From e9594a695d0ecf6dbed34563c696100e04ca5766 Mon Sep 17 00:00:00 2001 From: Jordan Crouse Date: Mon, 16 Dec 2019 12:27:51 -0700 Subject: [PATCH] msm: cvp: Avoid overflowing the stack frame Building with llvm generates the following warning: drivers/media/platform/msm/cvp//msm_cvp_ioctl.c:611:13: warning: stack frame size of 2064 bytes in function 'cvp_ioctl' [-Wframe-larger-than=] struct cvp_kmd_hfi_packet is 1880 bytes and is a member of a union inside struct cvp_kmd_arg which eventually triggers the warning. Allocate the struct from the heap instead. Fixes: ffe925cbcad6 ("msm: cvp: Port CVP driver to 5.x kernel") Change-Id: Ic0dedbad82d36b7faade85c3428b1013b527b576 Signed-off-by: Jordan Crouse --- .../media/platform/msm/cvp/msm_cvp_ioctl.c | 22 ++++++++++++------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/drivers/media/platform/msm/cvp/msm_cvp_ioctl.c b/drivers/media/platform/msm/cvp/msm_cvp_ioctl.c index ab2103f52d6e..d52a0689ac41 100644 --- a/drivers/media/platform/msm/cvp/msm_cvp_ioctl.c +++ b/drivers/media/platform/msm/cvp/msm_cvp_ioctl.c @@ -526,34 +526,40 @@ static long cvp_ioctl(struct msm_cvp_inst *inst, unsigned int cmd, unsigned long arg) { int rc; - struct cvp_kmd_arg karg; + struct cvp_kmd_arg *karg; if (!inst) { dprintk(CVP_ERR, "%s: invalid params\n", __func__); return -EINVAL; } - memset(&karg, 0, sizeof(struct cvp_kmd_arg)); + karg = kzalloc(sizeof(*karg), GFP_KERNEL); + if (!karg) + return -ENOMEM; - if (convert_from_user(&karg, arg, inst)) { + if (convert_from_user(karg, arg, inst)) { dprintk(CVP_ERR, "%s: failed to get from user cmd %x\n", - __func__, karg.type); + __func__, karg->type); + kfree(karg); return -EFAULT; } - rc = msm_cvp_private((void *)inst, cmd, &karg); + rc = msm_cvp_private((void *)inst, cmd, karg); if (rc) { dprintk(CVP_ERR, "%s: failed cmd type %x %d\n", - __func__, karg.type, rc); + __func__, karg->type, rc); + kfree(karg); return rc; } - if (convert_to_user(&karg, arg)) { + if (convert_to_user(karg, arg)) { dprintk(CVP_ERR, "%s: failed to copy to user cmd %x\n", - __func__, karg.type); + __func__, karg->type); + kfree(karg); return -EFAULT; } + kfree(karg); return rc; }