From: Dan Carpenter <error27@gmail.com>
To: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: Shyam Sunder Reddy Padira <shyamsunderreddypadira@gmail.com>,
gregkh@linuxfoundation.org, ethantidmore06@gmail.com,
nayana.mariyappa@gmail.com, s9430939@naver.com, kees@kernel.org,
linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v3] staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
Date: Tue, 14 Apr 2026 12:09:38 +0300 [thread overview]
Message-ID: <ad4EUpIInGHin71O@stanley.mountain> (raw)
In-Reply-To: <ad3-Yhh2kPsbYILC@ashevche-desk.local>
On Tue, Apr 14, 2026 at 11:44:18AM +0300, Andy Shevchenko wrote:
> On Tue, Apr 14, 2026 at 11:33:22AM +0300, Dan Carpenter wrote:
> > Really _obj() can't be ZERO_SIZE_PTR either, or if they are then it's
> > very difficult to dereference them since they don't have any struct
> > members.
> >
> > The main way that ZERO_SIZE_PTR bugs show up is with strings and NUL
> > terminators.
>
> Wouldn't it be the problem for
>
> struct foo {
> u32 baz[];
> };
There isn't really any difference between doing an out of bounds access
on an array with zero elements vs 10 elements. That's the beauty of
the ZERO_SIZE_PTR is that it lets you treat zero as just another number
of elements. But zero sizes can cause problems for code which does
things like "size - 1" but because of signedness that's ULONG_MAX.
regards,
dan carpenter
prev parent reply other threads:[~2026-04-14 9:29 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-13 18:08 [PATCH] staging: rtl8723bs: os_dep: avoid NULL pointer derefernece in rtw_cbuf_alloc Shyam Sunder Reddy Padira
2026-04-13 20:51 ` Ethan Tidmore
2026-04-13 22:44 ` [PATCH v2] staging: rtl8723bs: os_dep: avoid NULL pointer dereference " Shyam Sunder Reddy Padira
[not found] ` <CALx+fbZ_K3C2sTWY_HigceJcp414OEhyEQLGTDEfNnU2q_zKiA@mail.gmail.com>
2026-04-13 23:57 ` Shyam Sunder Reddy Padira
2026-04-14 5:59 ` Dan Carpenter
2026-04-14 7:42 ` Andy Shevchenko
2026-04-14 7:13 ` [PATCH v3] " Shyam Sunder Reddy Padira
2026-04-14 7:19 ` Dan Carpenter
2026-04-14 7:46 ` Andy Shevchenko
2026-04-14 7:55 ` Dan Carpenter
2026-04-14 8:00 ` Dan Carpenter
2026-04-14 8:20 ` Andy Shevchenko
2026-04-14 8:33 ` Dan Carpenter
2026-04-14 8:44 ` Andy Shevchenko
2026-04-14 8:47 ` Andy Shevchenko
2026-04-14 9:09 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ad4EUpIInGHin71O@stanley.mountain \
--to=error27@gmail.com \
--cc=andriy.shevchenko@intel.com \
--cc=ethantidmore06@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=kees@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=nayana.mariyappa@gmail.com \
--cc=s9430939@naver.com \
--cc=shyamsunderreddypadira@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox