diff options
author | Erick Archer <erick.archer@gmx.com> | 2024-02-17 18:47:58 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-03-05 16:59:14 +0300 |
commit | 699b60ba237def5d83c53fbf29be468154ec37a6 (patch) | |
tree | c436561ae3df133cdb9e8ae7137c182defdc9e57 /drivers/staging | |
parent | 673f605ea73f1658cea26bfcdfbffd54c34b7828 (diff) | |
download | linux-699b60ba237def5d83c53fbf29be468154ec37a6.tar.xz |
greybus: audio: apbridgea: Remove flexible array from struct audio_apbridgea_hdr
When a struct containing a flexible array is included in another struct,
and there is a member after the struct-with-flex-array, there is a
possibility of memory overlap. These cases must be audited [1]. See:
struct inner {
...
int flex[];
};
struct outer {
...
struct inner header;
int overlap;
...
};
This is the scenario for the "struct audio_apbridgea_hdr" structure
that is included in the following "struct audio_apbridgea_*_request"
structures:
struct audio_apbridgea_set_config_request
struct audio_apbridgea_register_cport_request
struct audio_apbridgea_unregister_cport_request
struct audio_apbridgea_set_tx_data_size_request
struct audio_apbridgea_prepare_tx_request
struct audio_apbridgea_start_tx_request
struct audio_apbridgea_stop_tx_request
struct audio_apbridgea_shutdown_tx_request
struct audio_apbridgea_set_rx_data_size_request
struct audio_apbridgea_prepare_rx_request
struct audio_apbridgea_start_rx_request
struct audio_apbridgea_stop_rx_request
struct audio_apbridgea_shutdown_rx_request
The pattern is like the one shown below:
struct audio_apbridgea_hdr {
...
__u8 data[];
} __packed;
struct audio_apbridgea_*_request {
struct audio_apbridgea_hdr hdr;
...
} __packed;
In this case, the trailing flexible array can be removed because it is
never used.
Link: https://github.com/KSPP/linux/issues/202 [1]
Signed-off-by: Erick Archer <erick.archer@gmx.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Acked-by: Mark Greer <mgreer@animalcreek.com>
Link: https://lore.kernel.org/r/20240217154758.7965-1-erick.archer@gmx.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
-rw-r--r-- | drivers/staging/greybus/audio_apbridgea.h | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/staging/greybus/audio_apbridgea.h b/drivers/staging/greybus/audio_apbridgea.h index efec0f815efd..ab707d310129 100644 --- a/drivers/staging/greybus/audio_apbridgea.h +++ b/drivers/staging/greybus/audio_apbridgea.h @@ -65,7 +65,6 @@ struct audio_apbridgea_hdr { __u8 type; __le16 i2s_port; - __u8 data[]; } __packed; struct audio_apbridgea_set_config_request { |