From patchwork Wed Apr 25 09:11:47 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Brivio X-Patchwork-Id: 10361967 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9305E601BE for ; Wed, 25 Apr 2018 09:12:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8562826E55 for ; Wed, 25 Apr 2018 09:12:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7A01928E15; Wed, 25 Apr 2018 09:12:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id AD0F426E55 for ; Wed, 25 Apr 2018 09:12:10 +0000 (UTC) Received: (qmail 23731 invoked by uid 550); 25 Apr 2018 09:12:07 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 23704 invoked from network); 25 Apr 2018 09:12:06 -0000 Date: Wed, 25 Apr 2018 11:11:47 +0200 From: Stefano Brivio To: Kees Cook Cc: Andreas Christoforou , kernel-hardening@lists.openwall.com, Steffen Klassert , Herbert Xu , "David S. Miller" , Alexey Kuznetsov , Hideaki YOSHIFUJI , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v3 ipsec-next] xfrm: remove VLA usage in __xfrm6_sort() Message-ID: <20180425111147.1ad6d2e1@epycfail> In-Reply-To: <20180424234651.GA30225@beast> References: <20180424234651.GA30225@beast> Organization: Red Hat MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.2]); Wed, 25 Apr 2018 09:11:55 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.2]); Wed, 25 Apr 2018 09:11:55 +0000 (UTC) for IP:'10.11.54.3' DOMAIN:'int-mx03.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'sbrivio@redhat.com' RCPT:'' X-Virus-Scanned: ClamAV using ClamSMTP Hi Kees, On Tue, 24 Apr 2018 16:46:51 -0700 Kees Cook wrote: > In the quest to remove all stack VLA usage removed from the kernel[1], > just use XFRM_MAX_DEPTH as already done for the "class" array. In one > case, it'll do this loop up to 5, the other caller up to 6. > > [1] https://lkml.org/lkml/2018/3/7/621 > > Co-developed-by: Andreas Christoforou > Signed-off-by: Kees Cook > --- > v3: > - adjust Subject and commit log (Steffen) > - use "= { }" instead of memset() (Stefano) > - reorder variables (Stefano) > v2: > - use XFRM_MAX_DEPTH for "count" array (Steffen and Mathias). > --- > net/ipv6/xfrm6_state.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c > index 16f434791763..eeb44b64ae7f 100644 > --- a/net/ipv6/xfrm6_state.c > +++ b/net/ipv6/xfrm6_state.c > @@ -60,9 +60,9 @@ xfrm6_init_temprop(struct xfrm_state *x, const struct xfrm_tmpl *tmpl, > static int > __xfrm6_sort(void **dst, void **src, int n, int (*cmp)(void *p), int maxclass) > { > - int i; > + int count[XFRM_MAX_DEPTH] = { }; > int class[XFRM_MAX_DEPTH]; > - int count[maxclass]; > + int i; > > memset(count, 0, sizeof(count)); I guess you forgot to remove the memset() here. Just to be clear, I think this is how it should look like: --- a/net/ipv6/xfrm6_state.c +++ b/net/ipv6/xfrm6_state.c @@ -60,11 +60,9 @@ xfrm6_init_temprop(struct xfrm_state *x, const struct xfrm_tmpl *tmpl, static int __xfrm6_sort(void **dst, void **src, int n, int (*cmp)(void *p), int maxclass) { - int i; + int count[XFRM_MAX_DEPTH] = { }; int class[XFRM_MAX_DEPTH]; - int count[maxclass]; - - memset(count, 0, sizeof(count)); + int i; for (i = 0; i < n; i++) { int c;