Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Bluetooth: Replace zero-length array with flexible-array member

The current codebase makes use of the zero-length array language
extension to the C90 standard, but the preferred mechanism to declare
variable-length types such as these ones is a flexible array member[1][2],
introduced in C99:

struct foo {
int stuff;
struct boo array[];
};

By making use of the mechanism above, we will get a compiler warning
in case the flexible array does not occur last in the structure, which
will help us prevent some kind of undefined behavior bugs from being
inadvertently introduced[3] to the codebase from now on.

Also, notice that, dynamic memory allocations won't be affected by
this change:

"Flexible array members have incomplete type, and so the sizeof operator
may not be applied. As a quirk of the original implementation of
zero-length arrays, sizeof evaluates to zero."[1]

This issue was found with the help of Coccinelle.

[1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html
[2] https://github.com/KSPP/linux/issues/21
[3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour")

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

authored by

Gustavo A. R. Silva and committed by
Marcel Holtmann
a7e45454 eed467b5

+36 -36
+3 -3
drivers/bluetooth/btqca.h
··· 79 79 struct edl_event_hdr { 80 80 __u8 cresp; 81 81 __u8 rtype; 82 - __u8 data[0]; 82 + __u8 data[]; 83 83 } __packed; 84 84 85 85 struct qca_btsoc_version { ··· 112 112 __le16 tag_len; 113 113 __le32 reserve1; 114 114 __le32 reserve2; 115 - __u8 data[0]; 115 + __u8 data[]; 116 116 } __packed; 117 117 118 118 struct tlv_type_hdr { 119 119 __le32 type_len; 120 - __u8 data[0]; 120 + __u8 data[]; 121 121 } __packed; 122 122 123 123 enum qca_btsoc_type {
+2 -2
drivers/bluetooth/btrtl.h
··· 38 38 struct rtl_vendor_config_entry { 39 39 __le16 offset; 40 40 __u8 len; 41 - __u8 data[0]; 41 + __u8 data[]; 42 42 } __packed; 43 43 44 44 struct rtl_vendor_config { 45 45 __le32 signature; 46 46 __le16 total_len; 47 - struct rtl_vendor_config_entry entry[0]; 47 + struct rtl_vendor_config_entry entry[]; 48 48 } __packed; 49 49 50 50 #if IS_ENABLED(CONFIG_BT_RTL)
+15 -15
include/net/bluetooth/hci.h
··· 935 935 struct hci_cp_set_event_flt { 936 936 __u8 flt_type; 937 937 __u8 cond_type; 938 - __u8 condition[0]; 938 + __u8 condition[]; 939 939 } __packed; 940 940 941 941 /* Filter types */ ··· 1335 1335 __u8 status; 1336 1336 __u8 phy_handle; 1337 1337 __le16 rem_len; 1338 - __u8 frag[0]; 1338 + __u8 frag[]; 1339 1339 } __packed; 1340 1340 1341 1341 #define HCI_OP_WRITE_REMOTE_AMP_ASSOC 0x140b ··· 1343 1343 __u8 phy_handle; 1344 1344 __le16 len_so_far; 1345 1345 __le16 rem_len; 1346 - __u8 frag[0]; 1346 + __u8 frag[]; 1347 1347 } __packed; 1348 1348 struct hci_rp_write_remote_amp_assoc { 1349 1349 __u8 status; ··· 1613 1613 __u8 