The patch titled
Subject: lib/reed_solomon: remove VLAs by setting upper bound on nroots
has been added to the -mm tree. Its filename is
rslib-remove-vlas-by-setting-upper-bound-on-nroots.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/rslib-remove-vlas-by-setting-upper-bound-on-nroots.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/rslib-remove-vlas-by-setting-upper-bound-on-nroots.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Kees Cook <keescook@xxxxxxxxxxxx>
Subject: lib/reed_solomon: remove VLAs by setting upper bound on nroots
Avoid stack VLAs[1] by always allocating the upper bound of stack space
needed. The existing users of rslib appear to max out at 24 roots[2], so
use that as the upper bound until we have a reason to change it.
Alternative considered: make init_rs() a true caller-instance and
pre-allocate the workspaces. This would possibly need locking and a
refactoring of the returned structure.
Using kmalloc in this path doesn't look great, especially since at least
one caller (pstore) is sensitive to allocations during rslib usage (it
expects to run it during an Oops, for example).
[1] https://lkml.org/lkml/2018/3/7/621
[2] https://lkml.org/lkml/2018/3/9/838
Link: http://lkml.kernel.org/r/20180315225919.GA43806@beast
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
Reviewed-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
Reviewed-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Cc: Segher Boessenkool <segher@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
lib/reed_solomon/decode_rs.c | 7 ++++---
lib/reed_solomon/reed_solomon.c | 5 ++++-
2 files changed, 8 insertions(+), 4 deletions(-)
diff -puN lib/reed_solomon/decode_rs.c~rslib-remove-vlas-by-setting-upper-bound-on-nroots lib/reed_solomon/decode_rs.c
--- a/lib/reed_solomon/decode_rs.c~rslib-remove-vlas-by-setting-upper-bound-on-nroots
+++ a/lib/reed_solomon/decode_rs.c
@@ -31,9 +31,10 @@
* of nroots is 8. So the necessary stack size will be about
* 220 bytes max.
*/
- uint16_t lambda[nroots + 1], syn[nroots];
- uint16_t b[nroots + 1], t[nroots + 1], omega[nroots + 1];
- uint16_t root[nroots], reg[nroots + 1], loc[nroots];
+ uint16_t lambda[RS_MAX_ROOTS + 1], syn[RS_MAX_ROOTS];
+ uint16_t b[RS_MAX_ROOTS + 1], t[RS_MAX_ROOTS + 1];
+ uint16_t omega[RS_MAX_ROOTS + 1], root[RS_MAX_ROOTS];
+ uint16_t reg[RS_MAX_ROOTS + 1], loc[RS_MAX_ROOTS];
int count = 0;
uint16_t msk = (uint16_t) rs->nn;
diff -puN lib/reed_solomon/reed_solomon.c~rslib-remove-vlas-by-setting-upper-bound-on-nroots lib/reed_solomon/reed_solomon.c
--- a/lib/reed_solomon/reed_solomon.c~rslib-remove-vlas-by-setting-upper-bound-on-nroots
+++ a/lib/reed_solomon/reed_solomon.c
@@ -51,6 +51,9 @@ static LIST_HEAD (rslist);
/* Protection for the list */
static DEFINE_MUTEX(rslistlock);
+/* Ultimately controls the upper bounds of the on-stack buffers. */
+#define RS_MAX_ROOTS 24
+
/**
* rs_init - Initialize a Reed-Solomon codec
* @symsize: symbol size, bits (1-8)
@@ -210,7 +213,7 @@ static struct rs_control *init_rs_intern
return NULL;
if (prim <= 0 || prim >= (1<<symsize))
return NULL;
- if (nroots < 0 || nroots >= (1<<symsize))
+ if (nroots < 0 || nroots >= (1<<symsize) || nroots > RS_MAX_ROOTS)
return NULL;
mutex_lock(&rslistlock);
_
Patches currently in -mm which might be from keescook@xxxxxxxxxxxx are
taint-convert-to-indexed-initialization.patch
taint-consolidate-documentation.patch
taint-add-taint-for-randstruct.patch
kernelh-introduce-const_max-for-vla-removal.patch
remove-false-positive-vlas-when-using-max.patch
task_struct-only-use-anon-struct-under-randstruct-plugin.patch
test_bitmap-do-not-accidentally-use-stack-vla.patch
rslib-remove-vlas-by-setting-upper-bound-on-nroots.patch
fork-unconditionally-clear-stack-on-fork.patch
exec-pass-stack-rlimit-into-mm-layout-functions.patch
exec-introduce-finalize_exec-before-start_thread.patch
exec-pin-stack-limit-during-exec.patch
exofs-avoid-vla-in-structures.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
