clk: visconti: Fix undefined behavior bug and add bounds-checking coverage

struct clk_hw_onecell_data is a flexible structure, which means that it contains flexible-array member at the bottom, in this case array hws:

include/linux/clk-provider.h:
1380 struct clk_hw_onecell_data {
1381 unsigned int num;
1382 struct clk_hw *hws[] __counted_by(num);
1383 };

This could potentially lead to an overwrite of the objects following clk_data in struct visconti_pll_provider, in this case struct device_node *node;, at run-time:

drivers/clk/visconti/pll.h:
16 struct visconti_pll_provider {

 17         void __iomem *reg_base;
 18         struct clk_hw_onecell_data clk_data;
 19         struct device_node *node;

20 };

Notice that a total of 56 bytes are allocated for flexible-array hws at line 328. See below:

include/dt-bindings/clock/toshiba,tmpv770x.h:
14 #define TMPV770X_NR_PLL 7

drivers/clk/visconti/pll-tmpv770x.c:
69 ctx = visconti_init_pll(np, reg_base, TMPV770X_NR_PLL);

drivers/clk/visconti/pll.c:
321 struct visconti_pll_provider * __init visconti_init_pll(struct device_node *np,
322 void __iomem *base,
323 unsigned long nr_plls)
324 {
325 struct visconti_pll_provider *ctx;
...
328 ctx = kzalloc(struct_size(ctx, clk_data.hws, nr_plls), GFP_KERNEL);

struct_size(ctx, clk_data.hws, nr_plls) above translates to sizeof(struct visconti_pll_provider) + sizeof(struct clk_hw *) * 7 == 24 + 8 * 7 == 24 + 56

		  ^^^^
		   |
	allocated bytes for flex array `hws`

$ pahole -C visconti_pll_provider drivers/clk/visconti/pll.o
struct visconti_pll_provider {
	void *                     reg_base;             /*     0     8 */
	struct clk_hw_onecell_data clk_data;             /*     8     8 */
	struct device_node *       node;                 /*    16     8 */

	/* size: 24, cachelines: 1, members: 3 */
	/* last cacheline: 24 bytes */
};

And then, after the allocation, some data is written into all members of struct visconti_pll_provider:

332 for (i = 0; i < nr_plls; ++i)
333 ctx->clk_data.hws[i] = ERR_PTR(-ENOENT);
334

335         ctx->node = np;
336         ctx->reg_base = base;
337         ctx->clk_data.num = nr_plls;

Fix all these by placing the declaration of object clk_data at the end of struct visconti_pll_provider. Also, add a comment to make it clear that this object must always be last in the structure, and prevent this bug from being introduced again in the future.

Fixes b4cbe606dc36 ("clk: visconti: Add support common clock driver and reset driver")

Cc [email protected]

Signed-off-by Gustavo A. R. Silva <[email protected]>

-----Original Message-----
From: Gustavo A. R. Silva <[email protected]>
Sent: Thursday, October 12, 2023 11:18 AM
To: Michael Turquette <[email protected]>; Stephen Boyd <[email protected]>; iwamatsu nobuhiro(岩松 信洋 ○ＤＩＴＣ□ＤＩＴ○Ｏ
ＳＴ) <[email protected]>
Cc: Kees Cook <[email protected]>; [email protected]; [email protected]; [email protected]; Gustavo A. R. Silva <[email protected]>; [email protected]
Subject: [PATCH 1/2][next] clk: visconti: Fix undefined behavior bug in struct visconti_pll_provider

struct clk_hw_onecell_data is a flexible structure, which means that it contains flexible-array member at the bottom, in this case array hws:

include/linux/clk-provider.h:
1380 struct clk_hw_onecell_data {
1381 unsigned int num;
1382 struct clk_hw *hws[] __counted_by(num);
1383 };

This could potentially lead to an overwrite of the objects following clk_data in struct visconti_pll_provider, in this case struct device_node *node;, at run-time:

drivers/clk/visconti/pll.h:
16 struct visconti_pll_provider {

 17         void __iomem *reg_base;
 18         struct clk_hw_onecell_data clk_data;
 19         struct device_node *node;

20 };

Notice that a total of 56 bytes are allocated for flexible-array hws at line 328. See below:

include/dt-bindings/clock/toshiba,tmpv770x.h:
14 #define TMPV770X_NR_PLL 7

drivers/clk/visconti/pll-tmpv770x.c:
69 ctx = visconti_init_pll(np, reg_base, TMPV770X_NR_PLL);

drivers/clk/visconti/pll.c:
321 struct visconti_pll_provider * __init visconti_init_pll(struct device_node *np,
322 void __iomem
*base,
323 unsigned long
nr_plls)
324 {
325 struct visconti_pll_provider *ctx;
...
328 ctx = kzalloc(struct_size(ctx, clk_data.hws, nr_plls),
GFP_KERNEL);

struct_size(ctx, clk_data.hws, nr_plls) above translates to sizeof(struct visconti_pll_provider) + sizeof(struct clk_hw *) * 7 ==
24 + 8 * 7 == 24 + 56

