[PATCH] bus: imx-weim: Remove VLA usage

[PATCH] bus: imx-weim: Remove VLA usage

[Kees Cook]

In the quest to remove all stack VLA usage from the kernel[1], this
switches to using a maximum size and adds a sanity check.

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com

Cc: Maxime Ripard <maxime.ripard@free-electrons.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Rob Herring <robh@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
 drivers/bus/imx-weim.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c
index 3d56ebcda720..6a94aa6a22c2 100644
--- a/drivers/bus/imx-weim.c
+++ b/drivers/bus/imx-weim.c
@@ -45,6 +45,8 @@ static const struct imx_weim_devtype imx51_weim_devtype = {
 	.cs_stride	= 0x18,
 };
 
+#define MAX_CS_REGS_COUNT	6
+
 static const struct of_device_id weim_id_table[] = {
 	/* i.MX1/21 */
 	{ .compatible = "fsl,imx1-weim", .data = &imx1_weim_devtype, },
@@ -112,9 +114,12 @@ static int __init imx_weim_gpr_setup(struct platform_device *pdev)
 static int __init weim_timing_setup(struct device_node *np, void __iomem *base,
 				    const struct imx_weim_devtype *devtype)
 {
-	u32 cs_idx, value[devtype->cs_regs_count];
+	u32 cs_idx, value[MAX_CS_REGS_COUNT];
 	int i, ret;
 
+	if (WARN_ON(devtype->cs_regs_count > MAX_CS_REGS_COUNT))
+		return -EINVAL;
+
 	/* get the CS index from this child node's "reg" property. */
 	ret = of_property_read_u32(np, "reg", &cs_idx);
 	if (ret)
-- 
2.17.1


-- 
Kees Cook
Pixel Security

Re: [PATCH] bus: imx-weim: Remove VLA usage

[Rob Herring]

On Fri, Jun 29, 2018 at 12:52 PM Kees Cook <keescook@chromium.org> wrote:
>
> In the quest to remove all stack VLA usage from the kernel[1], this
> switches to using a maximum size and adds a sanity check.
>
> [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com
>
> Cc: Maxime Ripard <maxime.ripard@free-electrons.com>
> Cc: Arnd Bergmann <arnd@arndb.de>
> Cc: Rob Herring <robh@kernel.org>
> Signed-off-by: Kees Cook <keescook@chromium.org>

Not sure how you came up with the CC list, but you should probably
have some i.MX folks CC'ed.

Rob

Re: [PATCH] bus: imx-weim: Remove VLA usage

[Kees Cook]

On Fri, Jun 29, 2018 at 12:45 PM, Rob Herring <robh@kernel.org> wrote:
> On Fri, Jun 29, 2018 at 12:52 PM Kees Cook <keescook@chromium.org> wrote:
>>
>> In the quest to remove all stack VLA usage from the kernel[1], this
>> switches to using a maximum size and adds a sanity check.
>>
>> [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com
>>
>> Cc: Maxime Ripard <maxime.ripard@free-electrons.com>
>> Cc: Arnd Bergmann <arnd@arndb.de>
>> Cc: Rob Herring <robh@kernel.org>
>> Signed-off-by: Kees Cook <keescook@chromium.org>
>
> Not sure how you came up with the CC list, but you should probably
> have some i.MX folks CC'ed.

Automation for the lose, apparently. :) Looks like maybe the
MAINTAINER entry for IMX needs a drivers/bus/imx* line added. :)

Adding more CCs...

-Kees

-- 
Kees Cook
Pixel Security

Re: [PATCH] bus: imx-weim: Remove VLA usage

[Arnd Bergmann]

On Fri, Jun 29, 2018 at 8:52 PM, Kees Cook <keescook@chromium.org> wrote:
> In the quest to remove all stack VLA usage from the kernel[1], this
> switches to using a maximum size and adds a sanity check.
>
> [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com
>
> Cc: Maxime Ripard <maxime.ripard@free-electrons.com>
> Cc: Arnd Bergmann <arnd@arndb.de>
> Cc: Rob Herring <robh@kernel.org>
> Signed-off-by: Kees Cook <keescook@chromium.org>

Reviewed-by: Arnd Bergmann <arnd@arndb.de>

Re: [PATCH] bus: imx-weim: Remove VLA usage

[Shawn Guo]

On Fri, Jun 29, 2018 at 01:02:36PM -0700, Kees Cook wrote:
> On Fri, Jun 29, 2018 at 12:45 PM, Rob Herring <robh@kernel.org> wrote:
> > On Fri, Jun 29, 2018 at 12:52 PM Kees Cook <keescook@chromium.org> wrote:
> >>
> >> In the quest to remove all stack VLA usage from the kernel[1], this
> >> switches to using a maximum size and adds a sanity check.
> >>
> >> [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com
> >>
> >> Cc: Maxime Ripard <maxime.ripard@free-electrons.com>
> >> Cc: Arnd Bergmann <arnd@arndb.de>
> >> Cc: Rob Herring <robh@kernel.org>
> >> Signed-off-by: Kees Cook <keescook@chromium.org>
> >
> > Not sure how you came up with the CC list, but you should probably
> > have some i.MX folks CC'ed.
> 
> Automation for the lose, apparently. :) Looks like maybe the
> MAINTAINER entry for IMX needs a drivers/bus/imx* line added. :)
> 
> Adding more CCs...

Acked-by: Shawn Guo <shawnguo@kernel.org>