From patchwork Wed May 2 23:58:09 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10376813 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3C82F60159 for ; Wed, 2 May 2018 23:58:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 27D3D28CAC for ; Wed, 2 May 2018 23:58:15 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 18F2B29124; Wed, 2 May 2018 23:58:15 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 78A0A28CAC for ; Wed, 2 May 2018 23:58:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751727AbeEBX6O (ORCPT ); Wed, 2 May 2018 19:58:14 -0400 Received: from mail-pf0-f196.google.com ([209.85.192.196]:34798 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751447AbeEBX6N (ORCPT ); Wed, 2 May 2018 19:58:13 -0400 Received: by mail-pf0-f196.google.com with SMTP id a14so13154279pfi.1 for ; Wed, 02 May 2018 16:58:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition; bh=KvC0QGfrDqZNFAvFJjIfUGY5gMM9T8/4OATQtnVHJ/U=; b=IoR5D0is+2eNJIOVz3vhBMsCO0DJq/iq5kXT+Skg8gONgtfufa7SmqDMqELl0AcgjP nw095diUNK/NgmEIRSS+zhWgRTGiBKbWxqBpcdDPE8zjFP31XrmB1D5qUq6XyYRCmAdb 1y1A67a5rFtOIPOeEejZfN7LZbS4jdOqK9Lhk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=KvC0QGfrDqZNFAvFJjIfUGY5gMM9T8/4OATQtnVHJ/U=; b=njB34HKdqEvq1Df4zuIdH1NN6FkNMZnJUyBh66cqsRFvgG0sPDj2pqrgwz/UTZwTK8 kws6XWeXWKzBWE2CL1VP5SIiQEZFqa0WCteKtym/ywgmf5hCoHaCyN7fqfE4O9nXG9yM O1V7e21litdrdqVTSjkB18qgdQ5Xxi0b6XUrwBqBXCfE1hhkDBY9UDHT/Y8spe61OPx2 H3PRhOs9wVmypuaQntzpwPsqt43DsRljkE3xSzrRTdFiAuD30Zp7q2o5u0uH9aCHOFvt fjHYf6DtQJgreUeZ54Bpj9Ij01bBM6XpNHgkC1qaHaFAGmDnq8XVgiWMz/w7KL15OLQv pWNw== X-Gm-Message-State: ALQs6tBEa999AN/k8gTaLlmBnSQe3UG5iBh3FvWA649D6/Bowoz4r1e0 QDx4IQG9E/2As2UlZ/h0EaZbvQ== X-Google-Smtp-Source: AB8JxZqg9qrJrLav/lFl1q3bZ80ElkiM3paH2+gmegP5VGjwsdMSiTfFyuVyP9MrYs0aE95F+OeI/Q== X-Received: by 2002:a17:902:264:: with SMTP id 91-v6mr21722913plc.341.1525305492650; Wed, 02 May 2018 16:58:12 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id c20sm6027940pfk.63.2018.05.02.16.58.10 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 02 May 2018 16:58:10 -0700 (PDT) Date: Wed, 2 May 2018 16:58:09 -0700 From: Kees Cook To: "Martin K. Petersen" Cc: Vinayak Holikatti , "James E.J. Bottomley" , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] scsi: ufs: ufshcd: Remove VLA usage Message-ID: <20180502235809.GA13998@beast> MIME-Version: 1.0 Content-Disposition: inline Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On the quest to remove all VLAs from the kernel[1] this moves buffers off the stack. In the second instance, this collapses two separately allocated buffers into a single buffer, since they are used consecutively, which saves 256 bytes (QUERY_DESC_MAX_SIZE + 1) of stack space. [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com Signed-off-by: Kees Cook Reviewed-by: Subhash Jadavani --- drivers/scsi/ufs/ufshcd.c | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index 00e79057f870..a271534362f6 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -5958,14 +5958,18 @@ static void ufshcd_init_icc_levels(struct ufs_hba *hba) { int ret; int buff_len = hba->desc_size.pwr_desc; - u8 desc_buf[hba->desc_size.pwr_desc]; + u8 *desc_buf; + + desc_buf = kmalloc(buff_len, GFP_KERNEL); + if (!desc_buf) + return; ret = ufshcd_read_power_desc(hba, desc_buf, buff_len); if (ret) { dev_err(hba->dev, "%s: Failed reading power descriptor.len = %d ret = %d", __func__, buff_len, ret); - return; + goto out; } hba->init_prefetch_data.icc_level = @@ -5983,6 +5987,8 @@ static void ufshcd_init_icc_levels(struct ufs_hba *hba) "%s: Failed configuring bActiveICCLevel = %d ret = %d", __func__, hba->init_prefetch_data.icc_level , ret); +out: + kfree(desc_buf); } /** @@ -6052,9 +6058,17 @@ static int ufs_get_device_desc(struct ufs_hba *hba, struct ufs_dev_desc *dev_desc) { int err; + size_t buff_len; u8 model_index; - u8 str_desc_buf[QUERY_DESC_MAX_SIZE + 1] = {0}; - u8 desc_buf[hba->desc_size.dev_desc]; + u8 *desc_buf; + + buff_len = max_t(size_t, hba->desc_size.dev_desc, + QUERY_DESC_MAX_SIZE + 1); + desc_buf = kmalloc(buff_len, GFP_KERNEL); + if (!desc_buf) { + err = -ENOMEM; + goto out; + } err = ufshcd_read_device_desc(hba, desc_buf, hba->desc_size.dev_desc); if (err) { @@ -6072,7 +6086,10 @@ static int ufs_get_device_desc(struct ufs_hba *hba, model_index = desc_buf[DEVICE_DESC_PARAM_PRDCT_NAME]; - err = ufshcd_read_string_desc(hba, model_index, str_desc_buf, + /* Zero-pad entire buffer for string termination. */ + memset(desc_buf, 0, buff_len); + + err = ufshcd_read_string_desc(hba, model_index, desc_buf, QUERY_DESC_MAX_SIZE, true/*ASCII*/); if (err) { dev_err(hba->dev, "%s: Failed reading Product Name. err = %d\n", @@ -6080,15 +6097,16 @@ static int ufs_get_device_desc(struct ufs_hba *hba, goto out; } - str_desc_buf[QUERY_DESC_MAX_SIZE] = '\0'; - strlcpy(dev_desc->model, (str_desc_buf + QUERY_DESC_HDR_SIZE), - min_t(u8, str_desc_buf[QUERY_DESC_LENGTH_OFFSET], + desc_buf[QUERY_DESC_MAX_SIZE] = '\0'; + strlcpy(dev_desc->model, (desc_buf + QUERY_DESC_HDR_SIZE), + min_t(u8, desc_buf[QUERY_DESC_LENGTH_OFFSET], MAX_MODEL_LEN)); /* Null terminate the model string */ dev_desc->model[MAX_MODEL_LEN] = '\0'; out: + kfree(desc_buf); return err; }