own_addr_type; 1614 1614 __u8 filter_policy; 1615 1615 __u8 scanning_phys; 1616 - __u8 data[0]; 1616 + __u8 data[]; 1617 1617 } __packed; 1618 1618 1619 1619 #define LE_SCAN_PHY_1M 0x01 ··· 1641 1641 __u8 peer_addr_type; 1642 1642 bdaddr_t peer_addr; 1643 1643 __u8 phys; 1644 - __u8 data[0]; 1644 + __u8 data[]; 1645 1645 } __packed; 1646 1646 1647 1647 struct hci_cp_le_ext_conn_param { ··· 1693 1693 struct hci_cp_le_set_ext_adv_enable { 1694 1694 __u8 enable; 1695 1695 __u8 num_of_sets; 1696 - __u8 data[0]; 1696 + __u8 data[]; 1697 1697 } __packed; 1698 1698 1699 1699 struct hci_cp_ext_adv_set { ··· 1775 1775 __le16 m_latency; 1776 1776 __le16 s_latency; 1777 1777 __u8 num_cis; 1778 - struct hci_cis_params cis[0]; 1778 + struct hci_cis_params cis[]; 1779 1779 } __packed; 1780 1780 1781 1781 struct hci_rp_le_set_cig_params { 1782 1782 __u8 status; 1783 1783 __u8 cig_id; 1784 1784 __u8 num_handles; 1785 - __le16 handle[0]; 1785 + __le16 handle[]; 1786 1786 } __packed; 1787 1787 1788 1788 #define HCI_OP_LE_CREATE_CIS 0x2064 ··· 1793 1793 1794 1794 struct hci_cp_le_create_cis { 1795 1795 __u8 num_cis; 1796 - struct hci_cis cis[0]; 1796 + struct hci_cis cis[]; 1797 1797 } __packed; 1798 1798 1799 1799 #define HCI_OP_LE_REMOVE_CIG 0x2065 ··· 1937 1937 1938 1938 struct hci_ev_num_comp_pkts { 1939 1939 __u8 num_hndl; 1940 - struct hci_comp_pkts_info handles[0]; 1940 + struct hci_comp_pkts_info handles[]; 1941 1941 } __packed; 1942 1942 1943 1943 #define HCI_EV_MODE_CHANGE 0x14 ··· 2170 2170 struct hci_ev_num_comp_blocks { 2171 2171 __le16 num_blocks; 2172 2172 __u8 num_hndl; 2173 - struct hci_comp_blocks_info handles[0]; 2173 + struct hci_comp_blocks_info handles[]; 2174 2174 } __packed; 2175 2175 2176 2176 #define HCI_EV_SYNC_TRAIN_COMPLETE 0x4F ··· 2226 2226 __u8 bdaddr_type; 2227 2227 bdaddr_t bdaddr; 2228 2228 __u8 length; 2229 - __u8 data[0]; 2229 + __u8 data[]; 2230 2230 } __packed; 2231 2231 2232 2232 #define HCI_EV_LE_CONN_UPDATE_COMPLETE 0x03 ··· 2302 2302 __u8 direct_addr_type; 2303 2303 bdaddr_t direct_addr; 2304 2304 __u8 length; 2305 - __u8 data[0]; 2305 + __u8 data[]; 2306 2306 } __packed; 2307 2307 2308 2308 #define HCI_EV_LE_ENHANCED_CONN_COMPLETE 0x0a ··· 2362 2362 #define HCI_EV_STACK_INTERNAL 0xfd 2363 2363 struct hci_ev_stack_internal { 2364 2364 __u16 type; 2365 - __u8 data[0]; 2365 + __u8 data[]; 2366 2366 } __packed; 2367 2367 2368 2368 #define HCI_EV_SI_DEVICE 0x01 ··· 2409 2409 struct hci_iso_hdr { 2410 2410 __le16 handle; 2411 2411 __le16 dlen; 2412 - __u8 data[0]; 2412 + __u8 data[]; 2413 2413 } __packed; 2414 2414 2415 2415 /* ISO data packet status flags */
+3 -3
include/net/bluetooth/hci_sock.h
