Skip to content

Commit 42ec15c

Browse files
arndbmartinkpetersen
authored andcommitted
scsi: fnic: fix invalid stack access
gcc -O3 warns that some local variables are not properly initialized: drivers/scsi/fnic/vnic_dev.c: In function 'fnic_dev_hang_notify': drivers/scsi/fnic/vnic_dev.c:511:16: error: 'a0' is used uninitialized in this function [-Werror=uninitialized] vdev->args[0] = *a0; ~~~~~~~~~~~~~~^~~~~ drivers/scsi/fnic/vnic_dev.c:691:6: note: 'a0' was declared here u64 a0, a1; ^~ drivers/scsi/fnic/vnic_dev.c:512:16: error: 'a1' is used uninitialized in this function [-Werror=uninitialized] vdev->args[1] = *a1; ~~~~~~~~~~~~~~^~~~~ drivers/scsi/fnic/vnic_dev.c:691:10: note: 'a1' was declared here u64 a0, a1; ^~ drivers/scsi/fnic/vnic_dev.c: In function 'fnic_dev_mac_addr': drivers/scsi/fnic/vnic_dev.c:512:16: error: 'a1' is used uninitialized in this function [-Werror=uninitialized] vdev->args[1] = *a1; ~~~~~~~~~~~~~~^~~~~ drivers/scsi/fnic/vnic_dev.c:698:10: note: 'a1' was declared here u64 a0, a1; ^~ Apparently the code relies on the local variables occupying adjacent memory locations in the same order, but this is of course not guaranteed. Use an array of two u64 variables where needed to make it work correctly. I suspect there is also an endianness bug here, but have not digged in deep enough to be sure. Fixes: 5df6d73 ("[SCSI] fnic: Add new Cisco PCI-Express FCoE HBA") Fixes: mmtom ("init/Kconfig: enable -O3 for all arches") Cc: [email protected] Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Martin K. Petersen <[email protected]>
1 parent 529244b commit 42ec15c

File tree

1 file changed

+10
-10
lines changed

1 file changed

+10
-10
lines changed

drivers/scsi/fnic/vnic_dev.c

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -688,26 +688,26 @@ int vnic_dev_soft_reset_done(struct vnic_dev *vdev, int *done)
688688

689689
int vnic_dev_hang_notify(struct vnic_dev *vdev)
690690
{
691-
u64 a0, a1;
691+
u64 a0 = 0, a1 = 0;
692692
int wait = 1000;
693693
return vnic_dev_cmd(vdev, CMD_HANG_NOTIFY, &a0, &a1, wait);
694694
}
695695

696696
int vnic_dev_mac_addr(struct vnic_dev *vdev, u8 *mac_addr)
697697
{
698-
u64 a0, a1;
698+
u64 a[2] = {};
699699
int wait = 1000;
700700
int err, i;
701701

702702
for (i = 0; i < ETH_ALEN; i++)
703703
mac_addr[i] = 0;
704704

705-
err = vnic_dev_cmd(vdev, CMD_MAC_ADDR, &a0, &a1, wait);
705+
err = vnic_dev_cmd(vdev, CMD_MAC_ADDR, &a[0], &a[1], wait);
706706
if (err)
707707
return err;
708708

709709
for (i = 0; i < ETH_ALEN; i++)
710-
mac_addr[i] = ((u8 *)&a0)[i];
710+
mac_addr[i] = ((u8 *)&a)[i];
711711

712712
return 0;
713713
}
@@ -732,30 +732,30 @@ void vnic_dev_packet_filter(struct vnic_dev *vdev, int directed, int multicast,
732732

733733
void vnic_dev_add_addr(struct vnic_dev *vdev, u8 *addr)
734734
{
735-
u64 a0 = 0, a1 = 0;
735+
u64 a[2] = {};
736736
int wait = 1000;
737737
int err;
738738
int i;
739739

740740
for (i = 0; i < ETH_ALEN; i++)
741-
((u8 *)&a0)[i] = addr[i];
741+
((u8 *)&a)[i] = addr[i];
742742

743-
err = vnic_dev_cmd(vdev, CMD_ADDR_ADD, &a0, &a1, wait);
743+
err = vnic_dev_cmd(vdev, CMD_ADDR_ADD, &a[0], &a[1], wait);
744744
if (err)
745745
pr_err("Can't add addr [%pM], %d\n", addr, err);
746746
}
747747

748748
void vnic_dev_del_addr(struct vnic_dev *vdev, u8 *addr)
749749
{
750-
u64 a0 = 0, a1 = 0;
750+
u64 a[2] = {};
751751
int wait = 1000;
752752
int err;
753753
int i;
754754

755755
for (i = 0; i < ETH_ALEN; i++)
756-
((u8 *)&a0)[i] = addr[i];
756+
((u8 *)&a)[i] = addr[i];
757757

758-
err = vnic_dev_cmd(vdev, CMD_ADDR_DEL, &a0, &a1, wait);
758+
err = vnic_dev_cmd(vdev, CMD_ADDR_DEL, &a[0], &a[1], wait);
759759
if (err)
760760
pr_err("Can't del addr [%pM], %d\n", addr, err);
761761
}

0 commit comments

Comments
 (0)