瀏覽代碼

iommu/rockchip: Fix allocation of bases array in driver probe

In .probe(), devm_kzalloc() is called with size == 0 and works only
by luck, due to internal behavior of the allocator and the fact
that the proper allocation size is small. Let's use proper value for
calculating the size.

Fixes: cd6438c5f844 ("iommu/rockchip: Reconstruct to support multi slaves")

Signed-off-by: Shunqian Zheng <zhengsq@rock-chips.com>
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Shunqian Zheng 9 年之前
父節點
當前提交
3d08f434bd
共有 1 個文件被更改,包括 4 次插入2 次删除
  1. 4 2
      drivers/iommu/rockchip-iommu.c

+ 4 - 2
drivers/iommu/rockchip-iommu.c

@@ -1034,6 +1034,7 @@ static int rk_iommu_probe(struct platform_device *pdev)
 	struct device *dev = &pdev->dev;
 	struct device *dev = &pdev->dev;
 	struct rk_iommu *iommu;
 	struct rk_iommu *iommu;
 	struct resource *res;
 	struct resource *res;
+	int num_res = pdev->num_resources;
 	int i;
 	int i;
 
 
 	iommu = devm_kzalloc(dev, sizeof(*iommu), GFP_KERNEL);
 	iommu = devm_kzalloc(dev, sizeof(*iommu), GFP_KERNEL);
@@ -1043,12 +1044,13 @@ static int rk_iommu_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, iommu);
 	platform_set_drvdata(pdev, iommu);
 	iommu->dev = dev;
 	iommu->dev = dev;
 	iommu->num_mmu = 0;
 	iommu->num_mmu = 0;
-	iommu->bases = devm_kzalloc(dev, sizeof(*iommu->bases) * iommu->num_mmu,
+
+	iommu->bases = devm_kzalloc(dev, sizeof(*iommu->bases) * num_res,
 				    GFP_KERNEL);
 				    GFP_KERNEL);
 	if (!iommu->bases)
 	if (!iommu->bases)
 		return -ENOMEM;
 		return -ENOMEM;
 
 
-	for (i = 0; i < pdev->num_resources; i++) {
+	for (i = 0; i < num_res; i++) {
 		res = platform_get_resource(pdev, IORESOURCE_MEM, i);
 		res = platform_get_resource(pdev, IORESOURCE_MEM, i);
 		if (!res)
 		if (!res)
 			continue;
 			continue;