··· 144 144 145 145 struct hci_dev_list_req { 146 146 __u16 dev_num; 147 - struct hci_dev_req dev_req[0]; /* hci_dev_req structures */ 147 + struct hci_dev_req dev_req[]; /* hci_dev_req structures */ 148 148 }; 149 149 150 150 struct hci_conn_list_req { 151 151 __u16 dev_id; 152 152 __u16 conn_num; 153 - struct hci_conn_info conn_info[0]; 153 + struct hci_conn_info conn_info[]; 154 154 }; 155 155 156 156 struct hci_conn_info_req { 157 157 bdaddr_t bdaddr; 158 158 __u8 type; 159 - struct hci_conn_info conn_info[0]; 159 + struct hci_conn_info conn_info[]; 160 160 }; 161 161 162 162 struct hci_auth_info_req {
+4 -4
include/net/bluetooth/l2cap.h
··· 299 299 struct l2cap_conf_req { 300 300 __le16 dcid; 301 301 __le16 flags; 302 - __u8 data[0]; 302 + __u8 data[]; 303 303 } __packed; 304 304 305 305 struct l2cap_conf_rsp { 306 306 __le16 scid; 307 307 __le16 flags; 308 308 __le16 result; 309 - __u8 data[0]; 309 + __u8 data[]; 310 310 } __packed; 311 311 312 312 #define L2CAP_CONF_SUCCESS 0x0000 ··· 322 322 struct l2cap_conf_opt { 323 323 __u8 type; 324 324 __u8 len; 325 - __u8 val[0]; 325 + __u8 val[]; 326 326 } __packed; 327 327 #define L2CAP_CONF_OPT_SIZE 2 328 328 ··· 392 392 struct l2cap_info_rsp { 393 393 __le16 type; 394 394 __le16 result; 395 - __u8 data[0]; 395 + __u8 data[]; 396 396 } __packed; 397 397 398 398 struct l2cap_create_chan_req {
+1 -1
include/net/bluetooth/rfcomm.h
··· 355 355 356 356 struct rfcomm_dev_list_req { 357 357 u16 dev_num; 358 - struct rfcomm_dev_info dev_info[0]; 358 + struct rfcomm_dev_info dev_info[]; 359 359 }; 360 360 361 361 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
+5 -5
net/bluetooth/a2mp.h
··· 36 36 __u8 code; 37 37 __u8 ident; 38 38 __le16 len; 39 - __u8 data[0]; 39 + __u8 data[]; 40 40 } __packed; 41 41 42 42 /* A2MP command codes */ 43 43 #define A2MP_COMMAND_REJ 0x01 44 44 struct a2mp_cmd_rej { 45 45 __le16 reason; 46 - __u8 data[0]; 46 + __u8 data[]; 47 47 } __packed; 48 48 49 49 #define A2MP_DISCOVER_REQ 0x02 ··· 62 62 struct a2mp_discov_rsp { 63 63 __le16 mtu; 64 64 __le16 ext_feat; 65 - struct a2mp_cl cl[0]; 65 + struct a2mp_cl cl[]; 66 66 } __packed; 67 67 68 68 #define A2MP_CHANGE_NOTIFY 0x04 ··· 93 93 struct a2mp_amp_assoc_rsp { 94 94 __u8 id; 95 95 __u8 status; 96 - __u8 amp_assoc[0]; 96 + __u8 amp_assoc[]; 97 97 } __packed; 98 98 99 99 #define A2MP_CREATEPHYSLINK_REQ 0x0A ··· 101 101 struct a2mp_physlink_req { 102 102 __u8 local_id; 103 103 __u8 remote_id; 104 - __u8 amp_assoc[0]; 104 + __u8 amp_assoc[]; 105 105 } __packed; 106 106 107 107 #define A2MP_CREATEPHYSLINK_RSP 0x0B
+3 -3
net/bluetooth/bnep/bnep.h
··· 74 74 __u8 type; 75 75 __u8 ctrl; 76 76 __u8 uuid_size; 77 - __u8 service[0]; 77 + __u8 service[]; 78 78 } __packed; 79 79 80 80 struct bnep_set_filter_req { 81 81 __u8 type; 82 82 __u8 ctrl; 83 83 __be16 len; 84 - __u8 list[0]; 84 + __u8 list[]; 85 85 } __packed; 86 86 87 87 struct bnep_control_rsp { ··· 93 93 struct bnep_ext_hdr { 94 94 __u8 type; 95 95 __u8 len; 96 - __u8 data[0]; 96 + __u8 data[]; 97 97 } __packed; 98 98 99 99 /* BNEP ioctl defines */