diff options
| author | Kees Cook <keescook@chromium.org> | 2018-09-05 15:03:51 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-10-07 22:42:00 -0700 |
| commit | 31a43fa7945a1de8c550b35c211be5670e32f12b (patch) | |
| tree | 4e2bc3c2bea2aa6b4e644013718cefc9e99f7e37 /arch/sparc/kernel | |
| parent | df58f37b5d8f883fb18ba85e8d9a624154879832 (diff) | |
| download | linux-0-day-31a43fa7945a1de8c550b35c211be5670e32f12b.tar.gz linux-0-day-31a43fa7945a1de8c550b35c211be5670e32f12b.tar.xz | |
sparc64: viohs: Remove VLA usage
In the quest to remove all stack VLA usage from the kernel[1], this
allocates a fixed size array for the maximum number of cookies and
adds a runtime sanity check.
[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1
RqZWA@mail.gmail.com
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'arch/sparc/kernel')
| -rw-r--r-- | arch/sparc/kernel/viohs.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/arch/sparc/kernel/viohs.c b/arch/sparc/kernel/viohs.c index 635d67ffc9a39..7db5aabe97085 100644 --- a/arch/sparc/kernel/viohs.c +++ b/arch/sparc/kernel/viohs.c @@ -180,11 +180,17 @@ static int send_dreg(struct vio_driver_state *vio) struct vio_dring_register pkt; char all[sizeof(struct vio_dring_register) + (sizeof(struct ldc_trans_cookie) * - dr->ncookies)]; + VIO_MAX_RING_COOKIES)]; } u; + size_t bytes = sizeof(struct vio_dring_register) + + (sizeof(struct ldc_trans_cookie) * + dr->ncookies); int i; - memset(&u, 0, sizeof(u)); + if (WARN_ON(bytes > sizeof(u))) + return -EINVAL; + + memset(&u, 0, bytes); init_tag(&u.pkt.tag, VIO_TYPE_CTRL, VIO_SUBTYPE_INFO, VIO_DRING_REG); u.pkt.dring_ident = 0; u.pkt.num_descr = dr->num_entries; @@ -206,7 +212,7 @@ static int send_dreg(struct vio_driver_state *vio) (unsigned long long) u.pkt.cookies[i].cookie_size); } - return send_ctrl(vio, &u.pkt.tag, sizeof(u)); + return send_ctrl(vio, &u.pkt.tag, bytes); } static int send_rdx(struct vio_driver_state *vio) |