diff mbox series

[v2,next] Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings

Message ID ZgRIF1bkXlZlaK22@neat (mailing list archive)
State Mainlined
Commit 1c08108f3014881ad5f4c35a2abaf9c65475035d
Headers show
Series [v2,next] Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings | expand

Commit Message

Gustavo A. R. Silva March 27, 2024, 4:23 p.m. UTC
-Wflex-array-member-not-at-end is coming in GCC-14, and we are getting
ready to enable it globally.

There are currently a couple of objects (`req` and `rsp`), in a couple
of structures, that contain flexible structures (`struct l2cap_ecred_conn_req`
and `struct l2cap_ecred_conn_rsp`), for example:

struct l2cap_ecred_rsp_data {
        struct {
                struct l2cap_ecred_conn_rsp rsp;
                __le16 scid[L2CAP_ECRED_MAX_CID];
        } __packed pdu;
        int count;
};

in the struct above, `struct l2cap_ecred_conn_rsp` is a flexible
structure:

struct l2cap_ecred_conn_rsp {
        __le16 mtu;
        __le16 mps;
        __le16 credits;
        __le16 result;
        __le16 dcid[];
};

So, in order to avoid ending up with a flexible-array member in the
middle of another structure, we use the `struct_group_tagged()` (and
`__struct_group()` when the flexible structure is `__packed`) helper
to separate the flexible array from the rest of the members in the
flexible structure:

struct l2cap_ecred_conn_rsp {
        struct_group_tagged(l2cap_ecred_conn_rsp_hdr, hdr,

	... the rest of members

        );
        __le16 dcid[];
};

With the change described above, we now declare objects of the type of
the tagged struct, in this example `struct l2cap_ecred_conn_rsp_hdr`,
without embedding flexible arrays in the middle of other structures:

struct l2cap_ecred_rsp_data {
        struct {
                struct l2cap_ecred_conn_rsp_hdr rsp;
                __le16 scid[L2CAP_ECRED_MAX_CID];
        } __packed pdu;
        int count;
};

Also, when the flexible-array member needs to be accessed, we use
`container_of()` to retrieve a pointer to the flexible structure.

We also use the `DEFINE_RAW_FLEX()` helper for a couple of on-stack
definitions of a flexible structure where the size of the flexible-array
member is known at compile-time.

So, with these changes, fix the following warnings:
net/bluetooth/l2cap_core.c:1260:45: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
net/bluetooth/l2cap_core.c:3740:45: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
net/bluetooth/l2cap_core.c:4999:45: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
net/bluetooth/l2cap_core.c:7116:47: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

Link: https://github.com/KSPP/linux/issues/202
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
Changes in v2:
 - Add a couple of code comments.

v1:
 - Link: https://lore.kernel.org/linux-hardening/ZgMpynzZ8FltPCi3@neat/

Hi!

I wonder if `struct l2cap_ecred_conn_rsp` should also be `__packed`.

Thanks
 - Gustavo

 include/net/bluetooth/l2cap.h | 22 +++++++++++------
 net/bluetooth/l2cap_core.c    | 46 ++++++++++++++++-------------------
 2 files changed, 35 insertions(+), 33 deletions(-)

Comments

Luiz Augusto von Dentz March 27, 2024, 4:55 p.m. UTC | #1
Hi Gustavo,

On Wed, Mar 27, 2024 at 12:23 PM Gustavo A. R. Silva
<gustavoars@kernel.org> wrote:
>
> -Wflex-array-member-not-at-end is coming in GCC-14, and we are getting
> ready to enable it globally.

Which tree is this base on, I just rebased bluetooth-next on top of
net-next but it looks like CI is still failing to build it, so either
we don't have all the dependencies already in net-next or perhaps you
had it submit while the tree had not been updated.

