greybus: audio: apbridgea: Remove flexible array from struct audio_apbridgea_hdr
authorErick Archer <erick.archer@gmx.com>
Sat, 17 Feb 2024 15:47:58 +0000 (16:47 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 5 Mar 2024 13:59:14 +0000 (13:59 +0000)
commit699b60ba237def5d83c53fbf29be468154ec37a6
treec436561ae3df133cdb9e8ae7137c182defdc9e57
parent673f605ea73f1658cea26bfcdfbffd54c34b7828
greybus: audio: apbridgea: Remove flexible array from struct audio_apbridgea_hdr

When a struct containing a flexible array is included in another struct,
and there is a member after the struct-with-flex-array, there is a
possibility of memory overlap. These cases must be audited [1]. See:

struct inner {
...
int flex[];
};

struct outer {
...
struct inner header;
int overlap;
...
};

This is the scenario for the "struct audio_apbridgea_hdr" structure
that is included in the following "struct audio_apbridgea_*_request"
structures:

struct audio_apbridgea_set_config_request
struct audio_apbridgea_register_cport_request
struct audio_apbridgea_unregister_cport_request
struct audio_apbridgea_set_tx_data_size_request
struct audio_apbridgea_prepare_tx_request
struct audio_apbridgea_start_tx_request
struct audio_apbridgea_stop_tx_request
struct audio_apbridgea_shutdown_tx_request
struct audio_apbridgea_set_rx_data_size_request
struct audio_apbridgea_prepare_rx_request
struct audio_apbridgea_start_rx_request
struct audio_apbridgea_stop_rx_request
struct audio_apbridgea_shutdown_rx_request

The pattern is like the one shown below:

struct audio_apbridgea_hdr {
...
__u8 data[];
} __packed;

struct audio_apbridgea_*_request {
struct audio_apbridgea_hdr hdr;
...
} __packed;

In this case, the trailing flexible array can be removed because it is
never used.

Link: https://github.com/KSPP/linux/issues/202
Signed-off-by: Erick Archer <erick.archer@gmx.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Acked-by: Mark Greer <mgreer@animalcreek.com>
Link: https://lore.kernel.org/r/20240217154758.7965-1-erick.archer@gmx.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/greybus/audio_apbridgea.h