* [PATCH][next] reiserfs: Replace one-element array with flexible-array member
@ 2023-06-21 22:43 Gustavo A. R. Silva
2023-06-22 0:03 ` Kees Cook
0 siblings, 1 reply; 2+ messages in thread
From: Gustavo A. R. Silva @ 2023-06-21 22:43 UTC (permalink / raw)
To: reiserfs-devel, linux-kernel, Gustavo A. R. Silva, linux-hardening
Cc: Kees Cook
One-element arrays are deprecated, and we are replacing them with flexible
array members instead. So, replace one-element array with flexible-array
member in direntry_uarea structure, and refactor the rest of the code,
accordingly.
Worth mentioning is that before these changes, the original implementation
was returning two-too many bytes in function direntry_create_vi():
fs/reiserfs/item_ops.c:464: int size = sizeof(struct direntry_uarea);
...
fs/reiserfs/item_ops.c-490- size += (dir_u->entry_count * sizeof(short));
...
fs/reiserfs/item_ops.c-517- return size;
Link: https://github.com/KSPP/linux/issues/79
Link: https://github.com/KSPP/linux/issues/290
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
fs/reiserfs/fix_node.c | 5 +++--
fs/reiserfs/reiserfs.h | 2 +-
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/fs/reiserfs/fix_node.c b/fs/reiserfs/fix_node.c
index fefe87e1c099..6c13a8d9a73c 100644
--- a/fs/reiserfs/fix_node.c
+++ b/fs/reiserfs/fix_node.c
@@ -2252,8 +2252,9 @@ static int get_virtual_node_size(struct super_block *sb, struct buffer_head *bh)
return sizeof(struct virtual_node) +
max(max_num_of_items * sizeof(struct virtual_item),
- sizeof(struct virtual_item) + sizeof(struct direntry_uarea) +
- (max_num_of_entries - 1) * sizeof(__u16));
+ sizeof(struct virtual_item) +
+ struct_size_t(struct direntry_uarea, entry_sizes,
+ max_num_of_entries));
}
/*
diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h
index 55e85256aae8..b81749492ef9 100644
--- a/fs/reiserfs/reiserfs.h
+++ b/fs/reiserfs/reiserfs.h
@@ -2373,7 +2373,7 @@ struct virtual_node {
struct direntry_uarea {
int flags;
__u16 entry_count;
- __u16 entry_sizes[1];
+ __u16 entry_sizes[];
} __attribute__ ((__packed__));
/***************************************************************************
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH][next] reiserfs: Replace one-element array with flexible-array member
2023-06-21 22:43 [PATCH][next] reiserfs: Replace one-element array with flexible-array member Gustavo A. R. Silva
@ 2023-06-22 0:03 ` Kees Cook
0 siblings, 0 replies; 2+ messages in thread
From: Kees Cook @ 2023-06-22 0:03 UTC (permalink / raw)
To: Gustavo A. R. Silva; +Cc: reiserfs-devel, linux-kernel, linux-hardening
On Wed, Jun 21, 2023 at 04:43:54PM -0600, Gustavo A. R. Silva wrote:
> One-element arrays are deprecated, and we are replacing them with flexible
> array members instead. So, replace one-element array with flexible-array
> member in direntry_uarea structure, and refactor the rest of the code,
> accordingly.
>
> Worth mentioning is that before these changes, the original implementation
> was returning two-too many bytes in function direntry_create_vi():
>
> fs/reiserfs/item_ops.c:464: int size = sizeof(struct direntry_uarea);
> ...
> fs/reiserfs/item_ops.c-490- size += (dir_u->entry_count * sizeof(short));
> ...
> fs/reiserfs/item_ops.c-517- return size;
>
> Link: https://github.com/KSPP/linux/issues/79
> Link: https://github.com/KSPP/linux/issues/290
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
--
Kees Cook
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-06-22 0:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-06-21 22:43 [PATCH][next] reiserfs: Replace one-element array with flexible-array member Gustavo A. R. Silva
2023-06-22 0:03 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).