treewide: Replace open-coded flex arrays in unions

In support of enabling -Warray-bounds and -Wzero-length-bounds and
correctly handling run-time memcpy() bounds checking, replace all
open-coded flexible arrays (i.e. 0-element arrays) in unions with the
DECLARE_FLEX_ARRAY() helper macro.

This fixes warnings such as:

fs/hpfs/anode.c: In function 'hpfs_add_sector_to_btree':
fs/hpfs/anode.c:209:27: warning: array subscript 0 is outside the bounds of an interior zero-length array 'struct bplus_internal_node[0]' [-Wzero-length-bounds]
  209 |    anode->btree.u.internal[0].down = cpu_to_le32(a);
      |    ~~~~~~~~~~~~~~~~~~~~~~~^~~
In file included from fs/hpfs/hpfs_fn.h:26,
                 from fs/hpfs/anode.c:10:
fs/hpfs/hpfs.h:412:32: note: while referencing 'internal'
  412 |     struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving
      |                                ^~~~~~~~

drivers/net/can/usb/etas_es58x/es58x_fd.c: In function 'es58x_fd_tx_can_msg':
drivers/net/can/usb/etas_es58x/es58x_fd.c:360:35: warning: array subscript 65535 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[]'} [-Wzero-length-bounds]
  360 |  tx_can_msg = (typeof(tx_can_msg))&es58x_fd_urb_cmd->raw_msg[msg_len];
      |                                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from drivers/net/can/usb/etas_es58x/es58x_core.h:22,
                 from drivers/net/can/usb/etas_es58x/es58x_fd.c:17:
drivers/net/can/usb/etas_es58x/es58x_fd.h:231:6: note: while referencing 'raw_msg'
  231 |   u8 raw_msg[0];
      |      ^~~~~~~

Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Ayush Sawal <ayush.sawal@chelsio.com>
Cc: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
Cc: Rohit Maheshwari <rohitm@chelsio.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Stanislaw Gruszka <stf_xl@wp.pl>
Cc: Luca Coelho <luciano.coelho@intel.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Yonghong Song <yhs@fb.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: KP Singh <kpsingh@kernel.org>
Cc: Johannes Berg <johannes.berg@intel.com>
Cc: Mordechay Goodstein <mordechay.goodstein@intel.com>
Cc: Lee Jones <lee.jones@linaro.org>
Cc: Wolfgang Grandegger <wg@grandegger.com>
Cc: Marc Kleine-Budde <mkl@pengutronix.de>
Cc: Arunachalam Santhanam <arunachalam.santhanam@in.bosch.com>
Cc: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Cc: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
Cc: linux-crypto@vger.kernel.org
Cc: ath10k@lists.infradead.org
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-scsi@vger.kernel.org
Cc: linux-can@vger.kernel.org
Cc: bpf@vger.kernel.org
Acked-by: Marc Kleine-Budde <mkl@pengutronix.de> # drivers/net/can/usb/etas_es58x/*
Signed-off-by: Kees Cook <keescook@chromium.org>

diff --git a/drivers/crypto/chelsio/chcr_crypto.h b/drivers/crypto/chelsio/chcr_crypto.h
index e89f9e0094b40b7d00a8fb42c98142bdbe3b474e..c7816c83e32461dd44f028a8904c5a982ca273e8 100644 (file)
--- a/drivers/crypto/chelsio/chcr_crypto.h
+++ b/drivers/crypto/chelsio/chcr_crypto.h
@@ -222,8 +222,10 @@ struct chcr_authenc_ctx {
 };
 
 struct __aead_ctx {
-       struct chcr_gcm_ctx gcm[0];
-       struct chcr_authenc_ctx authenc[];
+       union {
+               DECLARE_FLEX_ARRAY(struct chcr_gcm_ctx, gcm);
+               DECLARE_FLEX_ARRAY(struct chcr_authenc_ctx, authenc);
+       };
 };
 
