diff options
| author | Kees Cook <keescook@chromium.org> | 2018-05-01 14:01:30 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-05-02 11:11:30 -0400 |
| commit | 8ac60ffb9a83c8f0f6b3bab5c205d75a32914904 (patch) | |
| tree | 2cf6169fe64f112c23cfd632c6c413f1b050aeb6 /drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | |
| parent | 795d8098d32b6bef3d0821588cb6e4b1f369a7a4 (diff) | |
| download | op-kernel-dev-8ac60ffb9a83c8f0f6b3bab5c205d75a32914904.zip op-kernel-dev-8ac60ffb9a83c8f0f6b3bab5c205d75a32914904.tar.gz | |
net: stmmac: Avoid VLA usage
In the quest to remove all stack VLAs from the kernel[1], this switches
the "status" stack buffer to use the existing small (8) upper bound on
how many queues can be checked for DMA, and adds a sanity-check just to
make sure it doesn't operate under pathological conditions.
[1] http://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Jose Abreu <joabreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/stmicro/stmmac/stmmac_main.c')
| -rw-r--r-- | drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index 0135fd3..b935478 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -2022,7 +2022,11 @@ static void stmmac_dma_interrupt(struct stmmac_priv *priv) tx_channel_count : rx_channel_count; u32 chan; bool poll_scheduled = false; - int status[channels_to_check]; + int status[max_t(u32, MTL_MAX_TX_QUEUES, MTL_MAX_RX_QUEUES)]; + + /* Make sure we never check beyond our status buffer. */ + if (WARN_ON_ONCE(channels_to_check > ARRAY_SIZE(status))) + channels_to_check = ARRAY_SIZE(status); /* Each DMA channel can be used for rx and tx simultaneously, yet * napi_struct is embedded in struct stmmac_rx_queue rather than in a |
