Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 26d79b82 authored by Kees Cook's avatar Kees Cook Committed by Greg Kroah-Hartman
Browse files

nvmem: rave-sp-eeprom: Remove VLA usage 

In the quest to remove all stack VLA usage from the kernel[1], this
uses the maximum allocation size for the stack and adds a sanity check,
similar to what has already be done for the regular rave-sp driver.

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com



Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarAndrey Smirnov <andrew.smirnov@gmail.com>
Tested-by: default avatarAndrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 55d7d44e

drivers/nvmem/rave-sp-eeprom.c

+5 −1
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ enum rave_sp_eeprom_header_size { 
	RAVE_SP_EEPROM_HEADER_SMALL = 4U,

	RAVE_SP_EEPROM_HEADER_BIG   = 5U,

};

#define RAVE_SP_EEPROM_HEADER_MAX	RAVE_SP_EEPROM_HEADER_BIG



#define	RAVE_SP_EEPROM_PAGE_SIZE	32U
@@ -97,9 +98,12 @@ static int rave_sp_eeprom_io(struct rave_sp_eeprom *eeprom, 
	const unsigned int rsp_size =

		is_write ? sizeof(*page) - sizeof(page->data) : sizeof(*page);

	unsigned int offset = 0;

	u8 cmd[cmd_size];

	u8 cmd[RAVE_SP_EEPROM_HEADER_MAX + sizeof(page->data)];

	int ret;



	if (WARN_ON(cmd_size > sizeof(cmd)))

		return -EINVAL;



	cmd[offset++] = eeprom->address;

	cmd[offset++] = 0;

	cmd[offset++] = type;