tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Bluetooth: hci_conn: Use __counted_by() to avoid -Wfamnae warning

Prepare for the coming implementation by GCC and Clang of the
__counted_by attribute. Flexible array members annotated with
__counted_by can have their accesses bounds-checked at run-time
via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE
(for strcpy/memcpy-family functions).

Also, -Wflex-array-member-not-at-end is coming in GCC-14, and we are
getting ready to enable it globally.

So, use the `DEFINE_FLEX()` helper for an on-stack definition of
a flexible structure where the size of the flexible-array member
is known at compile-time, and refactor the rest of the code,
accordingly.

With these changes, fix the following warning:
net/bluetooth/hci_conn.c:2116:50: warning: structure containing a flexible
array member is not at the end of another structure
[-Wflex-array-member-not-at-end]

Link: https://github.com/KSPP/linux/issues/202
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

authored by

Gustavo A. R. Silva and committed by
Luiz Augusto von Dentz c90748b8 c4585edf

+12 -16
+1 -1
include/net/bluetooth/hci.h
··· 2216 2216 __u8 mse; 2217 2217 __le16 timeout; 2218 2218 __u8 num_bis; 2219 - __u8 bis[]; 2219 + __u8 bis[] __counted_by(num_bis); 2220 2220 } __packed; 2221 2221 2222 2222 #define HCI_OP_LE_BIG_TERM_SYNC 0x206c
+11 -15
net/bluetooth/hci_conn.c
··· 2109 2109 struct bt_iso_qos *qos, 2110 2110 __u16 sync_handle, __u8 num_bis, __u8 bis[]) 2111 2111 { 2112 - struct _packed { 2113 - struct hci_cp_le_big_create_sync cp; 2114 - __u8 bis[0x11]; 2115 - } pdu; 2112 + DEFINE_FLEX(struct hci_cp_le_big_create_sync, pdu, bis, num_bis, 0x11); 2116 2113 int err; 2117 2114 2118 - if (num_bis < 0x01 || num_bis > sizeof(pdu.bis)) 2115 + if (num_bis < 0x01 || num_bis > pdu->num_bis) 2119 2116 return -EINVAL; 2120 2117 2121 2118 err = qos_set_big(hdev, qos); ··· 2122 2125 if (hcon) 2123 2126 hcon->iso_qos.bcast.big = qos->bcast.big; 2124 2127 2125 - memset(&pdu, 0, sizeof(pdu)); 2126 - pdu.cp.handle = qos->bcast.big; 2127 - pdu.cp.sync_handle = cpu_to_le16(sync_handle); 2128 - pdu.cp.encryption = qos->bcast.encryption; 2129 - memcpy(pdu.cp.bcode, qos->bcast.bcode, sizeof(pdu.cp.bcode)); 2130 - pdu.cp.mse = qos->bcast.mse; 2131 - pdu.cp.timeout = cpu_to_le16(qos->bcast.timeout); 2132 - pdu.cp.num_bis = num_bis; 2133 - memcpy(pdu.bis, bis, num_bis); 2128 + pdu->handle = qos->bcast.big; 2129 + pdu->sync_handle = cpu_to_le16(sync_handle); 2130 + pdu->encryption = qos->bcast.encryption; 2131 + memcpy(pdu->bcode, qos->bcast.bcode, sizeof(pdu->bcode)); 2132 + pdu->mse = qos->bcast.mse; 2133 + pdu->timeout = cpu_to_le16(qos->bcast.timeout); 2134 + pdu->num_bis = num_bis; 2135 + memcpy(pdu->bis, bis, num_bis); 2134 2136 2135 2137 return hci_send_cmd(hdev, HCI_OP_LE_BIG_CREATE_SYNC, 2136 - sizeof(pdu.cp) + num_bis, &pdu); 2138 + sizeof(*pdu) + num_bis, pdu); 2137 2139 } 2138 2140 2139 2141 static void create_big_complete(struct hci_dev *hdev, void *data, int err)