linux-kernel - Re: [PATCH] [RESEND] firmware: tegra: reduce stack usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 7 Oct 2021 20:11:04 +0200
From:   Thierry Reding <thierry.reding@...il.com>
To:     Arnd Bergmann <arnd@...nel.org>
Cc:     Jonathan Hunter <jonathanh@...dia.com>,
        Arnd Bergmann <arnd@...db.de>, linux-tegra@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] [RESEND] firmware: tegra: reduce stack usage

On Mon, Sep 27, 2021 at 02:41:40PM +0200, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@...db.de>
> 
> Building the bpmp-debugfs driver for Arm results in a warning for stack usage:
> 
> drivers/firmware/tegra/bpmp-debugfs.c:321:16: error: stack frame size of 1224 bytes in function 'bpmp_debug_store' [-Werror,-Wframe-larger-than=]
> static ssize_t bpmp_debug_store(struct file *file, const char __user *buf,
> 
> It should be possible to rearrange the code to not require two separate
> buffers for the file name, but the easiest workaround is to use dynamic
> allocation.
> 
> Fixes: 5e37b9c137ee ("firmware: tegra: Add support for in-band debug")
> Link: https://lore.kernel.org/all/20201204193714.3134651-1-arnd@kernel.org/
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
> ---
> I sent this one in 2020 but got no reply. It still appears to be
> required, please have a look.
> ---
>  drivers/firmware/tegra/bpmp-debugfs.c | 16 +++++++++++-----
>  1 file changed, 11 insertions(+), 5 deletions(-)

If this is not a problem on 64-bit ARM, then perhaps we should add that
as a dependency. BPMP is only available in Tegra210 and later, all of
which are 64-bit.

But dynamic allocation also doesn't sound that bad. This is debugfs
support, after all, so shouldn't be in any fast path.

> 
> diff --git a/drivers/firmware/tegra/bpmp-debugfs.c b/drivers/firmware/tegra/bpmp-debugfs.c
> index 3e9fa4b54358..f6888cee83ee 100644
> --- a/drivers/firmware/tegra/bpmp-debugfs.c
> +++ b/drivers/firmware/tegra/bpmp-debugfs.c
> @@ -74,28 +74,34 @@ static void seqbuf_seek(struct seqbuf *seqbuf, ssize_t offset)
>  static const char *get_filename(struct tegra_bpmp *bpmp,
>  				const struct file *file, char *buf, int size)
>  {
> -	char root_path_buf[512];
> +	char *root_path_buf;
>  	const char *root_path;
> -	const char *filename;
> +	const char *filename = NULL;
>  	size_t root_len;
>  
> +	root_path_buf = kzalloc(512, GFP_KERNEL);
> +	if (!root_path_buf)
> +		goto out;
> +
>  	root_path = dentry_path(bpmp->debugfs_mirror, root_path_buf,
>  				sizeof(root_path_buf));
>  	if (IS_ERR(root_path))
> -		return NULL;
> +		goto out;
>  
>  	root_len = strlen(root_path);
>  
>  	filename = dentry_path(file->f_path.dentry, buf, size);
>  	if (IS_ERR(filename))
> -		return NULL;
> +		goto out;

Shouldn't this and...

>  	if (strlen(filename) < root_len ||
>  			strncmp(filename, root_path, root_len))
> -		return NULL;
> +		goto out;

this reset filename to NULL? All callers check for !filename as their
error condition.

I can fix that up as I apply this, but perhaps shout if you did this on
purpose and it needs to stay this way.

Thierry

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)