From patchwork Mon Jun 25 22:23:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10487375 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 868AE603B5 for ; Mon, 25 Jun 2018 22:23:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 772D728437 for ; Mon, 25 Jun 2018 22:23:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6A95A2846C; Mon, 25 Jun 2018 22:23:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1042928437 for ; Mon, 25 Jun 2018 22:23:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754595AbeFYWXU (ORCPT ); Mon, 25 Jun 2018 18:23:20 -0400 Received: from mail-pl0-f67.google.com ([209.85.160.67]:41287 "EHLO mail-pl0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754546AbeFYWXT (ORCPT ); Mon, 25 Jun 2018 18:23:19 -0400 Received: by mail-pl0-f67.google.com with SMTP id w8-v6so7490967ply.8 for ; Mon, 25 Jun 2018 15:23:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition; bh=byxY/0OaFbO8Mke8fed7BcJcGU7bAvx1Q3jx0IjcKsw=; b=c+M4zR9jwu2S8iSYpKukVTTiHPtq1hqrIWWaIUR9RFQGAQyJCh30hhk5N7lDvkg2WP AKNnjJS/jAnKCdoU0YlIo8GOXJ6td+GBrQibYYYgUizVnvKiAgl0iGE6Kj5xS3ElOZHq k/vok9OU7G4fygPG2XYCx5+AsD9r7lQqyFDmQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=byxY/0OaFbO8Mke8fed7BcJcGU7bAvx1Q3jx0IjcKsw=; b=driA0+hPE5E1bMz/wPvnkjueR9t2oNGszmZYUSYiIfWT7FRHsqf80FpyZP0Xtq+bLM xk6xTpEYWjforYeue+K0GqFR46gUHEuNTEA2zcXZM/6mxtCtbXGOxTizAxYnWJPfTeTN PuK4tb5Obwh2OOTjpRftlSCA9wmjHy8fp1DvExpZUptncTiHN/LYQNMuwAq7ZC5P1GJn 5urayvf5O1uuu8oJOHVwN82BUV/Q0xn2eN4fR6GyLDwTXU83SUxEou7q4UsFAjjVexDn 0D6cUq2As3h7ao/kx9LvmuSUbttpSxNcFM7hJicmI3nqGAj+vPR+zh9xnjM2fcLSp0R7 vthA== X-Gm-Message-State: APt69E3odtPuyR4yzn0AnJPCz1EDlY/xl/I33kHNMEUUdaynW6dWzawu WvBwbh4PdW29shTzwv2KpGL2aw== X-Google-Smtp-Source: ADUXVKK2ReaDFf3aaEsAM/wpoIsVoJzsoozpS3Xf41mQAWRLx/zIgcqyGEfpehM5kNetJ+G9llG88w== X-Received: by 2002:a17:902:8207:: with SMTP id x7-v6mr76167pln.57.1529965398678; Mon, 25 Jun 2018 15:23:18 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id c67-v6sm28805pfj.173.2018.06.25.15.23.17 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 25 Jun 2018 15:23:17 -0700 (PDT) Date: Mon, 25 Jun 2018 15:23:16 -0700 From: Kees Cook To: Greg Kroah-Hartman Cc: Heikki Krogerus , linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org Subject: [PATCH v2] usb: typec: tps6598x: Remove VLA usage Message-ID: <20180625222316.GA5773@beast> MIME-Version: 1.0 Content-Disposition: inline Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In the quest to remove all stack VLA usage from the kernel[1], this uses the maximum buffer size and adds a sanity check. While 25 bytes is the size of the largest current things coming through, Heikki Krogerus pointed out that the actual max in 64 bytes, as per ch 1.3.2 http://www.ti.com/lit/ug/slvuan1a/slvuan1a.pdf [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com Signed-off-by: Kees Cook Acked-by: Heikki Krogerus --- v2: use 64 bytes (Heikki) --- drivers/usb/typec/tps6598x.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c index 4b4c8d271b27..c84c8c189e90 100644 --- a/drivers/usb/typec/tps6598x.c +++ b/drivers/usb/typec/tps6598x.c @@ -81,12 +81,21 @@ struct tps6598x { struct typec_capability typec_cap; }; +/* + * Max data bytes for Data1, Data2, and other registers. See ch 1.3.2: + * http://www.ti.com/lit/ug/slvuan1a/slvuan1a.pdf + */ +#define TPS_MAX_LEN 64 + static int tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len) { - u8 data[len + 1]; + u8 data[TPS_MAX_LEN + 1]; int ret; + if (WARN_ON(len + 1 > sizeof(data))) + return -EINVAL; + if (!tps->i2c_protocol) return regmap_raw_read(tps->regmap, reg, val, len);