Commit 1ce871de authored by Kees Cook's avatar Kees Cook Committed by Martin K. Petersen
Browse files

scsi: esas2r: Use flex array destination for memcpy() 

In preparation for FORTIFY_SOURCE performing run-time destination buffer
bounds checking for memcpy(), specify the destination output buffer
explicitly, instead of asking memcpy() to write past the end of what looked
like a fixed-size object. Silences future run-time warning:

  memcpy: detected field-spanning write (size 80) of single field "trc + 1" (size 64)

There is no binary code output differences from this change.

Link: https://lore.kernel.org/r/20220901205729.2260982-1-keescook@chromium.org


Cc: Bradley Grove <linuxdrivers@attotech.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Reviewed-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 7eff437b

drivers/scsi/esas2r/atioctl.h

+1 −0
Original line number Diff line number Diff line
@@ -831,6 +831,7 @@ struct __packed atto_hba_trace { 
	u32 total_length;

	u32 trace_mask;

	u8 reserved2[48];

	u8 contents[];

};



#define ATTO_FUNC_SCSI_PASS_THRU     0x04

drivers/scsi/esas2r/esas2r_ioctl.c

+1 −2
Original line number Diff line number Diff line
@@ -947,10 +947,9 @@ static int hba_ioctl_callback(struct esas2r_adapter *a, 
					break;

				}



				memcpy(trc + 1,

				memcpy(trc->contents,

				       a->fw_coredump_buff + offset,

				       len);



				hi->data_length = len;

			} else if (trc->trace_func == ATTO_TRC_TF_RESET) {

				memset(a->fw_coredump_buff, 0,