mtd: nftl: Remove VLA usage

On the quest to remove all stack VLAs from the kernel[1] this changes
the check_free_sectors() routine to use a kmalloc()ed buffer instead
of a large VLA stack buffer.

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>

diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
index aab4f68bd36fc71882900274aaf3791cf38d3ab8..2d598412972dcd3f6350fae3d9c9b8481811824b 100644 (file)
--- a/drivers/mtd/inftlmount.c
+++ b/drivers/mtd/inftlmount.c
@@ -334,28 +334,37 @@ static int memcmpb(void *a, int c, int n)
 static int check_free_sectors(struct INFTLrecord *inftl, unsigned int address,
        int len, int check_oob)
 {
-       u8 buf[SECTORSIZE + inftl->mbd.mtd->oobsize];
        struct mtd_info *mtd = inftl->mbd.mtd;
        size_t retlen;
-       int i;
+       int i, ret;
+       u8 *buf;
+
+       buf = kmalloc(SECTORSIZE + mtd->oobsize, GFP_KERNEL);
+       if (!buf)
+               return -1;
 
+       ret = -1;
        for (i = 0; i < len; i += SECTORSIZE) {
                if (mtd_read(mtd, address, SECTORSIZE, &retlen, buf))
-                       return -1;
+                       goto out;
                if (memcmpb(buf, 0xff, SECTORSIZE) != 0)
-                       return -1;
+                       goto out;
 
                if (check_oob) {
                        if(inftl_read_oob(mtd, address, mtd->oobsize,
                                          &retlen, &buf[SECTORSIZE]) < 0)
-                               return -1;
+                               goto out;
                        if (memcmpb(buf + SECTORSIZE, 0xff, mtd->oobsize) != 0)
-                               return -1;
+                               goto out;
                }
                address += SECTORSIZE;
        }
 
-       return 0;
+       ret = 0;
+
+out:
+       kfree(buf);
+       return ret;
 }
 
 /*

diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
index a6fbfa4e57999d9717286f2647333f34137ccb57..6281da3dadaca4a8b50cd4da57ec060b381b9b6e 100644 (file)
--- a/drivers/mtd/nftlmount.c
+++ b/drivers/mtd/nftlmount.c
@@ -272,28 +272,37 @@ static int memcmpb(void *a, int c, int n)
 static int check_free_sectors(struct NFTLrecord *nftl, unsigned int address, int len,
                              int check_oob)
 {
-       u8 buf[SECTORSIZE + nftl->mbd.mtd->oobsize];
        struct mtd_info *mtd = nftl->mbd.mtd;
        size_t retlen;
-       int i;
+       int i, ret;
+       u8 *buf;
+
+       buf = kmalloc(SECTORSIZE + mtd->oobsize, GFP_KERNEL);
+       if (!buf)
+               return -1;
 
+       ret = -1;
        for (i = 0; i < len; i += SECTORSIZE) {
                if (mtd_read(mtd, address, SECTORSIZE, &retlen, buf))
-                       return -1;
+                       goto out;
                if (memcmpb(buf, 0xff, SECTORSIZE) != 0)
-                       return -1;
+                       goto out;
 
                if (check_oob) {
                        if(nftl_read_oob(mtd, address, mtd->oobsize,
                                         &retlen, &buf[SECTORSIZE]) < 0)
-                               return -1;
+                               goto out;
                        if (memcmpb(buf + SECTORSIZE, 0xff, mtd->oobsize) != 0)
-                               return -1;
+                               goto out;
                }
                address += SECTORSIZE;
        }
 
-       return 0;
+       ret = 0;
+
+out:
+       kfree(buf);
+       return ret;
 }
 
 /* NFTL_format: format a Erase Unit by erasing ALL Erase Zones in the Erase Unit and