Replace one-element array with flexible-array member in struct user_sgmap and refactor the rest of the code, accordingly. Issue found with the help of Coccinelle and audited and fixed, manually. This results in no differences in binary output. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/ClangBuiltLinux/linux/issues/1851 Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx> --- drivers/scsi/aacraid/aacraid.h | 2 +- drivers/scsi/aacraid/commctrl.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h index fb3d93e4a99e..7d3f2f7348ff 100644 --- a/drivers/scsi/aacraid/aacraid.h +++ b/drivers/scsi/aacraid/aacraid.h @@ -512,7 +512,7 @@ struct sgmap { struct user_sgmap { u32 count; - struct user_sgentry sg[1]; + struct user_sgentry sg[]; }; struct sgmap64 { diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c index df811ad4afaa..74eb33eb70d3 100644 --- a/drivers/scsi/aacraid/commctrl.c +++ b/drivers/scsi/aacraid/commctrl.c @@ -523,7 +523,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) goto cleanup; } - if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) || + if ((fibsize < sizeof(struct user_aac_srb)) || (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) { rcode = -EINVAL; goto cleanup; -- 2.34.1
