In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rtc: ac100: Assign .num before accessing .hws<\/p>\n
Commit f316cdff8d67 (“clk: Annotate struct clk_hw_onecell_data with
\n__counted_by”) annotated the hws member of ‘struct clk_hw_onecell_data’
\nwith __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)
\nabout the number of elements in .hws[], so that it can warn when .hws[]
\nis accessed out of bounds. As noted in that change, the __counted_by
\nmember must be initialized with the number of elements before the first
\narray access happens, otherwise there will be a warning from each access
\nprior to the initialization because the number of elements is zero.
\nThis occurs in ac100_rtc_register_clks() due to .num being assigned only
\nafter every clkout clock has been stored in .hws[]. With
\nCONFIG_UBSAN_BOUNDS and a compiler that implements __counted_by (GCC
\n15.1+ or Clang 20.1+), this triggers an array-index-out-of-bounds report
\nduring probe, and with CONFIG_UBSAN_TRAP the first store traps.<\/p>\n
Initialize .num with AC100_CLKOUT_NUM, the number of elements .hws[] was
\nallocated with, right after the allocation. That is the value the loop
\ncounter ends up at on the success path anyway, so the provider’s
\nbehaviour is unchanged.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rtc: ac100: Assign .num before accessing .hws<\/p>\n
Commit f316cdff8d67 (“clk: Annotate struct clk_hw_onecell_data with
\n__counted_by”) a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41320","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41320","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41320"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41320"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41320"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}