[PATCH v4] scsi: qla2xxx: Fix flex array member not at end

[PATCH v4] scsi: qla2xxx: Fix flex array member not at end

[Jesse Taube]

In qla_edif_bsg.h: `struct fc_bsg_reply` and `struct fc_bsg_request`
have flexible array members, thus they must be the last member of
the parent structure. Contininging in the effort to add
`-Wflex-array-member-not-at-end`, put `struct fc_bsg_*` inside a
union with the trailing members padded to the size of `struct fc_bsg_*`
to silence the warning. This is similar to TRAILING_OVERLAP, exept
that the position of the flexible array member is also in a union,
causing it to not be the last member of the structure.

Suggested-by: John Meneghini <jmeneghi@redhat.com>
Signed-off-by: Jesse Taube <jtaubepe@redhat.com>
---
V1 -> V2:
 - Rewrite
V2 -> V3:
 - Fix commit description
V3 -> V4:
 - Accedentally sent V1 ;(
   Send correct version.
---
 drivers/scsi/qla2xxx/qla_edif_bsg.h | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_edif_bsg.h b/drivers/scsi/qla2xxx/qla_edif_bsg.h
index 514c265ba86e..2b32a3185629 100644
--- a/drivers/scsi/qla2xxx/qla_edif_bsg.h
+++ b/drivers/scsi/qla2xxx/qla_edif_bsg.h
@@ -36,16 +36,26 @@ struct extra_auth_els {
 } __packed;
 
 struct qla_bsg_auth_els_request {
-	struct fc_bsg_request r;
-	struct extra_auth_els e;
+	union {
+		struct fc_bsg_request r;
+		struct {
+			unsigned char __fc_bsg_request_sz[sizeof(struct fc_bsg_request)];
+			struct extra_auth_els e;
+		};
+	};
 };
 
 struct qla_bsg_auth_els_reply {
-	struct fc_bsg_reply r;
-	uint32_t rx_xchg_address;
-	uint8_t version;
-	uint8_t pad[VND_CMD_PAD_SIZE];
-	uint8_t reserved[VND_CMD_APP_RESERVED_SIZE];
+	union {
+		struct fc_bsg_reply r;
+		struct {
+			unsigned char __fc_bsg_reply_sz[sizeof(struct fc_bsg_reply)];
+			uint32_t rx_xchg_address;
+			uint8_t version;
+			uint8_t pad[VND_CMD_PAD_SIZE];
+			uint8_t reserved[VND_CMD_APP_RESERVED_SIZE];
+		};
+	};
 };
 
 struct app_id {
-- 
2.54.0

Re: [PATCH v4] scsi: qla2xxx: Fix flex array member not at end

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing bounds check on user-provided BSG request length leads to out-of-bounds memory accesses when casting to driver-specific structures.
--

--- Patch [1]: [PATCH v4] scsi: qla2xxx: Fix flex array member not at end ---
commit 5047f2de85357d7b297d2d46b642495d4d1e88e7
Author: Jesse Taube <jtaubepe@redhat.com>

scsi: qla2xxx: Fix flex array member not at end

In qla_edif_bsg.h: struct fc_bsg_reply and struct fc_bsg_request have flexible
array members, thus they must be the last member of the parent structure. This
commit puts them inside a union with trailing members padded to silence warnings.

> diff --git a/drivers/scsi/qla2xxx/qla_edif_bsg.h b/drivers/scsi/qla2xxx/qla_edif_bsg.h
> index 514c265ba86e2..2b32a31856292 100644
> --- a/drivers/scsi/qla2xxx/qla_edif_bsg.h
> +++ b/drivers/scsi/qla2xxx/qla_edif_bsg.h
> @@ -36,16 +36,26 @@ struct extra_auth_els {
>  } __packed;
>  
>  struct qla_bsg_auth_els_request {
> -	struct fc_bsg_request r;
> -	struct extra_auth_els e;
> +	union {
> +		struct fc_bsg_request r;
> +		struct {
> +			unsigned char __fc_bsg_request_sz[sizeof(struct fc_bsg_request)];
> +			struct extra_auth_els e;
> +		};
> +	};
>  };

[Severity: High]
This is a pre-existing issue, but while reviewing this structure I noticed a
potential missing bounds check on the user-provided BSG request length.

When a local user with CAP_SYS_RAWIO issues an SG_IO ioctl on the BSG device
with a maliciously small request_len, the BSG core allocates exactly
request_len bytes using memdup_user().

Since the core fc_bsg_host_dispatch calculates the expected cmdlen but never
validates job->request_len against it, could this lead to an out-of-bounds
heap read when casting bsg_job->request to larger structures?

For instance, in drivers/scsi/qla2xxx/qla_bsg.c:qla2x00_process_vendor_specific(),
vendor_cmd[0] is accessed without checking if request_len is sufficiently large:

	ql_dbg(ql_dbg_edif, vha, 0x911b, "%s FC_BSG_HST_VENDOR cmd[0]=0x%x\n",
	    __func__, bsg_request->rqst_data.h_vendor.vendor_cmd[0]);

	switch (bsg_request->rqst_data.h_vendor.vendor_cmd[0]) {

Similarly, in drivers/scsi/qla2xxx/qla_edif.c:qla_bsg_check(), the code directly
dereferences req->e.sub_cmd assuming the request buffer is fully sized:

	if (p->sub_cmd == PULL_ELS) {

Is it possible to validate bsg_job->request_len before accessing these
driver-specific payload fields to prevent out-of-bounds accesses?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727164842.2123122-1-jtaubepe@redhat.com?part=1