[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Y5ouq4Tkc4V/dlCi@mail.google.com>
Date: Thu, 15 Dec 2022 09:14:35 +1300
From: Paulo Miguel Almeida <paulo.miguel.almeida.rodenas@...il.com>
To: Kees Cook <keescook@...omium.org>
Cc: Arnd Bergmann <arnd@...db.de>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Ilpo Järvinen <ilpo.jarvinen@...ux.intel.com>,
Jiri Slaby <jirislaby@...nel.org>,
Haowen Bai <baihaowen@...zu.com>,
Andy Shevchenko <andy.shevchenko@...il.com>,
linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org,
paulo.miguel.almeida.rodenas@...il.com
Subject: Re: [PATCH] [next] pcmcia: synclink_cs: replace 1-element array with
flex-array member
On Wed, Dec 14, 2022 at 11:29:37AM -0800, Kees Cook wrote:
> On Wed, Dec 14, 2022 at 09:42:00PM +1300, Paulo Miguel Almeida wrote:
> > One-element arrays are deprecated, and we are replacing them with
> > flexible array members instead. So, replace one-element array with
> > flexible-array member in struct RXBUF and refactor the rest of the code
> > accordingly.
> >
> > It's worth mentioning that doing a build before/after this patch
> > results in no binary output differences.
> >
> > This helps with the ongoing efforts to tighten the FORTIFY_SOURCE
> > routines on memcpy() and help us make progress towards globally
> > enabling -fstrict-flex-arrays=3 [1].
> >
> > Link: https://github.com/KSPP/linux/issues/79
> > Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101836 [1]
> >
> > Signed-off-by: Paulo Miguel Almeida <paulo.miguel.almeida.rodenas@...il.com>
> > ---
> > drivers/char/pcmcia/synclink_cs.c | 5 +++--
> > 1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
> > index b2735be81ab2..1ab2d552f498 100644
> > --- a/drivers/char/pcmcia/synclink_cs.c
> > +++ b/drivers/char/pcmcia/synclink_cs.c
> > @@ -105,7 +105,7 @@ static MGSL_PARAMS default_params = {
> > typedef struct {
> > int count;
> > unsigned char status;
> > - char data[1];
> > + char data[];
> > } RXBUF;
> >
> > /* The queue of BH actions to be performed */
> > @@ -2611,7 +2611,8 @@ static int mgslpc_proc_show(struct seq_file *m, void *v)
> > static int rx_alloc_buffers(MGSLPC_INFO *info)
> > {
> > /* each buffer has header and data */
> > - info->rx_buf_size = sizeof(RXBUF) + info->max_frame_size;
> > + info->rx_buf_size = max(offsetof(typeof(RXBUF), data) + 1, sizeof(RXBUF))
> > + + info->max_frame_size;
>
> It seems like there is an existing size bug here, and likely should be
> fixed separately?
>
> i.e. this was already allocating 1 byte "too much". I'd expect this
> first:
>
> - info->rx_buf_size = sizeof(RXBUF) + info->max_frame_size;
> + info->rx_buf_size = sizeof(RXBUF) - 1 + info->max_frame_size;
>
> and then the next patch:
>
> - char data[1];
> + char data[];
> ...
> - info->rx_buf_size = sizeof(RXBUF) - 1 + info->max_frame_size;
> + info->rx_buf_size = sizeof(RXBUF) + info->max_frame_size;
>
> The above would induce a binary output change, and the second would not.
>
> Though this results in what you had for the v2 patch (but I can't
> believe it had no binary changes...)
>
> --
> Kees Cook
Just realised that you made a comment on PATCH v1 and Andy made a
comment on PATCH v2. Please conside my answer for PATCH v2 as I have
abandoned the v1. Apologies for the confusion.
thanks!
- Paulo A.
Powered by blists - more mailing lists