Hi all, [Cc'ing the scsi maintainers. Sorry I should have done that sooner] On Mon, 24 Jan 2022 19:43:44 -0800 Kees Cook <keescook@xxxxxxxxxxxx> wrote: > > On Tue, Jan 25, 2022 at 02:24:30PM +1100, Stephen Rothwell wrote: > > > > After merging the kspp tree, today's linux-next build (powerpc > > allyesconfig) failed like this: > > > > > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_send_messages': > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1934:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds] > > 1934 | crq->valid = VALID_CMD_RESP_EL; > > | ^~ > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi' > > 1875 | u64 msg_hi = 0; > > | ^~~~~~ > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1935:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds] > > 1935 | crq->format = cmd->rsp.format; > > | ^~ > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi' > > 1875 | u64 msg_hi = 0; > > | ^~~~~~ > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1938:52: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds] > > 1938 | crq->status = VIOSRP_ADAPTER_FAIL; > > | ^~ > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi' > > 1875 | u64 msg_hi = 0; > > | ^~~~~~ > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1940:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds] > > 1940 | crq->IU_length = cpu_to_be16(cmd->rsp.len); > > | ^~ > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi' > > 1875 | u64 msg_hi = 0; > > | ^~~~~~ > > > > Exposed by commit > > > > 4ba545781e20 ("Makefile: Enable -Warray-bounds") > > > > Probably introduced by commit > > > > 88a678bbc34c ("ibmvscsis: Initial commit of IBM VSCSI Tgt Driver") > > > > I applied the following hack for now: > > > > From: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx> > > Date: Tue, 25 Jan 2022 14:18:36 +1100 > > Subject: [PATCH] scsi: hack for building with -Warray-bounds > > > > Signed-off-by: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx> > > --- > > drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 6 +++--- > > 1 file changed, 3 insertions(+), 3 deletions(-) > > > > diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c > > index 61f06f6885a5..89fcf98c61c3 100644 > > --- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c > > +++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c > > @@ -1872,11 +1872,11 @@ static void srp_snd_msg_failed(struct scsi_info *vscsi, long rc) > > */ > > static void ibmvscsis_send_messages(struct scsi_info *vscsi) > > { > > - u64 msg_hi = 0; > > + u64 msg_hi[2] = { }; > > /* note do not attempt to access the IU_data_ptr with this pointer > > * it is not valid > > */ > > - struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi; > > + struct viosrp_crq *crq = (struct viosrp_crq *)msg_hi; > > struct ibmvscsis_cmd *cmd, *nxt; > > long rc = ADAPT_SUCCESS; > > bool retry = false; > > @@ -1940,7 +1940,7 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi) > > crq->IU_length = cpu_to_be16(cmd->rsp.len); > > > > rc = h_send_crq(vscsi->dma_dev->unit_address, > > - be64_to_cpu(msg_hi), > > + be64_to_cpu(msg_hi[0]), > > be64_to_cpu(cmd->rsp.tag)); > > > > dev_dbg(&vscsi->dev, "send_messages: cmd %p, tag 0x%llx, rc %ld\n", > > This looks correct to me. struct viosrp_crq is 16 bytes wide. The only > suggestion I might make would be either avoid the bare '2': > > u64 msg_hi[sizeof(struct viosrp_crq) / sizeof(u64)] = { }; > > or adjust struct viosrp_crq so the casting isn't needed at all: > > > truct viosrp_crq { > union { > u64 hi; > struct { > u8 valid; /* used by RPA */ > u8 format; /* SCSI vs out-of-band */ > u8 reserved; > u8 status; /* non-scsi failure? (e.g. DMA failure) */ > __be16 timeout; /* in seconds */ > __be16 IU_length; /* in bytes */ > }; > }; > __be64 IU_data_ptr; /* the TCE for transferring data */ > }; > > struct viosrp_crq crq = { }; > ... > rc = h_send_crq(vscsi->dma_dev->unit_address, > be64_to_cpu(crq.hi), > be64_to_cpu(cmd->rsp.tag)); > > > Has there been any progress on this? Commit 88a678bbc34c mentioned above was merged in v4.8-rc1. -- Cheers, Stephen Rothwell
Attachment:
pgpE0XA2LqU3S.pgp
Description: OpenPGP digital signature