From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76CE72D949F for ; Fri, 17 Jul 2026 15:45:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=170.10.129.124 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784303146; cv=pass; b=nVnE/ONOq+thZUPd5+1roAX6N6MeeWnmwMVmLj6vkWLDW+XlTA7eL1JQJSRFv1hUDNRwPmY/TE3VpnbXuUxX5DKs4UirRJIR1qqwgnvp23C3kxOB8fCMJJ5fK/ZqOoxkyv04y2wZLcaiPlHVBNlAhV6AOz6tPVwd8flwLz2h7kQ= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784303146; c=relaxed/simple; bh=dZucJDqnxn2TBJC2ggZ3Ow2af1COy6hDtuR8z5sjvg8=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=k2Y3HWGHb9fTgOGLNqSE/UznXhXTdCdNAaOiQT1G95w6SE2CpdsOgsKVNtVYsz1lw0ezWyIgEtUKKwyoaZQJ+Pbe+y6uwEI1EAtBDI+UDwCnhhIUdv5n+WGG9ol/WkLuvs8m7XH72yNz0cBRqeRlpE5+XumfOjvnhRqKsQuGpnY= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=RlCW300c; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=JHRDvBE0; arc=pass smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="RlCW300c"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="JHRDvBE0" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784303144; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+15hMsYO07b/SOOuaYDJaqTE/uXukCXKD4WPh/0e1dA=; b=RlCW300cgewgK6mb4ywoM+O9bFYgdIBEQxix1X1CcxZukXAuytMGv0JNuWYFxt7i0QJojy A1/jo4p0BVvbm2EVDRIrujip5JsUderUP/WMoD7BtbxoXxr0JdejqOlsxiQgJ39+qRqZyx U+RRRfUmwgOOgIg8Ffwp5SwE23xbbZk= Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-367-XME98f5PPky32fl-xHW92A-1; Fri, 17 Jul 2026 11:45:43 -0400 X-MC-Unique: XME98f5PPky32fl-xHW92A-1 X-Mimecast-MFC-AGG-ID: XME98f5PPky32fl-xHW92A_1784303142 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-476608a9fefso1803375f8f.1 for ; Fri, 17 Jul 2026 08:45:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1784303142; cv=none; d=google.com; s=arc-20260327; b=ktleNp9yvRAMtaVtSnvvTJ8qy9l3bZzQKvZRuQaTRCRK6XitkcGZZ51qQeqbXOgk/k doUeKlQCXILNv5ByBBZaQlRFJGchJsNBdyK8klBfFOoI1el8tgw4ylCF47X7SQRmBxjg vUEyXYYsuaauHO0Knu9pma3SBsbNej6U6VtJUYEjLCcRTIfpRKhLKY4JZRNYMMRxddLu OhSR+FwvA8C62No8YMtFbVV91sGL08bV2iA32HeZ293F8WnKvGt+TG14NcL0tku+tuhv EtSrvbM2n6NO/DVkYb1PNQNXu51AMSd7C+nL0scZqx6swWTmqWnR00IotC7sk64I0FWV t6DQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=+15hMsYO07b/SOOuaYDJaqTE/uXukCXKD4WPh/0e1dA=; fh=gA7tHN17klmjsalU3LPmJg5Ljyvod9w3n/0RyhgWVKI=; b=ijP8XslgPi7P1i2EbsQAC0X8kTtxDWCUgzVf2JzF4ZKA7CTHF8/ll8U3LOsz6c9fdI skK1QE7PHDIcuYGjlVunqjEsamhDRHEmVj04A8rj7ODQXmlJMBCQzzV0/UvdO7XpCDAI 2HhKAEWJUoKuLTbH9qTTVB8gjPcK2dXc6mIGp+FEc0N0408bzUK2YvfZf7XXjeUI/94T Gtfa+XFxvBZQM0z9U2TSfWq3EvbCYp6E+sXzA1IuqjMJfn/NRoluiPLRi/S60oJABxJO LvwdqdGuXKFL9oAIT02+F2lqjJlSZyu1mv3Y8vS9EbBvKH/m4YYyPc6xURJvxfwQYfN/ ipEA==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1784303142; x=1784907942; darn=vger.kernel.org; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:from:to:cc:subject :date:message-id:reply-to:content-type; bh=+15hMsYO07b/SOOuaYDJaqTE/uXukCXKD4WPh/0e1dA=; b=JHRDvBE07RmkVg1J3zsPM/weR6LXGPN1PPpVQCSDqLQFwHzkmfohbBR7UEI3Lz1GFV sxCYK0oT4wgrjvPdig2jRkLpfHHJ1qjBa5Qh8J/KDvF43uTyA2AsKNiFpDWCxKtBESM7 1VdJ54lAhO8Oj6GjhwkNJjRtxzdotNSmZUOjNNsDlEZhgvRP//Xt1dru37n1mW66Zk/b AVLS+SHksD6bKGNmROHHVTOQkFhdGDh0ZPw0t0ak0PQM42obys99PmlTIHA4oCTC9u7R nYdYM9VfJxkcKtltk2OmfcOybXwfqbSpeg2ccBqsWGgYEL89glVgKrkxQ3Uu61Y0iF4C oPPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784303142; x=1784907942; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=+15hMsYO07b/SOOuaYDJaqTE/uXukCXKD4WPh/0e1dA=; b=r9rjuANs90qndj/slUK8OBAmM4t3Z966Hzb1H7+OtHaJPALicZaHKE+YoiVwBHrmQd K4TBjFE4LamLdWQoisAxps2jX4LFGf5FfrUVtQaCV+D22/IZi0W5/cM+rUn1vBW1a8r7 FwwL7TPNpLtgS+KoqDQ3C1Egpf6HaLQef9IUR/v7iuToxl7/PbF5AFuchq3clpngy7YC XuJkFJkj5U50oWiDM586tcMsZWKtfKaJLeY4HHIZGUSiJAjTk5bSjFCkNVnq5d4tpFKz Ai1iR8ZdCEkqS7u8mR3r43GNrZ68qBGDMoq/HkS9cbPQEpbSCQe8Q2iMJ9gl7Md0+ogs 8j2w== X-Gm-Message-State: AOJu0YxVnm/QG9q5QescNBBRFQEMAYgVGw3B+QjsSdLX3SAr4wHkw4qw vLEiZShwbGETF8Yuziv+68izFIGeYlX5pq5TSEahsabQeKTMbW/zsj9T7yRDZDDZRaOfUMSSlYS FQELc8McYhXu53lKh9WZTyh3WOmtvxifyaVrozeTOVHYw5uhvZ5qZyD/CzAGszsmmix4u14rEJm KwQ5JYL8RicO8H1AqugDahCDTJdli/m51pUG/I453wqyWzVyzgrT0= X-Gm-Gg: AfdE7cm/s6LQNch43dyXkBNdUFyo2Woopx8mFikxewBOxK2t7fUsAtDw0/6oYIJmSGO eniwt79d4LVZhGgdUK3jJO7IIymrO61GgE7e2y6M5FOW/KjAF3AIWAxrmWosP0Rz6Kzcm/QNfSl Wwx4QqfLTp2hyPrnQtECeboqjWcavn9xhwq5XOVYsVOWAfTvBKCre5Zs6Qh2Mciuar/Nd8Gnfby UddXbdBFRwfb58= X-Received: by 2002:a05:6000:41f0:b0:460:d18:865c with SMTP id ffacd0b85a97d-47f5a4182c4mr10238055f8f.1.1784303141751; Fri, 17 Jul 2026 08:45:41 -0700 (PDT) X-Received: by 2002:a05:6000:41f0:b0:460:d18:865c with SMTP id ffacd0b85a97d-47f5a4182c4mr10238028f8f.1.1784303141364; Fri, 17 Jul 2026 08:45:41 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260714152238.541704-1-jtaubepe@redhat.com> <202607150914.6C4DD9DE03@keescook> In-Reply-To: <202607150914.6C4DD9DE03@keescook> From: Jesse Taube Date: Fri, 17 Jul 2026 11:45:29 -0400 X-Gm-Features: AUfX_mxczdveYEkQ2F7ZGQimhXBeV77ore2QZAWldEN6Jbr11pwlMVAev648dps Message-ID: Subject: Re: [PATCH] scsi: qla2xxx: Fix flex array member not at end To: Kees Cook Cc: linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org, Nilesh Javali , GR-QLogic-Storage-Upstream@marvell.com, "James E.J. Bottomley" , "Martin K. Petersen" , "Gustavo A. R. Silva" , Christoph Hellwig , John Meneghini , Chris Leech , Jesse Taube Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 15, 2026 at 12:16=E2=80=AFPM Kees Cook wrote: > > On Tue, Jul 14, 2026 at 11:22:38AM -0400, Jesse Taube wrote: > > In qla_edif_bsg.h: `struct fc_bsg_reply` and `struct