		  ^^^^
		   |
	allocated bytes for flex array `hws`

$ pahole -C visconti_pll_provider drivers/clk/visconti/pll.o struct
visconti_pll_provider {
	void *                     reg_base;             /*     0     8 */
	struct clk_hw_onecell_data clk_data;             /*     8     8 */
	struct device_node *       node;                 /*    16     8 */

	/* size: 24, cachelines: 1, members: 3 */
	/* last cacheline: 24 bytes */
};

And then, after the allocation, some data is written into all members of struct visconti_pll_provider:

332 for (i = 0; i < nr_plls; ++i)
333 ctx->clk_data.hws[i] = ERR_PTR(-ENOENT);
334

335         ctx->node = np;
336         ctx->reg_base = base;
337         ctx->clk_data.num = nr_plls;

Fix all these by placing the declaration of object clk_data at the end of struct visconti_pll_provider. Also, add a comment to make it clear that this object must always be last in the structure, and prevent this bug from being introduced again in the future.

Fixes b4cbe606dc36 ("clk: visconti: Add support common clock driver and

reset driver")

Cc [email protected]

Signed-off-by Gustavo A. R. Silva <[email protected]>

In order to gain the bounds-checking coverage that __counted_by provides to flexible-array members at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions), we must make sure that the counter member, in this particular case num, is updated before the first access to the flex-array member, in this particular case array hws. See below:

commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") introduced __counted_by for struct clk_hw_onecell_data together with changes to relocate some of assignments of counter num before hws is accessed:

include/linux/clk-provider.h:
1380 struct clk_hw_onecell_data {
1381 unsigned int num;
1382 struct clk_hw *hws[] __counted_by(num);
1383 };

However, this structure is used as a member in other structs, in this case in struct visconti_pll_provider:

drivers/clk/visconti/pll.h:
16 struct visconti_pll_provider {
17 void __iomem *reg_base;
18 struct device_node *node;
19
20 /* Must be last */
21 struct clk_hw_onecell_data clk_data;
22 };

Hence, we need to move the assignments to ctx->clk_data.num after allocation for struct visconti_pll_provider and before accessing the flexible array ctx->clk_data.hws. And, as assignments for all members in struct visconti_pll_provider are originally adjacent to each other, relocate all assignments together, so we don't split up ctx->clk_data.hws = nr_plls from the rest. :)

Signed-off-by Gustavo A. R. Silva <[email protected]>

-----Original Message-----
From: Gustavo A. R. Silva <[email protected]>
Sent: Thursday, October 12, 2023 11:19 AM
To: Michael Turquette <[email protected]>; Stephen Boyd <[email protected]>; iwamatsu nobuhiro(岩松 信洋 ○ＤＩＴＣ□ＤＩＴ○Ｏ
ＳＴ) <[email protected]>
Cc: Kees Cook <[email protected]>; [email protected]; [email protected]; [email protected]; Gustavo A. R. Silva <[email protected]>; [email protected]
Subject: [PATCH 2/2][next] clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider

In order to gain the bounds-checking coverage that __counted_by provides to flexible-array members at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions), we must make sure that the counter member, in this particular case num, is updated before the first access to the flex-array member, in this particular case array hws. See below:

commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") introduced __counted_by for struct clk_hw_onecell_data together with changes to relocate some of assignments of counter num before hws is accessed:

include/linux/clk-provider.h:
1380 struct clk_hw_onecell_data {
1381 unsigned int num;
1382 struct clk_hw *hws[] __counted_by(num);
1383 };

However, this structure is used as a member in other structs, in this case in struct visconti_pll_provider:

drivers/clk/visconti/pll.h:
16 struct visconti_pll_provider {
17 void __iomem *reg_base;
18 struct device_node *node;
19
20 /* Must be last */
21 struct clk_hw_onecell_data clk_data;
22 };

Hence, we need to move the assignments to ctx->clk_data.num after allocation for struct visconti_pll_provider and before accessing the flexible array ctx->clk_data.hws. And, as assignments for all members in struct visconti_pll_provider are originally adjacent to each other, relocate all assignments together, so we don't split up ctx->clk_data.hws = nr_plls from the rest. :)

Signed-off-by Gustavo A. R. Silva <[email protected]>