search

KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
81 stars 5 forks source link

Replace 1-element arrays in drivers/scsi/bfa/bfa_fc.h #209

Closed GustavoARSilva closed 1 year ago

GustavoARSilva commented 1 year ago

Replace one-element arrays with flexible-array members in drivers/scsi/bfa/bfa_fc.h:

1545 /*                                                
1546  * FDMI attribute      
1547  */                               
1548 struct fdmi_attr_s {                           
1549         __be16        type;                                    
1550         __be16        len;                                         
1551         u8         value[1];     
1552 };

Audit (at least) all these places where the flex arrays are being used:

diff -u -p ./drivers/scsi/bfa/bfa_fcs_lport.c /tmp/nothing/drivers/scsi/bfa/bfa_fcs_lport.c
--- ./drivers/scsi/bfa/bfa_fcs_lport.c
+++ /tmp/nothing/drivers/scsi/bfa/bfa_fcs_lport.c
@@ -1938,7 +1938,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_NODENAME);
        templen = sizeof(wwn_t);
-       memcpy(attr->value, &bfa_fcs_lport_get_nwwn(port), templen);
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
        count++;
@@ -1951,7 +1950,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_MANUFACTURER);
        templen = (u16) strlen(fcs_hba_attr->manufacturer);
-       memcpy(attr->value, fcs_hba_attr->manufacturer, templen);
        templen = fc_roundup(templen, sizeof(u32));
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
@@ -1965,7 +1963,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_SERIALNUM);
        templen = (u16) strlen(fcs_hba_attr->serial_num);
-       memcpy(attr->value, fcs_hba_attr->serial_num, templen);
        templen = fc_roundup(templen, sizeof(u32));
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
@@ -1979,7 +1976,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_MODEL);
        templen = (u16) strlen(fcs_hba_attr->model);
-       memcpy(attr->value, fcs_hba_attr->model, templen);
        templen = fc_roundup(templen, sizeof(u32));
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
@@ -1993,7 +1989,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_MODEL_DESC);
        templen = (u16) strlen(fcs_hba_attr->model_desc);
-       memcpy(attr->value, fcs_hba_attr->model_desc, templen);
        templen = fc_roundup(templen, sizeof(u32));
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
@@ -2008,7 +2003,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_HW_VERSION);
                templen = (u16) strlen(fcs_hba_attr->hw_version);
-               memcpy(attr->value, fcs_hba_attr->hw_version, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2023,7 +2017,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_DRIVER_VERSION);
        templen = (u16) strlen(fcs_hba_attr->driver_version);
-       memcpy(attr->value, fcs_hba_attr->driver_version, templen);
        templen = fc_roundup(templen, sizeof(u32));
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
@@ -2038,7 +2031,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_ROM_VERSION);
                templen = (u16) strlen(fcs_hba_attr->option_rom_ver);
-               memcpy(attr->value, fcs_hba_attr->option_rom_ver, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2050,7 +2042,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_FW_VERSION);
        templen = (u16) strlen(fcs_hba_attr->fw_version);
-       memcpy(attr->value, fcs_hba_attr->fw_version, templen);
        templen = fc_roundup(templen, sizeof(u32));
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
@@ -2065,7 +2056,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_OS_NAME);
                templen = (u16) strlen(fcs_hba_attr->os_name);
-               memcpy(attr->value, fcs_hba_attr->os_name, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2080,7 +2070,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_MAX_CT);
        templen = sizeof(fcs_hba_attr->max_ct_pyld);
-       memcpy(attr->value, &fcs_hba_attr->max_ct_pyld, templen);
        templen = fc_roundup(templen, sizeof(u32));
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
@@ -2094,7 +2083,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_NODE_SYM_NAME);
                templen = sizeof(fcs_hba_attr->node_sym_name);
-               memcpy(attr->value, &fcs_hba_attr->node_sym_name, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2105,7 +2093,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_VENDOR_ID);
                templen = sizeof(fcs_hba_attr->vendor_info);
-               memcpy(attr->value, &fcs_hba_attr->vendor_info, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2116,7 +2103,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_NUM_PORTS);
                templen = sizeof(fcs_hba_attr->num_ports);
-               memcpy(attr->value, &fcs_hba_attr->num_ports, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2127,7 +2113,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_FABRIC_NAME);
                templen = sizeof(fcs_hba_attr->fabric_name);
