[PATCH v2][next] netfilter: x_tables: Avoid a couple -Wflex-array-member-not-at-end warnings

[PATCH v2][next] netfilter: x_tables: Avoid a couple -Wflex-array-member-not-at-end warnings

[Gustavo A. R. Silva]

-Wflex-array-member-not-at-end was introduced in GCC-14, and we are
getting ready to enable it, globally.

struct compat_xt_standard_target and struct compat_xt_error_target are
only used in xt_compat_check_entry_offsets(). Remove these structs and
instead define the same memory layout on the stack via flexible struct
compat_xt_entry_target and DEFINE_RAW_FLEX(). Adjust the rest of the
code accordingly.

With these changes, fix the following warnings:

1 net/netfilter/x_tables.c:816:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
1 net/netfilter/x_tables.c:811:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
Changes in v2:
 - Update verdict after (compat_uint_t *)st->data;

v1:
 - Link: https://lore.kernel.org/linux-hardening/adbIKC0cZcK7VcCF@kspp/

 net/netfilter/x_tables.c | 31 ++++++++++++++-----------------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index b39017c80548..746012196d83 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -817,17 +817,6 @@ int xt_compat_match_to_user(const struct xt_entry_match *m,
 }
 EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
 
-/* non-compat version may have padding after verdict */
-struct compat_xt_standard_target {
-	struct compat_xt_entry_target t;
-	compat_uint_t verdict;
-};
-
-struct compat_xt_error_target {
-	struct compat_xt_entry_target t;
-	char errorname[XT_FUNCTION_MAXNAMELEN];
-};
-
 int xt_compat_check_entry_offsets(const void *base, const char *elems,
 				  unsigned int target_offset,
 				  unsigned int next_offset)
@@ -850,18 +839,26 @@ int xt_compat_check_entry_offsets(const void *base, const char *elems,
 		return -EINVAL;
 
 	if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0) {
-		const struct compat_xt_standard_target *st = (const void *)t;
+		DEFINE_RAW_FLEX(const struct compat_xt_entry_target, st, data,
+				sizeof(compat_uint_t));
+		compat_uint_t *verdict;
 
-		if (COMPAT_XT_ALIGN(target_offset + sizeof(*st)) != next_offset)
+		st = (const void *)t;
+		verdict = (compat_uint_t *)st->data;
+
+		if (COMPAT_XT_ALIGN(target_offset + __struct_size(st)) !=
+				next_offset)
 			return -EINVAL;
 
-		if (!verdict_ok(st->verdict))
+		if (!verdict_ok(*verdict))
 			return -EINVAL;
 	} else if (strcmp(t->u.user.name, XT_ERROR_TARGET) == 0) {
-		const struct compat_xt_error_target *et = (const void *)t;
+		DEFINE_RAW_FLEX(const struct compat_xt_entry_target, et, data,
+				XT_FUNCTION_MAXNAMELEN);
+		et = (const void *)t;
 
-		if (!error_tg_ok(t->u.target_size, sizeof(*et),
-				 et->errorname, sizeof(et->errorname)))
+		if (!error_tg_ok(t->u.target_size, __struct_size(et),
+				 et->data, __member_size(et->data)))
 			return -EINVAL;
 	}
 
-- 
2.43.0

Re: [PATCH v2][next] netfilter: x_tables: Avoid a couple -Wflex-array-member-not-at-end warnings

[Gustavo A. R. Silva]

BTW folks,

We can use the TRAILING_OVERLAP() helper and address these warnings with
the following patch instead:

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index b39017c80548..9dd5957d9ed4 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -819,13 +819,15 @@ EXPORT_SYMBOL_GPL(xt_compat_match_to_user);

  /* non-compat version may have padding after verdict */
  struct compat_xt_standard_target {
-       struct compat_xt_entry_target t;
-       compat_uint_t verdict;
+       TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,
+               compat_uint_t verdict;
+       );
  };

  struct compat_xt_error_target {
-       struct compat_xt_entry_target t;
-       char errorname[XT_FUNCTION_MAXNAMELEN];
+       TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,
+               char errorname[XT_FUNCTION_MAXNAMELEN];
+       );
  };


This helper creates a union between a flexible-array member (FAM)
and a set of members that would otherwise follow it. This overlays
the trailing members onto the FAM while preserving the original
memory layout. It was created to address exactly these sorts of
issues where flexible-array members end up embedded in the middle
of structs.

You tell me what you prefer.