 struct chcr_aead_ctx {
@@ -245,9 +247,11 @@ struct hmac_ctx {
 };
 
 struct __crypto_ctx {
-       struct hmac_ctx hmacctx[0];
-       struct ablk_ctx ablkctx[0];
-       struct chcr_aead_ctx aeadctx[];
+       union {
+               DECLARE_FLEX_ARRAY(struct hmac_ctx, hmacctx);
+               DECLARE_FLEX_ARRAY(struct ablk_ctx, ablkctx);
+               DECLARE_FLEX_ARRAY(struct chcr_aead_ctx, aeadctx);
+       };
 };
 
 struct chcr_context {

diff --git a/drivers/net/can/usb/etas_es58x/es581_4.h b/drivers/net/can/usb/etas_es58x/es581_4.h
index 4bc60a6df697dce272f985de4c7bb75eff6cefe1..667ecb77168cc3b16ff97c40ab026add915f17d1 100644 (file)
--- a/drivers/net/can/usb/etas_es58x/es581_4.h
+++ b/drivers/net/can/usb/etas_es58x/es581_4.h
@@ -192,7 +192,7 @@ struct es581_4_urb_cmd {
                struct es581_4_rx_cmd_ret rx_cmd_ret;
                __le64 timestamp;
                u8 rx_cmd_ret_u8;
-               u8 raw_msg[0];
+               DECLARE_FLEX_ARRAY(u8, raw_msg);
        } __packed;
 
        __le16 reserved_for_crc16_do_not_use;

diff --git a/drivers/net/can/usb/etas_es58x/es58x_fd.h b/drivers/net/can/usb/etas_es58x/es58x_fd.h
index a191891b8777657f20ed18c52a15f2329f207f59..c4b19a6a33ae5384671a2a4bce0ec2714074c2e4 100644 (file)
--- a/drivers/net/can/usb/etas_es58x/es58x_fd.h
+++ b/drivers/net/can/usb/etas_es58x/es58x_fd.h
@@ -219,7 +219,7 @@ struct es58x_fd_urb_cmd {
                struct es58x_fd_tx_ack_msg tx_ack_msg;
                __le64 timestamp;
                __le32 rx_cmd_ret_le32;
-               u8 raw_msg[0];
+               DECLARE_FLEX_ARRAY(u8, raw_msg);
        } __packed;
 
        __le16 reserved_for_crc16_do_not_use;

diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index ec689e3ce48a7eaf86d50977aeedcffe3f3b0c3f..a6de08d3bf4a8fdb9a7dcc801e5468ef9e95c554 100644 (file)
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -1674,8 +1674,11 @@ struct htt_tx_fetch_ind {
        __le32 token;
        __le16 num_resp_ids;
        __le16 num_records;
-       __le32 resp_ids[0]; /* ath10k_htt_get_tx_fetch_ind_resp_ids() */
-       struct htt_tx_fetch_record records[];
+       union {
+               /* ath10k_htt_get_tx_fetch_ind_resp_ids() */
+               DECLARE_FLEX_ARRAY(__le32, resp_ids);
+               DECLARE_FLEX_ARRAY(struct htt_tx_fetch_record, records);
+       };
 } __packed;
 
 static inline void *

diff --git a/drivers/net/wireless/intel/iwlegacy/commands.h b/drivers/net/wireless/intel/iwlegacy/commands.h
index 89c6671b32bcbfa8641b414686305f2eced70583..4a97310f8feebfdcd450598282960fdbd015459b 100644 (file)
--- a/drivers/net/wireless/intel/iwlegacy/commands.h
+++ b/drivers/net/wireless/intel/iwlegacy/commands.h
@@ -1408,8 +1408,10 @@ struct il3945_tx_cmd {
         * MAC header goes here, followed by 2 bytes padding if MAC header
         * length is 26 or 30 bytes, followed by payload data
         */
-       u8 payload[0];
-       struct ieee80211_hdr hdr[];
+       union {
+               DECLARE_FLEX_ARRAY(u8, payload);
+               DECLARE_FLEX_ARRAY(struct ieee80211_hdr, hdr);
+       };
 } __packed;
 