fc_bsg_request` > > have flexible array members, thus they must be the last member of > > the parent structure. Contininging in the effort to add > > `-Wflex-array-member-not-at-end`, move the structs to the end of > > the parent structures, `struct qla_bsg_auth_els_reply` and > > `struct qla_bsg_auth_els_request `. > > > > Suggested-by: John Meneghini > > Signed-off-by: Jesse Taube > > It feels like this structure is part of the hardware spec? (and therefore > cannot be re-ordered.) I'm not sure at all, though, but it looks like > it's part of request serialization: I looked at the code closer and i relized this structure is passed to users= pace. I sent a patch V2 after i relized that though i accidentally kept the commit description the same. In the lpfc driver here you can see how `bsg_job->reply` is supossed to be = used. https://elixir.bootlin.com/linux/v7.0.10/source/drivers/scsi/lpfc/lpfc_bsg.= c#L662 the layout of `bsg_job->reply` is defined in `struct fc_bsg_reply`, the `struct qla_bsg_auth_els_request` data should have been put in the flex-array called `vendor_rsp` so `(struct qla_bsg_auth_els_request *)bsg_job->request->vendor_reply->vendor_= rsp; unfortunatly because of `vendor_reply` and `ctels_reply` being in a union the actuall vendor data from `struct qla_bsg_auth_els_request` is offset by the size of `ctels_reply`, this can be seen in V2 of this patch AFAIK this isn't leaking data. V2: https://lore.kernel.org/all/20260714185621.610105-1-jtaubepe@redhat.com= / Thanks, Jesse Taube > $ git grep 'qla_bsg_auth_els_request' | grep '>request' > drivers/scsi/qla2xxx/qla_edif.c: (struct qla_bsg_auth_els_requ= est *)bsg_job->request; > drivers/scsi/qla2xxx/qla_edif.c: (struct qla_bsg_auth_els_requ= est *)bsg_job->request; > drivers/scsi/qla2xxx/qla_edif.c: (struct qla_bsg_auth_els_requ= est *)bsg_job->request; > drivers/scsi/qla2xxx/qla_isr.c: (struct qla_bsg_a= uth_els_request *)bsg_job->request; > > -Kees > > > --- > > drivers/scsi/qla2xxx/qla_edif_bsg.h | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/scsi/qla2xxx/qla_edif_bsg.h b/drivers/scsi/qla2xxx= /qla_edif_bsg.h > > index 514c265ba86e..bcc35d149c1f 100644 > > --- a/drivers/scsi/qla2xxx/qla_edif_bsg.h > > +++ b/drivers/scsi/qla2xxx/qla_edif_bsg.h > > @@ -36,16 +36,16 @@ struct extra_auth_els { > > } __packed; > > > > struct qla_bsg_auth_els_request { > > - struct fc_bsg_request r; > > struct extra_auth_els e; > > + struct fc_bsg_request r; > > }; > > > > struct qla_bsg_auth_els_reply { > > - struct fc_bsg_reply r; > > uint32_t rx_xchg_address; > > uint8_t version; > > uint8_t pad[VND_CMD_PAD_SIZE]; > > uint8_t reserved[VND_CMD_APP_RESERVED_SIZE]; > > + struct fc_bsg_reply r; > > }; > > > > struct app_id { > > -- > > 2.54.0 > > > > -- > Kees Cook >