From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CE44EC43219 for ; Wed, 4 May 2022 07:28:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345428AbiEDHcY (ORCPT ); Wed, 4 May 2022 03:32:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240712AbiEDHcT (ORCPT ); Wed, 4 May 2022 03:32:19 -0400 Received: from sipsolutions.net (s3.sipsolutions.net [IPv6:2a01:4f8:191:4433::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CC1E823168; Wed, 4 May 2022 00:28:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sipsolutions.net; s=mail; h=Content-Transfer-Encoding:MIME-Version: Content-Type:References:In-Reply-To:Date:Cc:To:From:Subject:Message-ID:Sender :Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-To: Resent-Cc:Resent-Message-ID; bh=ity6IPNC2WIGLGTiJizfPDCFcsI1FfOGUjdPuI/9x1Q=; t=1651649323; x=1652858923; b=QT/lqMVOF1wssRE3WxIi8JFq9qydord3vIkdiB2RnWp4foW Y2EKnvOYOMnbG95Qdly+MoPypq2sN7AwddMp0VYIzVbdfWTRU6B/9bcArAn9dLA9S3yjy/847JAMM 5LJInaNZlJNS2YxORo9/2LoJ6iUnT3wyCzCYnMBPg0rAQhl5m/80xeXDtvXNqloQm4rd81zUR3d9V +Mcf8XskU9Hf/j9Yc5oRhMJ/y7/9QB3NmD3+sAFKcmfTxKBvoiJ6MhI/+px6IbLVE1cYELVTNv3+3 WgYpY8SAyqZNJdmAsttGuK1DDFIY0LoU33uBUCWEOSV4lb0v/xiWF1k3mZZVt6oQ==; Received: by sipsolutions.net with esmtpsa (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) (envelope-from ) id 1nm9Oe-001wnb-ND; Wed, 04 May 2022 09:26:04 +0200 Message-ID: Subject: Re: [PATCH 02/32] Introduce flexible array struct memcpy() helpers From: Johannes Berg To: Kees Cook , "Gustavo A . R . Silva" Cc: Keith Packard , Francis Laniel , Daniel Axtens , Dan Williams , Vincenzo Frascino , Guenter Roeck , Daniel Vetter , Tadeusz Struk , Alexei Starovoitov , alsa-devel@alsa-project.org, Al Viro , Andrew Gabbasov , Andrew Morton , Andy Gross , Andy Lavr , Arend van Spriel , Baowen Zheng , Bjorn Andersson , Boris Ostrovsky , Bradley Grove , brcm80211-dev-list.pdl@broadcom.com, Christian Brauner , Christian =?ISO-8859-1?Q?G=F6ttsche?= , Christian Lamparter , Chris Zankel , Cong Wang , David Gow , David Howells , "David S. Miller" , Dennis Dalessandro , devicetree@vger.kernel.org, Dexuan Cui , Dmitry Kasatkin , Eli Cohen , Eric Dumazet , Eric Paris , Eugeniu Rosca , Felipe Balbi , Frank Rowand , Franky Lin , Greg Kroah-Hartman , Gregory Greenman , Haiyang Zhang , Hante Meuleman , Herbert Xu , Hulk Robot , Jakub Kicinski , "James E.J. Bottomley" , James Morris , Jarkko Sakkinen , Jaroslav Kysela , Jason Gunthorpe , Jens Axboe , Johan Hedberg , John Keeping , Juergen Gross , Kalle Valo , keyrings@vger.kernel.org, kunit-dev@googlegroups.com, Kuniyuki Iwashima , "K. Y. Srinivasan" , Lars-Peter Clausen , Lee Jones , Leon Romanovsky , Liam Girdwood , linux1394-devel@lists.sourceforge.net, linux-afs@lists.infradead.org, linux-arm-kernel@lists.infradead.org, linux-arm-msm@vger.kernel.org, linux-bluetooth@vger.kernel.org, linux-hardening@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-integrity@vger.kernel.org, linux-rdma@vger.kernel.org, linux-scsi@vger.kernel.org, linux-security-module@vger.kernel.org, linux-usb@vger.kernel.org, linux-wireless@vger.kernel.org, linux-xtensa@linux-xtensa.org, llvm@lists.linux.dev, Loic Poulain , Louis Peens , Luca Coelho , Luiz Augusto von Dentz , Marc Dionne , Marcel Holtmann , Mark Brown , "Martin K. Petersen" , Max Filippov , Mimi Zohar , Muchun Song , Nathan Chancellor , netdev@vger.kernel.org, Nick Desaulniers , Nuno =?ISO-8859-1?Q?S=E1?= , Paolo Abeni , Paul Moore , Rich Felker , Rob Herring , Russell King , selinux@vger.kernel.org, "Serge E. Hallyn" , SHA-cyfmac-dev-list@infineon.com, Simon Horman , Stefano Stabellini , Stefan Richter , Steffen Klassert , Stephen Hemminger , Stephen Smalley , Takashi Iwai , Tom Rix , Udipto Goswami , wcn36xx@lists.infradead.org, Wei Liu , xen-devel@lists.xenproject.org, Xiu Jianfeng , Yang Yingliang , kvalo@kernel.org Date: Wed, 04 May 2022 09:25:56 +0200 In-Reply-To: <20220504014440.3697851-3-keescook@chromium.org> References: <20220504014440.3697851-1-keescook@chromium.org> <20220504014440.3697851-3-keescook@chromium.org> Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.42.4 (3.42.4-2.fc35) MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-malware-bazaar: not-scanned Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org On Tue, 2022-05-03 at 18:44 -0700, Kees Cook wrote: > > For example, using the most complicated helper, mem_to_flex_dup(): > > /* Flexible array struct with members identified. */ > struct something { > int mode; > DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(int, how_many); > unsigned long flags; > DECLARE_FLEX_ARRAY_ELEMENTS(u32, value); In many cases, the order of the elements doesn't really matter, so maybe it'd be nicer to be able to write it as something like DECLARE_FLEX_STRUCT(something, int mode; unsigned long flags; , int, how_many, u32, value); perhaps? OK, that doesn't seem so nice either. Maybe struct something { int mode; unsigned long flags; FLEX_ARRAY( int, how_many, u32, value ); }; or so? The long and duplicated DECLARE_FLEX_ARRAY_ELEMENTS_COUNT and DECLARE_FLEX_ARRAY_ELEMENTS seems a bit tedious to me, at least in cases where the struct layout is not the most important thing (or it's already at the end anyway). > struct something *instance = NULL; > int rc; > > rc = mem_to_flex_dup(&instance, byte_array, count, GFP_KERNEL); > if (rc) > return rc; This seems rather awkward, having to set it to NULL, then checking rc (and possibly needing a separate variable for it), etc. But I can understand how you arrived at this: - need to pass instance or &instance or such for typeof() or offsetof() or such - instance = mem_to_flex_dup(instance, ...) looks too much like it would actually dup 'instance', rather than 'byte_array' - if you pass &instance anyway, checking for NULL is simple and adds a bit of safety but still, honestly, I don't like it. As APIs go, it feels a bit cumbersome and awkward to use, and you really need everyone to use this, and not say "uh what, I'll memcpy() instead". Maybe there should also be a realloc() version of it? > +/** __fas_bytes - Calculate potential size of flexible array structure I think you forgot "\n *" in many cases here after "/**". johannes