linux-kernel - [PATCH 3.16 268/294] staging: dgnc: Fix frame size is larger than 1024B

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lsq.1510009382.283991492@decadent.org.uk>
Date:   Mon, 06 Nov 2017 23:03:02 +0000
From:   Ben Hutchings <ben@...adent.org.uk>
To:     linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:     akpm@...ux-foundation.org,
        "Konrad Zapalowicz" <bergo.torino@...il.com>,
        "Arnd Bergmann" <arnd@...db.de>,
        "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>
Subject: [PATCH 3.16 268/294] staging: dgnc: Fix frame size is larger than
 1024B

3.16.50-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Konrad Zapalowicz <bergo.torino@...il.com>

commit ea6e9dea2e72a7abd146a2c5bab726b27f34b36c upstream.

This comit fixes the following sparse warnign:

drivers/staging/dgnc/dgnc_tty.c:572:1:
    warning: the frame size of 1060 bytes is larger than 1024 bytes
    [-Wframe-larger-than=]

This was caused by having buffer as an automatic variable. This commit
moves it from the stack to the heap.

Signed-off-by: Konrad Zapalowicz <bergo.torino@...il.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Signed-off-by: Arnd Bergmann <arnd@...db.de>
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
 drivers/staging/dgnc/dgnc_tty.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

--- a/drivers/staging/dgnc/dgnc_tty.c
+++ b/drivers/staging/dgnc/dgnc_tty.c
@@ -481,13 +481,18 @@ void dgnc_sniff_nowait_nolock(struct cha
 	int nbuf;
 	int i;
 	int tmpbuflen;
-	char tmpbuf[TMPBUFLEN];
-	char *p = tmpbuf;
+	char *tmpbuf;
+	char *p;
 	int too_much_data;
 
+	tmpbuf = kzalloc(TMPBUFLEN, GFP_KERNEL);
+	if (!tmpbuf)
+		return;
+	p = tmpbuf;
+
 	/* Leave if sniff not open */
 	if (!(ch->ch_sniff_flags & SNIFF_OPEN))
-		return;
+		goto exit;
 
 	do_gettimeofday(&tv);
 
@@ -534,7 +539,7 @@ void dgnc_sniff_nowait_nolock(struct cha
 			 * function was probably called by the interrupt/timer routines!
 			 */
 			if (n == 0)
-				return;
+				goto exit;
 
 			/*
 			 * Copy as much data as will fit.
@@ -579,6 +584,9 @@ void dgnc_sniff_nowait_nolock(struct cha
 		}
 
 	} while (too_much_data);
+
+exit:
+	kfree(tmpbuf);
 }