mtd: nftl: Remove VLA usage

On the quest to remove all stack VLAs from the kernel[1] this changes
the check_free_sectors() routine to use a kmalloc()ed buffer instead
of a large VLA stack buffer.

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>

2 files changed, 32 insertions, 14 deletions

diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
index aab4f68bd36f..2d598412972d 100644
--- a/drivers/mtd/inftlmount.c
+++ b/drivers/mtd/inftlmount.c
@@ -334,28 +334,37 @@ static int memcmpb(void *a, int c, int n)
 static int check_free_sectors(struct INFTLrecord *inftl, unsigned int address,
         int len, int check_oob)
 {
-        u8 buf[SECTORSIZE + inftl->mbd.mtd->oobsize];
         struct mtd_info *mtd = inftl->mbd.mtd;
         size_t retlen;
-        int i;
+        int i, ret;
+        u8 *buf;
+
+        buf = kmalloc(SECTORSIZE + mtd->oobsize, GFP_KERNEL);
+        if (!buf)
+                return -1;
 
+        ret = -1;
         for (i = 0; i < len; i += SECTORSIZE) {
                 if (mtd_read(mtd, address, SECTORSIZE, &retlen, buf))
-                        return -1;
+                        goto out;
                 if (memcmpb(buf, 0xff, SECTORSIZE) != 0)
-                        return -1;
+                        goto out;
 
                 if (check_oob) {
                         if(inftl_read_oob(mtd, address, mtd->oobsize,
                                           &retlen, &buf[SECTORSIZE]) < 0)
-                                return -1;
+                                goto out;
                         if (memcmpb(buf + SECTORSIZE, 0xff, mtd->oobsize) != 0)
-                                return -1;
+                                goto out;
                 }
                 address += SECTORSIZE;
         }
 
-        return 0;
+        ret = 0;
+
+out:
+        kfree(buf);
+        return ret;
 }
 
 /*
diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
index a6fbfa4e5799..6281da3dadac 100644
--- a/drivers/mtd/nftlmount.c
+++ b/drivers/mtd/nftlmount.c
@@ -272,28 +272,37 @@ static int memcmpb(void *a, int c, int n)
 static int check_free_sectors(struct NFTLrecord *nftl, unsigned int address, int len,
                               int check_oob)
 {
-        u8 buf[SECTORSIZE + nftl->mbd.mtd->oobsize];
         struct mtd_info *mtd = nftl->mbd.mtd;
         size_t retlen;
-        int i;
+        int i, ret;
+        u8 *buf;
+
+        buf = kmalloc(SECTORSIZE + mtd->oobsize, GFP_KERNEL);
+        if (!buf)
+                return -1;
 
+        ret = -1;
         for (i = 0; i < len; i += SECTORSIZE) {
                 if (mtd_read(mtd, address, SECTORSIZE, &retlen, buf))
-                        return -1;
+                        goto out;
                 if (memcmpb(buf, 0xff, SECTORSIZE) != 0)
-                        return -1;
+                        goto out;
 
                 if (check_oob) {
                         if(nftl_read_oob(mtd, address, mtd->oobsize,
                                          &retlen, &buf[SECTORSIZE]) < 0)
-                                return -1;
+                                goto out;
                         if (memcmpb(buf + SECTORSIZE, 0xff, mtd->oobsize) != 0)
-                                return -1;
+                                goto out;
                 }
                 address += SECTORSIZE;
         }
 
-        return 0;
+        ret = 0;
+
+out:
+        kfree(buf);
+        return ret;
 }
 
 /* NFTL_format: format a Erase Unit by erasing ALL Erase Zones in the Erase Unit and