interconnect: qcom: Fix icc_onecell_data allocation

Commit Message

Leonard Crestez Sept. 24, 2019, 6:01 p.m. UTC

This is a struct with a trailing zero-length array of icc_node pointers
but it's allocated as if it were a single array of icc_nodes instead.

This allocates too much memory at probe time but shouldn't have any
noticeable effect. Both sdm845 and qcs404 are affected.

Fix by replacing kcalloc with kzalloc and using the "struct_size" macro.

Signed-off-by: Leonard Crestez <[e-mail]>

---

Didn't test beyond compiling, this was found this by reading the code.
---
 drivers/interconnect/qcom/qcs404.c | 3 ++-
 drivers/interconnect/qcom/sdm845.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

Patch

diff --git a/drivers/interconnect/qcom/qcs404.c b/drivers/interconnect/qcom/qcs404.c
index 910081d6ddc0..b4966d8f3348 100644
--- a/drivers/interconnect/qcom/qcs404.c
+++ b/drivers/interconnect/qcom/qcs404.c
@@ -431,11 +431,12 @@  static int qnoc_probe(struct platform_device *pdev)
 
 	qp = devm_kzalloc(dev, sizeof(*qp), GFP_KERNEL);
 	if (!qp)
 		return -ENOMEM;
 
-	data = devm_kcalloc(dev, num_nodes, sizeof(*node), GFP_KERNEL);
+	data = devm_kzalloc(dev, struct_size(data, nodes, num_nodes),
+			    GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
 
 	qp->bus_clks = devm_kmemdup(dev, bus_clocks, sizeof(bus_clocks),
 				    GFP_KERNEL);
diff --git a/drivers/interconnect/qcom/sdm845.c b/drivers/interconnect/qcom/sdm845.c
index 57955596bb59..502a6c22b41e 100644
--- a/drivers/interconnect/qcom/sdm845.c
+++ b/drivers/interconnect/qcom/sdm845.c
@@ -788,11 +788,12 @@  static int qnoc_probe(struct platform_device *pdev)
 
 	qp = devm_kzalloc(&pdev->dev, sizeof(*qp), GFP_KERNEL);
 	if (!qp)
 		return -ENOMEM;
 
-	data = devm_kcalloc(&pdev->dev, num_nodes, sizeof(*node), GFP_KERNEL);
+	data = devm_kzalloc(&pdev->dev, struct_size(data, nodes, num_nodes),
+			    GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
 
 	provider = &qp->provider;
 	provider->dev = &pdev->dev;