Re: linux-next: build failure after merge of the kspp tree

[Kees Cook]

On Tue, Feb 08, 2022 at 03:42:18PM +1100, Stephen Rothwell wrote:
> Hi all,
> 
> [Cc'ing the scsi maintainers.  Sorry I should have done that sooner]
> 
> On Mon, 24 Jan 2022 19:43:44 -0800 Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> >
> > On Tue, Jan 25, 2022 at 02:24:30PM +1100, Stephen Rothwell wrote:
> > > 
> > > After merging the kspp tree, today's linux-next build (powerpc
> > > allyesconfig) failed like this:
> > > 
> > > 
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_send_messages':
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1934:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > >  1934 |                                         crq->valid = VALID_CMD_RESP_EL;
> > >       |                                            ^~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > >  1875 |         u64 msg_hi = 0;
> > >       |             ^~~~~~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1935:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > >  1935 |                                         crq->format = cmd->rsp.format;
> > >       |                                            ^~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > >  1875 |         u64 msg_hi = 0;
> > >       |             ^~~~~~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1938:52: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > >  1938 |                                                 crq->status = VIOSRP_ADAPTER_FAIL;
> > >       |                                                    ^~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > >  1875 |         u64 msg_hi = 0;
> > >       |             ^~~~~~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1940:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
> > >  1940 |                                         crq->IU_length = cpu_to_be16(cmd->rsp.len);
> > >       |                                            ^~
> > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'
> > >  1875 |         u64 msg_hi = 0;
> > >       |             ^~~~~~
> > > 
> > > Exposed by commit
> > > 
> > >   4ba545781e20 ("Makefile: Enable -Warray-bounds")
> > > 
> > > Probably introduced by commit
> > > 
> > >   88a678bbc34c ("ibmvscsis: Initial commit of IBM VSCSI Tgt Driver")
> > > 
> > > I applied the following hack for now:
> > > 
> > > From: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx>
> > > Date: Tue, 25 Jan 2022 14:18:36 +1100
> > > Subject: [PATCH] scsi: hack for building with -Warray-bounds
> > > 
> > > Signed-off-by: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx>
> > > ---
> > >  drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 6 +++---
> > >  1 file changed, 3 insertions(+), 3 deletions(-)
> > > 
> > > diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> > > index 61f06f6885a5..89fcf98c61c3 100644
> > > --- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> > > +++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
> > > @@ -1872,11 +1872,11 @@ static void srp_snd_msg_failed(struct scsi_info *vscsi, long rc)
> > >   */
> > >  static void ibmvscsis_send_messages(struct scsi_info *vscsi)
> > >  {
> > > -	u64 msg_hi = 0;
> > > +	u64 msg_hi[2] = { };
> > >  	/* note do not attempt to access the IU_data_ptr with this pointer
> > >  	 * it is not valid
> > >  	 */
> > > -	struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi;
> > > +	struct viosrp_crq *crq = (struct viosrp_crq *)msg_hi;
> > >  	struct ibmvscsis_cmd *cmd, *nxt;
> > >  	long rc = ADAPT_SUCCESS;
> > >  	bool retry = false;
> > > @@ -1940,7 +1940,7 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
> > >  					crq->IU_length = cpu_to_be16(cmd->rsp.len);
> > >  
> > >  					rc = h_send_crq(vscsi->dma_dev->unit_address,
> > > -							be64_to_cpu(msg_hi),
> > > +							be64_to_cpu(msg_hi[0]),
> > >  							be64_to_cpu(cmd->rsp.tag));
> > >  
> > >  					dev_dbg(&vscsi->dev, "send_messages: cmd %p, tag 0x%llx, rc %ld\n",  
> > 
> > This looks correct to me. struct viosrp_crq is 16 bytes wide. The only
> > suggestion I might make would be either avoid the bare '2':
> > 
> > 	u64 msg_hi[sizeof(struct viosrp_crq) / sizeof(u64)] = { };
> > 
> > or adjust struct viosrp_crq so the casting isn't needed at all:
> > 
> > 
> > truct viosrp_crq {
> > 	union {
> > 		u64 hi;
> > 		struct {
> > 		        u8 valid;               /* used by RPA */
> > 		        u8 format;              /* SCSI vs out-of-band */
> > 		        u8 reserved;
> > 		        u8 status;              /* non-scsi failure? (e.g. DMA failure) */
> > 		        __be16 timeout;         /* in seconds */
> > 		        __be16 IU_length;       /* in bytes */
> > 		};
> > 	};
> >         __be64 IU_data_ptr;     /* the TCE for transferring data */
> > };
> > 
> > 	struct viosrp_crq crq = { };
> > 	...
> >  			rc = h_send_crq(vscsi->dma_dev->unit_address,
> > 					be64_to_cpu(crq.hi),
> > 					be64_to_cpu(cmd->rsp.tag));
> > 
> > 
> > 
> 
> Has there been any progress on this?
> 
> Commit 88a678bbc34c mentioned above was merged in v4.8-rc1.

Thanks for the reminder! I've sent this now:

https://lore.kernel.org/lkml/20220208061231.3429486-1-keescook@xxxxxxxxxxxx


-- 
Kees Cook