Commit 0fb9125e authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by Martin K. Petersen
Browse files

scsi: 3w-xxxx: Replace one-element array with flexible-array member 

One-element arrays are deprecated, and we are replacing them with flexible
array members instead. So, replace one-element array with flexible-array
member in struct TAG_TW_New_Ioctl and refactor the rest of the code,
accordingly.

Notice that, in multiple places, the subtraction of 1 from
sizeof(TW_New_Ioctl) is removed, as this operation is now implicit
after the flex-array transformation.

Link: https://github.com/KSPP/linux/issues/79
Link: https://github.com/KSPP/linux/issues/206
Link: https://lore.kernel.org/r/YyyyvB30jnjRaw/F@work


Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent d2079662

drivers/scsi/3w-xxxx.c

+7 −7
Original line number Diff line number Diff line
@@ -912,7 +912,7 @@ static long tw_chrdev_ioctl(struct file *file, unsigned int cmd, unsigned long a 
	data_buffer_length_adjusted = (data_buffer_length + 511) & ~511;



	/* Now allocate ioctl buf memory */

	cpu_addr = dma_alloc_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_New_Ioctl) - 1, &dma_handle, GFP_KERNEL);

	cpu_addr = dma_alloc_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted + sizeof(TW_New_Ioctl), &dma_handle, GFP_KERNEL);

	if (cpu_addr == NULL) {

		retval = -ENOMEM;

		goto out;
@@ -921,7 +921,7 @@ static long tw_chrdev_ioctl(struct file *file, unsigned int cmd, unsigned long a 
	tw_ioctl = (TW_New_Ioctl *)cpu_addr;



	/* Now copy down the entire ioctl */

	if (copy_from_user(tw_ioctl, argp, data_buffer_length + sizeof(TW_New_Ioctl) - 1))

	if (copy_from_user(tw_ioctl, argp, data_buffer_length + sizeof(TW_New_Ioctl)))

		goto out2;



	passthru = (TW_Passthru *)&tw_ioctl->firmware_command;
@@ -966,15 +966,15 @@ static long tw_chrdev_ioctl(struct file *file, unsigned int cmd, unsigned long a 
			/* Load the sg list */

			switch (TW_SGL_OUT(tw_ioctl->firmware_command.opcode__sgloffset)) {

			case 2:

				tw_ioctl->firmware_command.byte8.param.sgl[0].address = dma_handle + sizeof(TW_New_Ioctl) - 1;

				tw_ioctl->firmware_command.byte8.param.sgl[0].address = dma_handle + sizeof(TW_New_Ioctl);

				tw_ioctl->firmware_command.byte8.param.sgl[0].length = data_buffer_length_adjusted;

				break;

			case 3:

				tw_ioctl->firmware_command.byte8.io.sgl[0].address = dma_handle + sizeof(TW_New_Ioctl) - 1;

				tw_ioctl->firmware_command.byte8.io.sgl[0].address = dma_handle + sizeof(TW_New_Ioctl);

				tw_ioctl->firmware_command.byte8.io.sgl[0].length = data_buffer_length_adjusted;

				break;

			case 5:

				passthru->sg_list[0].address = dma_handle + sizeof(TW_New_Ioctl) - 1;

				passthru->sg_list[0].address = dma_handle + sizeof(TW_New_Ioctl);

				passthru->sg_list[0].length = data_buffer_length_adjusted;

				break;

			}
@@ -1017,12 +1017,12 @@ static long tw_chrdev_ioctl(struct file *file, unsigned int cmd, unsigned long a 
	}



	/* Now copy the response to userspace */

	if (copy_to_user(argp, tw_ioctl, sizeof(TW_New_Ioctl) + data_buffer_length - 1))

	if (copy_to_user(argp, tw_ioctl, sizeof(TW_New_Ioctl) + data_buffer_length))

		goto out2;

	retval = 0;

out2:

	/* Now free ioctl buf memory */

	dma_free_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_New_Ioctl) - 1, cpu_addr, dma_handle);

	dma_free_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted + sizeof(TW_New_Ioctl), cpu_addr, dma_handle);

out:

	mutex_unlock(&tw_dev->ioctl_lock);

	mutex_unlock(&tw_mutex);

drivers/scsi/3w-xxxx.h

+1 −1
Original line number Diff line number Diff line
@@ -348,7 +348,7 @@ typedef struct TAG_TW_New_Ioctl { 
	unsigned int data_buffer_length;

	unsigned char padding [508];

	TW_Command firmware_command;

	char data_buffer[1];

	char data_buffer[];

} TW_New_Ioctl;



/* GetParam descriptor */