drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
Hi all,
After merging the kspp tree, today's linux-next build (powerpc
allyesconfig) failed like this:
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_send_messages':
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1934:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1934 | crq->valid = VALID_CMD_RESP_EL;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
1875 | u64 msg_hi = 0;
| ^~~~~~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1935:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1935 | crq->format = cmd->rsp.format;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
1875 | u64 msg_hi = 0;
| ^~~~~~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1938:52: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1938 | crq->status = VIOSRP_ADAPTER_FAIL;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
1875 | u64 msg_hi = 0;
| ^~~~~~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1940:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1940 | crq->IU_length = cpu_to_be16(cmd->rsp.len);
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
1875 | u64 msg_hi = 0;
| ^~~~~~
Exposed by commit
4ba545781e20 ("Makefile: Enable -Warray-bounds")
Probably introduced by commit
88a678bbc34c ("ibmvscsis: Initial commit of IBM VSCSI Tgt Driver")
I applied the following hack for now:
From: Stephen Rothwell <sfr@canb.auug.org.au>
Date: Tue, 25 Jan 2022 14:18:36 +1100
Subject: [PATCH] scsi: hack for building with -Warray-bounds
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
---
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index 61f06f6885a5..89fcf98c61c3 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -1872,11 +1872,11 @@ static void srp_snd_msg_failed(struct scsi_info *vscsi, long rc)
*/
static void ibmvscsis_send_messages(struct scsi_info *vscsi)
{
- u64 msg_hi = 0;
+ u64 msg_hi[2] = { };
/* note do not attempt to access the IU_data_ptr with this pointer
* it is not valid
*/
- struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi;
+ struct viosrp_crq *crq = (struct viosrp_crq *)msg_hi;
struct ibmvscsis_cmd *cmd, *nxt;
long rc = ADAPT_SUCCESS;
bool retry = false;
@@ -1940,7 +1940,7 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
crq->IU_length = cpu_to_be16(cmd->rsp.len);
rc = h_send_crq(vscsi->dma_dev->unit_address,
- be64_to_cpu(msg_hi),
+ be64_to_cpu(msg_hi[0]),
be64_to_cpu(cmd->rsp.tag));
dev_dbg(&vscsi->dev, "send_messages: cmd %p, tag 0x%llx, rc %ld\n",
--
2.34.1
--
Cheers,
Stephen Rothwell
On Tue, Jan 25, 2022 at 02:24:30PM +1100, Stephen Rothwell wrote:
> Hi all,
>
> After merging the kspp tree, today's linux-next build (powerpc
> allyesconfig) failed like this:
>
>
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_send_messages':
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1934:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> 1934 | crq->valid = VALID_CMD_RESP_EL;
> | ^~
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> 1875 | u64 msg_hi = 0;
> | ^~~~~~
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1935:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> 1935 | crq->format = cmd->rsp.format;
> | ^~
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> 1875 | u64 msg_hi = 0;
> | ^~~~~~
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1938:52: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> 1938 | crq->status = VIOSRP_ADAPTER_FAIL;
> | ^~
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> 1875 | u64 msg_hi = 0;
> | ^~~~~~
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1940:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> 1940 | crq->IU_length = cpu_to_be16(cmd->rsp.len);
> | ^~
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> 1875 | u64 msg_hi = 0;
> | ^~~~~~
>
> Exposed by commit
>
> 4ba545781e20 ("Makefile: Enable -Warray-bounds")
>
> Probably introduced by commit
>
> 88a678bbc34c ("ibmvscsis: Initial commit of IBM VSCSI Tgt Driver")
>
> I applied the following hack for now:
>
> From: Stephen Rothwell <sfr@canb.auug.org.au>
> Date: Tue, 25 Jan 2022 14:18:36 +1100
> Subject: [PATCH] scsi: hack for building with -Warray-bounds
>
> Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
> ---
> drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> index 61f06f6885a5..89fcf98c61c3 100644
> --- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> +++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> @@ -1872,11 +1872,11 @@ static void srp_snd_msg_failed(struct scsi_info *vscsi, long rc)
> */
> static void ibmvscsis_send_messages(struct scsi_info *vscsi)
> {
> - u64 msg_hi = 0;
> + u64 msg_hi[2] = { };
> /* note do not attempt to access the IU_data_ptr with this pointer
> * it is not valid
> */
> - struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi;
> + struct viosrp_crq *crq = (struct viosrp_crq *)msg_hi;
> struct ibmvscsis_cmd *cmd, *nxt;
> long rc = ADAPT_SUCCESS;
> bool retry = false;
> @@ -1940,7 +1940,7 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
> crq->IU_length = cpu_to_be16(cmd->rsp.len);
>
> rc = h_send_crq(vscsi->dma_dev->unit_address,
> - be64_to_cpu(msg_hi),
> + be64_to_cpu(msg_hi[0]),
> be64_to_cpu(cmd->rsp.tag));
>
> dev_dbg(&vscsi->dev, "send_messages: cmd %p, tag 0x%llx, rc %ld\n",
This looks correct to me. struct viosrp_crq is 16 bytes wide. The only
suggestion I might make would be either avoid the bare '2':
u64 msg_hi[sizeof(struct viosrp_crq) / sizeof(u64)] = { };
or adjust struct viosrp_crq so the casting isn't needed at all:
truct viosrp_crq {
union {
u64 hi;
struct {
u8 valid; /* used by RPA */
u8 format; /* SCSI vs out-of-band */
u8 reserved;
u8 status; /* non-scsi failure? (e.g. DMA failure) */
__be16 timeout; /* in seconds */
__be16 IU_length; /* in bytes */
};
};
__be64 IU_data_ptr; /* the TCE for transferring data */
};
struct viosrp_crq crq = { };
...
rc = h_send_crq(vscsi->dma_dev->unit_address,
be64_to_cpu(crq.hi),
be64_to_cpu(cmd->rsp.tag));
--
Kees Cook
Hi all,
[Cc'ing the scsi maintainers. Sorry I should have done that sooner]
On Mon, 24 Jan 2022 19:43:44 -0800 Kees Cook <keescook@chromium.org> wrote:
>
> On Tue, Jan 25, 2022 at 02:24:30PM +1100, Stephen Rothwell wrote:
> >
> > After merging the kspp tree, today's linux-next build (powerpc
> > allyesconfig) failed like this:
> >
> >
> > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_send_messages':
> > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1934:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > 1934 | crq->valid = VALID_CMD_RESP_EL;
> > | ^~
> > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > 1875 | u64 msg_hi = 0;
> > | ^~~~~~
> > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1935:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > 1935 | crq->format = cmd->rsp.format;
> > | ^~
> > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > 1875 | u64 msg_hi = 0;
> > | ^~~~~~
> > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1938:52: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > 1938 | crq->status = VIOSRP_ADAPTER_FAIL;
> > | ^~
> > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > 1875 | u64 msg_hi = 0;
> > | ^~~~~~
> > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1940:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > 1940 | crq->IU_length = cpu_to_be16(cmd->rsp.len);
> > | ^~
> > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > 1875 | u64 msg_hi = 0;
> > | ^~~~~~
> >
> > Exposed by commit
> >
> > 4ba545781e20 ("Makefile: Enable -Warray-bounds")
> >
> > Probably introduced by commit
> >
> > 88a678bbc34c ("ibmvscsis: Initial commit of IBM VSCSI Tgt Driver")
> >
> > I applied the following hack for now:
> >
> > From: Stephen Rothwell <sfr@canb.auug.org.au>
> > Date: Tue, 25 Jan 2022 14:18:36 +1100
> > Subject: [PATCH] scsi: hack for building with -Warray-bounds
> >
> > Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
> > ---
> > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> > index 61f06f6885a5..89fcf98c61c3 100644
> > --- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> > +++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> > @@ -1872,11 +1872,11 @@ static void srp_snd_msg_failed(struct scsi_info *vscsi, long rc)
> > */
> > static void ibmvscsis_send_messages(struct scsi_info *vscsi)
> > {
> > - u64 msg_hi = 0;
> > + u64 msg_hi[2] = { };
> > /* note do not attempt to access the IU_data_ptr with this pointer
> > * it is not valid
> > */
> > - struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi;
> > + struct viosrp_crq *crq = (struct viosrp_crq *)msg_hi;
> > struct ibmvscsis_cmd *cmd, *nxt;
> > long rc = ADAPT_SUCCESS;
> > bool retry = false;
> > @@ -1940,7 +1940,7 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
> > crq->IU_length = cpu_to_be16(cmd->rsp.len);
> >
> > rc = h_send_crq(vscsi->dma_dev->unit_address,
> > - be64_to_cpu(msg_hi),
> > + be64_to_cpu(msg_hi[0]),
> > be64_to_cpu(cmd->rsp.tag));
> >
> > dev_dbg(&vscsi->dev, "send_messages: cmd %p, tag 0x%llx, rc %ld\n",
>
> This looks correct to me. struct viosrp_crq is 16 bytes wide. The only
> suggestion I might make would be either avoid the bare '2':
>
> u64 msg_hi[sizeof(struct viosrp_crq) / sizeof(u64)] = { };
>
> or adjust struct viosrp_crq so the casting isn't needed at all:
>
>
> truct viosrp_crq {
> union {
> u64 hi;
> struct {
> u8 valid; /* used by RPA */
> u8 format; /* SCSI vs out-of-band */
> u8 reserved;
> u8 status; /* non-scsi failure? (e.g. DMA failure) */
> __be16 timeout; /* in seconds */
> __be16 IU_length; /* in bytes */
> };
> };
> __be64 IU_data_ptr; /* the TCE for transferring data */
> };
>
> struct viosrp_crq crq = { };
> ...
> rc = h_send_crq(vscsi->dma_dev->unit_address,
> be64_to_cpu(crq.hi),
> be64_to_cpu(cmd->rsp.tag));
>
>
>
Has there been any progress on this?
