From: Larry Finger <Larry.Finger@lwfinger.net>
To: "Tobin C. Harding" <me@tobin.cc>, Kalle Valo <kvalo@codeaurora.org>
Cc: kernel-hardening@lists.openwall.com,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
linux-wireless@vger.kernel.org, Tycho Andersen <tycho@tycho.ws>,
Kees Cook <keescook@chromium.org>
Subject: Re: [RESEND PATCH] rsi: Remove stack VLA usage
Date: Sun, 11 Mar 2018 21:06:10 -0500 [thread overview]
Message-ID: <ff9309bf-4c3d-b0f9-cdd0-429dacd3177b@lwfinger.net> (raw)
In-Reply-To: <1520819022-15238-1-git-send-email-me@tobin.cc>
On 03/11/2018 08:43 PM, Tobin C. Harding wrote:
> The kernel would like to have all stack VLA usage removed[1]. rsi uses
> a VLA based on 'blksize'. Elsewhere in the SDIO code maximum block size
> is defined using a magic number. We can use a pre-processor defined
> constant and declare the array to maximum size. We add a check before
> accessing the array in case of programmer error.
>
> [1]: https://lkml.org/lkml/2018/3/7/621
>
> Signed-off-by: Tobin C. Harding <me@tobin.cc>
> ---
>
> RESEND: add wireless mailing list to CC's (requested by Kalle)
>
> drivers/net/wireless/rsi/rsi_91x_hal.c | 13 +++++++------
> drivers/net/wireless/rsi/rsi_91x_sdio.c | 9 +++++++--
> 2 files changed, 14 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
> index 1176de646942..839ebdd602df 100644
> --- a/drivers/net/wireless/rsi/rsi_91x_hal.c
> +++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
> @@ -641,7 +641,7 @@ static int ping_pong_write(struct rsi_hw *adapter, u8 cmd, u8 *addr, u32 size)
> u32 cmd_addr;
> u16 cmd_resp, cmd_req;
> u8 *str;
> - int status;
> + int status, ret;
>
> if (cmd == PING_WRITE) {
> cmd_addr = PING_BUFFER_ADDRESS;
> @@ -655,12 +655,13 @@ static int ping_pong_write(struct rsi_hw *adapter, u8 cmd, u8 *addr, u32 size)
> str = "PONG_VALID";
> }
>
> - status = hif_ops->load_data_master_write(adapter, cmd_addr, size,
> + ret = hif_ops->load_data_master_write(adapter, cmd_addr, size,
> block_size, addr);
> - if (status) {
> - rsi_dbg(ERR_ZONE, "%s: Unable to write blk at addr %0x\n",
> - __func__, *addr);
> - return status;
> + if (ret) {
> + if (ret != -EINVAL)
> + rsi_dbg(ERR_ZONE, "%s: Unable to write blk at addr %0x\n",
> + __func__, *addr);
> + return ret;
> }
>
> status = bl_cmd(adapter, cmd_req, cmd_resp, str);
> diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
> index b0cf41195051..b766578b591a 100644
> --- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
> +++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
> @@ -20,6 +20,8 @@
> #include "rsi_common.h"
> #include "rsi_hal.h"
>
> +#define RSI_MAX_BLOCK_SIZE 256
> +
> /**
> * rsi_sdio_set_cmd52_arg() - This function prepares cmd 52 read/write arg.
> * @rw: Read/write
> @@ -362,7 +364,7 @@ static int rsi_setblocklength(struct rsi_hw *adapter, u32 length)
> rsi_dbg(INIT_ZONE, "%s: Setting the block length\n", __func__);
>
> status = sdio_set_block_size(dev->pfunction, length);
> - dev->pfunction->max_blksize = 256;
> + dev->pfunction->max_blksize = RSI_MAX_BLOCK_SIZE;
> adapter->block_size = dev->pfunction->max_blksize;
>
> rsi_dbg(INFO_ZONE,
> @@ -567,9 +569,12 @@ static int rsi_sdio_load_data_master_write(struct rsi_hw *adapter,
> {
> u32 num_blocks, offset, i;
> u16 msb_address, lsb_address;
> - u8 temp_buf[block_size];
> + u8 temp_buf[RSI_MAX_BLOCK_SIZE];
> int status;
>
> + if (block_size > RSI_MAX_BLOCK_SIZE)
> + return -EINVAL;
> +
> num_blocks = instructions_sz / block_size;
> msb_address = base_address >> 16;
I am not giving this patch a negative review, but my solution to the same
problem has been to change the on-stack array into a u8 pointer, use kmalloc()
to assign the space, and then free that space at the end. That way large stack
allocations are avoided, with a minimum of changes.
Larry
>
>
next prev parent reply other threads:[~2018-03-12 2:06 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-12 1:43 [RESEND PATCH] rsi: Remove stack VLA usage Tobin C. Harding
2018-03-12 2:06 ` Larry Finger [this message]
2018-03-13 20:09 ` Tobin C. Harding
2018-03-12 9:46 ` [RESEND] " Kalle Valo
2018-03-12 9:46 ` Kalle Valo
2018-03-13 16:52 ` Kalle Valo
2018-03-13 16:52 ` Kalle Valo
[not found] ` <20180312094606.8192B6081A@smtp.codeaurora.org>
2018-03-13 20:17 ` tcharding
2018-03-13 21:00 ` Andy Shevchenko
2018-03-14 2:11 ` Tobin C. Harding
2018-03-14 2:53 ` Kees Cook
2018-03-14 3:43 ` Tobin C. Harding
2018-03-14 9:19 ` Kalle Valo
2018-03-14 20:19 ` Tobin C. Harding
2018-03-15 9:07 ` Kalle Valo
2018-03-14 9:11 ` Kalle Valo
2018-03-14 9:05 ` Kalle Valo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ff9309bf-4c3d-b0f9-cdd0-429dacd3177b@lwfinger.net \
--to=larry.finger@lwfinger.net \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=me@tobin.cc \
--cc=netdev@vger.kernel.org \
--cc=tycho@tycho.ws \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).