> There are currently a couple of objects (`req` and `rsp`), in a couple
> of structures, that contain flexible structures (`struct l2cap_ecred_conn_req`
> and `struct l2cap_ecred_conn_rsp`), for example:
>
> struct l2cap_ecred_rsp_data {
>         struct {
>                 struct l2cap_ecred_conn_rsp rsp;
>                 __le16 scid[L2CAP_ECRED_MAX_CID];
>         } __packed pdu;
>         int count;
> };
>
> in the struct above, `struct l2cap_ecred_conn_rsp` is a flexible
> structure:
>
> struct l2cap_ecred_conn_rsp {
>         __le16 mtu;
>         __le16 mps;
>         __le16 credits;
>         __le16 result;
>         __le16 dcid[];
> };
>
> So, in order to avoid ending up with a flexible-array member in the
> middle of another structure, we use the `struct_group_tagged()` (and
> `__struct_group()` when the flexible structure is `__packed`) helper
> to separate the flexible array from the rest of the members in the
> flexible structure:
>
> struct l2cap_ecred_conn_rsp {
>         struct_group_tagged(l2cap_ecred_conn_rsp_hdr, hdr,
>
>         ... the rest of members
>
>         );
>         __le16 dcid[];
> };
>
> With the change described above, we now declare objects of the type of
> the tagged struct, in this example `struct l2cap_ecred_conn_rsp_hdr`,
> without embedding flexible arrays in the middle of other structures:
>
> struct l2cap_ecred_rsp_data {
>         struct {
>                 struct l2cap_ecred_conn_rsp_hdr rsp;
>                 __le16 scid[L2CAP_ECRED_MAX_CID];
>         } __packed pdu;
>         int count;
> };
>
> Also, when the flexible-array member needs to be accessed, we use
> `container_of()` to retrieve a pointer to the flexible structure.
>
> We also use the `DEFINE_RAW_FLEX()` helper for a couple of on-stack
> definitions of a flexible structure where the size of the flexible-array
> member is known at compile-time.
>
> So, with these changes, fix the following warnings:
> net/bluetooth/l2cap_core.c:1260:45: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
> net/bluetooth/l2cap_core.c:3740:45: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
> net/bluetooth/l2cap_core.c:4999:45: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
> net/bluetooth/l2cap_core.c:7116:47: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
>
> Link: https://github.com/KSPP/linux/issues/202
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> ---
> Changes in v2:
>  - Add a couple of code comments.
>
> v1:
>  - Link: https://lore.kernel.org/linux-hardening/ZgMpynzZ8FltPCi3@neat/
>
> Hi!
>
> I wonder if `struct l2cap_ecred_conn_rsp` should also be `__packed`.
>
> Thanks
>  - Gustavo
>
>  include/net/bluetooth/l2cap.h | 22 +++++++++++------
>  net/bluetooth/l2cap_core.c    | 46 ++++++++++++++++-------------------
>  2 files changed, 35 insertions(+), 33 deletions(-)
>
> diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
> index a4278aa618ab..7d4a3e766e7b 100644
> --- a/include/net/bluetooth/l2cap.h
> +++ b/include/net/bluetooth/l2cap.h
> @@ -463,18 +463,24 @@ struct l2cap_le_credits {
>  #define L2CAP_ECRED_MAX_CID            5
>
>  struct l2cap_ecred_conn_req {
> -       __le16 psm;
> -       __le16 mtu;
> -       __le16 mps;
> -       __le16 credits;
> +       /* New members must be added within the struct_group() macro below. */
> +       __struct_group(l2cap_ecred_conn_req_hdr, hdr, __packed,
> +               __le16 psm;
> +               __le16 mtu;
> +               __le16 mps;
> +               __le16 credits;
> +       );
>         __le16 scid[];
>  } __packed;
>
>  struct l2cap_ecred_conn_rsp {
> -       __le16 mtu;
> -       __le16 mps;
> -       __le16 credits;
> -       __le16 result;
> +       /* New members must be added within the struct_group() macro below. */
> +       struct_group_tagged(l2cap_ecred_conn_rsp_hdr, hdr,
> +               __le16 mtu;
> +               __le16 mps;
> +               __le16 credits;
> +               __le16 result;
> +       );
>         __le16 dcid[];
>  };
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 467b242d8be0..bf087eca489e 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -1257,7 +1257,7 @@ static void l2cap_le_connect(struct l2cap_chan *chan)
>
>  struct l2cap_ecred_conn_data {
>         struct {
> -               struct l2cap_ecred_conn_req req;
> +               struct l2cap_ecred_conn_req_hdr req;
>                 __le16 scid[5];
>         } __packed pdu;
>         struct l2cap_chan *chan;
> @@ -3737,7 +3737,7 @@ static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data)
>
>  struct l2cap_ecred_rsp_data {
>         struct {
> -               struct l2cap_ecred_conn_rsp rsp;
> +               struct l2cap_ecred_conn_rsp_hdr rsp;
