CHROMIUM: MALI: Don't silently trash memory if there are > 2 regulators
When support as added to the mali code to support more than one
regulator the code was dynamic in checking to see how many supplies
were present but still stored supplies in a fixed sized array in
several places. Let's make it explicit that the hardcoded number used
to size the arrays is a maximum and also do bounds checking at init
time so we know we won't clobber memory.
See CL:1317240 for where the code was originally added.
BUG=chromium:941638
TEST=Boot up and use GPU on veyron
Change-Id: I581ed6cbc86c563f09d394bb1a8ecba00c0ddfb4
Fixes: d12dc1a83564 ("CHROMIUM: MALI: Add Mali platform specific source")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1539804
Reviewed-by: Dominik Behr <dbehr@chromium.org>
Reviewed-by: Pi-Hsun Shih <pihsun@chromium.org>
Reviewed-by: Nicolas Boichat <drinkcat@chromium.org>
diff --git a/drivers/gpu/arm/midgard/backend/gpu/mali_kbase_devfreq.c b/drivers/gpu/arm/midgard/backend/gpu/mali_kbase_devfreq.c
index 98f7d73..7fc4c5f 100644
--- a/drivers/gpu/arm/midgard/backend/gpu/mali_kbase_devfreq.c
+++ b/drivers/gpu/arm/midgard/backend/gpu/mali_kbase_devfreq.c
@@ -126,7 +126,7 @@
struct dev_pm_opp *opp;
unsigned long nominal_freq;
unsigned long freq = 0;
- unsigned long target_volt[REGULATOR_NUM];
+ unsigned long target_volt[KBASE_MAX_REGULATORS];
int err, i;
u64 core_mask;
diff --git a/drivers/gpu/arm/midgard/mali_kbase_core_linux.c b/drivers/gpu/arm/midgard/mali_kbase_core_linux.c
index b581c74..524b94d 100644
--- a/drivers/gpu/arm/midgard/mali_kbase_core_linux.c
+++ b/drivers/gpu/arm/midgard/mali_kbase_core_linux.c
@@ -3151,6 +3151,12 @@
kbdev->regulator_num = of_property_count_strings(kbdev->dev->of_node,
"supply-names");
+ if (kbdev->regulator_num > KBASE_MAX_REGULATORS) {
+ dev_err(&pdev->dev, "Too many regulators: %d > %d\n",
+ kbdev->regulator_num, KBASE_MAX_REGULATORS);
+ return -EINVAL;
+ }
+
reg_names = kcalloc(kbdev->regulator_num, sizeof(char *), GFP_KERNEL);
if (of_property_read_string_array(kbdev->dev->of_node, "supply-names",
diff --git a/drivers/gpu/arm/midgard/mali_kbase_defs.h b/drivers/gpu/arm/midgard/mali_kbase_defs.h
index 1454755..bcb4132 100644
--- a/drivers/gpu/arm/midgard/mali_kbase_defs.h
+++ b/drivers/gpu/arm/midgard/mali_kbase_defs.h
@@ -1166,7 +1166,7 @@
#define DEVNAME_SIZE 16
#if defined(CONFIG_REGULATOR)
-#define REGULATOR_NUM 2
+#define KBASE_MAX_REGULATORS 2
#endif
@@ -1433,7 +1433,7 @@
struct clk *clock;
#ifdef CONFIG_REGULATOR
int regulator_num;
- struct regulator *regulator[REGULATOR_NUM];
+ struct regulator *regulator[KBASE_MAX_REGULATORS];
struct opp_table *dev_opp_table;
#endif
char devname[DEVNAME_SIZE];
@@ -1520,7 +1520,7 @@
struct devfreq *devfreq;
unsigned long current_freq;
unsigned long current_nominal_freq;
- unsigned long current_voltage[REGULATOR_NUM];
+ unsigned long current_voltage[KBASE_MAX_REGULATORS];
u64 current_core_mask;
struct kbase_devfreq_opp *opp_table;
int num_opps;
diff --git a/drivers/gpu/arm/midgard/platform/mediatek/mali_kbase_runtime_pm.c b/drivers/gpu/arm/midgard/platform/mediatek/mali_kbase_runtime_pm.c
index 0271ffc..9922246 100644
--- a/drivers/gpu/arm/midgard/platform/mediatek/mali_kbase_runtime_pm.c
+++ b/drivers/gpu/arm/midgard/platform/mediatek/mali_kbase_runtime_pm.c
@@ -366,7 +366,7 @@
static int set_voltages(struct kbase_device *kbdev, unsigned long *voltages,
bool inc)
{
- unsigned long step_volt[REGULATOR_NUM];
+ unsigned long step_volt[KBASE_MAX_REGULATORS];
int first, step;
int i;
int err;
