From patchwork Tue Apr 10 07:57:46 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 10332483 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2036C601A0 for ; Tue, 10 Apr 2018 07:58:03 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 18A2328C5B for ; Tue, 10 Apr 2018 07:58:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0D59628C63; Tue, 10 Apr 2018 07:58:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 3F6B728C5B for ; Tue, 10 Apr 2018 07:58:01 +0000 (UTC) Received: (qmail 8165 invoked by uid 550); 10 Apr 2018 07:58:00 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 8146 invoked from network); 10 Apr 2018 07:57:59 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=T1OL7LXZRIPwKb37obrWR4yvuSZLsPiM8G7GBsLiJtw=; b=r/IrHuU6yTNNp18/PAnyVBkVWITCflbBTE+UxmYl4Nly03k28OL5yQChX1cccGODb0 oIrcnpWRPO/rhSD40FShEkP1cD0Q+xvfCgmsFrm/02y2fASxogh1+CugoplTVKWgFmml +a9EFP+o3EPiYeYcvlbQyxy6ztTO85QDmRhEfTNDCNHkRuROxKoLfbGal9HskxNlxJXX 9GaL0u5FwGhINhjj5rkC8rNojIdga4Wrfxp4l44qOBwj+39w0XtJUDdrqrGBkysusCeF V4ZA2+4H/1fjmauDoP2oygOUSEIpSgPPnX9a6g1biEQUfo3GtPyjlVJ8XYQxHIMOoDUI E7WA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=T1OL7LXZRIPwKb37obrWR4yvuSZLsPiM8G7GBsLiJtw=; b=Qj4lKCET1Mm7a4aIQsuVUSnfaa8y7agh3PHyeZ6/IOkYR+ASiIBviMLrIU+Kwz0AXu 8O6SxmHe56APlVsJLAJqmG2F3CVx3I09tg6aHpFAKXg7+0nc24YxjSW26ejm2ONk4I6v 0i92ytGJTeToSowU4XHrSRt9R2UVJJ4yH231P09O+AZ9ti5aR8/uBYDZ/DPQdfebR/qB cHwzxnGTGGxRjiGBohZD6Uzo8GI7qKblcv9SzZAm8lHwoSwa1NLoTxKSkrnM8ss/7SA4 8vXQAPp9xMtytOOtL9dINny895PYt6uUJEqsG3WAbryplO0si3nyYX8VYWYiyFpqvzSK 9WTA== X-Gm-Message-State: ALQs6tBCGZmTqiQDVI4KwAxLAkBXy/Q07Vw285dk3SGP1XdvxFmhozbu w4b9GQcmZoDeW6vynK+DeRvfMHk1RuuRSH7S7Ak= X-Google-Smtp-Source: AIpwx4+BreXcDJGrmwUf5tdRYl+fmqsgkTpdcbGgyG0EBD44t7+WFmeRyLh/Vb5fDUIzSDuhS1VNRGTbENtWlDhsbCk= X-Received: by 10.55.56.211 with SMTP id f202mr51184741qka.288.1523347067568; Tue, 10 Apr 2018 00:57:47 -0700 (PDT) MIME-Version: 1.0 Sender: arndbergmann@gmail.com In-Reply-To: <20180409210732.3919-1-labbott@redhat.com> References: <20180409210732.3919-1-labbott@redhat.com> From: Arnd Bergmann Date: Tue, 10 Apr 2018 09:57:46 +0200 X-Google-Sender-Auth: -3gO0PhR0vUxZ7mASjyFwWOUdPU Message-ID: Subject: Re: [PATCH] misc: tifm: Remove VLA To: Laura Abbott Cc: Alex Dubov , Greg Kroah-Hartman , Linux Kernel Mailing List , Kernel Hardening X-Virus-Scanned: ClamAV using ClamSMTP On Mon, Apr 9, 2018 at 11:07 PM, Laura Abbott wrote: > There's an ongoing effort to remove VLAs[1] from the kernel to eventually > turn on -Wvla. The single VLA can either take a value of 2 or 4 so switch > to the upper bound. > > [1] https://lkml.org/lkml/2018/3/7/621 > > Signed-off-by: Laura Abbott > --- > drivers/misc/tifm_7xx1.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/misc/tifm_7xx1.c b/drivers/misc/tifm_7xx1.c > index e5f108713dd8..690eaaea5ce4 100644 > --- a/drivers/misc/tifm_7xx1.c > +++ b/drivers/misc/tifm_7xx1.c > @@ -239,7 +239,8 @@ static int tifm_7xx1_resume(struct pci_dev *dev) > unsigned long timeout; > unsigned int good_sockets = 0, bad_sockets = 0; > unsigned long flags; > - unsigned char new_ids[fm->num_sockets]; > + /* Maximum number of entries is 4 */ > + unsigned char new_ids[4]; > DECLARE_COMPLETION_ONSTACK(finish_resume); > I like the idea of removing all the VLAs, but this one appears to make the code less robust rather than more: In case of an unexpected fm->num_sockets value, we now not only overflow the kernel stack area but also the local variable into the neighboring stack slots. Maybe add an extra overflow check? Arnd diff --git a/drivers/misc/tifm_7xx1.c b/drivers/misc/tifm_7xx1.c index e5f108713dd8..c702cd92d396 100644 --- a/drivers/misc/tifm_7xx1.c +++ b/drivers/misc/tifm_7xx1.c @@ -239,9 +239,12 @@ static int tifm_7xx1_resume(struct pci_dev *dev) unsigned long timeout; unsigned int good_sockets = 0, bad_sockets = 0; unsigned long flags; - unsigned char new_ids[fm->num_sockets]; + /* Maximum number of entries is 4 */ + unsigned char new_ids[4]; DECLARE_COMPLETION_ONSTACK(finish_resume); + if (WARN_ON(fm->num_sockets > ARRAY_SIZE(new_ids))) + return -ENXIO; + pci_set_power_state(dev, PCI_D0); pci_restore_state(dev); rc = pci_enable_device(dev);