>                 __le16 scid[L2CAP_ECRED_MAX_CID];
>         } __packed pdu;
>         int count;
> @@ -3746,6 +3746,8 @@ struct l2cap_ecred_rsp_data {
>  static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
>  {
>         struct l2cap_ecred_rsp_data *rsp = data;
> +       struct l2cap_ecred_conn_rsp *rsp_flex =
> +               container_of(&rsp->pdu.rsp, struct l2cap_ecred_conn_rsp, hdr);
>
>         if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
>                 return;
> @@ -3755,7 +3757,7 @@ static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
>
>         /* Include all channels pending with the same ident */
>         if (!rsp->pdu.rsp.result)
> -               rsp->pdu.rsp.dcid[rsp->count++] = cpu_to_le16(chan->scid);
> +               rsp_flex->dcid[rsp->count++] = cpu_to_le16(chan->scid);
>         else
>                 l2cap_chan_del(chan, ECONNRESET);
>  }
> @@ -4995,10 +4997,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
>                                        u8 *data)
>  {
>         struct l2cap_ecred_conn_req *req = (void *) data;
> -       struct {
> -               struct l2cap_ecred_conn_rsp rsp;
> -               __le16 dcid[L2CAP_ECRED_MAX_CID];
> -       } __packed pdu;
> +       DEFINE_RAW_FLEX(struct l2cap_ecred_conn_rsp, pdu, dcid, L2CAP_ECRED_MAX_CID);
>         struct l2cap_chan *chan, *pchan;
>         u16 mtu, mps;
>         __le16 psm;
> @@ -5017,7 +5016,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
>         cmd_len -= sizeof(*req);
>         num_scid = cmd_len / sizeof(u16);
>
> -       if (num_scid > ARRAY_SIZE(pdu.dcid)) {
> +       if (num_scid > L2CAP_ECRED_MAX_CID) {
>                 result = L2CAP_CR_LE_INVALID_PARAMS;
>                 goto response;
>         }
> @@ -5046,7 +5045,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
>
>         BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
>
> -       memset(&pdu, 0, sizeof(pdu));
> +       memset(pdu, 0, sizeof(*pdu));
>
>         /* Check if we have socket listening on psm */
>         pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
> @@ -5072,8 +5071,8 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
>
>                 BT_DBG("scid[%d] 0x%4.4x", i, scid);
>
> -               pdu.dcid[i] = 0x0000;
> -               len += sizeof(*pdu.dcid);
> +               pdu->dcid[i] = 0x0000;
> +               len += sizeof(*pdu->dcid);
>
>                 /* Check for valid dynamic CID range */
>                 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
> @@ -5107,13 +5106,13 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
>                 l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
>
>                 /* Init response */
> -               if (!pdu.rsp.credits) {
> -                       pdu.rsp.mtu = cpu_to_le16(chan->imtu);
> -                       pdu.rsp.mps = cpu_to_le16(chan->mps);
> -                       pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
> +               if (!pdu->credits) {
> +                       pdu->mtu = cpu_to_le16(chan->imtu);
> +                       pdu->mps = cpu_to_le16(chan->mps);
> +                       pdu->credits = cpu_to_le16(chan->rx_credits);
>                 }
>
> -               pdu.dcid[i] = cpu_to_le16(chan->scid);
> +               pdu->dcid[i] = cpu_to_le16(chan->scid);
>
>                 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
>
> @@ -5135,13 +5134,13 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
>         l2cap_chan_put(pchan);
>
>  response:
> -       pdu.rsp.result = cpu_to_le16(result);
> +       pdu->result = cpu_to_le16(result);
>
>         if (defer)
>                 return 0;
>
>         l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
> -                      sizeof(pdu.rsp) + len, &pdu);
> +                      sizeof(*pdu) + len, pdu);
>
>         return 0;
>  }
> @@ -7112,14 +7111,11 @@ EXPORT_SYMBOL_GPL(l2cap_chan_connect);
>  static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
>  {
>         struct l2cap_conn *conn = chan->conn;
> -       struct {
> -               struct l2cap_ecred_reconf_req req;
> -               __le16 scid;
> -       } pdu;
> +       DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1);
>
> -       pdu.req.mtu = cpu_to_le16(chan->imtu);
> -       pdu.req.mps = cpu_to_le16(chan->mps);
> -       pdu.scid    = cpu_to_le16(chan->scid);
> +       pdu->mtu = cpu_to_le16(chan->imtu);
> +       pdu->mps = cpu_to_le16(chan->mps);
> +       pdu->scid[0] = cpu_to_le16(chan->scid);
>
>         chan->ident = l2cap_get_ident(conn);
>
> --
> 2.34.1
>
Gustavo A. R. Silva March 27, 2024, 5:08 p.m. UTC | #2
Hi!

