On Tue, Jul 03, 2018 at 09:10:21PM -0700, Andrey Smirnov wrote: > This is a backport of patch [1] by Kees Cook > > [1] https://lkml.kernel.org/r/20180620182600.GA24297@beast > > Signed-off-by: Andrey Smirnov <andrew.smirnov@xxxxxxxxx> > --- Applied, thanks Sascha > drivers/nvmem/rave-sp-eeprom.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/nvmem/rave-sp-eeprom.c b/drivers/nvmem/rave-sp-eeprom.c > index 5fd429f16..ff91f39f7 100644 > --- a/drivers/nvmem/rave-sp-eeprom.c > +++ b/drivers/nvmem/rave-sp-eeprom.c > @@ -55,6 +55,7 @@ enum rave_sp_eeprom_header_size { > RAVE_SP_EEPROM_HEADER_SMALL = 4U, > RAVE_SP_EEPROM_HEADER_BIG = 5U, > }; > +#define RAVE_SP_EEPROM_HEADER_MAX RAVE_SP_EEPROM_HEADER_BIG > > #define RAVE_SP_EEPROM_PAGE_SIZE 32U > > @@ -115,9 +116,12 @@ static int rave_sp_eeprom_io(struct rave_sp_eeprom *eeprom, > const unsigned int rsp_size = > is_write ? sizeof(*page) - sizeof(page->data) : sizeof(*page); > unsigned int offset = 0; > - u8 cmd[cmd_size]; > + u8 cmd[RAVE_SP_EEPROM_HEADER_MAX + sizeof(page->data)]; > int ret; > > + if (WARN_ON(cmd_size > sizeof(cmd))) > + return -EINVAL; > + > cmd[offset++] = eeprom->address; > cmd[offset++] = 0; > cmd[offset++] = type; > -- > 2.17.1 > > > _______________________________________________ > barebox mailing list > barebox@xxxxxxxxxxxxxxxxxxx > http://lists.infradead.org/mailman/listinfo/barebox > -- Pengutronix e.K. | | Industrial Linux Solutions | http://www.pengutronix.de/ | Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | _______________________________________________ barebox mailing list barebox@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/barebox
