[PATCH] interconnect: mediatek: Assign .num_nodes before accessing .nodes

[Aamir Ahmed]

Commit dd4904f3b924 ("interconnect: qcom: Annotate struct
icc_onecell_data with __counted_by") annotated the nodes member of
'struct icc_onecell_data' with __counted_by, which informs the bounds
sanitizer (UBSAN_BOUNDS) about the number of elements in .nodes[], so
that it can warn when .nodes[] is accessed out of bounds. As noted in
that change, the __counted_by member must be initialized with the number
of elements before the first array access happens, otherwise there will
be a warning from each access prior to the initialization because the
number of elements is zero.

This occurs in mtk_emi_icc_probe() due to .num_nodes being assigned only
after every node has been stored in .nodes[]. With CONFIG_UBSAN_BOUNDS
and a compiler that implements __counted_by (GCC 15.1+ or Clang 20.1+),
this triggers an array-index-out-of-bounds report during probe, and with
CONFIG_UBSAN_TRAP the first store traps so the interconnect provider is
never registered.

Move the .num_nodes initialization to right after the allocation. The
value assigned is unchanged, and the other users of struct
icc_onecell_data already initialize it there.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: b45293799f75 ("interconnect: mediatek: Add MediaTek MT8183/8195 EMI Interconnect driver")
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>
---
Found by a tree-wide audit of every __counted_by annotated flexible
array whose counter is assigned after the array is first written. This
was the only remaining user of struct icc_onecell_data with that
ordering; the same class was fixed earlier in clk-s2mps11
(3e14c7207a97), exynos-clkout (cf33f0b7df13) and clk-raspberrypi
(6dc445c19050). The audit, the fix and this changelog were drafted with
an LLM assistant and reviewed by hand.

Compile-tested only (W=1, no warnings), on x86_64 with GCC 13.3, with
CONFIG_INTERCONNECT_MTK_DVFSRC_EMI=m forced on the make command line
because the driver depends on MTK_DVFSRC, which has no COMPILE_TEST
option. GCC 13.3 does not implement __counted_by (CC_HAS_COUNTED_BY
needs GCC 15.1+ or Clang 20.1+), so the build only confirms that the
change compiles; the sanitizer path was not exercised. I do not have the
hardware, so this is not runtime-tested and no UBSAN report was
captured.

Based on v7.3-rc1.

 drivers/interconnect/mediatek/icc-emi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/interconnect/mediatek/icc-emi.c b/drivers/interconnect/mediatek/icc-emi.c
index dfa3a9cd939..c4aa0ab566d 100644
--- a/drivers/interconnect/mediatek/icc-emi.c
+++ b/drivers/interconnect/mediatek/icc-emi.c
@@ -100,6 +100,8 @@ int mtk_emi_icc_probe(struct platform_device *pdev)
 	if (!data)
 		return -ENOMEM;
 
+	data->num_nodes = desc->num_nodes;
+
 	provider->dev = dev;
 	provider->set = mtk_emi_icc_set;
 	provider->aggregate = mtk_emi_icc_aggregate;
@@ -126,7 +128,6 @@ int mtk_emi_icc_probe(struct platform_device *pdev)
 
 		data->nodes[i] = node;
 	}
-	data->num_nodes = desc->num_nodes;
 
 	ret = icc_provider_register(provider);
 	if (ret)

base-commit: 654ae5d73c05bd2943d65636ce6cd0aa46e62f18
-- 
2.53.0.windows.1