On Sat, Sep 05, 2026 at 09:48:35PM +0100, Aamir Ahmed wrote:
> Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
> __counted_by") annotated the hws member of 'struct clk_hw_onecell_data'
> with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)
> about the number of elements in .hws[], so that it can warn when .hws[]
> is accessed out of bounds. As noted in that change, the __counted_by
> member must be initialized with the number of elements before the first
> array access happens, otherwise there will be a warning from each access
> prior to the initialization because the number of elements is zero.
> This occurs in atlantis_prcm_clocks_register() due to .num being
> assigned only after every clock has been stored in .hws[]. With
> CONFIG_UBSAN_BOUNDS and a compiler that implements __counted_by (GCC
> 15.1+ or Clang 20.1+), this triggers an array-index-out-of-bounds report
> during probe, and with CONFIG_UBSAN_TRAP the first store traps so the
> clock provider never registers.
>
> Move the .num initialization to right after the allocation.
>
> Cc: [email protected]
> Fixes: 23c8ebc95284 ("clk: tenstorrent: Add Atlantis clock controller driver")
> Assisted-by: LLM
> Signed-off-by: Aamir Ahmed <[email protected]>
> ---
> Found while auditing the remaining clk_hw_onecell_data users that assign
> .num only after touching .hws[], following the fixes already merged for
> clk-s2mps11 (3e14c7207a97), exynos-clkout (cf33f0b7df13) and
> clk-raspberrypi (6dc445c19050). The audit, the fix and this changelog
> were drafted with an LLM assistant and reviewed by hand.
>
> Compile-tested only (W=1, no warnings) on x86_64 with GCC 13.3, via
> COMPILE_TEST with CONFIG_TENSTORRENT_ATLANTIS_PRCM=m. GCC 13.3 does not
> implement __counted_by (CC_HAS_COUNTED_BY needs GCC 15.1+ or Clang
> 20.1+), so the build only confirms that the change compiles; the
> sanitizer path was not exercised. I do not have the hardware, so this is
> not runtime-tested and no UBSAN report was captured.
With CONFIG_UBSAN_TRAP, probe fails like this in the QEMU tt-atlantis
machine
[ 0.236357] Kernel BUG [#1]
[ 0.236483] Modules linked in:
[ 0.236699] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted
7.1.0-00145-g42d8a0e21d1a #2 PREEMPTLAZY
[ 0.236778] Hardware name: Tenstorrent Atlantis RISC-V Machine (DT)
[ 0.236833] epc : atlantis_prcm_probe+0x18e/0x194
[ 0.237107] ra : atlantis_prcm_probe+0xbe/0x194
[ 0.237123] epc : ffffffff8060ed7a ra : ffffffff8060ecaa sp :
ff20000000043b30
[ 0.237134] gp : ffffffff8173c808 tp : ff600001801f0cc0 t0 :
ffffffff812db9e8
[ 0.237143] t1 : 8d795c92de4feea0 t2 : 0000000000000000 s0 :
ff20000000043b90
[ 0.237153] s1 : ffffffff816d3b88 a0 : 0000000000000000 a1 :
0000000000000002
[ 0.237161] a2 : 0000000000000000 a3 : ffffffff81777080 a4 :
0000000000000000
[ 0.237170] a5 : 0000000000000000 a6 : ff60000180ee8000 a7 :
ff20000000043954
[ 0.237178] s2 : ff60000180380810 s3 : ff60000180eedc40 s4 :
ff60000180ee8000
[ 0.237187] s5 : ff60000180eedc48 s6 : 0000000000000038 s7 :
0000000000000000
[ 0.237196] s8 : ffffffff810a4b78 s9 : 0000000000000000 s10:
0000000000000000
[ 0.237204] s11: 0000000000000000 t3 : 0000000000000020 t4 :
ffffffffffffffff
[ 0.237223] t5 : ff20000000600000 t6 : ff6000018040793e ssp :
0000000000000000
[ 0.237232] status: 0000000200000120 badaddr: ffffffff8060ed7a cause:
0000000000000003
[ 0.237288] [<ffffffff8060ed7a>] atlantis_prcm_probe+0x18e/0x194
[ 0.237346] [<ffffffff806924f2>] platform_probe+0x66/0xac
[ 0.237356] [<ffffffff8068f9ec>] really_probe+0x8c/0x23c
[ 0.237367] [<ffffffff8068fc0c>] __driver_probe_device+0x70/0x110
[ 0.237376] [<ffffffff8068fd82>] driver_probe_device+0x2e/0x108
[ 0.237385] [<ffffffff8068ffc6>] __driver_attach+0x6a/0x168
[ 0.237394] [<ffffffff8068d944>] bus_for_each_dev+0x60/0xb0
[ 0.237403] [<ffffffff8068f48e>] driver_attach+0x1a/0x24
[ 0.237412] [<ffffffff8068ec92>] bus_add_driver+0xca/0x1ec
[ 0.237423] [<ffffffff80690c96>] driver_register+0x3e/0xdc
[ 0.237432] [<ffffffff80691c2c>] __platform_driver_register+0x1c/0x24
[ 0.237457] [<ffffffff80c30f16>] atlantis_prcm_driver_init+0x1a/0x24
[ 0.237473] [<ffffffff8001012c>] do_one_initcall+0x5c/0x1c8
[ 0.237483] [<ffffffff80c01396>] kernel_init_freeable+0x236/0x2cc
[ 0.237493] [<ffffffff80ad82dc>] kernel_init+0x1c/0x14c
[ 0.237503] [<ffffffff80011c74>] ret_from_fork_kernel+0x18/0x170
[ 0.237511] [<ffffffff80ae2342>] ret_from_fork_kernel_asm+0x16/0x18
[ 0.237598] Code: bf6d 55fd b5dd 854a 9617 00cc 0613 9326 55b5 b799 (9002)
57d1
[ 0.237743] ---[ end trace 0000000000000000 ]---
[ 0.237956] Kernel panic - not syncing: Fatal exception in interrupt
Reviewed-by: Anirudh Srinivasan <[email protected]>
Regards
Anirudh Srinivasan
>
> Based on v7.3-rc1.
>
> drivers/clk/tenstorrent/atlantis-prcm.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/clk/tenstorrent/atlantis-prcm.c
> b/drivers/clk/tenstorrent/atlantis-prcm.c
> index 6d4386eeb7d..a68534a295c 100644
> --- a/drivers/clk/tenstorrent/atlantis-prcm.c
> +++ b/drivers/clk/tenstorrent/atlantis-prcm.c
> @@ -796,6 +796,8 @@ static int atlantis_prcm_clocks_register(struct device
> *dev,
> if (!clk_data)
> return -ENOMEM;
>
> + clk_data->num = num_clks;
> +
> for (i = 0; i < data->num; i++) {
> struct clk_hw *hw = data->hws[i];
> struct atlantis_clk_common *common =
> @@ -809,8 +811,6 @@ static int atlantis_prcm_clocks_register(struct device
> *dev,
> clk_data->hws[common->clkid] = hw;
> }
>
> - clk_data->num = num_clks;
> -
> return devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get,
> clk_data);
> }
>
>
> base-commit: 654ae5d73c05bd2943d65636ce6cd0aa46e62f18
> --
> 2.53.0.windows.1
>
>
> _______________________________________________
> linux-riscv mailing list
> [email protected]
> http://lists.infradead.org/mailman/listinfo/linux-riscv
