linux-kernel - [PATCH v3 0/4] Add ARRAY_END(), and use it to fix off-by-one bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cover.1762711279.git.alx@kernel.org>
Date: Sun, 9 Nov 2025 19:06:49 +0100
From: Alejandro Colomar <alx@...nel.org>
To: linux-kernel@...r.kernel.org, linux-mm@...ck.org
Cc: Alejandro Colomar <alx@...nel.org>, Kees Cook <kees@...nel.org>, 
	Christopher Bazley <chris.bazley.wg14@...il.com>, Rasmus Villemoes <linux@...musvillemoes.dk>, 
	Marco Elver <elver@...gle.com>, Michal Hocko <mhocko@...e.com>, 
	Linus Torvalds <torvalds@...ux-foundation.org>, Al Viro <viro@...iv.linux.org.uk>, 
	Alexander Potapenko <glider@...gle.com>, Dmitry Vyukov <dvyukov@...gle.com>, Jann Horn <jannh@...gle.com>, 
	Andrew Morton <akpm@...ux-foundation.org>
Subject: [PATCH v3 0/4] Add ARRAY_END(), and use it to fix off-by-one bugs

ARRAY_END() is a macro to calculate a pointer to one past the last
element of an array argument.  This is a very common pointer, which is
used to iterate over all elements of an array:

        for (T *p = a; p < ARRAY_END(a); p++)
                ...

Of course, this pointer should never be dereferenced.  A pointer one
past the last element of an array should not be dereferenced; it's
perfectly fine to hold such a pointer --and a good thing to do--, but
the only thing it should be used for is comparing it with other pointers
derived from the same array.

Due to how special these pointers are, it would be good to use
consistent naming.  It's common to name such a pointer 'end' --in fact,
we have many such cases in the kernel--.  C++ even standardized this
name with std::end().  Let's try naming such pointers 'end', and try
also avoid using 'end' for pointers that are not the result of
ARRAY_END().

It has been incorrectly suggested that these pointers are dangerous, and
that they should never be used, suggesting to use something like

	#define ARRAY_LAST(a)  ((a) + ARRAY_SIZE(a) - 1)

	for (T *p = a; p <= ARRAY_LAST(a); p++)
		...

This is bogus, as it doesn't scale down to arrays of 0 elements.  In the
case of an array of 0 elements, ARRAY_LAST() would underflow the
pointer, which not only it can't be dereferenced, it can't even be held.
That would be a footgun.  Such arrays don't exist per the C standard;
however, GCC supports them as an extension (with partial support,
though; GCC has a few bugs which need to be fixed).

This patch set fixes a few places where it was intended to use the array
end (that is, one past the last element), but accidentally a pointer to
the last element was used instead, thus wasting one byte.

It also replaces other places where the array end was correctly
calculated with ARRAY_SIZE(), by using the simpler ARRAY_END().

Also, there was one drivers/ file that already defined this macro.  We
remove that definition, to not conflict with this one.

---

Hi!

Changes in v3:

-  Fix commit message.
-  Remove old definition from "drivers/block/floppy.c".
   [Reported-by: kernel test robot <lkp@...el.com>]
-  Use definition of ARRAY_END() with array notation.  There's work in
   the C committee to make array notation slightly safer than pointer
   arithmetic.

Have a lovely night!
Alex

Alejandro Colomar (4):
  array_size.h: Add ARRAY_END()
  mm: Fix benign off-by-one bugs
  kernel: Fix off-by-one benign bugs
  mm: Use ARRAY_END() instead of open-coding it

 drivers/block/floppy.c     | 2 --
 include/linux/array_size.h | 6 ++++++
 kernel/kcsan/kcsan_test.c  | 4 ++--
 mm/kfence/kfence_test.c    | 4 ++--
 mm/kmemleak.c              | 2 +-
 mm/kmsan/kmsan_test.c      | 2 +-
 mm/memcontrol-v1.c         | 4 ++--
 7 files changed, 14 insertions(+), 10 deletions(-)

Range-diff against v2:
1:  35255c1ceb54 ! 1:  2cb4ddff93b3 array_size.h: Add ARRAY_END()
    @@ Commit message
         the array argument.  This pointer is useful for iterating over the
         elements of an array:

    -            for (T *p = a, p < ENDOF(a); p++)
    +            for (T *p = a, p < ARRAY_END(a); p++)
                         ...

         Cc: Kees Cook <kees@...nel.org>
    @@ Commit message
         Signed-off-by: Alejandro Colomar <alx@...nel.org>
         Message-ID: <37b1088dbd01a21d2f9d460aa510726119b3bcb0.1752193588.git.alx@...nel.org>

    + ## drivers/block/floppy.c ##
    +@@ drivers/block/floppy.c: static void floppy_release_allocated_regions(int fdc, const struct io_region *p)
    + 	}
    + }
    + 
    +-#define ARRAY_END(X) (&((X)[ARRAY_SIZE(X)]))
    +-
    + static int floppy_request_regions(int fdc)
    + {
    + 	const struct io_region *p;
    +
      ## include/linux/array_size.h ##
     @@
       */
    @@ include/linux/array_size.h
     + * ARRAY_END - get a pointer to one past the last element in array @a
     + * @a: array
     + */
    -+#define ARRAY_END(a)  (a + ARRAY_SIZE(a))
    ++#define ARRAY_END(a)  (&(a)[ARRAY_SIZE(a)])
     +
      #endif  /* _LINUX_ARRAY_SIZE_H */
2:  acd8bcbb05d3 = 2:  831155f02bec mm: Fix benign off-by-one bugs
3:  781cce547eb2 = 3:  d8128f0c8b9f kernel: Fix off-by-one benign bugs
4:  094878542457 = 4:  9646a1d194a5 mm: Use ARRAY_END() instead of open-coding it
-- 
2.51.0