KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
81 stars 5 forks source link

Replace fake flexible-array declarations with the DECLARE_FLEX_ARRAY() helper macro #193

Closed GustavoARSilva closed 7 months ago

GustavoARSilva commented 2 years ago

Dependent bugs:

Replace all fake flexible arrays (i.e. zero-length and one-element arrays) in unions and structs with the DECLARE_FLEX_ARRAY() helper macro.

In cases where two or more flexible arrays are needed in a structure, all of them should be declared through the DECLARE_FLEX_ARRAY() helper and within a union. See:

diff --git a/include/linux/filter.h b/include/linux/filter.h
index 4a93c12543ee2..4298c5e428a37 100644
--- a/[include/linux/filter.h](https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/include/linux/filter.h?id=3080ea5553cc909b000d1f1d964a9041962f2c5b)
+++ b/[include/linux/filter.h](https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/include/linux/filter.h?id=fa7845cfd53f3b1d3f60efa55db89805595bc045)
@@ -586,8 +586,10 @@ struct bpf_prog {
    struct bpf_prog_aux *aux;       /* Auxiliary fields */
    struct sock_fprog_kern  *orig_prog; /* Original BPF program */
    /* Instructions for interpreter */
-   struct sock_filter  insns[0];
-   struct bpf_insn     insnsi[];
+   union {
+       DECLARE_FLEX_ARRAY(struct sock_filter, insns);
+       DECLARE_FLEX_ARRAY(struct bpf_insn, insnsi);
+   };
 };

 struct sk_filter {

All fake flexible arrays in unions should be declared through the DECLARE_FLEX_ARRAY() helper. See:

--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -229,7 +229,7 @@ struct dp_audio_infoframe {
 union audio_infoframe {
        struct hdmi_audio_infoframe hdmi;
        struct dp_audio_infoframe dp;
-       u8 bytes[0];
+       DECLARE_FLEX_ARRAY(u8, bytes);
 };

Any fake flexible array alone in a struct should be declared through the DECLARE_FLEX_ARRAY() helper. See:

 union bmi_resp {
    struct {
-       u8 payload[0];
+       DECLARE_FLEX_ARRAY(u8, payload);
    } read_mem;
    struct {
        __le32 result;

For more details and examples: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3080ea5553cc909b000d1f1d964a9041962f2c5b https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa7845cfd53f3b1d3f60efa55db89805595bc045 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=47c662486cccf03e7062139d069b07ab0126ef59

kees commented 7 months ago

All of these are done. Closing the issue.