Commit 8d361fa2 authored Jun 25, 2018 by Kees Cook Committed by Greg Kroah-Hartman Jun 28, 2018

usb: typec: tps6598x: Remove VLA usage

In the quest to remove all stack VLA usage from the kernel[1], this
uses the maximum buffer size and adds a sanity check. While 25 bytes
is the size of the largest current things coming through, Heikki
Krogerus pointed out that the actual max in 64 bytes, as per ch 1.3.2
http://www.ti.com/lit/ug/slvuan1a/slvuan1a.pdf

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com



Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 579b9cca

drivers/usb/typec/tps6598x.c

+10 −1

Original line number	Diff line number	Diff line
		@@ -81,12 +81,21 @@ struct tps6598x {
		struct typec_capability typec_cap;
		};

		/*
		* Max data bytes for Data1, Data2, and other registers. See ch 1.3.2:
		* http://www.ti.com/lit/ug/slvuan1a/slvuan1a.pdf
		*/
		#define TPS_MAX_LEN 64

		static int
		tps6598x_block_read(struct tps6598x tps, u8 reg, void val, size_t len)
		{
		u8 data[len + 1];
		u8 data[TPS_MAX_LEN + 1];
		int ret;

		if (WARN_ON(len + 1 > sizeof(data)))
		return -EINVAL;

		if (!tps->i2c_protocol)
		return regmap_raw_read(tps->regmap, reg, val, len);