drm/rockchip: vop: fix out of memory when calc bandwidth

bug log:
[   21.432332] Internal error: Accessing user space memory outside uaccess.h routines: 96000005 [#1] PREEMPT SMP
[   21.433228] Modules linked in:
[   21.433530] CPU: 3 PID: 716 Comm: ndroid.settings Not tainted 4.4.83 rockchip-linux#121
[   21.434130] Hardware name: Rockchip RK3399 Excavator Board edp (Android) (DT)
[   21.434768] task: ffffffc0cd63e800 task.stack: ffffffc0cd630000
[   21.435304] PC is at kmem_cache_alloc_trace+0xa8/0x204
[   21.435776] LR is at binder_transaction+0x58c/0x1c44
......
[   21.572340] [<ffffff80081ad584>] kmem_cache_alloc_trace+0xa8/0x204
[   21.572890] [<ffffff800893964c>] binder_transaction+0x58c/0x1c44
[   21.573424] [<ffffff800893cd08>] binder_thread_write+0xa44/0x136c
[   21.573968] [<ffffff800893d710>] binder_ioctl_write_read+0xe0/0x314
[   21.574523] [<ffffff800893db14>] binder_ioctl+0x1d0/0x668
[   21.575010] [<ffffff80081c77b8>] do_vfs_ioctl+0x5e4/0x720
[   21.575494] [<ffffff80081c7954>] SyS_ioctl+0x60/0x88
[   21.575936] [<ffffff8008083170>] el0_svc_naked+0x24/0x28

or:

[  549.171031] Internal error: Accessing user space memory outside uaccess.h routines: 96000005 [#1] PREEMPT SMP
[  549.171920] Modules linked in:
[  549.172213] CPU: 2 PID: 2575 Comm: surfaceflinger Not tainted 4.4.83 rockchip-linux#121
[  549.172810] Hardware name: Rockchip RK3399 Excavator Board edp (Android) (DT)
[  549.173444] task: ffffffc0b851a700 task.stack: ffffffc0b2a40000
[  549.173973] PC is at kmem_cache_alloc_trace+0xa8/0x204
[  549.174437] LR is at drm_flip_work_allocate_task+0x2c/0x4c
[  549.174920] pc : [<ffffff80081ad584>] lr : [<ffffff800848ce04>] pstate: 60400145
......
[  549.285299] [<ffffff80081ad584>] kmem_cache_alloc_trace+0xa8/0x204
[  549.285845] [<ffffff800848ce04>] drm_flip_work_allocate_task+0x2c/0x4c
[  549.286422] [<ffffff800848d020>] drm_flip_work_queue+0x38/0xa4
[  549.286942] [<ffffff80084a7a30>] vop_crtc_atomic_flush+0x1f48/0x2274
[  549.287509] [<ffffff800846add4>] drm_atomic_helper_commit_planes+0x194/0x1bc
[  549.288136] [<ffffff80084a0584>] rockchip_atomic_commit_complete+0x58/0xa0
[  549.288750] [<ffffff80084a0750>] rockchip_drm_atomic_commit+0x184/0x1a4
[  549.289340] [<ffffff800848e678>] drm_atomic_commit+0x64/0x70
[  549.289848] [<ffffff800848f960>] drm_mode_atomic_ioctl+0x4fc/0x604
[  549.290393] [<ffffff8008473368>] drm_ioctl+0x278/0x3f8
[  549.290856] [<ffffff80081c77b8>] do_vfs_ioctl+0x5e4/0x720
[  549.291339] [<ffffff80081c7954>] SyS_ioctl+0x60/0x88
[  549.291778] [<ffffff8008083170>] el0_svc_naked+0x24/0x28

Change-Id: I101c7dfa881611f3ca9225542e767897efe8fc1d
Signed-off-by: Sandy Huang <[email protected]>

drivers/gpu/drm/rockchip/rockchip_drm_vop.c

@@ -2232,19 +2232,22 @@ static size_t vop_crtc_bandwidth(struct drm_crtc *crtc,
 	u16 htotal = adjusted_mode->crtc_htotal;
 	u16 vdisplay = adjusted_mode->crtc_vdisplay;
 	int clock = adjusted_mode->crtc_clock;
-	struct vop *vop = to_vop(crtc);
-	const struct vop_data *vop_data = vop->data;
 	struct vop_plane_state *vop_plane_state;
 	struct drm_plane_state *pstate;
 	struct vop_bandwidth *pbandwidth;
 	struct drm_plane *plane;
 	u64 bandwidth;
-	int i, cnt = 0;
+	int i, cnt = 0, plane_num = 0;
 
 	if (!htotal || !vdisplay)
 		return 0;
 
-	pbandwidth = kmalloc_array(vop_data->win_size, sizeof(*pbandwidth),
+	for_each_plane_in_state(state, plane, pstate, i) {
+		if (pstate->crtc != crtc || !pstate->fb)
+			continue;
+		plane_num++;
+	}
+	pbandwidth = kmalloc_array(plane_num, sizeof(*pbandwidth),
 				   GFP_KERNEL);
 	if (!pbandwidth)
 		return -ENOMEM;