Commit dd4904f3b924 ("interconnect: qcom: Annotate struct
icc_onecell_data with __counted_by") annotated the nodes member of
'struct icc_onecell_data' with __counted_by, which informs the bounds
sanitizer (UBSAN_BOUNDS) about the number of elements in .nodes[], so
that it can warn when .nodes[] is accessed out of bounds. As noted in
that change, the __counted_by member must be initialized with the number
of elements before the first array access happens, otherwise there will
be a warning from each access prior to the initialization because the
number of elements is zero.This occurs in mtk_emi_icc_probe() due to .num_nodes being assigned only after every node has been stored in .nodes[]. With CONFIG_UBSAN_BOUNDS and a compiler that implements __counted_by (GCC 15.1+ or Clang 20.1+), this triggers an array-index-out-of-bounds report during probe, and with CONFIG_UBSAN_TRAP the first store traps so the interconnect provider is never registered. Move the .num_nodes initialization to right after the allocation. The value assigned is unchanged, and the other users of struct icc_onecell_data already initialize it there. Cc: [email protected] Fixes: b45293799f75 ("interconnect: mediatek: Add MediaTek MT8183/8195 EMI Interconnect driver") Assisted-by: LLM Signed-off-by: Aamir Ahmed <[email protected]> --- Found by a tree-wide audit of every __counted_by annotated flexible array whose counter is assigned after the array is first written. This was the only remaining user of struct icc_onecell_data with that ordering; the same class was fixed earlier in clk-s2mps11 (3e14c7207a97), exynos-clkout (cf33f0b7df13) and clk-raspberrypi (6dc445c19050). The audit, the fix and this changelog were drafted with an LLM assistant and reviewed by hand. Compile-tested only (W=1, no warnings), on x86_64 with GCC 13.3, with CONFIG_INTERCONNECT_MTK_DVFSRC_EMI=m forced on the make command line because the driver depends on MTK_DVFSRC, which has no COMPILE_TEST option. GCC 13.3 does not implement __counted_by (CC_HAS_COUNTED_BY needs GCC 15.1+ or Clang 20.1+), so the build only confirms that the change compiles; the sanitizer path was not exercised. I do not have the hardware, so this is not runtime-tested and no UBSAN report was captured. Based on v7.3-rc1. drivers/interconnect/mediatek/icc-emi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/interconnect/mediatek/icc-emi.c b/drivers/interconnect/mediatek/icc-emi.c index dfa3a9cd939..c4aa0ab566d 100644 --- a/drivers/interconnect/mediatek/icc-emi.c +++ b/drivers/interconnect/mediatek/icc-emi.c @@ -100,6 +100,8 @@ int mtk_emi_icc_probe(struct platform_device *pdev) if (!data) return -ENOMEM; + data->num_nodes = desc->num_nodes; + provider->dev = dev; provider->set = mtk_emi_icc_set; provider->aggregate = mtk_emi_icc_aggregate; @@ -126,7 +128,6 @@ int mtk_emi_icc_probe(struct platform_device *pdev) data->nodes[i] = node; } - data->num_nodes = desc->num_nodes; ret = icc_provider_register(provider); if (ret) base-commit: 654ae5d73c05bd2943d65636ce6cd0aa46e62f18 -- 2.53.0.windows.1
