linux-hardening - Re: [PATCH v3] ethtool: Replace 0-length array with flexible array

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202301061206.30BA940F83@keescook>
Date:   Fri, 6 Jan 2023 12:07:39 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Vincent MAILHOL <mailhol.vincent@...adoo.fr>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, Andrew Lunn <andrew@...n.ch>,
        kernel test robot <lkp@...el.com>,
        Oleksij Rempel <linux@...pel-privat.de>,
        Sean Anderson <sean.anderson@...o.com>,
        Alexandru Tachici <alexandru.tachici@...log.com>,
        Amit Cohen <amcohen@...dia.com>,
        "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-hardening@...r.kernel.org
Subject: Re: [PATCH v3] ethtool: Replace 0-length array with flexible array

On Fri, Jan 06, 2023 at 02:38:18PM +0900, Vincent MAILHOL wrote:
> On Fri. 6 Jan 2023 at 13:28, Kees Cook <keescook@...omium.org> wrote:
> > [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays
> 
> Side comment, this link does not mention the __DECLARE_FLEX_ARRAY().
> It could be good to add a reference to the helper here. But of course,
> this is not a criticism of this patch.

Good point! I've sent a patch for this now.

> You may want to double check your other patches as well. At least this
> one is also using the helper when not needed:
> 
>   https://lore.kernel.org/netdev/20230105223642.never.980-kees@kernel.org/T/#u

That one does, actually, need it since otherwise the flex array would be
"alone in a struct" which is the other case that C99 irrationally
disallows.

-Kees

-- 
Kees Cook