rtc: remove VLA usage
PATCH v2 1/1 rtc: remove VLA usage
In preparation to enabling -Wvla, remove VLA and replace it with a fixed-length array instead.
Quoted 1 line
From a security viewpoint, the use of Variable Length Arrays can be
a vector for stack overflow attacks. Also, in general, as the code evolves it is easy to lose track of how big a VLA can get. Thus, we can end up having segfaults that are hard to debug.
Also, fixed as part of the directive to remove all VLAs from the kernel: https://lkml.org/lkml/2018/3/7/621
---
Changes in v2:
- Update changelog as per Alexandre Belloni request.
- Update the code for rtc-bq32k driver based on Alexandre's feedback.
drivers/rtc/rtc-bq32k.c | 6 +++++- drivers/rtc/rtc-mcp795.c | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/rtc/rtc-bq32k.c +5 -1
@@ -36,6 +36,10 @@#define BQ32K_CFG2 0x09/* Trickle charger control */ #define BQ32K_TCFE BIT(6)/* Trickle charge FET bypass */ +#define MAX_LEN 10/* Maximum number of consecutive +* register for this particular RTC. +*/ +struct bq32k_regs {uint8_t seconds;uint8_t minutes;
@@ -74,7 +78,7 @@ static int bq32k_read(struct device *dev, void *data, uint8_t off, uint8_t len)static int bq32k_write (struct device *dev,void *data,uint8_t off,uint8_t len) {struct i2c_client *client =to_i2c_client (dev); -uint8_t buffer[len +1 ]; +uint8_t buffer[MAX_LEN +1 ]; buffer[0 ] = off;memcpy (&buffer[1 ], data, len);
drivers/rtc/rtc-mcp795.c +1 -1
@@ -82,7 +82,7 @@ static int mcp795_rtcc_write(struct device *dev, u8 addr, u8 *data, u8 count) {struct spi_device *spi =to_spi_device (dev);int ret; -u8 tx[2 + count]; +u8 tx[257 ]; tx[0 ] =MCP795_WRITE ; tx[1 ] = addr;
Signature · 1 line
2.7.4
Quoted 11 lines · Gustavo A. R. Silva
In preparation to enabling -Wvla, remove VLA and replace it with a fixed-length array instead.
From a security viewpoint, the use of Variable Length Arrays can be a vector for stack overflow attacks. Also, in general, as the code evolves it is easy to lose track of how big a VLA can get. Thus, we can end up having segfaults that are hard to debug.
Also, fixed as part of the directive to remove all VLAs from the kernel: https://lkml.org/lkml/2018/3/7/621
That is a good description, thanks
Quoted 10 lines
Signed-off-by Gustavo A. R. Silva <[email protected]>---
Changes in v2:
- Update changelog as per Alexandre Belloni request.
- Update the code for rtc-bq32k driver based on Alexandre's feedback.drivers/rtc/rtc-bq32k.c | 6 +++++- drivers/rtc/rtc-mcp795.c | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-)
Applied.
Signature · 3 lines
Alexandre Belloni, Bootlin (formerly Free Electrons) Embedded Linux and Kernel engineering https://bootlin.com