lkml.org 
[lkml]   [2024]   [Feb]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] greybus: Avoid fake flexible array for response data
    Date
    FORTIFY_SOURCE has been ignoring 0-sized destinations while the kernel
    code base has been converted to flexible arrays. In order to enforce
    the 0-sized destinations (e.g. with __counted_by), the remaining 0-sized
    destinations need to be handled. Instead of converting an empty struct
    into using a flexible array, just directly use a pointer without any
    additional indirection. Remove struct gb_bootrom_get_firmware_response
    and struct gb_fw_download_fetch_firmware_response.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    Cc: Viresh Kumar <vireshk@kernel.org>
    Cc: Johan Hovold <johan@kernel.org>
    Cc: Alex Elder <elder@kernel.org>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Gustavo A. R. Silva <gustavo@embeddedor.com>
    Cc: greybus-dev@lists.linaro.org
    Cc: linux-staging@lists.linux.dev
    ---
    drivers/staging/greybus/bootrom.c | 7 +++----
    drivers/staging/greybus/fw-download.c | 7 +++----
    include/linux/greybus/greybus_protocols.h | 8 --------
    3 files changed, 6 insertions(+), 16 deletions(-)

    diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c
    index 79581457c4af..76ad5f289072 100644
    --- a/drivers/staging/greybus/bootrom.c
    +++ b/drivers/staging/greybus/bootrom.c
    @@ -243,10 +243,10 @@ static int gb_bootrom_get_firmware(struct gb_operation *op)
    struct gb_bootrom *bootrom = gb_connection_get_data(op->connection);
    const struct firmware *fw;
    struct gb_bootrom_get_firmware_request *firmware_request;
    - struct gb_bootrom_get_firmware_response *firmware_response;
    struct device *dev = &op->connection->bundle->dev;
    unsigned int offset, size;
    enum next_request_type next_request;
    + u8 *firmware_response;
    int ret = 0;

    /* Disable timeouts */
    @@ -280,15 +280,14 @@ static int gb_bootrom_get_firmware(struct gb_operation *op)
    goto unlock;
    }

    - if (!gb_operation_response_alloc(op, sizeof(*firmware_response) + size,
    - GFP_KERNEL)) {
    + if (!gb_operation_response_alloc(op, size, GFP_KERNEL)) {
    dev_err(dev, "%s: error allocating response\n", __func__);
    ret = -ENOMEM;
    goto unlock;
    }

    firmware_response = op->response->payload;
    - memcpy(firmware_response->data, fw->data + offset, size);
    + memcpy(firmware_response, fw->data + offset, size);

    dev_dbg(dev, "responding with firmware (offs = %u, size = %u)\n",
    offset, size);
    diff --git a/drivers/staging/greybus/fw-download.c b/drivers/staging/greybus/fw-download.c
    index 543692c567f9..2d73bb729aa2 100644
    --- a/drivers/staging/greybus/fw-download.c
    +++ b/drivers/staging/greybus/fw-download.c
    @@ -271,11 +271,11 @@ static int fw_download_fetch_firmware(struct gb_operation *op)
    struct gb_connection *connection = op->connection;
    struct fw_download *fw_download = gb_connection_get_data(connection);
    struct gb_fw_download_fetch_firmware_request *request;
    - struct gb_fw_download_fetch_firmware_response *response;
    struct fw_request *fw_req;
    const struct firmware *fw;
    unsigned int offset, size;
    u8 firmware_id;
    + u8 *response;
    int ret = 0;

    if (op->request->payload_size != sizeof(*request)) {
    @@ -325,8 +325,7 @@ static int fw_download_fetch_firmware(struct gb_operation *op)
    goto put_fw;
    }

    - if (!gb_operation_response_alloc(op, sizeof(*response) + size,
    - GFP_KERNEL)) {
    + if (!gb_operation_response_alloc(op, size, GFP_KERNEL)) {
    dev_err(fw_download->parent,
    "error allocating fetch firmware response\n");
    ret = -ENOMEM;
    @@ -334,7 +333,7 @@ static int fw_download_fetch_firmware(struct gb_operation *op)
    }

    response = op->response->payload;
    - memcpy(response->data, fw->data + offset, size);
    + memcpy(response, fw->data + offset, size);

    dev_dbg(fw_download->parent,
    "responding with firmware (offs = %u, size = %u)\n", offset,
    diff --git a/include/linux/greybus/greybus_protocols.h b/include/linux/greybus/greybus_protocols.h
    index aeb8f9243545..603acdcc0c6b 100644
    --- a/include/linux/greybus/greybus_protocols.h
    +++ b/include/linux/greybus/greybus_protocols.h
    @@ -232,10 +232,6 @@ struct gb_fw_download_fetch_firmware_request {
    __le32 size;
    } __packed;

    -struct gb_fw_download_fetch_firmware_response {
    - __u8 data[0];
    -} __packed;
    -
    /* firmware download release firmware request */
    struct gb_fw_download_release_firmware_request {
    __u8 firmware_id;
    @@ -414,10 +410,6 @@ struct gb_bootrom_get_firmware_request {
    __le32 size;
    } __packed;

    -struct gb_bootrom_get_firmware_response {
    - __u8 data[0];
    -} __packed;
    -
    /* Bootrom protocol Ready to boot request */
    struct gb_bootrom_ready_to_boot_request {
    __u8 status;
    --
    2.34.1

    \
     
     \ /
      Last update: 2024-05-27 15:07    [W:3.575 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site