linux-kernel - [PATCH] m68k: Avoid VLA use in mangle_kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190107092935.14617-1-geert@linux-m68k.org>
Date:   Mon,  7 Jan 2019 10:29:35 +0100
From:   Geert Uytterhoeven <geert@...ux-m68k.org>
To:     linux-m68k@...ts.linux-m68k.org
Cc:     Arnd Bergmann <arnd@...db.de>, linux-kernel@...r.kernel.org,
        Geert Uytterhoeven <geert@...ux-m68k.org>
Subject: [PATCH] m68k: Avoid VLA use in mangle_kernel_stack()

With gcc 7.3.0:

    arch/m68k/kernel/signal.c: In function ‘mangle_kernel_stack’:
    arch/m68k/kernel/signal.c:654:3: warning: ISO C90 forbids variable length array ‘buf’ [-Wvla]
       unsigned long buf[fsize / 2]; /* yes, twice as much */
       ^~~~~~~~

Replace the variable size by the upper limit, which is 168 bytes.

Signed-off-by: Geert Uytterhoeven <geert@...ux-m68k.org>
---
 arch/m68k/kernel/signal.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/m68k/kernel/signal.c b/arch/m68k/kernel/signal.c
index e2a9421c57975034..87e7f3639839f559 100644
--- a/arch/m68k/kernel/signal.c
+++ b/arch/m68k/kernel/signal.c
@@ -651,7 +651,8 @@ static int mangle_kernel_stack(struct pt_regs *regs, int formatvec,
 		regs->vector = formatvec & 0xfff;
 	} else {
 		struct switch_stack *sw = (struct switch_stack *)regs - 1;
-		unsigned long buf[fsize / 2]; /* yes, twice as much */
+		/* yes, twice as much as max(sizeof(frame.un.fmt<x>)) */
+		unsigned long buf[sizeof(((struct frame *)0)->un) / 2];
 
 		/* that'll make sure that expansion won't crap over data */
 		if (copy_from_user(buf + fsize / 4, fp, fsize))
-- 
2.17.1