Re: [PATCH] scsi: qla2xxx: Fix flex array member not at end

[Jesse Taube]

On Wed, Jul 15, 2026 at 12:16 PM Kees Cook <kees@xxxxxxxxxx> wrote:
>
> On Tue, Jul 14, 2026 at 11:22:38AM -0400, Jesse Taube wrote:
> > In qla_edif_bsg.h: `struct fc_bsg_reply` and `struct fc_bsg_request`
> > have flexible array members, thus they must be the last member of
> > the parent structure. Contininging in the effort to add
> > `-Wflex-array-member-not-at-end`, move the structs to the end of
> > the parent structures, `struct qla_bsg_auth_els_reply` and
> > `struct qla_bsg_auth_els_request `.
> >
> > Suggested-by: John Meneghini <jmeneghi@xxxxxxxxxx>
> > Signed-off-by: Jesse Taube <jtaubepe@xxxxxxxxxx>
>
> It feels like this structure is part of the hardware spec? (and therefore
> cannot be re-ordered.) I'm not sure at all, though, but it looks like
> it's part of request serialization:

I looked at the code closer and i relized this structure is passed to userspace.
I sent a patch V2 after i relized that though i accidentally kept the
commit description the same.

In the lpfc driver here you can see how `bsg_job->reply` is supossed to be used.
https://elixir.bootlin.com/linux/v7.0.10/source/drivers/scsi/lpfc/lpfc_bsg.c#L662
the layout of `bsg_job->reply` is defined in `struct fc_bsg_reply`,
the `struct qla_bsg_auth_els_request`
data should have been put in the flex-array called `vendor_rsp` so
`(struct qla_bsg_auth_els_request *)bsg_job->request->vendor_reply->vendor_rsp;
unfortunatly because of `vendor_reply` and `ctels_reply` being in a
union the actuall vendor data from
`struct qla_bsg_auth_els_request` is offset by the size of
`ctels_reply`, this can be seen in V2 of this patch
AFAIK this isn't leaking data.

V2: https://lore.kernel.org/all/20260714185621.610105-1-jtaubepe@xxxxxxxxxx/

Thanks,
Jesse Taube

> $ git grep 'qla_bsg_auth_els_request' | grep '>request'
> drivers/scsi/qla2xxx/qla_edif.c:            (struct qla_bsg_auth_els_request *)bsg_job->request;
> drivers/scsi/qla2xxx/qla_edif.c:            (struct qla_bsg_auth_els_request *)bsg_job->request;
> drivers/scsi/qla2xxx/qla_edif.c:            (struct qla_bsg_auth_els_request *)bsg_job->request;
> drivers/scsi/qla2xxx/qla_isr.c:                         (struct qla_bsg_auth_els_request *)bsg_job->request;
>
> -Kees
>
> > ---
> >  drivers/scsi/qla2xxx/qla_edif_bsg.h | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/scsi/qla2xxx/qla_edif_bsg.h b/drivers/scsi/qla2xxx/qla_edif_bsg.h
> > index 514c265ba86e..bcc35d149c1f 100644
> > --- a/drivers/scsi/qla2xxx/qla_edif_bsg.h
> > +++ b/drivers/scsi/qla2xxx/qla_edif_bsg.h
> > @@ -36,16 +36,16 @@ struct extra_auth_els {
> >  } __packed;
> >
> >  struct qla_bsg_auth_els_request {
> > -     struct fc_bsg_request r;
> >       struct extra_auth_els e;
> > +     struct fc_bsg_request r;
> >  };
> >
> >  struct qla_bsg_auth_els_reply {
> > -     struct fc_bsg_reply r;
> >       uint32_t rx_xchg_address;
> >       uint8_t version;
> >       uint8_t pad[VND_CMD_PAD_SIZE];
> >       uint8_t reserved[VND_CMD_APP_RESERVED_SIZE];
> > +     struct fc_bsg_reply r;
> >  };
> >
> >  struct app_id {
> > --
> > 2.54.0
> >
>
> --
> Kees Cook
>