accel/qaic: Quiet array bounds check on DMA abort message
authorCarl Vanderlip <quic_carlv@quicinc.com>
Fri, 27 Oct 2023 18:08:10 +0000 (12:08 -0600)
committerJeffrey Hugo <quic_jhugo@quicinc.com>
Fri, 3 Nov 2023 14:55:44 +0000 (08:55 -0600)
commit44793c6a5b784f1f25608e3773fd40e011c63391
treeaec414fd8433fdd213a70673c8577460f548593e
parent6fd9487147c4f18ad77eea00bd8c9189eec74a3e
accel/qaic: Quiet array bounds check on DMA abort message

Current wrapper is right-sized to the message being transferred;
however, this is smaller than the structure defining message wrappers
since the trailing element is a union of message/transfer headers of
various sizes (8 and 32 bytes on 32-bit system where issue was
reported). Using the smaller header with a small message
(wire_trans_dma_xfer is 24 bytes including header) ends up being smaller
than a wrapper with the larger header. There are no accesses outside of
the defined size, however they are possible if the larger union member
is referenced.

Abort messages are outside of hot-path and changing the wrapper struct
would require a larger rewrite, so having the memory allocated to the
message be 8 bytes too big is acceptable.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310182253.bcb9JcyJ-lkp@intel.com/
Signed-off-by: Carl Vanderlip <quic_carlv@quicinc.com>
Reviewed-by: Pranjal Ramajor Asha Kanojiya <quic_pkanojiy@quicinc.com>
Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231027180810.4873-1-quic_jhugo@quicinc.com
drivers/accel/qaic/qaic_control.c