| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20210818081118.1667663-3-keescook@chromium.org>
Date: Wed, 18 Aug 2021 01:11:15 -0700
From: Kees Cook <keescook@...omium.org>
To: linux-kernel@...r.kernel.org
Cc: Kees Cook <keescook@...omium.org>,
"Gustavo A. R. Silva" <gustavoars@...nel.org>,
Arnd Bergmann <arnd@...db.de>,
Ayush Sawal <ayush.sawal@...lsio.com>,
Vinay Kumar Yadav <vinay.yadav@...lsio.com>,
Rohit Maheshwari <rohitm@...lsio.com>,
Herbert Xu <herbert@...dor.apana.org.au>,
"David S. Miller" <davem@...emloft.net>,
Kalle Valo <kvalo@...eaurora.org>,
Jakub Kicinski <kuba@...nel.org>,
Stanislaw Gruszka <stf_xl@...pl>,
Luca Coelho <luciano.coelho@...el.com>,
"James E.J. Bottomley" <jejb@...ux.ibm.com>,
"Martin K. Petersen" <martin.petersen@...cle.com>,
Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Andrii Nakryiko <andrii@...nel.org>,
Martin KaFai Lau <kafai@...com>,
Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
John Fastabend <john.fastabend@...il.com>,
KP Singh <kpsingh@...nel.org>,
Johannes Berg <johannes.berg@...el.com>,
Mordechay Goodstein <mordechay.goodstein@...el.com>,
Lee Jones <lee.jones@...aro.org>,
Wolfgang Grandegger <wg@...ndegger.com>,
Marc Kleine-Budde <mkl@...gutronix.de>,
Arunachalam Santhanam <arunachalam.santhanam@...bosch.com>,
Vincent Mailhol <mailhol.vincent@...adoo.fr>,
Mikulas Patocka <mikulas@...ax.karlin.mff.cuni.cz>,
linux-crypto@...r.kernel.org, ath10k@...ts.infradead.org,
linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
linux-scsi@...r.kernel.org, linux-can@...r.kernel.org,
bpf@...r.kernel.org, clang-built-linux@...glegroups.com,
linux-hardening@...r.kernel.org
Subject: [PATCH 2/5] treewide: Replace open-coded flex arrays in unions
In support of enabling -Warray-bounds and -Wzero-length-bounds and
correctly handling run-time memcpy() bounds checking, replace all
open-coded flexible arrays (i.e. 0-element arrays) in unions with the
flex_array() helper macro.
This fixes warnings such as:
fs/hpfs/anode.c: In function 'hpfs_add_sector_to_btree':
fs/hpfs/anode.c:209:27: warning: array subscript 0 is outside the bounds of an interior zero-length array 'struct bplus_internal_node[0]' [-Wzero-length-bounds]
209 | anode->btree.u.internal[0].down = cpu_to_le32(a);
| ~~~~~~~~~~~~~~~~~~~~~~~^~~
In file included from fs/hpfs/hpfs_fn.h:26,
from fs/hpfs/anode.c:10:
fs/hpfs/hpfs.h:412:32: note: while referencing 'internal'
412 | struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving
| ^~~~~~~~
drivers/net/can/usb/etas_es58x/es58x_fd.c: In function 'es58x_fd_tx_can_msg':
drivers/net/can/usb/etas_es58x/es58x_fd.c:360:35: warning: array subscript 65535 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[]'} [-Wzero-length-bounds]
360 | tx_can_msg = (typeof(tx_can_msg))&es58x_fd_urb_cmd->raw_msg[msg_len];
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from drivers/net/can/usb/etas_es58x/es58x_core.h:22,
from drivers/net/can/usb/etas_es58x/es58x_fd.c:17:
drivers/net/can/usb/etas_es58x/es58x_fd.h:231:6: note: while referencing 'raw_msg'
231 | u8 raw_msg[0];
| ^~~~~~~
Cc: "Gustavo A. R. Silva" <gustavoars@...nel.org>
Cc: Arnd Bergmann <arnd@...db.de>
Cc: Ayush Sawal <ayush.sawal@...lsio.com>
Cc: Vinay Kumar Yadav <vinay.yadav@...lsio.com>
Cc: Rohit Maheshwari <rohitm@...lsio.com>
Cc: Herbert Xu <herbert@...dor.apana.org.au>
Cc: "David S. Miller" <davem@...emloft.net>
Cc: Kalle Valo <kvalo@...eaurora.org>
Cc: Jakub Kicinski <kuba@...nel.org>
Cc: Stanislaw Gruszka <stf_xl@...pl>
Cc: Luca Coelho <luciano.coelho@...el.com>
Cc: "James E.J. Bottomley" <jejb@...ux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@...cle.com>
Cc: Alexei Starovoitov <ast@...nel.org>
Cc: Daniel Borkmann <daniel@...earbox.net>
Cc: Andrii Nakryiko <andrii@...nel.org>
Cc: Martin KaFai Lau <kafai@...com>
Cc: Song Liu <songliubraving@...com>
Cc: Yonghong Song <yhs@...com>
Cc: John Fastabend <john.fastabend@...il.com>
Cc: KP Singh <kpsingh@...nel.org>
Cc: Johannes Berg <johannes.berg@...el.com>
Cc: Mordechay Goodstein <mordechay.goodstein@...el.com>
Cc: Lee Jones <lee.jones@...aro.org>
Cc: Wolfgang Grandegger <wg@...ndegger.com>
Cc: Marc Kleine-Budde <mkl@...gutronix.de>
Cc: Arunachalam Santhanam <arunachalam.santhanam@...bosch.com>
Cc: Vincent Mailhol <mailhol.vincent@...adoo.fr>
Cc: Mikulas Patocka <mikulas@...ax.karlin.mff.cuni.cz>
Cc: linux-crypto@...r.kernel.org
Cc: ath10k@...ts.infradead.org
Cc: linux-wireless@...r.kernel.org
Cc: netdev@...r.kernel.org
Cc: linux-scsi@...r.kernel.org
Cc: linux-can@...r.kernel.org
Cc: bpf@...r.kernel.org
Signed-off-by: Kees Cook <keescook@...omium.org>
---
drivers/crypto/chelsio/chcr_crypto.h | 14 +++++++++-----
drivers/net/can/usb/etas_es58x/es581_4.h | 2 +-
drivers/net/can/usb/etas_es58x/es58x_fd.h | 2 +-
drivers/net/wireless/ath/ath10k/htt.h | 7 +++++--
drivers/net/wireless/intel/iwlegacy/commands.h | 6 ++++--
drivers/net/wireless/intel/iwlwifi/dvm/commands.h | 6 ++++--
drivers/net/wireless/intel/iwlwifi/fw/api/tx.h | 6 ++++--
drivers/scsi/aic94xx/aic94xx_sds.c | 6 ++++--
fs/hpfs/hpfs.h | 8 ++++----
include/linux/filter.h | 6 ++++--
include/scsi/sas.h | 12 ++++++++----
include/uapi/rdma/rdma_user_rxe.h | 6 ++++--
include/uapi/sound/asoc.h | 6 ++++--
13 files changed, 56 insertions(+), 31 deletions(-)
diff --git a/drivers/crypto/chelsio/chcr_crypto.h b/drivers/crypto/chelsio/chcr_crypto.h
index e89f9e0094b4..1cadc231c6b0 100644
--- a/drivers/crypto/chelsio/chcr_crypto.h
+++ b/drivers/crypto/chelsio/chcr_crypto.h
@@ -222,8 +222,10 @@ struct chcr_authenc_ctx {
};
struct __aead_ctx {
- struct chcr_gcm_ctx gcm[0];
- struct chcr_authenc_ctx authenc[];
+ union {
+ flex_array(struct chcr_gcm_ctx gcm[]);
+ flex_array(struct chcr_authenc_ctx authenc[]);
+ };
};
struct chcr_aead_ctx {
@@ -245,9 +247,11 @@ struct hmac_ctx {
};
struct __crypto_ctx {
- struct hmac_ctx hmacctx[0];
- struct ablk_ctx ablkctx[0];
- struct chcr_aead_ctx aeadctx[];
+ union {
+ flex_array(struct hmac_ctx hmacctx[]);
+ flex_array(struct ablk_ctx ablkctx[]);
+ flex_array(struct chcr_aead_ctx aeadctx[]);
+ };
};
struct chcr_context {
diff --git a/drivers/net/can/usb/etas_es58x/es581_4.h b/drivers/net/can/usb/etas_es58x/es581_4.h
index 4bc60a6df697..8657145dc2a9 100644
--- a/drivers/net/can/usb/etas_es58x/es581_4.h
