Commit fa7845cf authored Aug 09, 2021 by Kees Cook

treewide: Replace open-coded flex arrays in unions



In support of enabling -Warray-bounds and -Wzero-length-bounds and
correctly handling run-time memcpy() bounds checking, replace all
open-coded flexible arrays (i.e. 0-element arrays) in unions with the
DECLARE_FLEX_ARRAY() helper macro.

This fixes warnings such as:

fs/hpfs/anode.c: In function 'hpfs_add_sector_to_btree':
fs/hpfs/anode.c:209:27: warning: array subscript 0 is outside the bounds of an interior zero-length array 'struct bplus_internal_node[0]' [-Wzero-length-bounds]
  209 |    anode->btree.u.internal[0].down = cpu_to_le32(a);
      |    ~~~~~~~~~~~~~~~~~~~~~~~^~~
In file included from fs/hpfs/hpfs_fn.h:26,
                 from fs/hpfs/anode.c:10:
fs/hpfs/hpfs.h:412:32: note: while referencing 'internal'
  412 |     struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving
      |                                ^~~~~~~~

drivers/net/can/usb/etas_es58x/es58x_fd.c: In function 'es58x_fd_tx_can_msg':
drivers/net/can/usb/etas_es58x/es58x_fd.c:360:35: warning: array subscript 65535 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[]'} [-Wzero-length-bounds]
  360 |  tx_can_msg = (typeof(tx_can_msg))&es58x_fd_urb_cmd->raw_msg[msg_len];
      |                                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from drivers/net/can/usb/etas_es58x/es58x_core.h:22,
                 from drivers/net/can/usb/etas_es58x/es58x_fd.c:17:
drivers/net/can/usb/etas_es58x/es58x_fd.h:231:6: note: while referencing 'raw_msg'
  231 |   u8 raw_msg[0];
      |      ^~~~~~~

Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Ayush Sawal <ayush.sawal@chelsio.com>
Cc: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
Cc: Rohit Maheshwari <rohitm@chelsio.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Stanislaw Gruszka <stf_xl@wp.pl>
Cc: Luca Coelho <luciano.coelho@intel.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Yonghong Song <yhs@fb.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: KP Singh <kpsingh@kernel.org>
Cc: Johannes Berg <johannes.berg@intel.com>
Cc: Mordechay Goodstein <mordechay.goodstein@intel.com>
Cc: Lee Jones <lee.jones@linaro.org>
Cc: Wolfgang Grandegger <wg@grandegger.com>
Cc: Marc Kleine-Budde <mkl@pengutronix.de>
Cc: Arunachalam Santhanam <arunachalam.santhanam@in.bosch.com>
Cc: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Cc: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
Cc: linux-crypto@vger.kernel.org
Cc: ath10k@lists.infradead.org
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-scsi@vger.kernel.org
Cc: linux-can@vger.kernel.org
Cc: bpf@vger.kernel.org
Acked-by: Marc Kleine-Budde <mkl@pengutronix.de> # drivers/net/can/usb/etas_es58x/*
Signed-off-by: Kees Cook <keescook@chromium.org>

parent 3080ea55

drivers/crypto/chelsio/chcr_crypto.h

+9 −5

Original line number	Diff line number	Diff line
		@@ -222,8 +222,10 @@ struct chcr_authenc_ctx {
		};

		struct __aead_ctx {
		struct chcr_gcm_ctx gcm[0];
		struct chcr_authenc_ctx authenc[];
		union {
		DECLARE_FLEX_ARRAY(struct chcr_gcm_ctx, gcm);
		DECLARE_FLEX_ARRAY(struct chcr_authenc_ctx, authenc);
		};
		};

		struct chcr_aead_ctx {
		@@ -245,9 +247,11 @@ struct hmac_ctx {
		};

		struct __crypto_ctx {
		struct hmac_ctx hmacctx[0];
		struct ablk_ctx ablkctx[0];
		struct chcr_aead_ctx aeadctx[];
		union {
		DECLARE_FLEX_ARRAY(struct hmac_ctx, hmacctx);
		DECLARE_FLEX_ARRAY(struct ablk_ctx, ablkctx);
		DECLARE_FLEX_ARRAY(struct chcr_aead_ctx, aeadctx);
		};
		};

		struct chcr_context {

drivers/net/can/usb/etas_es58x/es581_4.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -192,7 +192,7 @@ struct es581_4_urb_cmd {
		struct es581_4_rx_cmd_ret rx_cmd_ret;
		__le64 timestamp;
		u8 rx_cmd_ret_u8;
		u8 raw_msg[0];
		DECLARE_FLEX_ARRAY(u8, raw_msg);
		} __packed;

		__le16 reserved_for_crc16_do_not_use;

drivers/net/can/usb/etas_es58x/es58x_fd.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -219,7 +219,7 @@ struct es58x_fd_urb_cmd {
		struct es58x_fd_tx_ack_msg tx_ack_msg;
		__le64 timestamp;
		__le32 rx_cmd_ret_le32;
		u8 raw_msg[0];
		DECLARE_FLEX_ARRAY(u8, raw_msg);
		} __packed;

		__le16 reserved_for_crc16_do_not_use;

drivers/net/wireless/ath/ath10k/htt.h

+5 −2

Original line number	Diff line number	Diff line
		@@ -1674,8 +1674,11 @@ struct htt_tx_fetch_ind {
		__le32 token;
		__le16 num_resp_ids;
		__le16 num_records;
		__le32 resp_ids[0]; /* ath10k_htt_get_tx_fetch_ind_resp_ids() */
		struct htt_tx_fetch_record records[];
		union {
		/* ath10k_htt_get_tx_fetch_ind_resp_ids() */
		DECLARE_FLEX_ARRAY(__le32, resp_ids);
		DECLARE_FLEX_ARRAY(struct htt_tx_fetch_record, records);
		};
		} __packed;

		static inline void *

drivers/net/wireless/intel/iwlegacy/commands.h

+4 −2

Original line number	Diff line number	Diff line
		@@ -1408,8 +1408,10 @@ struct il3945_tx_cmd {
		* MAC header goes here, followed by 2 bytes padding if MAC header
		* length is 26 or 30 bytes, followed by payload data
		*/
		u8 payload[0];
		struct ieee80211_hdr hdr[];
		union {
		DECLARE_FLEX_ARRAY(u8, payload);
		DECLARE_FLEX_ARRAY(struct ieee80211_hdr, hdr);
		};
		} __packed;

		/*