| Message ID | 20220909022943.8896-1-hbh25y@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | infiniband: ulp: srpt: Use flex array destination for memcpy() | expand |
On Fri, Sep 09, 2022 at 10:29:43AM +0800, Hangyu Hua wrote: > In preparation for FORTIFY_SOURCE performing run-time destination buffer > bounds checking for memcpy(), specify the destination output buffer > explicitly, instead of asking memcpy() to write past the end of what looked > like a fixed-size object. > > Notice that srp_rsp[] is a pointer to a structure that contains > flexible-array member data[]: > > struct srp_rsp { > ... > __be32 sense_data_len; > __be32 resp_data_len; > u8 data[]; > }; > > link: https://github.com/KSPP/linux/issues/201 > Signed-off-by: Hangyu Hua <hbh25y@gmail.com> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Thanks -- Gustavo > --- > drivers/infiniband/ulp/srpt/ib_srpt.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c > index 21cbe30d526f..8c29e14150d3 100644 > --- a/drivers/infiniband/ulp/srpt/ib_srpt.c > +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c > @@ -1421,7 +1421,7 @@ static int srpt_build_cmd_rsp(struct srpt_rdma_ch *ch, > > srp_rsp->flags |= SRP_RSP_FLAG_SNSVALID; > srp_rsp->sense_data_len = cpu_to_be32(sense_data_len); > - memcpy(srp_rsp + 1, sense_data, sense_data_len); > + memcpy(srp_rsp->data, sense_data, sense_data_len); > } > > return sizeof(*srp_rsp) + sense_data_len; > -- > 2.34.1 >
On 9/8/22 19:29, Hangyu Hua wrote: > In preparation for FORTIFY_SOURCE performing run-time destination buffer > bounds checking for memcpy(), specify the destination output buffer > explicitly, instead of asking memcpy() to write past the end of what looked > like a fixed-size object. Reviewed-by: Bart Van Assche <bvanassche@acm.org>
On Fri, 9 Sep 2022 10:29:43 +0800, Hangyu Hua wrote: > In preparation for FORTIFY_SOURCE performing run-time destination buffer > bounds checking for memcpy(), specify the destination output buffer > explicitly, instead of asking memcpy() to write past the end of what looked > like a fixed-size object. > > Notice that srp_rsp[] is a pointer to a structure that contains > flexible-array member data[]: > > [...] Applied, thanks! [1/1] infiniband: ulp: srpt: Use flex array destination for memcpy() https://git.kernel.org/rdma/rdma/c/4b46a6079d2f8a Best regards,
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c index 21cbe30d526f..8c29e14150d3 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c @@ -1421,7 +1421,7 @@ static int srpt_build_cmd_rsp(struct srpt_rdma_ch *ch, srp_rsp->flags |= SRP_RSP_FLAG_SNSVALID; srp_rsp->sense_data_len = cpu_to_be32(sense_data_len); - memcpy(srp_rsp + 1, sense_data, sense_data_len); + memcpy(srp_rsp->data, sense_data, sense_data_len); } return sizeof(*srp_rsp) + sense_data_len;
In preparation for FORTIFY_SOURCE performing run-time destination buffer bounds checking for memcpy(), specify the destination output buffer explicitly, instead of asking memcpy() to write past the end of what looked like a fixed-size object. Notice that srp_rsp[] is a pointer to a structure that contains flexible-array member data[]: struct srp_rsp { ... __be32 sense_data_len; __be32 resp_data_len; u8 data[]; }; link: https://github.com/KSPP/linux/issues/201 Signed-off-by: Hangyu Hua <hbh25y@gmail.com> --- drivers/infiniband/ulp/srpt/ib_srpt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)