thermal: mtk: Allocate enough space for mtk_thermal.

peter50216 · zhang-rui · commit fb4d83f293e0 · 2019-03-18T22:23:10.000+08:00
The mtk_thermal struct contains a 'struct mtk_thermal_bank banks[];',
but the allocation only allocates sizeof(struct mtk_thermal) bytes,
which cause out of bound access with the -&gt;banks[] member. Change it to
a fixed size array instead.

Signed-off-by: Pi-Hsun Shih &lt;pihsun@chromium.org&gt;
Reviewed-by: Daniel Lezcano &lt;daniel.lezcano@linaro.org&gt;
Signed-off-by: Zhang Rui &lt;rui.zhang@intel.com&gt;
diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
@@ -199,6 +199,9 @@ enum {
 #define MT7622_TS1	0
 #define MT7622_NUM_CONTROLLER		1
 
+/* The maximum number of banks */
+#define MAX_NUM_ZONES		8
+
 /* The calibration coefficient of sensor  */
 #define MT7622_CALIBRATION	165
 
@@ -249,7 +252,7 @@ struct mtk_thermal_data {
 	const int num_controller;
 	const int *controller_offset;
 	bool need_switch_bank;
-	struct thermal_bank_cfg bank_data[];
+	struct thermal_bank_cfg bank_data[MAX_NUM_ZONES];
 };
 
 struct mtk_thermal {
@@ -268,7 +271,7 @@ struct mtk_thermal {
 	s32 vts[MAX_NUM_VTS];
 
 	const struct mtk_thermal_data *conf;
-	struct mtk_thermal_bank banks[];
+	struct mtk_thermal_bank banks[MAX_NUM_ZONES];
 };
 
 /* MT8183 thermal sensor data */
