Re: [PATCH v2] clk: mstar: msc313-mpll: fix off-by-one in clock array allocation

[Brian Masney]

On Mon, Aug 24, 2026 at 10:28:00PM +0800, hanzhijian wrote:
> The hws array of mpll->clk_data is allocated with struct_size() using
> ARRAY_SIZE(output_dividers) as the element count, giving it 7 elements.
> But the probe function stores the MPLL clock at hws[0] and one
> fixed-factor clock for each output divider at hws[i + 1] for i in
> [0, ARRAY_SIZE(output_dividers)), writing 8 elements in total.  The
> final write to hws[7] is past the end of the allocation.
> 
> clk_data->num is also set to NUMOUTPUTS (8), so the clock framework
> reads hws[0..7], again accessing hws[7] out of bounds.
> 
> Use NUMOUTPUTS as the element count so the allocation matches the
> number of clocks actually stored and exposed.
> 
> Found by smatch:
>   drivers/clk/mstar/clk-msc313-mpll.c:134 msc313_mpll_probe()
>   error: buffer overflow 'mpll->clk_data->hws' 7 <= 7
> 
> Fixes: bef7a78da716 ("clk: mstar: MStar/SigmaStar MPLL driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: hanzhijian <hanzhijian1991@xxxxxxxxx>

Reviewed-by: Brian Masney <bmasney@xxxxxxxxxx>