Commit a1547e0b authored by Kees Cook's avatar Kees Cook Committed by Florian Fainelli

firmware: raspberrypi: Remove VLA usage

In the quest to remove all stack VLA usage from the kernel[1], this
removes the VLA in favor of a maximum size and adds a sanity check.
Existing callers of the firmware interface never need more than 24
bytes (struct gpio_set_config). This chooses 32 just to stay ahead
of future growth.

v2: Fix the length passed to rpi_firmware_property_list (by anholt,
    acked by Kees).

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.comSigned-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarEric Anholt <eric@anholt.net>
Reviewed-by: default avatarEric Anholt <eric@anholt.net>
parent 70eea1bb
...@@ -21,6 +21,8 @@ ...@@ -21,6 +21,8 @@
#define MBOX_DATA28(msg) ((msg) & ~0xf) #define MBOX_DATA28(msg) ((msg) & ~0xf)
#define MBOX_CHAN_PROPERTY 8 #define MBOX_CHAN_PROPERTY 8
#define MAX_RPI_FW_PROP_BUF_SIZE 32
static struct platform_device *rpi_hwmon; static struct platform_device *rpi_hwmon;
struct rpi_firmware { struct rpi_firmware {
...@@ -145,18 +147,22 @@ int rpi_firmware_property(struct rpi_firmware *fw, ...@@ -145,18 +147,22 @@ int rpi_firmware_property(struct rpi_firmware *fw,
/* Single tags are very small (generally 8 bytes), so the /* Single tags are very small (generally 8 bytes), so the
* stack should be safe. * stack should be safe.
*/ */
u8 data[buf_size + sizeof(struct rpi_firmware_property_tag_header)]; u8 data[sizeof(struct rpi_firmware_property_tag_header) +
MAX_RPI_FW_PROP_BUF_SIZE];
struct rpi_firmware_property_tag_header *header = struct rpi_firmware_property_tag_header *header =
(struct rpi_firmware_property_tag_header *)data; (struct rpi_firmware_property_tag_header *)data;
int ret; int ret;
if (WARN_ON(buf_size > sizeof(data) - sizeof(*header)))
return -EINVAL;
header->tag = tag; header->tag = tag;
header->buf_size = buf_size; header->buf_size = buf_size;
header->req_resp_size = 0; header->req_resp_size = 0;
memcpy(data + sizeof(struct rpi_firmware_property_tag_header), memcpy(data + sizeof(struct rpi_firmware_property_tag_header),
tag_data, buf_size); tag_data, buf_size);
ret = rpi_firmware_property_list(fw, &data, sizeof(data)); ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));
memcpy(tag_data, memcpy(tag_data,
data + sizeof(struct rpi_firmware_property_tag_header), data + sizeof(struct rpi_firmware_property_tag_header),
buf_size); buf_size);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment