kernel/drivers/scsi/bfa, branch linux-6.9.y

scsi: bfa: Ensure the copied buf is NUL terminated

2024-05-30T07:44:33Z

[ Upstream commit 13d0cecb4626fae67c00c84d3c7851f6b62f7df3 ] Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user. Fixes: 9f30b674759b ("bfa: replace 2 kzalloc/copy_from_user by memdup_user") Signed-off-by: Bui Quang Minh Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-3-f1f1b53a10f4@gmail.com Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: bfa: Fix function pointer type mismatch for state machines

2024-02-27T02:16:48Z

The bfa driver is full of state machines and a generic abstraction layer for them. This relies on casting function pointers, but that is no longer allowed when CONFIG_CFI_CLANG is enabled and causes a huge number of warnings like: drivers/scsi/bfa/bfad.c:169:3: error: cast from 'void (*)(struct bfad_s *, enum bfad_sm_event)' to 'bfa_sm_t' (aka 'void (*)(void *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict] bfa_sm_set_state(bfad, bfad_sm_created); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Rework the mechanism to no longer require the function pointer casts, by having separate types for each individual state machine. This in turn requires moving the enum definitions for each state machine into the header files in order to define the typedef. Reviewed-by: Kees Cook Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20240222124433.2046570-2-arnd@kernel.org Signed-off-by: Martin K. Petersen

scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn

2024-02-27T02:16:48Z

Some callback functions used here take a boolean argument, others take a status argument. This breaks KCFI type checking, so clang now warns about the function pointer cast: drivers/scsi/bfa/bfad_bsg.c:2138:29: error: cast from 'void (*)(void *, enum bfa_status)' to 'bfa_cb_cbfn_t' (aka 'void (*)(void *, enum bfa_boolean)') converts to incompatible function type [-Werror,-Wcast-function-type-strict] Assuming the code is actually correct here and the callers always match the argument types of the callee, rework this to replace the explicit cast with a union of the two pointer types. This does not change the behavior of the code, so if something is actually broken here, a larger rework may be necessary. Fixes: 37ea0558b87a ("[SCSI] bfa: Added support to collect and reset fcport stats") Fixes: 3ec4f2c8bff2 ("[SCSI] bfa: Added support to configure QOS and collect stats.") Reviewed-by: Kees Cook Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20240222124433.2046570-1-arnd@kernel.org Signed-off-by: Martin K. Petersen

scsi: bfa: Remove additional unnecessary struct declarations

2024-02-27T02:16:33Z

Commit c3b0d087763f ("scsi: bfa: Remove unnecessary struct declarations") removed duplicate struct declarations for struct bfa_fcs_s and struct bfa_fcs_fabric_s. However, there are further duplications: - struct bfad_vf_s is declared in line 165 remove the duplication in line 834. - struct bfad_rport_s is declared in line 394 remove the duplication in line 836. Remove them. Signed-off-by: Simone Weiß Link: https://lore.kernel.org/r/20240217191409.6260-1-simone.p.weiss@posteo.com Signed-off-by: Martin K. Petersen

scsi: bfa: Use the proper data type for BLIST flags

2023-11-25T00:23:39Z

Fix the following sparse warning: drivers/scsi/bfa/bfad_bsg.c:2553:50: sparse: sparse: incorrect type in initializer (different base types) Fixes: 2e5a6c3baccd ("scsi: bfa: Convert bfad_reset_sdev_bflags() from a macro into a function") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311031255.lmSPisIk-lkp@intel.com/ Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20231115193338.2261972-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen

scsi: bfa: Replace one-element array with flexible-array member in struct fc_rscn_pl_s

2023-08-21T21:13:56Z

One-element and zero-length arrays are deprecated. So, replace one-element array in struct fc_rscn_pl_s with flexible-array member. This results in no differences in binary output. Link: https://github.com/KSPP/linux/issues/339 Signed-off-by: "Gustavo A. R. Silva" Link: https://lore.kernel.org/r/ZN0VTpDBOSVHGayb@work Reviewed-by: Kees Cook Signed-off-by: Martin K. Petersen

scsi: bfa: Replace all non-returning strlcpy() with strscpy()

2023-05-17T01:38:36Z

strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Link: https://lore.kernel.org/r/20230516013345.723623-1-azeemshaikh38@gmail.com Reviewed-by: Kees Cook Signed-off-by: Martin K. Petersen

scsi: bfa: Drop redundant pci_enable_pcie_error_reporting()

2023-03-10T03:00:38Z

pci_enable_pcie_error_reporting() enables the device to send ERR_* Messages. Since commit f26e58bf6f54 ("PCI/AER: Enable error reporting when AER is native"), the PCI core does this for all devices during enumeration, so the driver doesn't need to do it itself. Remove the redundant pci_enable_pcie_error_reporting() call from the driver. Also remove the corresponding pci_disable_pcie_error_reporting() from the driver .remove() path. Note that this only controls ERR_* Messages from the device. An ERR_* Message may cause the Root Port to generate an interrupt, depending on the AER Root Error Command register managed by the AER service driver. Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20230307182842.870378-5-helgaas@kernel.org Cc: Anil Gurumurthy Cc: Sudarsana Kalluru Signed-off-by: Martin K. Petersen

scsi: bfa: Replace one-element array with flexible-array member

2022-11-17T18:15:45Z

One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct fdmi_attr_s. Important to mention is that doing a build before/after this patch results in no binary output differences. This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1]. Link: https://github.com/KSPP/linux/issues/209 Link: https://github.com/KSPP/linux/issues/79 Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [1] Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/Y3P1rEEBq7HzJygq@work Reviewed-by: Kees Cook Signed-off-by: Martin K. Petersen

scsi: bfa: Rework bfad_reset_sdev_bflags()

2022-11-08T03:34:39Z

Since commit f93ed747e2c7 ("scsi: core: Release SCSI devices synchronously") it is no longer allowed to call scsi_device_put() from atomic context. Rework bfad_reset_sdev_bflags() such that scsi_device_put() is no longer called. This fixes the following smatch warning: drivers/scsi/bfa/bfad_bsg.c:2551 bfad_iocmd_lunmask_reset_lunscan_mode() warn: sleeping in atomic context bfad_iocmd_lunmask() <- disables preempt -> bfad_iocmd_lunmask_reset_lunscan_mode() -> scsi_device_put() Cc: Anil Gurumurthy Cc: Sudarsana Kalluru Cc: Dan Carpenter Reported-by: Dan Carpenter Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20221031224728.2607760-5-bvanassche@acm.org Signed-off-by: Martin K. Petersen