From caed56e1326aeb80878254cdb8ce7480689cca66 Mon Sep 17 00:00:00 2001 From: Xubin Bai Date: Wed, 17 Aug 2022 04:24:00 -0700 Subject: [PATCH] cpufreq: qcom-hw-debug: Fix buffer overflow Currently the hw_regs->base array size is hardcoded to 3, but some chips have more frequency domains than this, which will result in buffer overflows The array size should be dynamically allocated according to hw_regs->domain_cnt, not hardcoded directly. Change-Id: Ida14766fe77195aef41c6e754f2875b5a24fe742 Signed-off-by: Xubin Bai --- drivers/cpufreq/qcom-cpufreq-hw-debug.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/cpufreq/qcom-cpufreq-hw-debug.c b/drivers/cpufreq/qcom-cpufreq-hw-debug.c index 292b0ac7c17e..1ca3f2572aea 100644 --- a/drivers/cpufreq/qcom-cpufreq-hw-debug.c +++ b/drivers/cpufreq/qcom-cpufreq-hw-debug.c @@ -23,7 +23,7 @@ enum debug_hw_regs_data { }; struct cpufreq_hwregs { - void __iomem *base[REG_ARRAY_SIZE]; + void * __iomem *base; int domain_cnt; struct dentry *debugfs_base; }; @@ -134,6 +134,11 @@ static int cpufreq_get_hwregs(struct platform_device *pdev) hw_regs->domain_cnt = prop->length / (2 * sizeof(prop->length)); + hw_regs->base = devm_kzalloc(&pdev->dev, + hw_regs->domain_cnt * sizeof(base), GFP_KERNEL); + if (!hw_regs->base) + return -ENOMEM; + for (i = 0; i < hw_regs->domain_cnt; i++) { ret = of_parse_phandle_with_fixed_args(pdev->dev.of_node, "qcom,freq-hw-domain", 1, i, &args);