+++ b/drivers/net/can/usb/etas_es58x/es581_4.h
@@ -192,7 +192,7 @@ struct es581_4_urb_cmd {
struct es581_4_rx_cmd_ret rx_cmd_ret;
__le64 timestamp;
u8 rx_cmd_ret_u8;
- u8 raw_msg[0];
+ flex_array(u8 raw_msg);
} __packed;
__le16 reserved_for_crc16_do_not_use;
diff --git a/drivers/net/can/usb/etas_es58x/es58x_fd.h b/drivers/net/can/usb/etas_es58x/es58x_fd.h
index ee18a87e40c0..3053e0958132 100644
--- a/drivers/net/can/usb/etas_es58x/es58x_fd.h
+++ b/drivers/net/can/usb/etas_es58x/es58x_fd.h
@@ -228,7 +228,7 @@ struct es58x_fd_urb_cmd {
struct es58x_fd_tx_ack_msg tx_ack_msg;
__le64 timestamp;
__le32 rx_cmd_ret_le32;
- u8 raw_msg[0];
+ flex_array(u8 raw_msg[]);
} __packed;
__le16 reserved_for_crc16_do_not_use;
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index ec689e3ce48a..c0729f882556 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -1674,8 +1674,11 @@ struct htt_tx_fetch_ind {
__le32 token;
__le16 num_resp_ids;
__le16 num_records;
- __le32 resp_ids[0]; /* ath10k_htt_get_tx_fetch_ind_resp_ids() */
- struct htt_tx_fetch_record records[];
+ union {
+ /* ath10k_htt_get_tx_fetch_ind_resp_ids() */
+ flex_array(__le32 resp_ids[]);
+ flex_array(struct htt_tx_fetch_record records[]);
+ };
} __packed;
static inline void *
diff --git a/drivers/net/wireless/intel/iwlegacy/commands.h b/drivers/net/wireless/intel/iwlegacy/commands.h
index 89c6671b32bc..ec0bc534c503 100644
--- a/drivers/net/wireless/intel/iwlegacy/commands.h
+++ b/drivers/net/wireless/intel/iwlegacy/commands.h
@@ -1408,8 +1408,10 @@ struct il3945_tx_cmd {
* MAC header goes here, followed by 2 bytes padding if MAC header
* length is 26 or 30 bytes, followed by payload data
*/
- u8 payload[0];
- struct ieee80211_hdr hdr[];
+ union {
+ flex_array(u8 payload[]);
+ flex_array(struct ieee80211_hdr hdr[]);
+ };
} __packed;
/*
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/commands.h b/drivers/net/wireless/intel/iwlwifi/dvm/commands.h
index 235c7a2e3483..efe205929a21 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/commands.h
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/commands.h
@@ -1251,8 +1251,10 @@ struct iwl_tx_cmd {
* MAC header goes here, followed by 2 bytes padding if MAC header
* length is 26 or 30 bytes, followed by payload data
*/
- u8 payload[0];
- struct ieee80211_hdr hdr[];
+ union {
+ flex_array(u8 payload[]);
+ flex_array(struct ieee80211_hdr hdr[]);
+ };
} __packed;
/*
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
index 24e4a82a55da..d183f4856220 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
@@ -713,8 +713,10 @@ struct iwl_mvm_compressed_ba_notif {
__le32 tx_rate;
__le16 tfd_cnt;
__le16 ra_tid_cnt;
- struct iwl_mvm_compressed_ba_ratid ra_tid[0];
- struct iwl_mvm_compressed_ba_tfd tfd[];
+ union {
+ flex_array(struct iwl_mvm_compressed_ba_ratid ra_tid[]);
+ flex_array(struct iwl_mvm_compressed_ba_tfd tfd[]);
+ };
} __packed; /* COMPRESSED_BA_RES_API_S_VER_4 */
/**
diff --git a/drivers/scsi/aic94xx/aic94xx_sds.c b/drivers/scsi/aic94xx/aic94xx_sds.c
index 46815e65f7a4..ae20b855d449 100644
--- a/drivers/scsi/aic94xx/aic94xx_sds.c
+++ b/drivers/scsi/aic94xx/aic94xx_sds.c
