[PATCH][next] UAPI: ndctl / acpi: intel: Avoid multiple -Wflex-array-member-not-at-end warnings

[PATCH][next] UAPI: ndctl / acpi: intel: Avoid multiple -Wflex-array-member-not-at-end warnings

[Gustavo A. R. Silva]

-Wflex-array-member-not-at-end was introduced in GCC-14, and we are
getting ready to enable it, globally.

So, in order to avoid ending up with flexible-array members in the
middle of other structs, we use the `__struct_group()` helper to
separate the flexible array from the rest of the members in the
flexible structure. We then use the newly created tagged `struct
nd_cmd_pkg_hdr` to replace the type of the objects causing trouble
(`pkg`) in multiple structs.

So, with these changes, fix the following warnings:

drivers/acpi/nfit/intel.c:692:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
drivers/acpi/nfit/intel.c:59:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
drivers/acpi/nfit/intel.c:586:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
drivers/acpi/nfit/intel.c:522:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
drivers/acpi/nfit/intel.c:411:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
drivers/acpi/nfit/intel.c:358:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
drivers/acpi/nfit/intel.c:322:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
drivers/acpi/nfit/intel.c:281:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
drivers/acpi/nfit/intel.c:238:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
drivers/acpi/nfit/intel.c:199:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
drivers/acpi/nfit/intel.c:157:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
drivers/acpi/nfit/intel.c:124:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
 drivers/acpi/nfit/intel.c  | 24 ++++++++++++------------
 include/uapi/linux/ndctl.h | 15 +++++++++------
 2 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/drivers/acpi/nfit/intel.c b/drivers/acpi/nfit/intel.c
index 3902759abcba..fe561ce0ddec 100644
--- a/drivers/acpi/nfit/intel.c
+++ b/drivers/acpi/nfit/intel.c
@@ -56,7 +56,7 @@ static unsigned long intel_security_flags(struct nvdimm *nvdimm,
 	struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
 	unsigned long security_flags = 0;
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_get_security_state cmd;
 	} nd_cmd = {
 		.pkg = {
@@ -121,7 +121,7 @@ static int intel_security_freeze(struct nvdimm *nvdimm)
 {
 	struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_freeze_lock cmd;
 	} nd_cmd = {
 		.pkg = {
@@ -154,7 +154,7 @@ static int intel_security_change_key(struct nvdimm *nvdimm,
 		NVDIMM_INTEL_SET_MASTER_PASSPHRASE :
 		NVDIMM_INTEL_SET_PASSPHRASE;
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_set_passphrase cmd;
 	} nd_cmd = {
 		.pkg = {
@@ -196,7 +196,7 @@ static int __maybe_unused intel_security_unlock(struct nvdimm *nvdimm,
 {
 	struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_unlock_unit cmd;
 	} nd_cmd = {
 		.pkg = {
@@ -235,7 +235,7 @@ static int intel_security_disable(struct nvdimm *nvdimm,
 	int rc;
 	struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_disable_passphrase cmd;
 	} nd_cmd = {
 		.pkg = {
@@ -278,7 +278,7 @@ static int __maybe_unused intel_security_erase(struct nvdimm *nvdimm,
 	unsigned int cmd = ptype == NVDIMM_MASTER ?
 		NVDIMM_INTEL_MASTER_SECURE_ERASE : NVDIMM_INTEL_SECURE_ERASE;
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_secure_erase cmd;
 	} nd_cmd = {
 		.pkg = {
@@ -319,7 +319,7 @@ static int __maybe_unused intel_security_query_overwrite(struct nvdimm *nvdimm)
 	int rc;
 	struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_query_overwrite cmd;
 	} nd_cmd = {
 		.pkg = {
@@ -355,7 +355,7 @@ static int __maybe_unused intel_security_overwrite(struct nvdimm *nvdimm,
 	int rc;
 	struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_overwrite cmd;
 	} nd_cmd = {
 		.pkg = {
@@ -408,7 +408,7 @@ static int intel_bus_fwa_businfo(struct nvdimm_bus_descriptor *nd_desc,
 		struct nd_intel_bus_fw_activate_businfo *info)
 {
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_bus_fw_activate_businfo cmd;
 	} nd_cmd = {
 		.pkg = {
@@ -519,7 +519,7 @@ static int intel_bus_fwa_activate(struct nvdimm_bus_descriptor *nd_desc)
 {
 	struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_bus_fw_activate cmd;
 	} nd_cmd = {
 		.pkg = {
@@ -583,7 +583,7 @@ static int intel_fwa_dimminfo(struct nvdimm *nvdimm,
 		struct nd_intel_fw_activate_dimminfo *info)
 {
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_fw_activate_dimminfo cmd;
 	} nd_cmd = {
 		.pkg = {
@@ -689,7 +689,7 @@ static int intel_fwa_arm(struct nvdimm *nvdimm, enum nvdimm_fwa_trigger arm)
 	struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
 	struct acpi_nfit_desc *acpi_desc = nfit_mem->acpi_desc;
 	struct {
-		struct nd_cmd_pkg pkg;
+		struct nd_cmd_pkg_hdr pkg;
 		struct nd_intel_fw_activate_arm cmd;
 	} nd_cmd = {
 		.pkg = {
diff --git a/include/uapi/linux/ndctl.h b/include/uapi/linux/ndctl.h
index 73516e263627..34c11644d5d7 100644
--- a/include/uapi/linux/ndctl.h
+++ b/include/uapi/linux/ndctl.h
@@ -227,12 +227,15 @@ enum ars_masks {
  */
 