On 3/27/24 10:55, Luiz Augusto von Dentz wrote:
> Hi Gustavo,
> 
> On Wed, Mar 27, 2024 at 12:23 PM Gustavo A. R. Silva
> <gustavoars@kernel.org> wrote:
>>
>> -Wflex-array-member-not-at-end is coming in GCC-14, and we are getting
>> ready to enable it globally.
> 
> Which tree is this base on, I just rebased bluetooth-next on top of
> net-next but it looks like CI is still failing to build it, so either
> we don't have all the dependencies already in net-next or perhaps you
> had it submit while the tree had not been updated.

This is based off of linux-next.

I think net-next is missing this commit in v6.9-rc1:

d8e45f2929b9 "overflow: Change DEFINE_FLEX to take __counted_by member")

https://git.kernel.org/linus/d8e45f2929b9

Thanks
--
Gustavo
Kees Cook March 28, 2024, 5:28 a.m. UTC | #3
On March 27, 2024 11:08:33 AM MDT, "Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote:
>Hi!
>
>On 3/27/24 10:55, Luiz Augusto von Dentz wrote:
>> Hi Gustavo,
>> 
>> On Wed, Mar 27, 2024 at 12:23 PM Gustavo A. R. Silva
>> <gustavoars@kernel.org> wrote:
>>> 
>>> -Wflex-array-member-not-at-end is coming in GCC-14, and we are getting
>>> ready to enable it globally.
>> 
>> Which tree is this base on, I just rebased bluetooth-next on top of
>> net-next but it looks like CI is still failing to build it, so either
>> we don't have all the dependencies already in net-next or perhaps you
>> had it submit while the tree had not been updated.
>
>This is based off of linux-next.
>
>I think net-next is missing this commit in v6.9-rc1:
>
>d8e45f2929b9 "overflow: Change DEFINE_FLEX to take __counted_by member")
>
>https://git.kernel.org/linus/d8e45f2929b9

Just FYI, that is in rc1. (I sent it late to avoid a netdev collision.)
Gustavo A. R. Silva March 28, 2024, 5:51 a.m. UTC | #4
On 27/03/24 23:28, Kees Cook wrote:
> 
> 
> On March 27, 2024 11:08:33 AM MDT, "Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote:
>> Hi!
>>
>> On 3/27/24 10:55, Luiz Augusto von Dentz wrote:
>>> Hi Gustavo,
>>>
>>> On Wed, Mar 27, 2024 at 12:23 PM Gustavo A. R. Silva
>>> <gustavoars@kernel.org> wrote:
>>>>
>>>> -Wflex-array-member-not-at-end is coming in GCC-14, and we are getting
>>>> ready to enable it globally.
>>>
>>> Which tree is this base on, I just rebased bluetooth-next on top of
>>> net-next but it looks like CI is still failing to build it, so either
>>> we don't have all the dependencies already in net-next or perhaps you
>>> had it submit while the tree had not been updated.
>>
>> This is based off of linux-next.
>>
>> I think net-next is missing this commit in v6.9-rc1:
>>
>> d8e45f2929b9 "overflow: Change DEFINE_FLEX to take __counted_by member")
>>
>> https://git.kernel.org/linus/d8e45f2929b9
> 
> Just FYI, that is in rc1. (I sent it late to avoid a netdev collision.)
> 

Yep.

They haven't pulled all the changes from mainline up to -rc1, yet:

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/log/

--
Gustavo
patchwork-bot+bluetooth@kernel.org April 8, 2024, 10:11 p.m. UTC | #5
Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 27 Mar 2024 10:23:51 -0600 you wrote:
> -Wflex-array-member-not-at-end is coming in GCC-14, and we are getting
> ready to enable it globally.
> 
> There are currently a couple of objects (`req` and `rsp`), in a couple
> of structures, that contain flexible structures (`struct l2cap_ecred_conn_req`
> and `struct l2cap_ecred_conn_rsp`), for example:
> 
> [...]

Here is the summary with links:
  - [v2,next] Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings
    https://git.kernel.org/bluetooth/bluetooth-next/c/215c4704208b

You are awesome, thank you!
diff mbox series

Patch

diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index a4278aa618ab..7d4a3e766e7b 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -463,18 +463,24 @@  struct l2cap_le_credits {
 #define L2CAP_ECRED_MAX_CID		5
 
 struct l2cap_ecred_conn_req {
-	__le16 psm;
-	__le16 mtu;
-	__le16 mps;
-	__le16 credits;
+	/* New members must be added within the struct_group() macro below. */
+	__struct_group(l2cap_ecred_conn_req_hdr, hdr, __packed,
+		__le16 psm;
+		__le16 mtu;
+		__le16 mps;
+		__le16 credits;
+	);
 	__le16 scid[];
 } __packed;
 
 struct l2cap_ecred_conn_rsp {
-	__le16 mtu;
-	__le16 mps;
-	__le16 credits;
-	__le16 result;
+	/* New members must be added within the struct_group() macro below. */
+	struct_group_tagged(l2cap_ecred_conn_rsp_hdr, hdr,
+		__le16 mtu;
+		__le16 mps;
+		__le16 credits;
+		__le16 result;
+	);
 	__le16 dcid[];
 };
 
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 467b242d8be0..bf087eca489e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1257,7 +1257,7 @@  static void l2cap_le_connect(struct l2cap_chan *chan)
 
 struct l2cap_ecred_conn_data {
 	struct {
-		struct l2cap_ecred_conn_req req;
+		struct l2cap_ecred_conn_req_hdr req;
 		__le16 scid[5];
 	} __packed pdu;
 	struct l2cap_chan *chan;
@@ -3737,7 +3737,7 @@  static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data)
 
 struct l2cap_ecred_rsp_data {
 	struct {
-		struct l2cap_ecred_conn_rsp rsp;
+		struct l2cap_ecred_conn_rsp_hdr rsp;
 		__le16 scid[L2CAP_ECRED_MAX_CID];
 	} __packed pdu;
 	int count;
@@ -3746,6 +3746,8 @@  struct l2cap_ecred_rsp_data {
 static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
 {
 	struct l2cap_ecred_rsp_data *rsp = data;
+	struct l2cap_ecred_conn_rsp *rsp_flex =
+		container_of(&rsp->pdu.rsp, struct l2cap_ecred_conn_rsp, hdr);
 
 	if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
 		return;
@@ -3755,7 +3757,7 @@  static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
 
