Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a1547e0b authored by Kees Cook's avatar Kees Cook Committed by Florian Fainelli
Browse files

firmware: raspberrypi: Remove VLA usage 

In the quest to remove all stack VLA usage from the kernel[1], this
removes the VLA in favor of a maximum size and adds a sanity check.
Existing callers of the firmware interface never need more than 24
bytes (struct gpio_set_config). This chooses 32 just to stay ahead
of future growth.

v2: Fix the length passed to rpi_firmware_property_list (by anholt,
    acked by Kees).

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com



Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarEric Anholt <eric@anholt.net>
Reviewed-by: default avatarEric Anholt <eric@anholt.net>
parent 70eea1bb

drivers/firmware/raspberrypi.c

+8 −2
Original line number Diff line number Diff line
@@ -21,6 +21,8 @@ 
#define MBOX_DATA28(msg)		((msg) & ~0xf)

#define MBOX_CHAN_PROPERTY		8



#define MAX_RPI_FW_PROP_BUF_SIZE	32



static struct platform_device *rpi_hwmon;



struct rpi_firmware {
@@ -145,18 +147,22 @@ int rpi_firmware_property(struct rpi_firmware *fw, 
	/* Single tags are very small (generally 8 bytes), so the

	 * stack should be safe.

	 */

	u8 data[buf_size + sizeof(struct rpi_firmware_property_tag_header)];

	u8 data[sizeof(struct rpi_firmware_property_tag_header) +

		MAX_RPI_FW_PROP_BUF_SIZE];

	struct rpi_firmware_property_tag_header *header =

		(struct rpi_firmware_property_tag_header *)data;

	int ret;



	if (WARN_ON(buf_size > sizeof(data) - sizeof(*header)))

		return -EINVAL;



	header->tag = tag;

	header->buf_size = buf_size;

	header->req_resp_size = 0;

	memcpy(data + sizeof(struct rpi_firmware_property_tag_header),

	       tag_data, buf_size);



	ret = rpi_firmware_property_list(fw, &data, sizeof(data));

	ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));

	memcpy(tag_data,

	       data + sizeof(struct rpi_firmware_property_tag_header),

	       buf_size);