linux-kernel - [PATCH] rtc: mcp795: remove VLA usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 13 Mar 2018 00:13:38 +0100
From:   Stefano Manni <stefano.manni@...il.com>
To:     a.zummo@...ertech.it, alexandre.belloni@...e-electrons.com
Cc:     linux-rtc@...r.kernel.org, linux-kernel@...r.kernel.org,
        Stefano Manni <stefano.manni@...il.com>
Subject: [PATCH] rtc: mcp795: remove VLA usage

In preparation to enabling -Wvla, remove VLAs and replace them with
fixed-length arrays instead.

rtc-mcp795.c uses a variable-length array declaration to contain
the command to write the rtcc; this can be replaced by a fixed-
size array of length 2 (instruction, address) + 32 (data out),
assuming a maximum data length of 32 bytes before wrap up.

This was prompted by https://lkml.org/lkml/2018/3/7/621

Signed-off-by: Stefano Manni <stefano.manni@...il.com>
---
 drivers/rtc/rtc-mcp795.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-mcp795.c b/drivers/rtc/rtc-mcp795.c
index 77f21331ae21..a5f504e2364c 100644
--- a/drivers/rtc/rtc-mcp795.c
+++ b/drivers/rtc/rtc-mcp795.c
@@ -61,6 +61,9 @@
 
 #define SEC_PER_DAY		(24 * 60 * 60)
 
+/* Maximum length for data out in write operation to RTCC */
+#define MCP795_MAX_DATAOUT_LEN	32
+
 static int mcp795_rtcc_read(struct device *dev, u8 addr, u8 *buf, u8 count)
 {
 	struct spi_device *spi = to_spi_device(dev);
@@ -82,7 +85,10 @@ static int mcp795_rtcc_write(struct device *dev, u8 addr, u8 *data, u8 count)
 {
 	struct spi_device *spi = to_spi_device(dev);
 	int ret;
-	u8 tx[2 + count];
+	u8 tx[2 + MCP795_MAX_DATAOUT_LEN];
+
+	if (count > MCP795_MAX_DATAOUT_LEN)
+		return -EINVAL;
 
 	tx[0] = MCP795_WRITE;
 	tx[1] = addr;
-- 
2.14.3