lkml.org 
[lkml]   [2023]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH][next] ALSA: 6fire: Fix undefined behavior bug in struct comm_runtime
From


On 9/29/23 19:26, Kees Cook wrote:
> On Fri, Sep 29, 2023 at 05:59:22PM +0200, Gustavo A. R. Silva wrote:
>> `struct urb` is a flexible structure, which means that it contains a
>> flexible-array member at the bottom. This could potentially lead to an
>> overwrite of the objects following `receiver` in `struct comm_runtime`,
>> among them some function pointers.
>>
>> Fix this by placing the declaration of object `receiver` at the end of
>> `struct comm_runtime`.
>>
>> Fixes: ddb6b5a96437 ("ALSA: 6fire: fix DMA issues with URB transfer_buffer usage")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
>
> Should these mention -Wflex-array-member-not-at-end ?

Probably, yes. I wasn't sure about mentioning it because it's not been released yet.

>
> Reviewed-by: Kees Cook <keescook@chromium.org>
>

Thanks!
--
Gustavo

\
 
 \ /
  Last update: 2023-10-01 08:52    [W:0.272 / U:0.048 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site