Patch "crypto: qat - avoid memcpy() overflow warning" has been added to the 6.8-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    crypto: qat - avoid memcpy() overflow warning

to the 6.8-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     crypto-qat-avoid-memcpy-overflow-warning.patch
and it can be found in the queue-6.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9754fa3740b68b6ecd5188171636b2f49308eec1
Author: Arnd Bergmann <arnd@xxxxxxxx>
Date:   Wed Jan 3 17:26:02 2024 +0100

    crypto: qat - avoid memcpy() overflow warning
    
    [ Upstream commit 23a22e831ed4e6aa0831312e8cc8b7c60a657f60 ]
    
    The use of array_size() leads gcc to assume the memcpy() can have a larger
    limit than actually possible, which triggers a string fortification warning:
    
    In file included from include/linux/string.h:296,
                     from include/linux/bitmap.h:12,
                     from include/linux/cpumask.h:12,
                     from include/linux/sched.h:16,
                     from include/linux/delay.h:23,
                     from include/linux/iopoll.h:12,
                     from drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c:3:
    In function 'fortify_memcpy_chk',
        inlined from 'adf_gen4_init_thd2arb_map' at drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c:401:3:
    include/linux/fortify-string.h:579:4: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
      579 |    __write_overflow_field(p_size_field, size);
          |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    include/linux/fortify-string.h:588:4: error: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning]
      588 |    __read_overflow2_field(q_size_field, size);
          |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    Add an explicit range check to avoid this.
    
    Fixes: 5da6a2d5353e ("crypto: qat - generate dynamically arbiter mappings")
    Signed-off-by: Arnd Bergmann <arnd@xxxxxxxx>
    Acked-by: Giovanni Cabiddu <giovanni.cabiddu@xxxxxxxxx>
    Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c b/drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c
index 9985683056d5f..f752653ccb47e 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c
@@ -398,6 +398,9 @@ int adf_gen4_init_thd2arb_map(struct adf_accel_dev *accel_dev)
 			 ADF_GEN4_ADMIN_ACCELENGINES;
 
 	if (srv_id == SVC_DCC) {
+		if (ae_cnt > ICP_QAT_HW_AE_DELIMITER)
+			return -EINVAL;
+
 		memcpy(thd2arb_map, thrd_to_arb_map_dcc,
 		       array_size(sizeof(*thd2arb_map), ae_cnt));
 		return 0;