Re: [PATCH v3][next] scsi: lpfc: Use struct_size() helper

[Kees Cook <keescook@chromium.org>]

On Wed, May 31, 2023 at 03:33:19PM -0700, Justin Tee wrote:
> Prefer struct_size() over open-coded versions of idiom:
> 
> sizeof(struct-with-flex-array) + sizeof(typeof-flex-array-elements) * count
> 
> where count is the max number of items the flexible array is supposed to
> contain.
> 
> Link: https://github.com/KSPP/linux/issues/160

The SoB chain here looks weird -- I think this should include the C-d-b
tags as well:

> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>

Co-developed-by: Gustavo A. R. Silva <gustavoars@kernel.org>

> Signed-off-by: Kees Cook <keescook@chromium.org>

Co-developed-by: Kees Cook <keescook@chromium.org>

> Signed-off-by: Justin Tee <justin.tee@broadcom.com>

But regardless, thank you -- looks good!

Reviewed-by: Kees Cook <keescook@chromium.org>

-Kees

> ---
> Changes in v3:
>  - Instead of hardcode to 1, use be32_to_cpu(rap->no_of_objects).
>    (Justin Tee).
> 
> v2:
>  - Use literal 1 in call to struct_size(), instead of rap->no_of_objects
>    (Kees Cook).
> 
> v1:
>  - Link:
>    https://lore.kernel.org/linux-hardening/99e06733f5f35c6cd62e05f530b93107bfd03362.1684358315.git.gustavoars@kernel.org/
> ---
>  drivers/scsi/lpfc/lpfc_ct.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
> index e880d127d7f5..703429512ead 100644
> --- a/drivers/scsi/lpfc/lpfc_ct.c
> +++ b/drivers/scsi/lpfc/lpfc_ct.c
> @@ -3748,8 +3748,7 @@ lpfc_vmid_cmd(struct lpfc_vport *vport,
>  		rap->obj[0].entity_id_len = vmid->vmid_len;
>  		memcpy(rap->obj[0].entity_id, vmid->host_vmid, vmid->vmid_len);
>  		size = RAPP_IDENT_OFFSET +
> -			sizeof(struct lpfc_vmid_rapp_ident_list) +
> -			sizeof(struct entity_id_object);
> +		       struct_size(rap, obj, be32_to_cpu(rap->no_of_objects));
>  		retry = 1;
>  		break;
>  
> @@ -3768,8 +3767,7 @@ lpfc_vmid_cmd(struct lpfc_vport *vport,
>  		dap->obj[0].entity_id_len = vmid->vmid_len;
>  		memcpy(dap->obj[0].entity_id, vmid->host_vmid, vmid->vmid_len);
>  		size = DAPP_IDENT_OFFSET +
> -			sizeof(struct lpfc_vmid_dapp_ident_list) +
> -			sizeof(struct entity_id_object);
> +		       struct_size(dap, obj, be32_to_cpu(dap->no_of_objects));
>  		write_lock(&vport->vmid_lock);
>  		vmid->flag &= ~LPFC_VMID_REGISTERED;
>  		write_unlock(&vport->vmid_lock);
> -- 
> 2.38.0
> 

-- 
Kees Cook