On Mon, Oct 09, 2023 at 12:42:05PM -0600, Gustavo A. R. Silva wrote: > Array `data` in `struct hfi_sfr` is being used as a fake flexible array > at run-time: > > drivers/media/platform/qcom/venus/hfi_venus.c: > 1033 p = memchr(sfr->data, '\0', sfr->buf_size); > 1034 /* > 1035 * SFR isn't guaranteed to be NULL terminated since SYS_ERROR indicates > 1036 * that Venus is in the process of crashing. > 1037 */ > 1038 if (!p) > 1039 sfr->data[sfr->buf_size - 1] = '\0'; > 1040 > 1041 dev_err_ratelimited(dev, "SFR message from FW: %s\n", sfr->data); > > Fake flexible arrays are deprecated, and should be replaced by > flexible-array members. So, replace one-element array with a > flexible-array member in `struct hfi_sfr`. > > While there, also annotate array `data` with __counted_by() to prepare > for the coming implementation by GCC and Clang of the __counted_by > attribute. Flexible array members annotated with __counted_by can have > their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for > array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family > functions). > > This results in no differences in binary output. Thanks for checking! > > This issue was found with the help of Coccinelle, and audited and fixed > manually. > > Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx> Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> -- Kees Cook
