Re: [PATCH 3/3] scsi: isci: Use correctly sized target buffer for memcpy()
From: Gustavo A. R. Silva <hidden>
Date: 2021-05-28 20:28:58
Also in:
linux-hardening, lkml
On 5/28/21 13:13, Kees Cook wrote:
In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), avoid intentionally writing across neighboring array fields. Switch from rsp_ui to resp_buf, since resp_ui isn't SSP_RESP_IU_MAX_SIZE bytes in length. This avoids future compile-time warnings. Signed-off-by: Kees Cook <redacted>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Thanks -- Gustavo
quoted hunk ↗ jump to hunk
--- drivers/scsi/isci/task.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c index 62062ed6cd9a..eeaec26ac324 100644 --- a/drivers/scsi/isci/task.c +++ b/drivers/scsi/isci/task.c@@ -709,8 +709,8 @@ isci_task_request_complete(struct isci_host *ihost, tmf->status = completion_status; if (tmf->proto == SAS_PROTOCOL_SSP) { - memcpy(&tmf->resp.resp_iu, - &ireq->ssp.rsp, + memcpy(tmf->resp.rsp_buf, + ireq->ssp.rsp_buf, SSP_RESP_IU_MAX_SIZE); } else if (tmf->proto == SAS_PROTOCOL_SATA) { memcpy(&tmf->resp.d2h_fis,