On Wed, Sep 5, 2018 at 3:03 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote: > In the quest to remove all stack VLA usage from the kernel[1], this > allocates a fixed size array for the maximum number of cookies and > adds a runtime sanity check. > > [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1 > RqZWA@xxxxxxxxxxxxxx > > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> Friendly ping. Dave, can you take this? Thanks! -Kees > --- > arch/sparc/kernel/viohs.c | 12 +++++++++--- > 1 file changed, 9 insertions(+), 3 deletions(-) > > diff --git a/arch/sparc/kernel/viohs.c b/arch/sparc/kernel/viohs.c > index 635d67ffc9a3..7db5aabe9708 100644 > --- a/arch/sparc/kernel/viohs.c > +++ b/arch/sparc/kernel/viohs.c > @@ -180,11 +180,17 @@ static int send_dreg(struct vio_driver_state *vio) > struct vio_dring_register pkt; > char all[sizeof(struct vio_dring_register) + > (sizeof(struct ldc_trans_cookie) * > - dr->ncookies)]; > + VIO_MAX_RING_COOKIES)]; > } u; > + size_t bytes = sizeof(struct vio_dring_register) + > + (sizeof(struct ldc_trans_cookie) * > + dr->ncookies); > int i; > > - memset(&u, 0, sizeof(u)); > + if (WARN_ON(bytes > sizeof(u))) > + return -EINVAL; > + > + memset(&u, 0, bytes); > init_tag(&u.pkt.tag, VIO_TYPE_CTRL, VIO_SUBTYPE_INFO, VIO_DRING_REG); > u.pkt.dring_ident = 0; > u.pkt.num_descr = dr->num_entries; > @@ -206,7 +212,7 @@ static int send_dreg(struct vio_driver_state *vio) > (unsigned long long) u.pkt.cookies[i].cookie_size); > } > > - return send_ctrl(vio, &u.pkt.tag, sizeof(u)); > + return send_ctrl(vio, &u.pkt.tag, bytes); > } > > static int send_rdx(struct vio_driver_state *vio) > -- > 2.17.1 > > > -- > Kees Cook > Pixel Security -- Kees Cook Pixel Security
