Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 31a43fa7 authored by Kees Cook's avatar Kees Cook Committed by David S. Miller
Browse files

sparc64: viohs: Remove VLA usage 

In the quest to remove all stack VLA usage from the kernel[1], this
allocates a fixed size array for the maximum number of cookies and
adds a runtime sanity check.

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1


RqZWA@mail.gmail.com

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent df58f37b

arch/sparc/kernel/viohs.c

+9 −3
Original line number Diff line number Diff line
@@ -180,11 +180,17 @@ static int send_dreg(struct vio_driver_state *vio) 
		struct vio_dring_register pkt;

		char all[sizeof(struct vio_dring_register) +

			 (sizeof(struct ldc_trans_cookie) *

			  dr->ncookies)];

			  VIO_MAX_RING_COOKIES)];

	} u;

	size_t bytes = sizeof(struct vio_dring_register) +

		       (sizeof(struct ldc_trans_cookie) *

			dr->ncookies);

	int i;



	memset(&u, 0, sizeof(u));

	if (WARN_ON(bytes > sizeof(u)))

		return -EINVAL;



	memset(&u, 0, bytes);

	init_tag(&u.pkt.tag, VIO_TYPE_CTRL, VIO_SUBTYPE_INFO, VIO_DRING_REG);

	u.pkt.dring_ident = 0;

	u.pkt.num_descr = dr->num_entries;
@@ -206,7 +212,7 @@ static int send_dreg(struct vio_driver_state *vio) 
		       (unsigned long long) u.pkt.cookies[i].cookie_size);

	}



	return send_ctrl(vio, &u.pkt.tag, sizeof(u));

	return send_ctrl(vio, &u.pkt.tag, bytes);

}



static int send_rdx(struct vio_driver_state *vio)