All of lore.kernel.org
 help / color / mirror / Atom feed
From: Kees Cook <keescook@chromium.org>
To: "Martin K . Petersen" <martin.petersen@oracle.com>
Cc: Kees Cook <keescook@chromium.org>, Hannes Reinecke <hare@suse.de>,
	"James E.J. Bottomley" <jejb@linux.ibm.com>,
	"Gustavo A. R. Silva" <gustavoars@kernel.org>,
	Bradley Grove <linuxdrivers@attotech.com>,
	Artur Paszkiewicz <artur.paszkiewicz@intel.com>,
	linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org,
	linux-hardening@vger.kernel.org
Subject: [PATCH 2/3] scsi: esas2r: Switch to flexible array member
Date: Fri, 28 May 2021 11:13:36 -0700	[thread overview]
Message-ID: <20210528181337.792268-3-keescook@chromium.org> (raw)
In-Reply-To: <20210528181337.792268-1-keescook@chromium.org>

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), avoid intentionally writing across
neighboring array fields.

Remove old-style 1-byte array in favor of a flexible array[1] to avoid
future false-positive cross-field memcpy() warning in:

esas2r_vda.c:
	memcpy(vi->cmd.gsv.version_info, esas2r_vdaioctl_versions, ...)

The change in struct size doesn't change other structure sizes (it is
already maxed out to 256 bytes, for example here:

        union {
                struct atto_ioctl_vda_scsi_cmd scsi;
                struct atto_ioctl_vda_flash_cmd flash;
                struct atto_ioctl_vda_diag_cmd diag;
                struct atto_ioctl_vda_cli_cmd cli;
                struct atto_ioctl_vda_smp_cmd smp;
                struct atto_ioctl_vda_cfg_cmd cfg;
                struct atto_ioctl_vda_mgt_cmd mgt;
                struct atto_ioctl_vda_gsv_cmd gsv;
                u8 cmd_info[256];
        } cmd;

No sizes are calculated using the enclosing structure, so no other
updates are needed.

Signed-off-by: Kees Cook <keescook@chromium.org>
---
 drivers/scsi/esas2r/atioctl.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/esas2r/atioctl.h b/drivers/scsi/esas2r/atioctl.h
index 4aca3d52c851..ff2ad9b38575 100644
--- a/drivers/scsi/esas2r/atioctl.h
+++ b/drivers/scsi/esas2r/atioctl.h
@@ -1141,7 +1141,7 @@ struct __packed atto_ioctl_vda_gsv_cmd {
 
 	u8 rsp_len;
 	u8 reserved[7];
-	u8 version_info[1];
+	u8 version_info[];
 	#define ATTO_VDA_VER_UNSUPPORTED 0xFF
 
 };
-- 
2.25.1


  parent reply	other threads:[~2021-05-28 18:13 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-28 18:13 [PATCH 0/3] scsi: Fix a handful of memcpy() field overflows Kees Cook
2021-05-28 18:13 ` [PATCH 1/3] scsi: fcoe: Statically initialize flogi_maddr Kees Cook
2021-05-28 18:28   ` Joe Perches
2021-05-28 18:29     ` Kees Cook
2021-05-28 18:13 ` Kees Cook [this message]
2021-05-28 20:26   ` [PATCH 2/3] scsi: esas2r: Switch to flexible array member Gustavo A. R. Silva
2021-05-28 18:13 ` [PATCH 3/3] scsi: isci: Use correctly sized target buffer for memcpy() Kees Cook
2021-05-28 20:29   ` Gustavo A. R. Silva
2021-06-02  3:38 ` [PATCH 0/3] scsi: Fix a handful of memcpy() field overflows Martin K. Petersen
2021-06-02 18:00   ` Kees Cook
2021-06-08  3:05 ` Martin K. Petersen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210528181337.792268-3-keescook@chromium.org \
    --to=keescook@chromium.org \
    --cc=artur.paszkiewicz@intel.com \
    --cc=gustavoars@kernel.org \
    --cc=hare@suse.de \
    --cc=jejb@linux.ibm.com \
    --cc=linux-hardening@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-scsi@vger.kernel.org \
    --cc=linuxdrivers@attotech.com \
    --cc=martin.petersen@oracle.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.