firmware: raspberrypi: Remove VLA usage

In the quest to remove all stack VLA usage from the kernel[1], this
removes the VLA in favor of a maximum size and adds a sanity check.
Existing callers of the firmware interface never need more than 24
bytes (struct gpio_set_config). This chooses 32 just to stay ahead
of future growth.

v2: Fix the length passed to rpi_firmware_property_list (by anholt,
    acked by Kees).

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Eric Anholt <eric@anholt.net>

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index 0602626..a200a21 100644 (file)
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -21,6 +21,8 @@
 #define MBOX_DATA28(msg)               ((msg) & ~0xf)
 #define MBOX_CHAN_PROPERTY             8
 
+#define MAX_RPI_FW_PROP_BUF_SIZE       32
+
 static struct platform_device *rpi_hwmon;
 
 struct rpi_firmware {
@@ -145,18 +147,22 @@ int rpi_firmware_property(struct rpi_firmware *fw,
        /* Single tags are very small (generally 8 bytes), so the
         * stack should be safe.
         */
-       u8 data[buf_size + sizeof(struct rpi_firmware_property_tag_header)];
+       u8 data[sizeof(struct rpi_firmware_property_tag_header) +
+               MAX_RPI_FW_PROP_BUF_SIZE];
        struct rpi_firmware_property_tag_header *header =
                (struct rpi_firmware_property_tag_header *)data;
        int ret;
 
+       if (WARN_ON(buf_size > sizeof(data) - sizeof(*header)))
+               return -EINVAL;
+
        header->tag = tag;
        header->buf_size = buf_size;
        header->req_resp_size = 0;
        memcpy(data + sizeof(struct rpi_firmware_property_tag_header),
               tag_data, buf_size);
 
-       ret = rpi_firmware_property_list(fw, &data, sizeof(data));
+       ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));
        memcpy(tag_data,
               data + sizeof(struct rpi_firmware_property_tag_header),
               buf_size);