scsi: 3w-xxxx: Replace one-element array with flexible-array member

One-element arrays are deprecated, and we are replacing them with flexible
array members instead. So, replace one-element array with flexible-array
member in struct TAG_TW_New_Ioctl and refactor the rest of the code,
accordingly.

Notice that, in multiple places, the subtraction of 1 from
sizeof(TW_New_Ioctl) is removed, as this operation is now implicit
after the flex-array transformation.

Link: https://github.com/KSPP/linux/issues/79
Link: https://github.com/KSPP/linux/issues/206
Link: https://lore.kernel.org/r/YyyyvB30jnjRaw/F@work
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index a853c5497af62de98c0792af52e02da0ca31a261..ffdecb12d654c7c37c5c886647ff5c867b8fad24 100644 (file)
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -912,7 +912,7 @@ static long tw_chrdev_ioctl(struct file *file, unsigned int cmd, unsigned long a
        data_buffer_length_adjusted = (data_buffer_length + 511) & ~511;
 
        /* Now allocate ioctl buf memory */
-       cpu_addr = dma_alloc_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_New_Ioctl) - 1, &dma_handle, GFP_KERNEL);
+       cpu_addr = dma_alloc_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted + sizeof(TW_New_Ioctl), &dma_handle, GFP_KERNEL);
        if (cpu_addr == NULL) {
                retval = -ENOMEM;
                goto out;
@@ -921,7 +921,7 @@ static long tw_chrdev_ioctl(struct file *file, unsigned int cmd, unsigned long a
        tw_ioctl = (TW_New_Ioctl *)cpu_addr;
 
        /* Now copy down the entire ioctl */
-       if (copy_from_user(tw_ioctl, argp, data_buffer_length + sizeof(TW_New_Ioctl) - 1))
+       if (copy_from_user(tw_ioctl, argp, data_buffer_length + sizeof(TW_New_Ioctl)))
                goto out2;
 
        passthru = (TW_Passthru *)&tw_ioctl->firmware_command;
@@ -966,15 +966,15 @@ static long tw_chrdev_ioctl(struct file *file, unsigned int cmd, unsigned long a
                        /* Load the sg list */
                        switch (TW_SGL_OUT(tw_ioctl->firmware_command.opcode__sgloffset)) {
                        case 2:
-                               tw_ioctl->firmware_command.byte8.param.sgl[0].address = dma_handle + sizeof(TW_New_Ioctl) - 1;
+                               tw_ioctl->firmware_command.byte8.param.sgl[0].address = dma_handle + sizeof(TW_New_Ioctl);
                                tw_ioctl->firmware_command.byte8.param.sgl[0].length = data_buffer_length_adjusted;
                                break;
                        case 3:
-                               tw_ioctl->firmware_command.byte8.io.sgl[0].address = dma_handle + sizeof(TW_New_Ioctl) - 1;
+                               tw_ioctl->firmware_command.byte8.io.sgl[0].address = dma_handle + sizeof(TW_New_Ioctl);
                                tw_ioctl->firmware_command.byte8.io.sgl[0].length = data_buffer_length_adjusted;
                                break;
                        case 5:
-                               passthru->sg_list[0].address = dma_handle + sizeof(TW_New_Ioctl) - 1;
+                               passthru->sg_list[0].address = dma_handle + sizeof(TW_New_Ioctl);
                                passthru->sg_list[0].length = data_buffer_length_adjusted;
                                break;
                        }
@@ -1017,12 +1017,12 @@ static long tw_chrdev_ioctl(struct file *file, unsigned int cmd, unsigned long a
        }
 
        /* Now copy the response to userspace */
-       if (copy_to_user(argp, tw_ioctl, sizeof(TW_New_Ioctl) + data_buffer_length - 1))
+       if (copy_to_user(argp, tw_ioctl, sizeof(TW_New_Ioctl) + data_buffer_length))
                goto out2;
        retval = 0;
 out2:
        /* Now free ioctl buf memory */
-       dma_free_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_New_Ioctl) - 1, cpu_addr, dma_handle);
+       dma_free_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted + sizeof(TW_New_Ioctl), cpu_addr, dma_handle);
 out:
        mutex_unlock(&tw_dev->ioctl_lock);
        mutex_unlock(&tw_mutex);

diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h
index e8f3f081b7d8d06efe1cdc726723b64b6fb25808..120a087bdf3cbcc089ad39a0a9ab275415bf7091 100644 (file)
--- a/drivers/scsi/3w-xxxx.h
+++ b/drivers/scsi/3w-xxxx.h
@@ -348,7 +348,7 @@ typedef struct TAG_TW_New_Ioctl {
        unsigned int data_buffer_length;
        unsigned char padding [508];
        TW_Command firmware_command;
-       char data_buffer[1];
+       char data_buffer[];
 } TW_New_Ioctl;
 
 /* GetParam descriptor */