Thanks
-Gustavo

On 4/9/26 14:28, Gustavo A. R. Silva wrote:
> -Wflex-array-member-not-at-end was introduced in GCC-14, and we are
> getting ready to enable it, globally.
> 
> struct compat_xt_standard_target and struct compat_xt_error_target are
> only used in xt_compat_check_entry_offsets(). Remove these structs and
> instead define the same memory layout on the stack via flexible struct
> compat_xt_entry_target and DEFINE_RAW_FLEX(). Adjust the rest of the
> code accordingly.
> 
> With these changes, fix the following warnings:
> 
> 1 net/netfilter/x_tables.c:816:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
> 1 net/netfilter/x_tables.c:811:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
> 
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> ---
> Changes in v2:
>   - Update verdict after (compat_uint_t *)st->data;
> 
> v1:
>   - Link: https://lore.kernel.org/linux-hardening/adbIKC0cZcK7VcCF@kspp/
> 
>   net/netfilter/x_tables.c | 31 ++++++++++++++-----------------
>   1 file changed, 14 insertions(+), 17 deletions(-)
> 
> diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
> index b39017c80548..746012196d83 100644
> --- a/net/netfilter/x_tables.c
> +++ b/net/netfilter/x_tables.c
> @@ -817,17 +817,6 @@ int xt_compat_match_to_user(const struct xt_entry_match *m,
>   }
>   EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
>   
> -/* non-compat version may have padding after verdict */
> -struct compat_xt_standard_target {
> -	struct compat_xt_entry_target t;
> -	compat_uint_t verdict;
> -};
> -
> -struct compat_xt_error_target {
> -	struct compat_xt_entry_target t;
> -	char errorname[XT_FUNCTION_MAXNAMELEN];
> -};
> -
>   int xt_compat_check_entry_offsets(const void *base, const char *elems,
>   				  unsigned int target_offset,
>   				  unsigned int next_offset)
> @@ -850,18 +839,26 @@ int xt_compat_check_entry_offsets(const void *base, const char *elems,
>   		return -EINVAL;
>   
>   	if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0) {
> -		const struct compat_xt_standard_target *st = (const void *)t;
> +		DEFINE_RAW_FLEX(const struct compat_xt_entry_target, st, data,
> +				sizeof(compat_uint_t));
> +		compat_uint_t *verdict;
>   
> -		if (COMPAT_XT_ALIGN(target_offset + sizeof(*st)) != next_offset)
> +		st = (const void *)t;
> +		verdict = (compat_uint_t *)st->data;
> +
> +		if (COMPAT_XT_ALIGN(target_offset + __struct_size(st)) !=
> +				next_offset)
>   			return -EINVAL;
>   
> -		if (!verdict_ok(st->verdict))
> +		if (!verdict_ok(*verdict))
>   			return -EINVAL;
>   	} else if (strcmp(t->u.user.name, XT_ERROR_TARGET) == 0) {
> -		const struct compat_xt_error_target *et = (const void *)t;
> +		DEFINE_RAW_FLEX(const struct compat_xt_entry_target, et, data,
> +				XT_FUNCTION_MAXNAMELEN);
> +		et = (const void *)t;
>   
> -		if (!error_tg_ok(t->u.target_size, sizeof(*et),
> -				 et->errorname, sizeof(et->errorname)))
> +		if (!error_tg_ok(t->u.target_size, __struct_size(et),
> +				 et->data, __member_size(et->data)))
>   			return -EINVAL;
>   	}
>   

Re: [PATCH v2][next] netfilter: x_tables: Avoid a couple -Wflex-array-member-not-at-end warnings

[Florian Westphal]

Gustavo A. R. Silva <gustavo@embeddedor.com> wrote:
> diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
> index b39017c80548..9dd5957d9ed4 100644
> --- a/net/netfilter/x_tables.c
> +++ b/net/netfilter/x_tables.c
> @@ -819,13 +819,15 @@ EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
> 
>   /* non-compat version may have padding after verdict */
>   struct compat_xt_standard_target {
> -       struct compat_xt_entry_target t;
> -       compat_uint_t verdict;
> +       TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,
> +               compat_uint_t verdict;
> +       );
>   };
> 
>   struct compat_xt_error_target {
> -       struct compat_xt_entry_target t;
> -       char errorname[XT_FUNCTION_MAXNAMELEN];
> +       TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,
> +               char errorname[XT_FUNCTION_MAXNAMELEN];
> +       );
>   };
> 
> You tell me what you prefer.

I have no strong opinion. This compat code is needed to run 32bit
iptables binaries on a 64 bit host, not many users these days I think.
I still hope we can remove this eventually.

But as the above diff is smaller I would prefer it.

Re: [PATCH v2][next] netfilter: x_tables: Avoid a couple -Wflex-array-member-not-at-end warnings

[Gustavo A. R. Silva]

On 4/9/26 16:18, Florian Westphal wrote:
> Gustavo A. R. Silva <gustavo@embeddedor.com> wrote:
>> diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
>> index b39017c80548..9dd5957d9ed4 100644
>> --- a/net/netfilter/x_tables.c
>> +++ b/net/netfilter/x_tables.c
>> @@ -819,13 +819,15 @@ EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
>>
>>    /* non-compat version may have padding after verdict */
>>    struct compat_xt_standard_target {
>> -       struct compat_xt_entry_target t;
>> -       compat_uint_t verdict;
>> +       TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,
>> +               compat_uint_t verdict;
>> +       );
>>    };
>>
>>    struct compat_xt_error_target {
>> -       struct compat_xt_entry_target t;
>> -       char errorname[XT_FUNCTION_MAXNAMELEN];
>> +       TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,
>> +               char errorname[XT_FUNCTION_MAXNAMELEN];
>> +       );
>>    };
>>
>> You tell me what you prefer.
> 
> I have no strong opinion. This compat code is needed to run 32bit
> iptables binaries on a 64 bit host, not many users these days I think.
> I still hope we can remove this eventually.
> 
> But as the above diff is smaller I would prefer it.

Okay; I'll submit this as v3 then.

Thanks for the feedback,
-Gustavo