 /*

diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/commands.h b/drivers/net/wireless/intel/iwlwifi/dvm/commands.h
index 235c7a2e3483f145acd68278eba8f6dde4cca380..75a4b8e26232c3d71cdb57fa110a54ba3583d442 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/dvm/commands.h
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/commands.h
@@ -1251,8 +1251,10 @@ struct iwl_tx_cmd {
         * MAC header goes here, followed by 2 bytes padding if MAC header
         * length is 26 or 30 bytes, followed by payload data
         */
-       u8 payload[0];
-       struct ieee80211_hdr hdr[];
+       union {
+               DECLARE_FLEX_ARRAY(u8, payload);
+               DECLARE_FLEX_ARRAY(struct ieee80211_hdr, hdr);
+       };
 } __packed;
 
 /*

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
index 24e4a82a55da1ecdbb0164bdce004809655bc27f..5fddfd39194142c2aa13cd03367b4af3e868b052 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
@@ -239,8 +239,10 @@ struct iwl_tx_cmd {
        u8 tid_tspec;
        __le16 pm_frame_timeout;
        __le16 reserved4;
-       u8 payload[0];
-       struct ieee80211_hdr hdr[0];
+       union {
+               DECLARE_FLEX_ARRAY(u8, payload);
+               DECLARE_FLEX_ARRAY(struct ieee80211_hdr, hdr);
+       };
 } __packed; /* TX_CMD_API_S_VER_6 */
 
 struct iwl_dram_sec_info {
@@ -713,8 +715,10 @@ struct iwl_mvm_compressed_ba_notif {
        __le32 tx_rate;
        __le16 tfd_cnt;
        __le16 ra_tid_cnt;
-       struct iwl_mvm_compressed_ba_ratid ra_tid[0];
-       struct iwl_mvm_compressed_ba_tfd tfd[];
+       union {
+               DECLARE_FLEX_ARRAY(struct iwl_mvm_compressed_ba_ratid, ra_tid);
+               DECLARE_FLEX_ARRAY(struct iwl_mvm_compressed_ba_tfd, tfd);
+       };
 } __packed; /* COMPRESSED_BA_RES_API_S_VER_4 */
 
 /**

diff --git a/drivers/scsi/aic94xx/aic94xx_sds.c b/drivers/scsi/aic94xx/aic94xx_sds.c
index 46815e65f7a45a7616623aed4844f8156ddb3f1f..5def83c88f130ebe0ed81d27ecdf1c2cee2b18e6 100644 (file)
--- a/drivers/scsi/aic94xx/aic94xx_sds.c
+++ b/drivers/scsi/aic94xx/aic94xx_sds.c
@@ -517,8 +517,10 @@ struct asd_ms_conn_map {
        u8    num_nodes;
        u8    usage_model_id;
        u32   _resvd;
-       struct asd_ms_conn_desc conn_desc[0];
-       struct asd_ms_node_desc node_desc[];
+       union {
+               DECLARE_FLEX_ARRAY(struct asd_ms_conn_desc, conn_desc);
+               DECLARE_FLEX_ARRAY(struct asd_ms_node_desc, node_desc);
+       };
 } __attribute__ ((packed));
 
 struct asd_ctrla_phy_entry {

diff --git a/fs/hpfs/hpfs.h b/fs/hpfs/hpfs.h
index d92c4af3e1b43d164a1fc8d1e27bde8cce8e6166..281dec8f636b326796edda49857cd33c82dd24fb 100644 (file)
--- a/fs/hpfs/hpfs.h
+++ b/fs/hpfs/hpfs.h
@@ -409,10 +409,10 @@ struct bplus_header
   __le16 first_free;                   /* offset from start of header to
                                           first free node in array */
   union {
-    struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving
-                                              subtree pointers */
-    struct bplus_leaf_node external[0];            /* (external) 3-word entries giving
-                                              sector runs */
+       /* (internal) 2-word entries giving subtree pointers */
+       DECLARE_FLEX_ARRAY(struct bplus_internal_node, internal);
+       /* (external) 3-word entries giving sector runs */
+       DECLARE_FLEX_ARRAY(struct bplus_leaf_node, external);
   } u;
 };
 

