diff options
| author |   Arnd Bergmann <arnd@arndb.de> | 2019-06-19 14:50:34 +0200 |
|---|---|---|
| committer |   Corey Minyard <cminyard@mvista.com> | 2019-06-19 09:03:55 -0500 |
| commit | 21feadd024e747123bc0aaba8d8cbef2b5eda058 (patch) | |
| tree | 9b63a17c5f17e7aa82f0f1b2ecf6aa1c51f1e73d /drivers/char | |
| parent | ipmi: ipmb: Fix build error while CONFIG_I2C is set to m (diff) | |
| download | linux-dev-21feadd024e747123bc0aaba8d8cbef2b5eda058.tar.xz linux-dev-21feadd024e747123bc0aaba8d8cbef2b5eda058.zip | |
ipmi: ipmb: don't allocate i2c_client on stack
The i2c_client structure can be fairly large, which leads to
a warning about possible kernel stack overflow in some
configurations:
drivers/char/ipmi/ipmb_dev_int.c:115:16: error: stack frame size of 1032 bytes in function 'ipmb_write' [-Werror,-Wframe-larger-than=]
There is no real reason to even declare an i2c_client, as we can simply
call i2c_smbus_xfer() directly instead of the i2c_smbus_write_block_data()
wrapper.
Convert the ipmb_write() to use an open-coded i2c_smbus_write_block_data()
here, without changing the behavior.
It seems that there is another problem with this implementation;
when user space passes a length of more than I2C_SMBUS_BLOCK_MAX
bytes, all the rest is silently ignored. This should probably be
addressed in a separate patch, but I don't know what the intended
behavior is here.
Fixes: 51bd6f291583 ("Add support for IPMB driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Message-Id: <20190619125045.918700-1-arnd@arndb.de>
Acked-by: Asmaa Mnebhi <Asmaa@mellanox.com>
[Broke up a line >80 characters on i2c_smbus_xfer().]
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/ipmi/ipmb_dev_int.c | 21 |
1 files changed, 11 insertions, 10 deletions
diff --git a/drivers/char/ipmi/ipmb_dev_int.c b/drivers/char/ipmi/ipmb_dev_int.c index 2895abf72e61..4d608a67f9a3 100644 --- a/drivers/char/ipmi/ipmb_dev_int.c +++ b/drivers/char/ipmi/ipmb_dev_int.c @@ -117,7 +117,7 @@ static ssize_t ipmb_write(struct file *file, const char __user *buf, { struct ipmb_dev *ipmb_dev = to_ipmb_dev(file); u8 rq_sa, netf_rq_lun, msg_len; - struct i2c_client rq_client; + union i2c_smbus_data data; u8 msg[MAX_MSG_LEN]; ssize_t ret; @@ -138,17 +138,18 @@ static ssize_t ipmb_write(struct file *file, const char __user *buf, /* * subtract rq_sa and netf_rq_lun from the length of the msg passed to - * i2c_smbus_write_block_data_local + * i2c_smbus_xfer */ msg_len = msg[IPMB_MSG_LEN_IDX] - SMBUS_MSG_HEADER_LENGTH; - - strcpy(rq_client.name, "ipmb_requester"); - rq_client.adapter = ipmb_dev->client->adapter; - rq_client.flags = ipmb_dev->client->flags; - rq_client.addr = rq_sa; - - ret = i2c_smbus_write_block_data(&rq_client, netf_rq_lun, msg_len, - msg + SMBUS_MSG_IDX_OFFSET); + if (msg_len > I2C_SMBUS_BLOCK_MAX) + msg_len = I2C_SMBUS_BLOCK_MAX; + + data.block[0] = msg_len; + memcpy(&data.block[1], msg + SMBUS_MSG_IDX_OFFSET, msg_len); + ret = i2c_smbus_xfer(ipmb_dev->client->adapter, rq_sa, + ipmb_dev->client->flags, + I2C_SMBUS_WRITE, netf_rq_lun, + I2C_SMBUS_BLOCK_DATA, &data); return ret ? : count; } |