linux-kernel - Re: [PATCH][next] zd1211rw/zd_usb.h: Replace zero-length array with flexible-array member

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 Mar 2020 18:07:35 -0400
From:   Jes Sorensen <jes.sorensen@...il.com>
To:     "Gustavo A. R. Silva" <gustavo@...eddedor.com>,
        Kalle Valo <kvalo@...eaurora.org>
Cc:     Joe Perches <joe@...ches.com>, Daniel Drake <dsd@...too.org>,
        Ulrich Kunitz <kune@...ne-taler.de>,
        "David S. Miller" <davem@...emloft.net>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH][next] zd1211rw/zd_usb.h: Replace zero-length array with
 flexible-array member

On 3/10/20 5:52 PM, Gustavo A. R. Silva wrote:
> 
> 
> On 3/10/20 8:56 AM, Kalle Valo wrote:
>> + jes
>>
>> "Gustavo A. R. Silva" <gustavo@...eddedor.com> writes:
>>>> I wrote in a confusing way, my question above was about the actual patch
>>>> and not the the title. For example, Jes didn't like this style change:
>>>>
>>>> https://patchwork.kernel.org/patch/11402315/
>>>>
>>>
>>> It doesn't seem that that comment adds a lot to the conversation. The only
>>> thing that it says is literally "fix the compiler". By the way, more than
>>> a hundred patches have already been applied to linux-next[1] and he seems
>>> to be the only person that has commented such a thing.
>>
>> But I also asked who prefers this format in that thread, you should not
>> ignore questions from two maintainers (me and Jes).
>>
> 
> I'm sorry. I thought the changelog text had already the proper information.
> In the changelog text I'm quoting the GCC documentation below:
> 
> "The preferred mechanism to declare variable-length types like struct line
> above is the ISO C99 flexible array member..." [1]
> 
> I'm also including a link to the following KSPP open issue:
> 
> https://github.com/KSPP/linux/issues/21
> 
> The issue above mentions the following:
> 
> "Both cases (0-byte and 1-byte arrays) pose confusion for things like sizeof(),
> CONFIG_FORTIFY_SOURCE."
> 
> sizeof(flexible-array-member) triggers a warning because flexible array members have
> incomplete type[1]. There are some instances of code in which the sizeof operator
> is being incorrectly/erroneously applied to zero-length arrays and the result is zero.
> Such instances may be hiding some bugs. So, the idea is also to get completely rid
> of those sorts of issues.

As I stated in my previous answer, this seems more code churn than an
actual fix. If this is a real problem, shouldn't the work be put into
fixing the compiler to handle foo[0] instead? It seems that is where the
real value would be.

Thanks,
Jes