lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 9 Aug 2021 16:32:27 -0500
From:   "Gustavo A. R. Silva" <>
To:     Brian Norris <>,
        "Gustavo A. R. Silva" <>
Cc:     Amitkumar Karwar <>,
        Ganapathi Bhat <>,
        Sharvari Harisangam <>,
        Xinming Hu <>,
        Kalle Valo <>,
        "David S. Miller" <>,
        Jakub Kicinski <>,
        linux-wireless <>,,
        Linux Kernel <>,
Subject: Re: [PATCH][next] mwifiex: usb: Replace one-element array with
 flexible-array member

On 8/9/21 16:24, Brian Norris wrote:
> On Mon, Aug 9, 2021 at 2:08 PM Gustavo A. R. Silva
> <> wrote:
>> There is a regular need in the kernel to provide a way to declare having
>> a dynamically sized set of trailing elements in a structure. Kernel code
>> should always use “flexible array members”[1] for these cases. The older
>> style of one-element or zero-length arrays should no longer be used[2].
>> This helps with the ongoing efforts to globally enable -Warray-bounds
>> and get us closer to being able to tighten the FORTIFY_SOURCE routines
>> on memcpy().
>> This issue was found with the help of Coccinelle and audited and fixed,
>> manually.
>> [1]
>> [2]
>> Link:
>> Link:
>> Signed-off-by: Gustavo A. R. Silva <>
> An important part of your patch rationale should include determining
> that the 1-length wasn't actually important anywhere. I double checked
> for you, and nobody seemed to be relying on 'sizeof struct fw_data' at
> all, so this should be OK:

I always do that. That's the reason why I included this line in the
changelog text:

"This issue was found with the help of Coccinelle and audited and fixed,

Thanks for double-checking, though. :)

> Reviewed-by: Brian Norris <>


Powered by blists - more mailing lists