netdev - [PATCH] bnxt_en: take coredump_record structure off stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 14 Aug 2018 00:12:45 +0200
From:   Arnd Bergmann <arnd@...db.de>
To:     Michael Chan <michael.chan@...adcom.com>,
        "David S. Miller" <davem@...emloft.net>
Cc:     Arnd Bergmann <arnd@...db.de>,
        Vasundhara Volam <vasundhara-v.volam@...adcom.com>,
        Andy Gospodarek <gospo@...adcom.com>,
        Scott Branden <scott.branden@...adcom.com>,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] bnxt_en: take coredump_record structure off stack

The bnxt_coredump_record structure is very long, causing a warning
about possible stack overflow on 32-bit architectures:

drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c: In function 'bnxt_get_coredump':
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c:2989:1: error: the frame size of 1188 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

I could not see any reason to operate on an on-stack copy of the
structure before copying it back into the caller-provided buffer, which
also simplifies the code here.

Fixes: 6c5657d085ae ("bnxt_en: Add support for ethtool get dump.")
Signed-off-by: Arnd Bergmann <arnd@...db.de>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 539be1d1b67f..e52d7af3ab3e 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -2900,7 +2900,6 @@ static int bnxt_get_coredump(struct bnxt *bp, void *buf, u32 *dump_len)
 	struct coredump_segment_record *seg_record = NULL;
 	u32 offset = 0, seg_hdr_len, seg_record_len;
 	struct bnxt_coredump_segment_hdr seg_hdr;
-	struct bnxt_coredump_record coredump_rec;
 	struct bnxt_coredump coredump = {NULL};
 	time64_t start_time;
 	u16 start_utc;
@@ -2976,14 +2975,12 @@ static int bnxt_get_coredump(struct bnxt *bp, void *buf, u32 *dump_len)
 	}
 
 err:
-	if (buf) {
-		bnxt_fill_coredump_record(bp, &coredump_rec, start_time,
+	if (buf)
+		bnxt_fill_coredump_record(bp, buf + offset, start_time,
 					  start_utc, coredump.total_segs + 1,
 					  rc);
-		memcpy(buf + offset, &coredump_rec, sizeof(coredump_rec));
-	}
 	kfree(coredump.data);
-	*dump_len += sizeof(coredump_rec);
+	*dump_len += sizeof(struct bnxt_coredump_record);
 
 	return rc;
 }
-- 
2.18.0