-               memcpy(attr->value, &fcs_hba_attr->fabric_name, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2138,7 +2123,6 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_HBA_ATTRIB_BIOS_VER);
                templen = sizeof(fcs_hba_attr->bios_ver);
-               memcpy(attr->value, &fcs_hba_attr->bios_ver, templen);
                templen = fc_roundup(attr->len, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2270,7 +2254,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_FC4_TYPES);
        templen = sizeof(fcs_port_attr.supp_fc4_types);
-       memcpy(attr->value, fcs_port_attr.supp_fc4_types, templen);
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
        ++count;
@@ -2284,7 +2267,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_SUPP_SPEED);
        templen = sizeof(fcs_port_attr.supp_speed);
-       memcpy(attr->value, &fcs_port_attr.supp_speed, templen);
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
        ++count;
@@ -2298,7 +2280,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_PORT_SPEED);
        templen = sizeof(fcs_port_attr.curr_speed);
-       memcpy(attr->value, &fcs_port_attr.curr_speed, templen);
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
        ++count;
@@ -2311,7 +2292,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
        attr = (struct fdmi_attr_s *) curr_ptr;
        attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_FRAME_SIZE);
        templen = sizeof(fcs_port_attr.max_frm_size);
-       memcpy(attr->value, &fcs_port_attr.max_frm_size, templen);
        curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
        len += templen;
        ++count;
@@ -2325,7 +2305,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_DEV_NAME);
                templen = (u16) strlen(fcs_port_attr.os_device_name);
-               memcpy(attr->value, fcs_port_attr.os_device_name, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2340,7 +2319,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_HOST_NAME);
                templen = (u16) strlen(fcs_port_attr.host_name);
-               memcpy(attr->value, fcs_port_attr.host_name, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2353,7 +2331,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_NODE_NAME);
                templen = sizeof(fcs_port_attr.node_name);
-               memcpy(attr->value, &fcs_port_attr.node_name, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2364,7 +2341,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_PORT_NAME);
                templen = sizeof(fcs_port_attr.port_name);
-               memcpy(attr->value, &fcs_port_attr.port_name, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(attr->len) + templen;
                len += templen;
@@ -2377,7 +2353,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
                        attr->type =
                                cpu_to_be16(FDMI_PORT_ATTRIB_PORT_SYM_NAME);
                        templen = sizeof(fcs_port_attr.port_sym_name);
-                       memcpy(attr->value,
                                &fcs_port_attr.port_sym_name, templen);
                        templen = fc_roundup(templen, sizeof(u32));
                        curr_ptr += sizeof(attr->type) +
@@ -2391,7 +2366,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_PORT_TYPE);
                templen = sizeof(fcs_port_attr.port_type);
-               memcpy(attr->value, &fcs_port_attr.port_type, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2402,7 +2376,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_SUPP_COS);
                templen = sizeof(fcs_port_attr.scos);
-               memcpy(attr->value, &fcs_port_attr.scos, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2413,7 +2386,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_PORT_FAB_NAME);
                templen = sizeof(fcs_port_attr.port_fabric_name);
-               memcpy(attr->value, &fcs_port_attr.port_fabric_name, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2424,7 +2396,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_PORT_FC4_TYPE);
                templen = sizeof(fcs_port_attr.port_act_fc4_type);
-               memcpy(attr->value, fcs_port_attr.port_act_fc4_type,
                                templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
@@ -2436,7 +2407,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_PORT_STATE);
                templen = sizeof(fcs_port_attr.port_state);
-               memcpy(attr->value, &fcs_port_attr.port_state, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
@@ -2447,7 +2417,6 @@ bfa_fcs_lport_fdmi_build_portattr_block(
                attr = (struct fdmi_attr_s *) curr_ptr;
                attr->type = cpu_to_be16(FDMI_PORT_ATTRIB_PORT_NUM_RPRT);
                templen = sizeof(fcs_port_attr.num_ports);
-               memcpy(attr->value, &fcs_port_attr.num_ports, templen);
                templen = fc_roundup(templen, sizeof(u32));
                curr_ptr += sizeof(attr->type) + sizeof(templen) + templen;
                len += templen;
GustavoARSilva commented 1 year ago

https://lore.kernel.org/linux-hardening/Y3P1rEEBq7HzJygq@work/