linux-kernel - Re: [PATCH wireless-drivers] mt76x0: Remove VLA usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180809104137.GA1955@redhat.com>
Date:   Thu, 9 Aug 2018 12:41:38 +0200
From:   Stanislaw Gruszka <sgruszka@...hat.com>
To:     Kees Cook <keescook@...omium.org>
Cc:     Kalle Valo <kvalo@...eaurora.org>,
        "David S. Miller" <davem@...emloft.net>,
        linux-wireless <linux-wireless@...r.kernel.org>,
        Network Development <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH wireless-drivers] mt76x0: Remove VLA usage

On Wed, Aug 08, 2018 at 08:41:28AM -0700, Kees Cook wrote:
> >> I thought SPDX line is needed only if file has no license and eeprom.c
> >> file and other mt76x0 files have specified the license. Is SPDX still
> >> needed in that case ?
> 
> I thought all source files needed SPDX: https://lwn.net/Articles/739183/

Ok, goal is to have all kernel source files with SPDX header.

> >>> +#define MT_MAP_READS        DIV_ROUND_UP(MT_EFUSE_USAGE_MAP_SIZE, 16)
> >>>  static int
> >>>  mt76x0_efuse_physical_size_check(struct mt76x0_dev *dev)
> >>>  {
> >>> -    const int map_reads = DIV_ROUND_UP(MT_EFUSE_USAGE_MAP_SIZE, 16);
> >>> -    u8 data[map_reads * 16];
> >>
> >> Why this is variable length array? DIV_ROUND_UP can not be calculated
> >> at compile time? But if so, macro do not change the situation either.
> >
> > The commit log mentioned:
> >
> >   "Even with "const" variables, the compiler will generate warnings about
> >    VLA usage."
> >
> > So I guess the compiler (gcc?) is just not smart enough in this case?
> 
> Correct. This is technically a false positive, but with the goal of
> adding -Wvla to the build globally, we have to get rid of these as
> well. It's a little frustrating, I agree, but with all others fixed
> now, these stand out. :)

Then:
Acked-by: Stanislaw Gruszka <sgruszka@...hat.com>