[PATCH][next] overflow: Fix direct struct member initialization in _DEFINE_FLEX()

[PATCH][next] overflow: Fix direct struct member initialization in _DEFINE_FLEX()

[Gustavo A. R. Silva]

Currently, to statically initialize the struct members of the `type`
object created by _DEFINE_FLEX(), the internal `obj` member must be
explicitly referenced at the call site. See:

struct flex {
	int a;
	int b;
	struct foo flex_array[];
};

_DEFINE_FLEX(struct flex, instance, flex_array,
	     FIXED_SIZE, = {
		.obj = {
			.a = 0,
			.b = 1,
		},
	});

This leaks _DEFINE_FLEX() internal implementation details and make
the helper harder to use and read.

Fix this and allow for a more natural and intuitive C99 init-style:

_DEFINE_FLEX(struct flex, instance, flex_array,
	     FIXED_SIZE, = {
		.a = 0,
		.b = 1,
	});

Also, update "counter" member initialization in DEFINE_FLEX().

Fixes: 26dd68d293fd ("overflow: add DEFINE_FLEX() for on-stack allocs")
Link: https://lore.kernel.org/linux-hardening/c4828c41-e46c-43c9-a73a-38ce8ab2c1c4@embeddedor.com/
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
 include/linux/overflow.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/overflow.h b/include/linux/overflow.h
index 69533e703be5..170d3cfe7ecc 100644
--- a/include/linux/overflow.h
+++ b/include/linux/overflow.h
@@ -404,7 +404,7 @@ static inline size_t __must_check size_sub(size_t minuend, size_t subtrahend)
 	union {									\
 		u8 bytes[struct_size_t(type, member, count)];			\
 		type obj;							\
-	} name##_u initializer;							\
+	} name##_u = { .obj initializer };					\
 	type *name = (type *)&name##_u
 
 /**
@@ -444,7 +444,7 @@ static inline size_t __must_check size_sub(size_t minuend, size_t subtrahend)
  * elements in array @member.
  */
 #define DEFINE_FLEX(TYPE, NAME, MEMBER, COUNTER, COUNT)	\
-	_DEFINE_FLEX(TYPE, NAME, MEMBER, COUNT, = { .obj.COUNTER = COUNT, })
+	_DEFINE_FLEX(TYPE, NAME, MEMBER, COUNT, = { .COUNTER = COUNT, })
 
 /**
  * STACK_FLEX_ARRAY_SIZE() - helper macro for DEFINE_FLEX() family.
-- 
2.43.0

Re: [PATCH][next] overflow: Fix direct struct member initialization in _DEFINE_FLEX()

[Kees Cook]

On Wed, Apr 30, 2025 at 05:46:21PM -0600, Gustavo A. R. Silva wrote:
> Currently, to statically initialize the struct members of the `type`
> object created by _DEFINE_FLEX(), the internal `obj` member must be
> explicitly referenced at the call site. See:
> 
> struct flex {
> 	int a;
> 	int b;
> 	struct foo flex_array[];
> };
> 
> _DEFINE_FLEX(struct flex, instance, flex_array,
> 	     FIXED_SIZE, = {
> 		.obj = {
> 			.a = 0,
> 			.b = 1,
> 		},
> 	});
> 
> This leaks _DEFINE_FLEX() internal implementation details and make
> the helper harder to use and read.
> 
> Fix this and allow for a more natural and intuitive C99 init-style:
> 
> _DEFINE_FLEX(struct flex, instance, flex_array,
> 	     FIXED_SIZE, = {
> 		.a = 0,
> 		.b = 1,
> 	});
> 
> Also, update "counter" member initialization in DEFINE_FLEX().
> 
> Fixes: 26dd68d293fd ("overflow: add DEFINE_FLEX() for on-stack allocs")
> Link: https://lore.kernel.org/linux-hardening/c4828c41-e46c-43c9-a73a-38ce8ab2c1c4@embeddedor.com/
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> ---
>  include/linux/overflow.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/overflow.h b/include/linux/overflow.h
> index 69533e703be5..170d3cfe7ecc 100644
> --- a/include/linux/overflow.h
> +++ b/include/linux/overflow.h
> @@ -404,7 +404,7 @@ static inline size_t __must_check size_sub(size_t minuend, size_t subtrahend)

Earlier up in the file:

...
 * @initializer: initializer expression (could be empty for no init).
   ^^^^^^^^^
 */
#define _DEFINE_FLEX(type, name, member, count, initializer...)

This argument now becomes required, which is fine, but we should keep
the docs updated and double check any existing "_DEFINE_FLEX" users that
may have an empty final argument (I don't see any, so that's nice).

>  	union {									\
>  		u8 bytes[struct_size_t(type, member, count)];			\
>  		type obj;							\
> -	} name##_u initializer;							\
> +	} name##_u = { .obj initializer };					\
>  	type *name = (type *)&name##_u
>  
>  /**
> @@ -444,7 +444,7 @@ static inline size_t __must_check size_sub(size_t minuend, size_t subtrahend)
>   * elements in array @member.
>   */
>  #define DEFINE_FLEX(TYPE, NAME, MEMBER, COUNTER, COUNT)	\
> -	_DEFINE_FLEX(TYPE, NAME, MEMBER, COUNT, = { .obj.COUNTER = COUNT, })
> +	_DEFINE_FLEX(TYPE, NAME, MEMBER, COUNT, = { .COUNTER = COUNT, })
>  
>  /**
>   * STACK_FLEX_ARRAY_SIZE() - helper macro for DEFINE_FLEX() family.

But otherwise, yes, let's do this!

-- 
Kees Cook

Re: [PATCH][next] overflow: Fix direct struct member initialization in _DEFINE_FLEX()

[Gustavo A. R. Silva]

> Earlier up in the file:
> 
> ...
>   * @initializer: initializer expression (could be empty for no init).
>     ^^^^^^^^^
>   */
> #define _DEFINE_FLEX(type, name, member, count, initializer...)
> 
> This argument now becomes required, which is fine, but we should keep

Nice catch!

> the docs updated and double check any existing "_DEFINE_FLEX" users that
> may have an empty final argument (I don't see any, so that's nice).

Yep, I build-tested it and saw no errors.

> 
>>   	union {									\
>>   		u8 bytes[struct_size_t(type, member, count)];			\
>>   		type obj;							\
>> -	} name##_u initializer;							\
>> +	} name##_u = { .obj initializer };					\
>>   	type *name = (type *)&name##_u
>>   
>>   /**
>> @@ -444,7 +444,7 @@ static inline size_t __must_check size_sub(size_t minuend, size_t subtrahend)
>>    * elements in array @member.
>>    */
>>   #define DEFINE_FLEX(TYPE, NAME, MEMBER, COUNTER, COUNT)	\
>> -	_DEFINE_FLEX(TYPE, NAME, MEMBER, COUNT, = { .obj.COUNTER = COUNT, })
>> +	_DEFINE_FLEX(TYPE, NAME, MEMBER, COUNT, = { .COUNTER = COUNT, })
>>   
>>   /**
>>    * STACK_FLEX_ARRAY_SIZE() - helper macro for DEFINE_FLEX() family.
> 
> But otherwise, yes, let's do this!
> 

Here you go :)

https://lore.kernel.org/linux-hardening/aBP0b3gfurLFDlwY@kspp/

Thanks!
-Gustavo