From: Kees Cook <keescook@chromium.org>
To: "Martin K . Petersen" <martin.petersen@oracle.com>
Cc: Kees Cook <keescook@chromium.org>, Hannes Reinecke <hare@suse.de>,
"James E.J. Bottomley" <jejb@linux.ibm.com>,
"Gustavo A. R. Silva" <gustavoars@kernel.org>,
Bradley Grove <linuxdrivers@attotech.com>,
Artur Paszkiewicz <artur.paszkiewicz@intel.com>,
linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org,
linux-hardening@vger.kernel.org
Subject: [PATCH 3/3] scsi: isci: Use correctly sized target buffer for memcpy()
Date: Fri, 28 May 2021 11:13:37 -0700 [thread overview]
Message-ID: <20210528181337.792268-4-keescook@chromium.org> (raw)
In-Reply-To: <20210528181337.792268-1-keescook@chromium.org>
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), avoid intentionally writing across
neighboring array fields.
Switch from rsp_ui to resp_buf, since resp_ui isn't SSP_RESP_IU_MAX_SIZE
bytes in length. This avoids future compile-time warnings.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
drivers/scsi/isci/task.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
index 62062ed6cd9a..eeaec26ac324 100644
--- a/drivers/scsi/isci/task.c
+++ b/drivers/scsi/isci/task.c
@@ -709,8 +709,8 @@ isci_task_request_complete(struct isci_host *ihost,
tmf->status = completion_status;
if (tmf->proto == SAS_PROTOCOL_SSP) {
- memcpy(&tmf->resp.resp_iu,
- &ireq->ssp.rsp,
+ memcpy(tmf->resp.rsp_buf,
+ ireq->ssp.rsp_buf,
SSP_RESP_IU_MAX_SIZE);
} else if (tmf->proto == SAS_PROTOCOL_SATA) {
memcpy(&tmf->resp.d2h_fis,
--
2.25.1
next prev parent reply other threads:[~2021-05-28 18:13 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-28 18:13 [PATCH 0/3] scsi: Fix a handful of memcpy() field overflows Kees Cook
2021-05-28 18:13 ` [PATCH 1/3] scsi: fcoe: Statically initialize flogi_maddr Kees Cook
2021-05-28 18:28 ` Joe Perches
2021-05-28 18:29 ` Kees Cook
2021-05-28 18:13 ` [PATCH 2/3] scsi: esas2r: Switch to flexible array member Kees Cook
2021-05-28 20:26 ` Gustavo A. R. Silva
2021-05-28 18:13 ` Kees Cook [this message]
2021-05-28 20:29 ` [PATCH 3/3] scsi: isci: Use correctly sized target buffer for memcpy() Gustavo A. R. Silva
2021-06-02 3:38 ` [PATCH 0/3] scsi: Fix a handful of memcpy() field overflows Martin K. Petersen
2021-06-02 18:00 ` Kees Cook
2021-06-08 3:05 ` Martin K. Petersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210528181337.792268-4-keescook@chromium.org \
--to=keescook@chromium.org \
--cc=artur.paszkiewicz@intel.com \
--cc=gustavoars@kernel.org \
--cc=hare@suse.de \
--cc=jejb@linux.ibm.com \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=linuxdrivers@attotech.com \
--cc=martin.petersen@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.