linux-kernel - Re: [PATCH 4.19 540/639] wcn36xx: use dynamic allocation for large variables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 26 Jan 2020 12:36:16 +0100
From:   Pavel Machek <pavel@...x.de>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Arnd Bergmann <arnd@...db.de>,
        Kalle Valo <kvalo@...eaurora.org>,
        Sasha Levin <sashal@...nel.org>
Subject: Re: [PATCH 4.19 540/639] wcn36xx: use dynamic allocation for large
 variables

Hi!

> From: Arnd Bergmann <arnd@...db.de>
> 
> [ Upstream commit 355cf31912014e6ff1bb1019ae4858cad12c68cf ]
> 
> clang triggers a warning about oversized stack frames that gcc does not
> notice because of slightly different inlining decisions:
> 
> ath/wcn36xx/smd.c:1409:5: error: stack frame size of 1040 bytes in function 'wcn36xx_smd_config_bss' [-Werror,-Wframe-larger-than=]
> ath/wcn36xx/smd.c:640:5: error: stack frame size of 1032 bytes in function 'wcn36xx_smd_start_hw_scan' [-Werror,-Wframe-larger-than=]
> 
> Basically the wcn36xx_hal_start_scan_offload_req_msg,
> wcn36xx_hal_config_bss_req_msg_v1, and wcn36xx_hal_config_bss_req_msg
> structures are too large to be put on the kernel stack, but small
> enough that gcc does not warn about them.
> 
> Use kzalloc() to allocate them all. There are similar structures in other
> parts of this driver, but they are all smaller, with the next largest
> stack frame at 480 bytes for wcn36xx_smd_send_beacon.

>  	int ret, i;
>  
>  	if (req->ie_len > WCN36XX_MAX_SCAN_IE_LEN)
>  		return -EINVAL;
>  
>  	mutex_lock(&wcn->hal_mutex);
> -	INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_SCAN_OFFLOAD_REQ);
> +	msg_body = kzalloc(sizeof(*msg_body), GFP_KERNEL);
> +	if (!msg_body) {
> +		ret = -ENOMEM;
> +		goto out;
> +	}

The allocation can be done outside the lock.

> @@ -1410,16 +1428,21 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
>  			   struct ieee80211_sta *sta, const u8 *bssid,
>  			   bool update)
>  {
> -	struct wcn36xx_hal_config_bss_req_msg msg;
> +	struct wcn36xx_hal_config_bss_req_msg *msg;
>  	struct wcn36xx_hal_config_bss_params *bss;
>  	struct wcn36xx_hal_config_sta_params *sta_params;
>  	struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
>  	int ret;
>  
>  	mutex_lock(&wcn->hal_mutex);
> -	INIT_HAL_MSG(msg, WCN36XX_HAL_CONFIG_BSS_REQ);
> +	msg = kzalloc(sizeof(*msg), GFP_KERNEL);
> +	if (!msg) {
> +		ret = -ENOMEM;
> +		goto out;
> +	}
> +	INIT_HAL_MSG((*msg), WCN36XX_HAL_CONFIG_BSS_REQ);

Same here.

Best regards,
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)