubsan_epilogue from __ubsan_handle_out_of_bounds+0x88/0x8c
[  +0,000024]  __ubsan_handle_out_of_bounds from exynos_clkout_probe+0x38c/0x428
[  +0,000029]  exynos_clkout_probe from platform_probe+0x64/0x98
[  +0,000034]  platform_probe from really_probe+0xd8/0x3ac
[  +0,000031]  really_probe from __driver_probe_device+0x94/0x1dc
[  +0,000027]  __driver_probe_device from driver_probe_device+0x3c/0xd8
[  +0,000027]  driver_probe_device from __driver_attach+0xd8/0x1d8
[  +0,000028]  __driver_attach from bus_for_each_dev+0x84/0xd4
[  +0,000026]  bus_for_each_dev from bus_add_driver+0xf4/0x218
[  +0,000023]  bus_add_driver from driver_register+0x8c/0x140
[  +0,000027]  driver_register from do_one_initcall+0x50/0x24c
[  +0,000023]  do_one_initcall from kernel_init_freeable+0x288/0x2fc
[  +0,000022]  kernel_init_freeable from kernel_init+0x24/0x140
[  +0,000022]  kernel_init from ret_from_fork+0x14/0x28
[  +0,000015] Exception stack(0xf0835fb0 to 0xf0835ff8)
[  +0,000012] 5fa0:                                     00000000 00000000 00000000 00000000
[  +0,000011] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  +0,000009] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[  +0,000007] ---[ end trace ]---
[  +0,000226] ------------[ cut here ]------------
[  +0,000012] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/drivers/clk/samsung/clk-exynos-clkout.c:183:29
[  +0,000032] index 0 is out of range for type 'clk_hw *[*]'
[  +0,000021] CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.8+deb14-armmp #1 NONE  Debian 6.17.8-1
[  +0,000014] Hardware name: Samsung Exynos (Flattened Device Tree)
[  +0,000006] Call trace:
[  +0,000006]  unwind_backtrace from show_stack+0x18/0x1c
[  +0,000032]  show_stack from dump_stack_lvl+0x54/0x68
[  +0,000033]  dump_stack_lvl from ubsan_epilogue+0x8/0x34
[  +0,000023]  ubsan_epilogue from __ubsan_handle_out_of_bounds+0x88/0x8c
[  +0,000020]  __ubsan_handle_out_of_bounds from exynos_clkout_probe+0x354/0x428
[  +0,000024]  exynos_clkout_probe from platform_probe+0x64/0x98
[  +0,000031]  platform_probe from really_probe+0xd8/0x3ac
[  +0,000031]  really_probe from __driver_probe_device+0x94/0x1dc
[  +0,000031]  __driver_probe_device from driver_probe_device+0x3c/0xd8
[  +0,000028]  driver_probe_device from __driver_attach+0xd8/0x1d8
[  +0,000027]  __driver_attach from bus_for_each_dev+0x84/0xd4
[  +0,000025]  bus_for_each_dev from bus_add_driver+0xf4/0x218
[  +0,000023]  bus_add_driver from driver_register+0x8c/0x140
[  +0,000027]  driver_register from do_one_initcall+0x50/0x24c

Quoted 8 lines

[  +0,000022]  do_one_initcall from kernel_init_freeable+0x288/0x2fc
[  +0,000019]  kernel_init_freeable from kernel_init+0x24/0x140
[  +0,000020]  kernel_init from ret_from_fork+0x14/0x28
[  +0,000016] Exception stack(0xf0835fb0 to 0xf0835ff8)
[  +0,000010] 5fa0:                                     00000000 00000000 00000000 00000000
[  +0,000009] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  +0,000009] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[  +0,000098] ---[ end trace ]---

Quoted 2 lines

Can you have a look into it? The downstream report is at
https://bugs.debian.org/1121211

I bet it is the same problem as the ones I fixed in

6dc445c19050 ("clk: bcm: rpi: Assign ->num before accessing ->hws") 9368cdf90f52 ("clk: bcm: dvp: Assign ->num before accessing ->hws")

So something like this?

Cheers,
Nathan

drivers/clk/samsung/clk-exynos-clkout.c +1 -0

index 5f1a4f5e2e59..5b21025338bd 100644
@@ -175,6 +175,7 @@ static int exynos_clkout_probe(struct platform_device *pdev)
 	clkout->mux.shift = EXYNOS_CLKOUT_MUX_SHIFT;
 	clkout->mux.lock = &clkout->slock;
 
+	clkout->data.num = EXYNOS_CLKOUT_NR_CLKS;
 	clkout->data.hws[0] = clk_hw_register_composite(NULL, "clkout",
 				parent_names, parent_count, &clkout->mux.hw,
 				&clk_mux_ops, NULL, NULL, &clkout->gate.hw,

drivers/clk/samsung/clk-exynos-clkout.c static int exynos_clkout_probe(struct platform_device *pdev) · line 191

Quoted 7 lines

drivers/clk/samsung/clk-exynos-clkout.c +0 -1

@@ -185,7 +186,6 @@ static int exynos_clkout_probe(struct platform_device *pdev)
 		goto err_unmap;
 	}
 
-	clkout->data.num = EXYNOS_CLKOUT_NR_CLKS;
 	ret = of_clk_add_hw_provider(clkout->np, of_clk_hw_onecell_get, &clkout->data);
 	if (ret)
 		goto err_clk_unreg;

Thank you very much. Jochen, can you test the patch and report back?

Regards,
Salvatore

Jochen Sprickerhof

Tested-by

2025-11-23 20:34 UTC #4 lore raw

In reply to Nathan Chancellor

Hi Nathan,

Quoted 24 lines · Nathan Chancellor

I bet it is the same problem as the ones I fixed in
6dc445c19050 ("clk: bcm: rpi: Assign ->num before accessing ->hws") 9368cdf90f52 ("clk: bcm: dvp: Assign ->num before accessing ->hws")
So something like this?
Cheers,
Nathan
drivers/clk/samsung/clk-exynos-clkout.c +1 -0
index 5f1a4f5e2e59..5b21025338bd 100644
@@ -175,6 +175,7 @@ static int exynos_clkout_probe(struct platform_device *pdev)
 	clkout->mux.shift = EXYNOS_CLKOUT_MUX_SHIFT;
 	clkout->mux.lock = &clkout->slock;
 
+	clkout->data.num = EXYNOS_CLKOUT_NR_CLKS;
 	clkout->data.hws[0] = clk_hw_register_composite(NULL, "clkout",
 				parent_names, parent_count, &clkout->mux.hw,
 				&clk_mux_ops, NULL, NULL, &clkout->gate.hw,

drivers/clk/samsung/clk-exynos-clkout.c static int exynos_clkout_probe(struct platform_device *pdev) · line 191

Quoted 7 lines

drivers/clk/samsung/clk-exynos-clkout.c +0 -1

@@ -185,7 +186,6 @@ static int exynos_clkout_probe(struct platform_device *pdev)
 		goto err_unmap;
 	}
 
-	clkout->data.num = EXYNOS_CLKOUT_NR_CLKS;
 	ret = of_clk_add_hw_provider(clkout->np, of_clk_hw_onecell_get, &clkout->data);
 	if (ret)
 		goto err_clk_unreg;

This fixes it for me, feel free to add a

Tested-by Jochen Sprickerhof <[email protected]>

Thanks!

Jochen