 struct nd_cmd_pkg {
-	__u64   nd_family;		/* family of commands */
-	__u64   nd_command;
-	__u32   nd_size_in;		/* INPUT: size of input args */
-	__u32   nd_size_out;		/* INPUT: size of payload */
-	__u32   nd_reserved2[9];	/* reserved must be zero */
-	__u32   nd_fw_size;		/* OUTPUT: size fw wants to return */
+	/* New members MUST be added within the __struct_group() macro below. */
+	__struct_group(nd_cmd_pkg_hdr, __hdr, /* no attrs */,
+		__u64   nd_family;		/* family of commands */
+		__u64   nd_command;
+		__u32   nd_size_in;		/* INPUT: size of input args */
+		__u32   nd_size_out;		/* INPUT: size of payload */
+		__u32   nd_reserved2[9];	/* reserved must be zero */
+		__u32   nd_fw_size;		/* OUTPUT: size fw wants to return */
+	);
 	unsigned char nd_payload[];	/* Contents of call      */
 };
 
-- 
2.43.0

Re: [PATCH][next] UAPI: ndctl / acpi: intel: Avoid multiple -Wflex-array-member-not-at-end warnings

[Alison Schofield]

On Thu, Feb 13, 2025 at 03:29:12PM +1030, Gustavo A. R. Silva wrote:
> -Wflex-array-member-not-at-end was introduced in GCC-14, and we are
> getting ready to enable it, globally.
> 
> So, in order to avoid ending up with flexible-array members in the
> middle of other structs, we use the `__struct_group()` helper to
> separate the flexible array from the rest of the members in the
> flexible structure. We then use the newly created tagged `struct
> nd_cmd_pkg_hdr` to replace the type of the objects causing trouble
> (`pkg`) in multiple structs.
> 
> So, with these changes, fix the following warnings:
> 
> drivers/acpi/nfit/intel.c:692:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

One sample warning is good.

How about adding a comment on why the usage of __struct_group() here
means this doesn't break userspace.

snip

> diff --git a/include/uapi/linux/ndctl.h b/include/uapi/linux/ndctl.h
> index 73516e263627..34c11644d5d7 100644
> --- a/include/uapi/linux/ndctl.h
> +++ b/include/uapi/linux/ndctl.h

FWIW: In a patch like this where reviewers likely want to see
the header file change first, put it first in the diff.
(git diff.orderfile)


> @@ -227,12 +227,15 @@ enum ars_masks {
>   */
>  
>  struct nd_cmd_pkg {
> -	__u64   nd_family;		/* family of commands */
> -	__u64   nd_command;
> -	__u32   nd_size_in;		/* INPUT: size of input args */
> -	__u32   nd_size_out;		/* INPUT: size of payload */
> -	__u32   nd_reserved2[9];	/* reserved must be zero */
> -	__u32   nd_fw_size;		/* OUTPUT: size fw wants to return */
> +	/* New members MUST be added within the __struct_group() macro below. */
> +	__struct_group(nd_cmd_pkg_hdr, __hdr, /* no attrs */,
> +		__u64   nd_family;		/* family of commands */
> +		__u64   nd_command;
> +		__u32   nd_size_in;		/* INPUT: size of input args */
> +		__u32   nd_size_out;		/* INPUT: size of payload */
> +		__u32   nd_reserved2[9];	/* reserved must be zero */
> +		__u32   nd_fw_size;		/* OUTPUT: size fw wants to return */
> +	);
>  	unsigned char nd_payload[];	/* Contents of call      */
>  };
>  
> -- 
> 2.43.0
> 
> 

Re: [PATCH][next] UAPI: ndctl / acpi: intel: Avoid multiple -Wflex-array-member-not-at-end warnings

[Kees Cook]

On Thu, Feb 13, 2025 at 02:25:27PM -0800, Alison Schofield wrote:
> On Thu, Feb 13, 2025 at 03:29:12PM +1030, Gustavo A. R. Silva wrote:
> > -Wflex-array-member-not-at-end was introduced in GCC-14, and we are
> > getting ready to enable it, globally.
> > 
> > So, in order to avoid ending up with flexible-array members in the
> > middle of other structs, we use the `__struct_group()` helper to
> > separate the flexible array from the rest of the members in the
> > flexible structure. We then use the newly created tagged `struct
> > nd_cmd_pkg_hdr` to replace the type of the objects causing trouble
> > (`pkg`) in multiple structs.
> > 
> > So, with these changes, fix the following warnings:
> > 
> > drivers/acpi/nfit/intel.c:692:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
> 
> One sample warning is good.
> 
> How about adding a comment on why the usage of __struct_group() here
> means this doesn't break userspace.
> 
> snip
> 
> > diff --git a/include/uapi/linux/ndctl.h b/include/uapi/linux/ndctl.h
> > index 73516e263627..34c11644d5d7 100644
> > --- a/include/uapi/linux/ndctl.h
> > +++ b/include/uapi/linux/ndctl.h
> 
> FWIW: In a patch like this where reviewers likely want to see
> the header file change first, put it first in the diff.
> (git diff.orderfile)

TIL about diff.orderfile! :) Just for my own education, what do you have
as the contents for your orderfile? Is it just simply:

*.h

?

