[PATCH 2/3] clk: imx: imx8qxp-lpcg: Fix stack overflow with too many clock indices

[Frank Li]

On Mon, Nov 02, 2026 at 01:48:50PM +0200, Abel Vesa wrote:
> imx_lpcg_parse_clks_from_dt() reads the clock-indices, the parent names
> and the clock-output-names into on-stack arrays of IMX_LPCG_MAX_CLKS
> entries, but sizes the reads by the number of clock-indices entries,
> which it never checks. A clock-indices property with more than
> IMX_LPCG_MAX_CLKS entries thus makes all three reads write past the end
> of their arrays.
>
> An LPCG has at most IMX_LPCG_MAX_CLKS clock outputs, so reject a larger
> count.
>
> Fixes: d5f1e6a2bb61 ("clk: imx: imx8qxp-lpcg: add parsing clocks from device tree")
> Cc: stable at vger.kernel.org
> Signed-off-by: Abel Vesa <abel.vesa at oss.qualcomm.com>
> ---

Reviewed-by: Frank Li <Frank.Li at nxp.com>

>  drivers/clk/imx/clk-imx8qxp-lpcg.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/clk/imx/clk-imx8qxp-lpcg.c b/drivers/clk/imx/clk-imx8qxp-lpcg.c
> index e57e7bc074a9..ae8cb5408246 100644
> --- a/drivers/clk/imx/clk-imx8qxp-lpcg.c
> +++ b/drivers/clk/imx/clk-imx8qxp-lpcg.c
> @@ -200,6 +200,11 @@ static int imx_lpcg_parse_clks_from_dt(struct platform_device *pdev,
>  		return -EINVAL;
>  	}
>
> +	if (count > IMX_LPCG_MAX_CLKS) {
> +		dev_err(&pdev->dev, "too many clocks: %d\n", count);
> +		return -EINVAL;
> +	}
> +
>  	/*
>  	 * A trick here is that we set the num of clks to the MAX instead
>  	 * of the count from clock-indices because one LPCG supports up to
>
> --
> 2.54.0
>
>