diff --git a/include/linux/filter.h b/include/linux/filter.h
index 4a93c12543ee282fce511d4bffe105ae2dd3e234..4298c5e428a3721e9b347378dc36b74220719475 100644 (file)
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -586,8 +586,10 @@ struct bpf_prog {
        struct bpf_prog_aux     *aux;           /* Auxiliary fields */
        struct sock_fprog_kern  *orig_prog;     /* Original BPF program */
        /* Instructions for interpreter */
-       struct sock_filter      insns[0];
-       struct bpf_insn         insnsi[];
+       union {
+               DECLARE_FLEX_ARRAY(struct sock_filter, insns);
+               DECLARE_FLEX_ARRAY(struct bpf_insn, insnsi);
+       };
 };
 
 struct sk_filter {

diff --git a/include/scsi/sas.h b/include/scsi/sas.h
index 4726c1bbec65994d36de3e91fe39ecb29a0b8c2a..64154c1fed020f07bca0629409db018f0211cb18 100644 (file)
--- a/include/scsi/sas.h
+++ b/include/scsi/sas.h
@@ -323,8 +323,10 @@ struct ssp_response_iu {
        __be32 sense_data_len;
        __be32 response_data_len;
 
-       u8     resp_data[0];
-       u8     sense_data[];
+       union {
+               DECLARE_FLEX_ARRAY(u8, resp_data);
+               DECLARE_FLEX_ARRAY(u8, sense_data);
+       };
 } __attribute__ ((packed));
 
 struct ssp_command_iu {
@@ -554,8 +556,10 @@ struct ssp_response_iu {
        __be32 sense_data_len;
        __be32 response_data_len;
 
-       u8     resp_data[0];
-       u8     sense_data[];
+       union {
+               DECLARE_FLEX_ARRAY(u8, resp_data);
+               DECLARE_FLEX_ARRAY(u8, sense_data);
+       };
 } __attribute__ ((packed));
 
 struct ssp_command_iu {

diff --git a/include/uapi/rdma/rdma_user_rxe.h b/include/uapi/rdma/rdma_user_rxe.h
index e283c2220abaf1ae5f2babce9b959c2ccc400aa5..7f44d54bb0abe14f23f983ff0e1b831352d20a6b 100644 (file)
--- a/include/uapi/rdma/rdma_user_rxe.h
+++ b/include/uapi/rdma/rdma_user_rxe.h
@@ -141,8 +141,8 @@ struct rxe_dma_info {
        __u32                   sge_offset;
        __u32                   reserved;
        union {
-               __u8            inline_data[0];
-               struct rxe_sge  sge[0];
+               __DECLARE_FLEX_ARRAY(__u8, inline_data);
+               __DECLARE_FLEX_ARRAY(struct rxe_sge, sge);
        };
 };
 

diff --git a/include/uapi/sound/asoc.h b/include/uapi/sound/asoc.h
index da61398b1f8f3a7c23ceeab46287910e85a8184e..053949287ce893b3ca6a1db422180edf874fc703 100644 (file)
--- a/include/uapi/sound/asoc.h
+++ b/include/uapi/sound/asoc.h
@@ -240,8 +240,8 @@ struct snd_soc_tplg_vendor_array {
 struct snd_soc_tplg_private {
        __le32 size;    /* in bytes of private data */
        union {
-               char data[0];
-               struct snd_soc_tplg_vendor_array array[0];
+               __DECLARE_FLEX_ARRAY(char, data);
+               __DECLARE_FLEX_ARRAY(struct snd_soc_tplg_vendor_array, array);
        };
 } __attribute__((packed));