linux-kernel - Re: [PATCH] Bluetooth: btusb: fix excessive stack usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 4 Feb 2021 18:13:19 +0100
From:   Marcel Holtmann <marcel@...tmann.org>
To:     Arnd Bergmann <arnd@...nel.org>
Cc:     Johan Hedberg <johan.hedberg@...il.com>,
        Luiz Augusto von Dentz <luiz.dentz@...il.com>,
        Mark Chen <Mark-YW.Chen@...iatek.com>,
        Arnd Bergmann <arnd@...db.de>, Kiran K <kiran.k@...el.com>,
        Alain Michaud <alainm@...omium.org>,
        Chethan T N <chethan.tumkur.narayan@...el.com>,
        Abhishek Pandit-Subedi <abhishekpandit@...omium.org>,
        Sathish Narasimman <nsathish41@...il.com>,
        Rocky Liao <rjliao@...eaurora.org>,
        Ismael Ferreras Morezuelas <swyterzone@...il.com>,
        Hilda Wu <hildawu@...ltek.com>,
        Trent Piepho <tpiepho@...il.com>,
        Bluetooth Kernel Mailing List 
        <linux-bluetooth@...r.kernel.org>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Bluetooth: btusb: fix excessive stack usage

Hi Arnd,

> Enlarging the size of 'struct btmtk_hci_wmt_cmd' makes it no longer
> fit on the kernel stack, as seen from this compiler warning:
> 
> drivers/bluetooth/btusb.c:3365:12: error: stack frame size of 1036 bytes in function 'btusb_mtk_hci_wmt_sync' [-Werror,-Wframe-larger-than=]
> 
> Change the function to dynamically allocate the buffer instead.
> As there are other sleeping functions called from the same location,
> using GFP_KERNEL should be fine here, and the runtime overhead should
> not matter as this is rarely called.
> 
> Unfortunately, I could not figure out why the message size is
> increased in the previous patch. Using dynamic allocation means
> any size is possible now, but there is still a range check that
> limits the total size (including the five-byte header) to 255
> bytes, so whatever was intended there is now undone.
> 
> Fixes: 48c13301e6ba ("Bluetooth: btusb: Fine-tune mt7663 mechanism.")
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
> ---
> drivers/bluetooth/btusb.c | 24 +++++++++++++++---------
> 1 file changed, 15 insertions(+), 9 deletions(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel