Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

scsi: ibmvscsis: Silence -Warray-bounds warning

Instead of doing a cast to storage that is too small, add a union for the
high 64 bits. Silences the warnings under -Warray-bounds:

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_send_messages':
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1934:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1934 | crq->valid = VALID_CMD_RESP_EL;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
1875 | u64 msg_hi = 0;
| ^~~~~~

There is no change to the resulting binary instructions.

Link: https://lore.kernel.org/lkml/20220125142430.75c3160e@canb.auug.org.au
Link: https://lore.kernel.org/r/20220208061231.3429486-1-keescook@chromium.org
Cc: Michael Cyr <mikecyr@linux.ibm.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Tyrel Datwyler <tyreld@linux.ibm.com>
Cc: linux-scsi@vger.kernel.org
Cc: target-devel@vger.kernel.org
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Reviewed-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

authored by

Kees Cook and committed by
Martin K. Petersen
03e4383c 49b729f5

+14 -12
+3 -6
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
··· 1872 1872 */ 1873 1873 static void ibmvscsis_send_messages(struct scsi_info *vscsi) 1874 1874 { 1875 - u64 msg_hi = 0; 1876 - /* note do not attempt to access the IU_data_ptr with this pointer 1877 - * it is not valid 1878 - */ 1879 - struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi; 1875 + struct viosrp_crq empty_crq = { }; 1876 + struct viosrp_crq *crq = &empty_crq; 1880 1877 struct ibmvscsis_cmd *cmd, *nxt; 1881 1878 long rc = ADAPT_SUCCESS; 1882 1879 bool retry = false; ··· 1937 1940 crq->IU_length = cpu_to_be16(cmd->rsp.len); 1938 1941 1939 1942 rc = h_send_crq(vscsi->dma_dev->unit_address, 1940 - be64_to_cpu(msg_hi), 1943 + be64_to_cpu(crq->high), 1941 1944 be64_to_cpu(cmd->rsp.tag)); 1942 1945 1943 1946 dev_dbg(&vscsi->dev, "send_messages: cmd %p, tag 0x%llx, rc %ld\n",
+11 -6
include/scsi/viosrp.h
··· 70 70 }; 71 71 72 72 struct viosrp_crq { 73 - u8 valid; /* used by RPA */ 74 - u8 format; /* SCSI vs out-of-band */ 75 - u8 reserved; 76 - u8 status; /* non-scsi failure? (e.g. DMA failure) */ 77 - __be16 timeout; /* in seconds */ 78 - __be16 IU_length; /* in bytes */ 73 + union { 74 + __be64 high; /* High 64 bits */ 75 + struct { 76 + u8 valid; /* used by RPA */ 77 + u8 format; /* SCSI vs out-of-band */ 78 + u8 reserved; 79 + u8 status; /* non-scsi failure? (e.g. DMA failure) */ 80 + __be16 timeout; /* in seconds */ 81 + __be16 IU_length; /* in bytes */ 82 + }; 83 + }; 79 84 __be64 IU_data_ptr; /* the TCE for transferring data */ 80 85 }; 81 86