EDAC, thunderx: Remove VLA usage

In the quest to remove all stack VLA usage from the kernel[1], switch to
using a kmalloc-allocated buffer instead of stack space. This should be
fine since the existing routine is allocating memory too.

Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Jan Glauber <jglauber@cavium.com>
Cc: David Daney <david.daney@cavium.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: http://lkml.kernel.org/r/20180629184850.GA37464@beast
Link: https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com
Signed-off-by: Borislav Petkov <bp@suse.de>

diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c
index 4803c6468bab4d18eafe65514344c2de02dd909c..c009d94f40c52982546fd8354c0b613d0b30237c 100644 (file)
--- a/drivers/edac/thunderx_edac.c
+++ b/drivers/edac/thunderx_edac.c
@@ -408,26 +408,29 @@ static ssize_t thunderx_lmc_inject_ecc_write(struct file *file,
                                             size_t count, loff_t *ppos)
 {
        struct thunderx_lmc *lmc = file->private_data;
-
        unsigned int cline_size = cache_line_size();
-
-       u8 tmp[cline_size];
+       u8 *tmp;
        void __iomem *addr;
        unsigned int offs, timeout = 100000;
 
        atomic_set(&lmc->ecc_int, 0);
 
        lmc->mem = alloc_pages_node(lmc->node, GFP_KERNEL, 0);
-
        if (!lmc->mem)
                return -ENOMEM;
 
+       tmp = kmalloc(cline_size, GFP_KERNEL);
+       if (!tmp) {
+               __free_pages(lmc->mem, 0);
+               return -ENOMEM;
+       }
+
        addr = page_address(lmc->mem);
 
        while (!atomic_read(&lmc->ecc_int) && timeout--) {
                stop_machine(inject_ecc_fn, lmc, NULL);
 
-               for (offs = 0; offs < PAGE_SIZE; offs += sizeof(tmp)) {
+               for (offs = 0; offs < PAGE_SIZE; offs += cline_size) {
                        /*
                         * Do a load from the previously rigged location
                         * This should generate an error interrupt.
@@ -437,6 +440,7 @@ static ssize_t thunderx_lmc_inject_ecc_write(struct file *file,
                }
        }
 
+       kfree(tmp);
        __free_pages(lmc->mem, 0);
 
        return count;