KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
83 stars 5 forks source link

Replace fake-flex array with flex-array member in drivers/scsi/bfa/bfa_fcs_lport.c #339

Closed GustavoARSilva closed 9 months ago

GustavoARSilva commented 1 year ago
diff --git a/drivers/scsi/bfa/bfa_fc.h b/drivers/scsi/bfa/bfa_fc.h
index a12d693065ce..1091aa428533 100644
--- a/drivers/scsi/bfa/bfa_fc.h
+++ b/drivers/scsi/bfa/bfa_fc.h
@@ -800,7 +800,7 @@ struct fc_rscn_pl_s {
        u8      command;
        u8      pagelen;
        __be16  payldlen;
-       struct fc_rscn_event_s event[1];
+       struct fc_rscn_event_s event[];
 };

Audit the following code:

diff -u -p ./drivers/scsi/bfa/bfa_fcs_lport.c /tmp/nothing/drivers/scsi/bfa/bfa_fcs_lport.c
--- ./drivers/scsi/bfa/bfa_fcs_lport.c
+++ /tmp/nothing/drivers/scsi/bfa/bfa_fcs_lport.c
@@ -5630,7 +5630,6 @@ bfa_fcs_lport_scn_process_rscn(struct bf

        num_entries =
                (be16_to_cpu(rscn->payldlen) -
-                sizeof(u32)) / sizeof(rscn->event[0]);

        bfa_trc(port->fcs, num_entries);

@@ -5639,15 +5638,12 @@ bfa_fcs_lport_scn_process_rscn(struct bf
        bfa_fcs_lport_scn_send_ls_acc(port, fchs);

        for (i = 0; i < num_entries; i++) {
-               rscn_pid = rscn->event[i].portid;

-               bfa_trc(port->fcs, rscn->event[i].format);
                bfa_trc(port->fcs, rscn_pid);

                /* check for duplicate entries in the list */
                found = BFA_FALSE;
                for (j = 0; j < i; j++) {
-                       if (rscn->event[j].portid == rscn_pid) {
                                found = BFA_TRUE;
                                break;
                        }
@@ -5659,9 +5655,7 @@ bfa_fcs_lport_scn_process_rscn(struct bf
                        continue;
                }

-               switch (rscn->event[i].format) {
                case FC_RSCN_FORMAT_PORTID:
-                       if (rscn->event[i].qualifier == FC_QOS_RSCN_EVENT) {
                                /*
                                 * Ignore this event.
                                 * f/w would have processed it
@@ -5674,7 +5668,6 @@ bfa_fcs_lport_scn_process_rscn(struct bf
                break;

                case FC_RSCN_FORMAT_FABRIC:
-                       if (rscn->event[i].qualifier ==
                                        FC_FABRIC_NAME_RSCN_EVENT) {
                                bfa_fcs_lport_ms_fabric_rscn(port);
                                break;
@@ -5685,7 +5678,6 @@ bfa_fcs_lport_scn_process_rscn(struct bf
                case FC_RSCN_FORMAT_DOMAIN:
                        nsquery = BFA_TRUE;
                        bfa_fcs_lport_scn_multiport_rscn(port,
-                                                       rscn->event[i].format,
                                                        rscn_pid);
                        break;
kees commented 9 months ago

Fixed in commit 56a4d69a26c9bc77f4697692b6f7223e09f9de1a.