@@ -517,8 +517,10 @@ struct asd_ms_conn_map {
u8 num_nodes;
u8 usage_model_id;
u32 _resvd;
- struct asd_ms_conn_desc conn_desc[0];
- struct asd_ms_node_desc node_desc[];
+ union {
+ flex_array(struct asd_ms_conn_desc conn_desc[]);
+ flex_array(struct asd_ms_node_desc node_desc[]);
+ };
} __attribute__ ((packed));
struct asd_ctrla_phy_entry {
diff --git a/fs/hpfs/hpfs.h b/fs/hpfs/hpfs.h
index d92c4af3e1b4..ee26c85d57a7 100644
--- a/fs/hpfs/hpfs.h
+++ b/fs/hpfs/hpfs.h
@@ -409,10 +409,10 @@ struct bplus_header
__le16 first_free; /* offset from start of header to
first free node in array */
union {
- struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving
- subtree pointers */
- struct bplus_leaf_node external[0]; /* (external) 3-word entries giving
- sector runs */
+ /* (internal) 2-word entries giving subtree pointers */
+ flex_array(struct bplus_internal_node internal[]);
+ /* (external) 3-word entries giving sector runs */
+ flex_array(struct bplus_leaf_node external[]);
} u;
};
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 1797e8506929..6c41c03b791c 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -588,8 +588,10 @@ struct bpf_prog {
struct bpf_prog_aux *aux; /* Auxiliary fields */
struct sock_fprog_kern *orig_prog; /* Original BPF program */
/* Instructions for interpreter */
- struct sock_filter insns[0];
- struct bpf_insn insnsi[];
+ union {
+ flex_array(struct sock_filter insns[]);
+ flex_array(struct bpf_insn insnsi[]);
+ };
};
struct sk_filter {
diff --git a/include/scsi/sas.h b/include/scsi/sas.h
index 4726c1bbec65..67c63a87602f 100644
--- a/include/scsi/sas.h
+++ b/include/scsi/sas.h
@@ -323,8 +323,10 @@ struct ssp_response_iu {
__be32 sense_data_len;
__be32 response_data_len;
- u8 resp_data[0];
- u8 sense_data[];
+ union {
+ flex_array(u8 resp_data[]);
+ flex_array(u8 sense_data[]);
+ };
} __attribute__ ((packed));
struct ssp_command_iu {
@@ -554,8 +556,10 @@ struct ssp_response_iu {
__be32 sense_data_len;
__be32 response_data_len;
- u8 resp_data[0];
- u8 sense_data[];
+ union {
+ flex_array(u8 resp_data[]);
+ flex_array(u8 sense_data[]);
+ };
} __attribute__ ((packed));
struct ssp_command_iu {
diff --git a/include/uapi/rdma/rdma_user_rxe.h b/include/uapi/rdma/rdma_user_rxe.h
index e283c2220aba..fb63de88423b 100644
--- a/include/uapi/rdma/rdma_user_rxe.h
+++ b/include/uapi/rdma/rdma_user_rxe.h
@@ -141,8 +141,10 @@ struct rxe_dma_info {
__u32 sge_offset;
__u32 reserved;
union {
- __u8 inline_data[0];
- struct rxe_sge sge[0];
+ __flex_array(__fa1,
+ __u8 inline_data[]);
+ __flex_array(__fa2,
+ struct rxe_sge sge[]);
};
};
diff --git a/include/uapi/sound/asoc.h b/include/uapi/sound/asoc.h
index da61398b1f8f..aa4e9dd94d29 100644
--- a/include/uapi/sound/asoc.h
+++ b/include/uapi/sound/asoc.h
@@ -240,8 +240,10 @@ struct snd_soc_tplg_vendor_array {
struct snd_soc_tplg_private {
__le32 size; /* in bytes of private data */
union {
- char data[0];
- struct snd_soc_tplg_vendor_array array[0];
+ __flex_array(__fa1,
+ char data[]);
+ __flex_array(__fa2,
+ struct snd_soc_tplg_vendor_array array[]);
};
} __attribute__((packed));
--
2.30.2
Powered by blists - more mailing lists