Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Asmaa Mnebhi <Asmaa@mellanox.com>
To:     Arnd Bergmann <arnd@arndb.de>, Corey Minyard <minyard@acm.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CC:     Vadim Pasternak <vadimp@mellanox.com>,
        Corey Minyard <cminyard@mvista.com>,
        "openipmi-developer@lists.sourceforge.net" 
        <openipmi-developer@lists.sourceforge.net>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH] ipmi: ipmb: don't allocate i2c_client on stack
Thread-Topic: [PATCH] ipmi: ipmb: don't allocate i2c_client on stack
Thread-Index: AQHVJp2fQC/TzrHQG025Fo3gniO4X6ai+YIA
Date:   Wed, 19 Jun 2019 13:39:20 +0000
Message-ID: <VI1PR05MB623982A86E259CE5F9E5A771DAE50@VI1PR05MB6239.eurprd05.prod.outlook.com>
References: <20190619125045.918700-1-arnd@arndb.de>
In-Reply-To: <20190619125045.918700-1-arnd@arndb.de>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: mellanox.com does not designate
 permitted sender hosts)
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: ddc7a073-119c-4ffe-4f61-08d6f4bb889a
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Jun 2019 13:39:20.5280
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a652971c-7d2e-4d9b-a6a4-d149256f461b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: Asmaa@mellanox.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR05MB5407
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Arnd,

LGTM.=20

-----Original Message-----
From: Arnd Bergmann <arnd@arndb.de>=20
Sent: Wednesday, June 19, 2019 8:51 AM
To: Corey Minyard <minyard@acm.org>; Greg Kroah-Hartman <gregkh@linuxfounda=
tion.org>
Cc: Arnd Bergmann <arnd@arndb.de>; Asmaa Mnebhi <Asmaa@mellanox.com>; Vadim=
 Pasternak <vadimp@mellanox.com>; Corey Minyard <cminyard@mvista.com>; open=
ipmi-developer@lists.sourceforge.net; linux-kernel@vger.kernel.org
Subject: [PATCH] ipmi: ipmb: don't allocate i2c_client on stack

The i2c_client structure can be fairly large, which leads to a warning abou=
t possible kernel stack overflow in some
configurations:

drivers/char/ipmi/ipmb_dev_int.c:115:16: error: stack frame size of 1032 by=
tes in function 'ipmb_write' [-Werror,-Wframe-larger-than=3D]

There is no real reason to even declare an i2c_client, as we can simply cal=
l i2c_smbus_xfer() directly instead of the i2c_smbus_write_block_data() wra=
pper.

Convert the ipmb_write() to use an open-coded i2c_smbus_write_block_data() =
here, without changing the behavior.

It seems that there is another problem with this implementation; when user =
space passes a length of more than I2C_SMBUS_BLOCK_MAX bytes, all the rest =
is silently ignored. This should probably be addressed in a separate patch,=
 but I don't know what the intended behavior is here.

Fixes: 51bd6f291583 ("Add support for IPMB driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 drivers/char/ipmi/ipmb_dev_int.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/char/ipmi/ipmb_dev_int.c b/drivers/char/ipmi/ipmb_dev_=
int.c
index 2895abf72e61..c9724f6cf32d 100644
--- a/drivers/char/ipmi/ipmb_dev_int.c
+++ b/drivers/char/ipmi/ipmb_dev_int.c
@@ -117,7 +117,7 @@ static ssize_t ipmb_write(struct file *file, const char=
 __user *buf,  {
 	struct ipmb_dev *ipmb_dev =3D to_ipmb_dev(file);
 	u8 rq_sa, netf_rq_lun, msg_len;
-	struct i2c_client rq_client;
+	union i2c_smbus_data data;
 	u8 msg[MAX_MSG_LEN];
 	ssize_t ret;
=20
@@ -138,17 +138,17 @@ static ssize_t ipmb_write(struct file *file, const ch=
ar __user *buf,
=20
 	/*
 	 * subtract rq_sa and netf_rq_lun from the length of the msg passed to
-	 * i2c_smbus_write_block_data_local
+	 * i2c_smbus_xfer
 	 */
 	msg_len =3D msg[IPMB_MSG_LEN_IDX] - SMBUS_MSG_HEADER_LENGTH;
-
-	strcpy(rq_client.name, "ipmb_requester");
-	rq_client.adapter =3D ipmb_dev->client->adapter;
-	rq_client.flags =3D ipmb_dev->client->flags;
-	rq_client.addr =3D rq_sa;
-
-	ret =3D i2c_smbus_write_block_data(&rq_client, netf_rq_lun, msg_len,
-					msg + SMBUS_MSG_IDX_OFFSET);
+	if (msg_len > I2C_SMBUS_BLOCK_MAX)
+		msg_len =3D I2C_SMBUS_BLOCK_MAX;
+
+	data.block[0] =3D msg_len;
+	memcpy(&data.block[1], msg + SMBUS_MSG_IDX_OFFSET, msg_len);
+	ret =3D i2c_smbus_xfer(ipmb_dev->client->adapter, rq_sa, ipmb_dev->client=
->flags,
+			     I2C_SMBUS_WRITE, netf_rq_lun,
+			     I2C_SMBUS_BLOCK_DATA, &data);
=20
 	return ret ? : count;
 }
--
2.20.0