linux-kernel - [PATCH] KVM: x86: dynamically allocate large struct in em

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 23 May 2017 23:24:33 -0700
From:   Nick Desaulniers <nick.desaulniers@...il.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     Nick Desaulniers <nick.desaulniers@...il.com>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] KVM: x86: dynamically allocate large struct in em_fxrstor

Fixes the warning:

arch/x86/kvm/emulate.c:4018:12: warning: stack frame size of 1080 bytes in
function
      'em_fxrstor' [-Wframe-larger-than=]
static int em_fxrstor(struct x86_emulate_ctxt *ctxt)
           ^

Found with CONFIG_FRAME_WARN set to 1024.

Signed-off-by: Nick Desaulniers <nick.desaulniers@...il.com>
---
 arch/x86/kvm/emulate.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 0816ab2e8adc..1d7c9ceeff56 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4017,30 +4017,38 @@ static int fxrstor_fixup(struct x86_emulate_ctxt *ctxt,
 
 static int em_fxrstor(struct x86_emulate_ctxt *ctxt)
 {
-	struct fxregs_state fx_state;
+	struct fxregs_state *fx_state;
 	int rc;
 
 	rc = check_fxsr(ctxt);
 	if (rc != X86EMUL_CONTINUE)
 		return rc;
 
-	rc = segmented_read_std(ctxt, ctxt->memop.addr.mem, &fx_state, 512);
+	fx_state = kmalloc(sizeof(*fx_state), GFP_KERNEL);
+	if (!fx_state)
+		return -ENOMEM;
+
+	rc = segmented_read_std(ctxt, ctxt->memop.addr.mem, fx_state, 512);
 	if (rc != X86EMUL_CONTINUE)
-		return rc;
+		goto out;
 
-	if (fx_state.mxcsr >> 16)
-		return emulate_gp(ctxt, 0);
+	if (fx_state->mxcsr >> 16) {
+		rc = emulate_gp(ctxt, 0);
+		goto out;
+	}
 
 	ctxt->ops->get_fpu(ctxt);
 
 	if (ctxt->mode < X86EMUL_MODE_PROT64)
-		rc = fxrstor_fixup(ctxt, &fx_state);
+		rc = fxrstor_fixup(ctxt, fx_state);
 
 	if (rc == X86EMUL_CONTINUE)
-		rc = asm_safe("fxrstor %[fx]", : [fx] "m"(fx_state));
+		rc = asm_safe("fxrstor %[fx]", : [fx] "m"(*fx_state));
 
 	ctxt->ops->put_fpu(ctxt);
 
+out:
+	kfree(fx_state);
 	return rc;
 }
 
-- 
2.11.0