diff options
| author | Kees Cook <keescook@chromium.org> | 2018-06-20 20:26:00 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-07-07 17:30:46 +0200 |
| commit | 26d79b820b2773eabdc512c84d1152f0f631b2fc (patch) | |
| tree | 1059845e8d9d5add5b70d405bb06094f5a6d0d2c /drivers/nvmem/rave-sp-eeprom.c | |
| parent | MAINTAINERS: Add file patterns for w1 device tree bindings (diff) | |
| download | linux-26d79b820b2773eabdc512c84d1152f0f631b2fc.tar.xz linux-26d79b820b2773eabdc512c84d1152f0f631b2fc.zip | |
nvmem: rave-sp-eeprom: Remove VLA usage
In the quest to remove all stack VLA usage from the kernel[1], this
uses the maximum allocation size for the stack and adds a sanity check,
similar to what has already be done for the regular rave-sp driver.
[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Tested-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to '')
| -rw-r--r-- | drivers/nvmem/rave-sp-eeprom.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/nvmem/rave-sp-eeprom.c b/drivers/nvmem/rave-sp-eeprom.c index 50aeea6ec6cc..66699d44f73d 100644 --- a/drivers/nvmem/rave-sp-eeprom.c +++ b/drivers/nvmem/rave-sp-eeprom.c @@ -35,6 +35,7 @@ enum rave_sp_eeprom_header_size { RAVE_SP_EEPROM_HEADER_SMALL = 4U, RAVE_SP_EEPROM_HEADER_BIG = 5U, }; +#define RAVE_SP_EEPROM_HEADER_MAX RAVE_SP_EEPROM_HEADER_BIG #define RAVE_SP_EEPROM_PAGE_SIZE 32U @@ -97,9 +98,12 @@ static int rave_sp_eeprom_io(struct rave_sp_eeprom *eeprom, const unsigned int rsp_size = is_write ? sizeof(*page) - sizeof(page->data) : sizeof(*page); unsigned int offset = 0; - u8 cmd[cmd_size]; + u8 cmd[RAVE_SP_EEPROM_HEADER_MAX + sizeof(page->data)]; int ret; + if (WARN_ON(cmd_size > sizeof(cmd))) + return -EINVAL; + cmd[offset++] = eeprom->address; cmd[offset++] = 0; cmd[offset++] = type; |