On Thu, 2024-04-04 at 12:49 -0400, Mimi Zohar wrote: > Hi Gustavo, > > On Thu, 2024-04-04 at 09:00 -0600, Gustavo A. R. Silva wrote: > > -Wflex-array-member-not-at-end is coming in GCC-14, and we are getting > > ready to enable it globally. > > > > There is currently an object (`hdr)` in `struct ima_max_digest_data` > > that contains a flexible structure (`struct ima_digest_data`): > > > > struct ima_max_digest_data { > > struct ima_digest_data hdr; > > u8 digest[HASH_MAX_DIGESTSIZE]; > > } __packed; > > > > So, in order to avoid ending up with a flexible-array member in the > > middle of a struct, we use the `__struct_group()` helper to separate > > the flexible array from the rest of the members in the flexible > > structure: > > > > struct ima_digest_data { > > __struct_group(ima_digest_data_hdr, hdr, __packed, > > > > ... the rest of the members > > > > ); > > u8 digest[]; > > } __packed; > > > > And similarly for `struct evm_ima_xattr_data`. > > > > With the change described above, we can now declare an object of the > > type of the tagged `struct ima_digest_data_hdr`, without embedding the > > flexible array in the middle of another struct: > > > > struct ima_max_digest_data { > > struct ima_digest_data_hdr hdr; > > u8 digest[HASH_MAX_DIGESTSIZE]; > > } __packed; > > > > And similarly for `struct evm_digest` and `struct evm_xattr`. > > > > We also use `container_of()` whenever we need to retrieve a pointer to > > the flexible structure. > > > > So, with these changes, fix the following warnings: > > > > security/integrity/evm/evm.h:64:32: warning: structure containing a flexible > > array member is not at the end of another structure [-Wflex-array-member- > > not- > > at-end] > > security/integrity/evm/../integrity.h:40:35: warning: structure containing a > > flexible array member is not at the end of another structure [-Wflex-array- > > member-not-at-end] > > security/integrity/evm/../integrity.h:68:32: warning: structure containing a > > flexible array member is not at the end of another structure [-Wflex-array- > > member-not-at-end] > > security/integrity/ima/../integrity.h:40:35: warning: structure containing a > > flexible array member is not at the end of another structure [-Wflex-array- > > member-not-at-end] > > security/integrity/ima/../integrity.h:68:32: warning: structure containing a > > flexible array member is not at the end of another structure [-Wflex-array- > > member-not-at-end] > > security/integrity/integrity.h:40:35: warning: structure containing a > > flexible > > array member is not at the end of another structure [-Wflex-array-member- > > not- > > at-end] > > security/integrity/integrity.h:68:32: warning: structure containing a > > flexible > > array member is not at the end of another structure [-Wflex-array-member- > > not- > > at-end] > > security/integrity/platform_certs/../integrity.h:40:35: warning: structure > > containing a flexible array member is not at the end of another structure [- > > Wflex-array-member-not-at-end] > > security/integrity/platform_certs/../integrity.h:68:32: warning: structure > > containing a flexible array member is not at the end of another structure [- > > Wflex-array-member-not-at-end] > > > > Link: https://github.com/KSPP/linux/issues/202 > > Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx> > > Reviewed-by: Mimi Zohar <zohar@xxxxxxxxxxxxx> > > Thanks, Gustavo. I already applied and tested v4, but was trying to actually > see the errors with before pushing it out. With GCC-14, I'm seeing the "warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]" messages. As expected, with the patch no warnings. "checkpatch.pl --strict" complains "CHECK: Alignment should match open parenthesis". I'll queue the patch, but how about teaching checkpatch.pl to ignore __struct_group()? thanks, Mimi