 	/* Include all channels pending with the same ident */
 	if (!rsp->pdu.rsp.result)
-		rsp->pdu.rsp.dcid[rsp->count++] = cpu_to_le16(chan->scid);
+		rsp_flex->dcid[rsp->count++] = cpu_to_le16(chan->scid);
 	else
 		l2cap_chan_del(chan, ECONNRESET);
 }
@@ -4995,10 +4997,7 @@  static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
 				       u8 *data)
 {
 	struct l2cap_ecred_conn_req *req = (void *) data;
-	struct {
-		struct l2cap_ecred_conn_rsp rsp;
-		__le16 dcid[L2CAP_ECRED_MAX_CID];
-	} __packed pdu;
+	DEFINE_RAW_FLEX(struct l2cap_ecred_conn_rsp, pdu, dcid, L2CAP_ECRED_MAX_CID);
 	struct l2cap_chan *chan, *pchan;
 	u16 mtu, mps;
 	__le16 psm;
@@ -5017,7 +5016,7 @@  static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
 	cmd_len -= sizeof(*req);
 	num_scid = cmd_len / sizeof(u16);
 
-	if (num_scid > ARRAY_SIZE(pdu.dcid)) {
+	if (num_scid > L2CAP_ECRED_MAX_CID) {
 		result = L2CAP_CR_LE_INVALID_PARAMS;
 		goto response;
 	}
@@ -5046,7 +5045,7 @@  static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
 
 	BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
 
-	memset(&pdu, 0, sizeof(pdu));
+	memset(pdu, 0, sizeof(*pdu));
 
 	/* Check if we have socket listening on psm */
 	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
@@ -5072,8 +5071,8 @@  static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
 
 		BT_DBG("scid[%d] 0x%4.4x", i, scid);
 
-		pdu.dcid[i] = 0x0000;
-		len += sizeof(*pdu.dcid);
+		pdu->dcid[i] = 0x0000;
+		len += sizeof(*pdu->dcid);
 
 		/* Check for valid dynamic CID range */
 		if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
@@ -5107,13 +5106,13 @@  static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
 		l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
 
 		/* Init response */
-		if (!pdu.rsp.credits) {
-			pdu.rsp.mtu = cpu_to_le16(chan->imtu);
-			pdu.rsp.mps = cpu_to_le16(chan->mps);
-			pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
+		if (!pdu->credits) {
+			pdu->mtu = cpu_to_le16(chan->imtu);
+			pdu->mps = cpu_to_le16(chan->mps);
+			pdu->credits = cpu_to_le16(chan->rx_credits);
 		}
 
-		pdu.dcid[i] = cpu_to_le16(chan->scid);
+		pdu->dcid[i] = cpu_to_le16(chan->scid);
 
 		__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
 
@@ -5135,13 +5134,13 @@  static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
 	l2cap_chan_put(pchan);
 
 response:
-	pdu.rsp.result = cpu_to_le16(result);
+	pdu->result = cpu_to_le16(result);
 
 	if (defer)
 		return 0;
 
 	l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
-		       sizeof(pdu.rsp) + len, &pdu);
+		       sizeof(*pdu) + len, pdu);
 
 	return 0;
 }
@@ -7112,14 +7111,11 @@  EXPORT_SYMBOL_GPL(l2cap_chan_connect);
 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
 {
 	struct l2cap_conn *conn = chan->conn;
-	struct {
-		struct l2cap_ecred_reconf_req req;
-		__le16 scid;
-	} pdu;
+	DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1);
 
-	pdu.req.mtu = cpu_to_le16(chan->imtu);
-	pdu.req.mps = cpu_to_le16(chan->mps);
-	pdu.scid    = cpu_to_le16(chan->scid);
+	pdu->mtu = cpu_to_le16(chan->imtu);
+	pdu->mps = cpu_to_le16(chan->mps);
+	pdu->scid[0] = cpu_to_le16(chan->scid);
 
 	chan->ident = l2cap_get_ident(conn);