Commit 88a678bbc34c mentioned above was merged in v4.8-rc1.
--
Cheers,
Stephen Rothwell
On Tue, Feb 08, 2022 at 03:42:18PM +1100, Stephen Rothwell wrote:
> Hi all,
>
> [Cc'ing the scsi maintainers. Sorry I should have done that sooner]
>
> On Mon, 24 Jan 2022 19:43:44 -0800 Kees Cook <keescook@chromium.org> wrote:
> >
> > On Tue, Jan 25, 2022 at 02:24:30PM +1100, Stephen Rothwell wrote:
> > >
> > > After merging the kspp tree, today's linux-next build (powerpc
> > > allyesconfig) failed like this:
> > >
> > >
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_send_messages':
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1934:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > > 1934 | crq->valid = VALID_CMD_RESP_EL;
> > > | ^~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > > 1875 | u64 msg_hi = 0;
> > > | ^~~~~~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1935:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > > 1935 | crq->format = cmd->rsp.format;
> > > | ^~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > > 1875 | u64 msg_hi = 0;
> > > | ^~~~~~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1938:52: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > > 1938 | crq->status = VIOSRP_ADAPTER_FAIL;
> > > | ^~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > > 1875 | u64 msg_hi = 0;
> > > | ^~~~~~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1940:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > > 1940 | crq->IU_length = cpu_to_be16(cmd->rsp.len);
> > > | ^~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > > 1875 | u64 msg_hi = 0;
> > > | ^~~~~~
> > >
> > > Exposed by commit
> > >
> > > 4ba545781e20 ("Makefile: Enable -Warray-bounds")
> > >
> > > Probably introduced by commit
> > >
> > > 88a678bbc34c ("ibmvscsis: Initial commit of IBM VSCSI Tgt Driver")
> > >
> > > I applied the following hack for now:
> > >
> > > From: Stephen Rothwell <sfr@canb.auug.org.au>
> > > Date: Tue, 25 Jan 2022 14:18:36 +1100
> > > Subject: [PATCH] scsi: hack for building with -Warray-bounds
> > >
> > > Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
> > > ---
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 6 +++---
> > > 1 file changed, 3 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> > > index 61f06f6885a5..89fcf98c61c3 100644
> > > --- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> > > +++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> > > @@ -1872,11 +1872,11 @@ static void srp_snd_msg_failed(struct scsi_info *vscsi, long rc)
> > > */
> > > static void ibmvscsis_send_messages(struct scsi_info *vscsi)
> > > {
> > > - u64 msg_hi = 0;
> > > + u64 msg_hi[2] = { };
> > > /* note do not attempt to access the IU_data_ptr with this pointer
> > > * it is not valid
> > > */
> > > - struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi;
> > > + struct viosrp_crq *crq = (struct viosrp_crq *)msg_hi;
> > > struct ibmvscsis_cmd *cmd, *nxt;
> > > long rc = ADAPT_SUCCESS;
> > > bool retry = false;
> > > @@ -1940,7 +1940,7 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
> > > crq->IU_length = cpu_to_be16(cmd->rsp.len);
> > >
> > > rc = h_send_crq(vscsi->dma_dev->unit_address,
> > > - be64_to_cpu(msg_hi),
> > > + be64_to_cpu(msg_hi[0]),
> > > be64_to_cpu(cmd->rsp.tag));
> > >
> > > dev_dbg(&vscsi->dev, "send_messages: cmd %p, tag 0x%llx, rc %ld\n",
> >
> > This looks correct to me. struct viosrp_crq is 16 bytes wide. The only
> > suggestion I might make would be either avoid the bare '2':
> >
> > u64 msg_hi[sizeof(struct viosrp_crq) / sizeof(u64)] = { };
> >
> > or adjust struct viosrp_crq so the casting isn't needed at all:
> >
> >
> > truct viosrp_crq {
> > union {
> > u64 hi;
> > struct {
> > u8 valid; /* used by RPA */
> > u8 format; /* SCSI vs out-of-band */
> > u8 reserved;
> > u8 status; /* non-scsi failure? (e.g. DMA failure) */
> > __be16 timeout; /* in seconds */
> > __be16 IU_length; /* in bytes */
> > };
> > };
> > __be64 IU_data_ptr; /* the TCE for transferring data */
> > };
> >
> > struct viosrp_crq crq = { };
> > ...
> > rc = h_send_crq(vscsi->dma_dev->unit_address,
> > be64_to_cpu(crq.hi),
> > be64_to_cpu(cmd->rsp.tag));
> >
> >
> >
>
> Has there been any progress on this?
>
> Commit 88a678bbc34c mentioned above was merged in v4.8-rc1.
Thanks for the reminder! I've sent this now:
https://lore.kernel.org/lkml/20220208061231.3429486-1-keescook@chromium.org
--
Kees Cook
© 2016 - 2026 Red Hat, Inc.