summaryrefslogtreecommitdiff
path: root/drivers/nvmem
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2018-06-20 11:26:00 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-07-07 17:30:46 +0200
commit26d79b820b2773eabdc512c84d1152f0f631b2fc (patch)
tree1059845e8d9d5add5b70d405bb06094f5a6d0d2c /drivers/nvmem
parent55d7d44eb21dd7b88d7f17747bdc96e415bde75c (diff)
nvmem: rave-sp-eeprom: Remove VLA usage
In the quest to remove all stack VLA usage from the kernel[1], this uses the maximum allocation size for the stack and adds a sanity check, similar to what has already be done for the regular rave-sp driver. [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Andrey Smirnov <andrew.smirnov@gmail.com> Tested-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/nvmem')
-rw-r--r--drivers/nvmem/rave-sp-eeprom.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/nvmem/rave-sp-eeprom.c b/drivers/nvmem/rave-sp-eeprom.c
index 50aeea6ec6cc..66699d44f73d 100644
--- a/drivers/nvmem/rave-sp-eeprom.c
+++ b/drivers/nvmem/rave-sp-eeprom.c
@@ -35,6 +35,7 @@ enum rave_sp_eeprom_header_size {
RAVE_SP_EEPROM_HEADER_SMALL = 4U,
RAVE_SP_EEPROM_HEADER_BIG = 5U,
};
+#define RAVE_SP_EEPROM_HEADER_MAX RAVE_SP_EEPROM_HEADER_BIG
#define RAVE_SP_EEPROM_PAGE_SIZE 32U
@@ -97,9 +98,12 @@ static int rave_sp_eeprom_io(struct rave_sp_eeprom *eeprom,
const unsigned int rsp_size =
is_write ? sizeof(*page) - sizeof(page->data) : sizeof(*page);
unsigned int offset = 0;
- u8 cmd[cmd_size];
+ u8 cmd[RAVE_SP_EEPROM_HEADER_MAX + sizeof(page->data)];
int ret;
+ if (WARN_ON(cmd_size > sizeof(cmd)))
+ return -EINVAL;
+
cmd[offset++] = eeprom->address;
cmd[offset++] = 0;
cmd[offset++] = type;