From: Thierry Reding <treding@xxxxxxxxxx>
The code will attempt to read "count" entries from DT, but the code
allocates the maximum number that is possible, potentially over-
allocating the array. Use the actual number of entries when allocating.
Signed-off-by: Thierry Reding <treding@xxxxxxxxxx>
---
drivers/thermal/tegra/soctherm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
index c7f8e36cbeab..88ceeb8491cc 100644
--- a/drivers/thermal/tegra/soctherm.c
+++ b/drivers/thermal/tegra/soctherm.c
@@ -1469,7 +1469,6 @@ static int soctherm_clk_enable(struct tegra_soctherm *tegra, bool enable)
static int soctherm_thermtrips_parse(struct tegra_soctherm *ts)
{
struct tsensor_group_thermtrips *tt = ts->soc->thermtrips;
- const int max_num_prop = ts->soc->num_ttgs * 2;
unsigned int i, j, count;
u32 *tlb;
int ret;
@@ -1486,7 +1485,7 @@ static int soctherm_thermtrips_parse(struct tegra_soctherm *ts)
count = min_t(unsigned int, ret, ts->soc->num_ttgs * 2);
- tlb = devm_kcalloc(ts->dev, max_num_prop, sizeof(u32), GFP_KERNEL);
+ tlb = devm_kcalloc(ts->dev, count, sizeof(u32), GFP_KERNEL);
if (!tlb)
return -ENOMEM;
@@ -1506,6 +1505,8 @@ static int soctherm_thermtrips_parse(struct tegra_soctherm *ts)
i++;
}
+ devm_kfree(ts->dev, tlb);
+
return 0;
}
--
2.42.0
