linux-kernel - Re: [PATCH] PM / devfreq: events: fix excessive stack usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 1 Nov 2019 15:51:32 +0900
From:   Chanwoo Choi <cw00.choi@...sung.com>
To:     Arnd Bergmann <arnd@...db.de>,
        MyungJoo Ham <myungjoo.ham@...sung.com>,
        Kyungmin Park <kyungmin.park@...sung.com>,
        Kukjin Kim <kgene@...nel.org>,
        Krzysztof Kozlowski <krzk@...nel.org>
Cc:     Lukasz Luba <l.luba@...tner.samsung.com>, linux-pm@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org,
        linux-samsung-soc@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] PM / devfreq: events: fix excessive stack usage

Hi Arnd,

On 19. 10. 22. 오후 11:26, Arnd Bergmann wrote:
> Putting a 'struct devfreq_event_dev' object on the stack is generally
> a bad idea and here it leads to a warnig about potential stack overflow:
> 
> drivers/devfreq/event/exynos-ppmu.c:643:12: error: stack frame size of 1040 bytes in function 'exynos_ppmu_probe' [-Werror,-Wframe-larger-than=]
> 
> There is no real need for the device structure, only the string inside
> it, so add an internal helper function that simply takes the string
> as its argument and remove the device structure.
> 
> Fixes: 1dd62c66d345 ("PM / devfreq: events: extend events by type of counted data")
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
> ---
>  drivers/devfreq/event/exynos-ppmu.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/devfreq/event/exynos-ppmu.c b/drivers/devfreq/event/exynos-ppmu.c
> index 87b42055e6bc..302e466549d3 100644
> --- a/drivers/devfreq/event/exynos-ppmu.c
> +++ b/drivers/devfreq/event/exynos-ppmu.c
> @@ -101,17 +101,22 @@ static struct __exynos_ppmu_events {
>  	PPMU_EVENT(dmc1_1),
>  };
>  
> -static int exynos_ppmu_find_ppmu_id(struct devfreq_event_dev *edev)
> +static int __exynos_ppmu_find_ppmu_id(const char *edev_name)
>  {
>  	int i;
>  
>  	for (i = 0; i < ARRAY_SIZE(ppmu_events); i++)
> -		if (!strcmp(edev->desc->name, ppmu_events[i].name))
> +		if (!strcmp(edev_name, ppmu_events[i].name))
>  			return ppmu_events[i].id;
>  
>  	return -EINVAL;
>  }
>  
> +static int exynos_ppmu_find_ppmu_id(struct devfreq_event_dev *edev)
> +{
> +	return __exynos_ppmu_find_ppmu_id(edev->desc->name);
> +}
> +
>  /*
>   * The devfreq-event ops structure for PPMU v1.1
>   */
> @@ -556,13 +561,11 @@ static int of_get_devfreq_events(struct device_node *np,
>  			 * use default if not.
>  			 */
>  			if (info->ppmu_type == EXYNOS_TYPE_PPMU_V2) {
> -				struct devfreq_event_dev edev;
>  				int id;
>  				/* Not all registers take the same value for
>  				 * read+write data count.
>  				 */
> -				edev.desc = &desc[j];
> -				id = exynos_ppmu_find_ppmu_id(&edev);
> +				id = __exynos_ppmu_find_ppmu_id(desc->name);

I got that the original exynos_ppmu_find_ppmu_id() function
has the bug. If 'events' node contains the one more events,
it will be failed. Because 'events' node only contained
the only one event on device-tree node on real use-case,
the problem had not happened.

'desc' indicates the array. So, instead of desc->name,
have to use 'desc[j].name correctly. 

And I'll fix the fundamental bug on separate patch.

>  
>  				switch (id) {
>  				case PPMU_PMNCNT0:
> 


-- 
Best Regards,
Chanwoo Choi
Samsung Electronics