Commit 1ce871de authored by Kees Cook's avatar Kees Cook Committed by Martin K. Petersen

scsi: esas2r: Use flex array destination for memcpy()

In preparation for FORTIFY_SOURCE performing run-time destination buffer
bounds checking for memcpy(), specify the destination output buffer
explicitly, instead of asking memcpy() to write past the end of what looked
like a fixed-size object. Silences future run-time warning:

  memcpy: detected field-spanning write (size 80) of single field "trc + 1" (size 64)

There is no binary code output differences from this change.

Link: https://lore.kernel.org/r/20220901205729.2260982-1-keescook@chromium.org
Cc: Bradley Grove <linuxdrivers@attotech.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Reviewed-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 7eff437b
...@@ -831,6 +831,7 @@ struct __packed atto_hba_trace { ...@@ -831,6 +831,7 @@ struct __packed atto_hba_trace {
u32 total_length; u32 total_length;
u32 trace_mask; u32 trace_mask;
u8 reserved2[48]; u8 reserved2[48];
u8 contents[];
}; };
#define ATTO_FUNC_SCSI_PASS_THRU 0x04 #define ATTO_FUNC_SCSI_PASS_THRU 0x04
......
...@@ -947,10 +947,9 @@ static int hba_ioctl_callback(struct esas2r_adapter *a, ...@@ -947,10 +947,9 @@ static int hba_ioctl_callback(struct esas2r_adapter *a,
break; break;
} }
memcpy(trc + 1, memcpy(trc->contents,
a->fw_coredump_buff + offset, a->fw_coredump_buff + offset,
len); len);
hi->data_length = len; hi->data_length = len;
} else if (trc->trace_func == ATTO_TRC_TF_RESET) { } else if (trc->trace_func == ATTO_TRC_TF_RESET) {
memset(a->fw_coredump_buff, 0, memset(a->fw_coredump_buff, 0,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment