linux-kernel - [PATCH] fixup! firmware: raspberrypi: Remove VLA usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  2 Jul 2018 12:45:05 -0700
From:   Eric Anholt <eric@...olt.net>
To:     Kees Cook <keescook@...omium.org>,
        Stefan Wahren <stefan.wahren@...e.com>
Cc:     Arnd Bergmann <arnd@...db.de>, linux-kernel@...r.kernel.org,
        Eric Anholt <eric@...olt.net>
Subject: [PATCH] fixup! firmware: raspberrypi: Remove VLA usage

Kees - with this fix to your patch, the kernel boots again (otherwise,
the FW would try to parse the uninitialized bits of stack and throw
errors).  If you're good with me squashing this in, I'll do so and
send it to -next.

Signed-off-by: Eric Anholt <eric@...olt.net>
---
 drivers/firmware/raspberrypi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index b80f15214b73..a200a2174611 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -162,7 +162,7 @@ int rpi_firmware_property(struct rpi_firmware *fw,
 	memcpy(data + sizeof(struct rpi_firmware_property_tag_header),
 	       tag_data, buf_size);
 
-	ret = rpi_firmware_property_list(fw, &data, sizeof(data));
+	ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));
 	memcpy(tag_data,
 	       data + sizeof(struct rpi_firmware_property_tag_header),
 	       buf_size);
-- 
2.18.0