From: Thierry Reding <treding@xxxxxxxxxx>
The code will attempt to read "count" entries from DT, but the code
allocates the maximum number that is possible, potentially over-
allocating the array. Use the actual number of entries when allocating.
Signed-off-by: Thierry Reding <treding@xxxxxxxxxx>
---
drivers/thermal/tegra/soctherm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
index 730b034004cb..16fa00fa0839 100644
--- a/drivers/thermal/tegra/soctherm.c
+++ b/drivers/thermal/tegra/soctherm.c
@@ -1436,7 +1436,6 @@ static int soctherm_clk_enable(struct tegra_soctherm *tegra, bool enable)
static int soctherm_thermtrips_parse(struct tegra_soctherm *ts)
{
struct tsensor_group_thermtrips *tt = ts->soc->thermtrips;
- const int max_num_prop = ts->soc->num_ttgs * 2;
unsigned int i, j, count;
u32 *tlb;
int ret;
@@ -1453,7 +1452,7 @@ static int soctherm_thermtrips_parse(struct tegra_soctherm *ts)
count = min_t(unsigned int, ret, ts->soc->num_ttgs * 2);
- tlb = devm_kcalloc(ts->dev, max_num_prop, sizeof(u32), GFP_KERNEL);
+ tlb = devm_kcalloc(ts->dev, count, sizeof(u32), GFP_KERNEL);
if (!tlb)
return -ENOMEM;
@@ -1473,6 +1472,8 @@ static int soctherm_thermtrips_parse(struct tegra_soctherm *ts)
i++;
}
+ devm_kfree(ts->dev, tlb);
+
return 0;
}
--
2.40.0
