Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <5095df45-c7bf-9040-1720-09a562b8714a@huaweicloud.com>
Date:   Wed, 9 Aug 2023 11:05:49 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.11.0
Subject: Re: [PATCH] netfilter: ebtables: fix fortify warnings
Content-Language: en-US
To:     Florian Westphal <fw@strlen.de>
Cc:     Pablo Neira Ayuso <pablo@netfilter.org>,
        Jozsef Kadlecsik <kadlec@netfilter.org>,
        Roopa Prabhu <roopa@nvidia.com>,
        Nikolay Aleksandrov <razor@blackwall.org>,
        Kees Cook <keescook@chromium.org>,
        netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
        netdev@vger.kernel.org, linux-hardening@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        Wang Weiyang <wangweiyang2@huawei.com>,
        Xiu Jianfeng <xiujianfeng@huawei.com>
References: <20230808014821.241688-1-gongruiqi@huaweicloud.com>
 <20230808155430.GB9741@breakpoint.cc>
From:   "GONG, Ruiqi" <gongruiqi@huaweicloud.com>
In-Reply-To: <20230808155430.GB9741@breakpoint.cc>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 2023/08/08 23:54, Florian Westphal wrote:
> 
> [...]
>>
>> diff --git a/include/uapi/linux/netfilter_bridge/ebtables.h b/include/uapi/linux/netfilter_bridge/ebtables.h
>> index a494cf43a755..e634da196d08 100644
>> --- a/include/uapi/linux/netfilter_bridge/ebtables.h
>> +++ b/include/uapi/linux/netfilter_bridge/ebtables.h
>> @@ -182,12 +182,14 @@ struct ebt_entry {
>>  	unsigned char sourcemsk[ETH_ALEN];
>>  	unsigned char destmac[ETH_ALEN];
>>  	unsigned char destmsk[ETH_ALEN];
>> -	/* sizeof ebt_entry + matches */
>> -	unsigned int watchers_offset;
>> -	/* sizeof ebt_entry + matches + watchers */
>> -	unsigned int target_offset;
>> -	/* sizeof ebt_entry + matches + watchers + target */
>> -	unsigned int next_offset;
>> +	struct_group(offsets,
>> +		/* sizeof ebt_entry + matches */
> 
> This is an UAPI header, I think you need to use __struct_group here.

Thanks for the reminder! I've fixed it in v2:

https://lore.kernel.org/all/20230808133038.771316-1-gongruiqi@huaweicloud.com/

Please review it :)