summaryrefslogtreecommitdiff
path: root/drivers/staging
diff options
context:
space:
mode:
authorErick Archer <erick.archer@gmx.com>2024-02-17 18:47:58 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2024-03-05 16:59:14 +0300
commit699b60ba237def5d83c53fbf29be468154ec37a6 (patch)
treec436561ae3df133cdb9e8ae7137c182defdc9e57 /drivers/staging
parent673f605ea73f1658cea26bfcdfbffd54c34b7828 (diff)
downloadlinux-699b60ba237def5d83c53fbf29be468154ec37a6.tar.xz
greybus: audio: apbridgea: Remove flexible array from struct audio_apbridgea_hdr
When a struct containing a flexible array is included in another struct, and there is a member after the struct-with-flex-array, there is a possibility of memory overlap. These cases must be audited [1]. See: struct inner { ... int flex[]; }; struct outer { ... struct inner header; int overlap; ... }; This is the scenario for the "struct audio_apbridgea_hdr" structure that is included in the following "struct audio_apbridgea_*_request" structures: struct audio_apbridgea_set_config_request struct audio_apbridgea_register_cport_request struct audio_apbridgea_unregister_cport_request struct audio_apbridgea_set_tx_data_size_request struct audio_apbridgea_prepare_tx_request struct audio_apbridgea_start_tx_request struct audio_apbridgea_stop_tx_request struct audio_apbridgea_shutdown_tx_request struct audio_apbridgea_set_rx_data_size_request struct audio_apbridgea_prepare_rx_request struct audio_apbridgea_start_rx_request struct audio_apbridgea_stop_rx_request struct audio_apbridgea_shutdown_rx_request The pattern is like the one shown below: struct audio_apbridgea_hdr { ... __u8 data[]; } __packed; struct audio_apbridgea_*_request { struct audio_apbridgea_hdr hdr; ... } __packed; In this case, the trailing flexible array can be removed because it is never used. Link: https://github.com/KSPP/linux/issues/202 [1] Signed-off-by: Erick Archer <erick.archer@gmx.com> Reviewed-by: Alex Elder <elder@linaro.org> Acked-by: Mark Greer <mgreer@animalcreek.com> Link: https://lore.kernel.org/r/20240217154758.7965-1-erick.archer@gmx.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
-rw-r--r--drivers/staging/greybus/audio_apbridgea.h1
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/staging/greybus/audio_apbridgea.h b/drivers/staging/greybus/audio_apbridgea.h
index efec0f815efd..ab707d310129 100644
--- a/drivers/staging/greybus/audio_apbridgea.h
+++ b/drivers/staging/greybus/audio_apbridgea.h
@@ -65,7 +65,6 @@
struct audio_apbridgea_hdr {
__u8 type;
__le16 i2s_port;
- __u8 data[];
} __packed;
struct audio_apbridgea_set_config_request {