> 
> 
> > @@ -227,12 +227,15 @@ enum ars_masks {
> >   */
> >  
> >  struct nd_cmd_pkg {
> > -	__u64   nd_family;		/* family of commands */
> > -	__u64   nd_command;
> > -	__u32   nd_size_in;		/* INPUT: size of input args */
> > -	__u32   nd_size_out;		/* INPUT: size of payload */
> > -	__u32   nd_reserved2[9];	/* reserved must be zero */
> > -	__u32   nd_fw_size;		/* OUTPUT: size fw wants to return */
> > +	/* New members MUST be added within the __struct_group() macro below. */
> > +	__struct_group(nd_cmd_pkg_hdr, __hdr, /* no attrs */,
> > +		__u64   nd_family;		/* family of commands */
> > +		__u64   nd_command;
> > +		__u32   nd_size_in;		/* INPUT: size of input args */
> > +		__u32   nd_size_out;		/* INPUT: size of payload */
> > +		__u32   nd_reserved2[9];	/* reserved must be zero */
> > +		__u32   nd_fw_size;		/* OUTPUT: size fw wants to return */
> > +	);
> >  	unsigned char nd_payload[];	/* Contents of call      */
> >  };

Gustavo, any updates on this patch? I'm skimming through patchwork to
check on stalled patches...

-- 
Kees Cook

Re: [PATCH][next] UAPI: ndctl / acpi: intel: Avoid multiple -Wflex-array-member-not-at-end warnings

[Gustavo A. R. Silva]

> Gustavo, any updates on this patch? I'm skimming through patchwork to
> check on stalled patches...
> 

Yep, I proposed a couple of patches for this:

https://lore.kernel.org/linux-hardening/a66056cf-570c-4875-b5cf-c51e2bc488d9@intel.com/t/#mf958b73b3021db415b9e9c623c3f386259ca0829
(not sure why my patch doesn't show up on linux-hardening anymore...)

And this is the most recent alternative:
https://lore.kernel.org/linux-hardening/Z-QpUcxFCRByYcTA@kspp/

Thanks
--
Gustavo

Re: [PATCH][next] UAPI: ndctl / acpi: intel: Avoid multiple -Wflex-array-member-not-at-end warnings

[Kees Cook]

On Mon, Apr 07, 2025 at 11:11:08AM -0700, Kees Cook wrote:
> On Thu, Feb 13, 2025 at 02:25:27PM -0800, Alison Schofield wrote:
> > On Thu, Feb 13, 2025 at 03:29:12PM +1030, Gustavo A. R. Silva wrote:
> > > -Wflex-array-member-not-at-end was introduced in GCC-14, and we are
> > > getting ready to enable it, globally.
> > > 
> > > So, in order to avoid ending up with flexible-array members in the
> > > middle of other structs, we use the `__struct_group()` helper to
> > > separate the flexible array from the rest of the members in the
> > > flexible structure. We then use the newly created tagged `struct
> > > nd_cmd_pkg_hdr` to replace the type of the objects causing trouble
> > > (`pkg`) in multiple structs.
> > > 
> > > So, with these changes, fix the following warnings:
> > > 
> > > drivers/acpi/nfit/intel.c:692:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
> > 
> > One sample warning is good.
> > 
> > How about adding a comment on why the usage of __struct_group() here
> > means this doesn't break userspace.
> > 
> > snip
> > 
> > > diff --git a/include/uapi/linux/ndctl.h b/include/uapi/linux/ndctl.h
> > > index 73516e263627..34c11644d5d7 100644
> > > --- a/include/uapi/linux/ndctl.h
> > > +++ b/include/uapi/linux/ndctl.h
> > 
> > FWIW: In a patch like this where reviewers likely want to see
> > the header file change first, put it first in the diff.
> > (git diff.orderfile)
> 
> TIL about diff.orderfile! :) Just for my own education, what do you have
> as the contents for your orderfile? Is it just simply:
> 
> *.h
> 
> ?

I've updated my local environment to use this, to see how well it ends up
behaving:

Kconfig
*/Kconfig
*/Kconfig.*
Makefile
*/Makefile
*/Makefile.*
scripts/*
Documentation/*
*.h
*.S
*.c
tools/testing/*

https://github.com/kees/kernel-tools/commit/909db155b5cd36832d10d7d9932d7b51b46388aa

-Kees

-- 
Kees Cook