linux-next: build failure after merge of the kspp tree

Hi all,

After merging the kspp tree, today's linux-next build (powerpc allyesconfig) failed like this:

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_send_messages':
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1934:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1934 | crq->valid = VALID_CMD_RESP_EL;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1935:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1935 | crq->format = cmd->rsp.format;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1938:52: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1938 | crq->status = VIOSRP_ADAPTER_FAIL;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1940:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1940 | crq->IU_length = cpu_to_be16(cmd->rsp.len);
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

Exposed by commit

4ba545781e20 ("Makefile: Enable -Warray-bounds")

Probably introduced by commit

88a678bbc34c ("ibmvscsis: Initial commit of IBM VSCSI Tgt Driver")

I applied the following hack for now:

From: Stephen Rothwell <[email protected]>
Date: Tue, 25 Jan 2022 14:18:36 +1100
Subject: [PATCH] scsi: hack for building with -Warray-bounds

Signed-off-by Stephen Rothwell <[email protected]>

---
 drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +2 -2

index 61f06f6885a5..89fcf98c61c3 100644
@@ -1872,11 +1872,11 @@ static void srp_snd_msg_failed(struct scsi_info *vscsi, long rc)
  */
 static void ibmvscsis_send_messages(struct scsi_info *vscsi)
 {
-	u64 msg_hi = 0;
+	u64 msg_hi[2] = { };
 	/* note do not attempt to access the IU_data_ptr with this pointer
 	 * it is not valid
 	 */
-	struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi;
+	struct viosrp_crq *crq = (struct viosrp_crq *)msg_hi;
 	struct ibmvscsis_cmd *cmd, *nxt;
 	long rc = ADAPT_SUCCESS;
 	bool retry = false;

Quoted 69 lines · Stephen Rothwell

After merging the kspp tree, today's linux-next build (powerpc allyesconfig) failed like this:

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_send_messages':
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1934:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1934 | crq->valid = VALID_CMD_RESP_EL;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1935:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1935 | crq->format = cmd->rsp.format;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1938:52: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1938 | crq->status = VIOSRP_ADAPTER_FAIL;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1940:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1940 | crq->IU_length = cpu_to_be16(cmd->rsp.len);
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

Exposed by commit

4ba545781e20 ("Makefile: Enable -Warray-bounds")

Probably introduced by commit

88a678bbc34c ("ibmvscsis: Initial commit of IBM VSCSI Tgt Driver")

I applied the following hack for now:

From: Stephen Rothwell <[email protected]>
Date: Tue, 25 Jan 2022 14:18:36 +1100
Subject: [PATCH] scsi: hack for building with -Warray-bounds

Signed-off-by Stephen Rothwell <[email protected]>

---
 drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +2 -2

index 61f06f6885a5..89fcf98c61c3 100644
@@ -1872,11 +1872,11 @@ static void srp_snd_msg_failed(struct scsi_info *vscsi, long rc)
  */
 static void ibmvscsis_send_messages(struct scsi_info *vscsi)
 {
-	u64 msg_hi = 0;
+	u64 msg_hi[2] = { };
 	/* note do not attempt to access the IU_data_ptr with this pointer
 	 * it is not valid
 	 */
-	struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi;
+	struct viosrp_crq *crq = (struct viosrp_crq *)msg_hi;
 	struct ibmvscsis_cmd *cmd, *nxt;
 	long rc = ADAPT_SUCCESS;
 	bool retry = false;

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c static void ibmvscsis_send_messages(struct scsi_info *vscsi) · line 1946

Quoted 8 lines

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +1 -1

@@ -1940,7 +1940,7 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
 					crq->IU_length = cpu_to_be16(cmd->rsp.len);
 
 					rc = h_send_crq(vscsi->dma_dev->unit_address,
-							be64_to_cpu(msg_hi),
+							be64_to_cpu(msg_hi[0]),
 							be64_to_cpu(cmd->rsp.tag));
 
 					dev_dbg(&vscsi->dev, "send_messages: cmd %p, tag 0x%llx, rc %ld\n",  

This looks correct to me. struct viosrp_crq is 16 bytes wide. The only suggestion I might make would be either avoid the bare '2':

	u64 msg_hi[sizeof(struct viosrp_crq) / sizeof(u64)] = { };

or adjust struct viosrp_crq so the casting isn't needed at all:

truct viosrp_crq {
	union {
		u64 hi;
		struct {
		        u8 valid;               /* used by RPA */
		        u8 format;              /* SCSI vs out-of-band */
		        u8 reserved;
		        u8 status;              /* non-scsi failure? (e.g. DMA failure) */
		        __be16 timeout;         /* in seconds */
		        __be16 IU_length;       /* in bytes */
		};
	};
        __be64 IU_data_ptr;     /* the TCE for transferring data */
};

	struct viosrp_crq crq = { };
	...
 			rc = h_send_crq(vscsi->dma_dev->unit_address,
					be64_to_cpu(crq.hi),
					be64_to_cpu(cmd->rsp.tag));

Hi all,

[Cc'ing the scsi maintainers. Sorry I should have done that sooner]

Quoted 103 lines · On Mon, 24 Jan 2022 19:43:44 -0800 Kees Cook <[email protected]> wrote:

Quoted 69 lines · Stephen Rothwell

After merging the kspp tree, today's linux-next build (powerpc allyesconfig) failed like this:

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c: In function 'ibmvscsis_send_messages':
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1934:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1934 | crq->valid = VALID_CMD_RESP_EL;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1935:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1935 | crq->format = cmd->rsp.format;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1938:52: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1938 | crq->status = VIOSRP_ADAPTER_FAIL;
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1940:44: error: array subscript 'struct viosrp_crq[0]' is partly outside array bounds of 'u64[1]' {aka 'long long unsigned int[1]'} [-Werror=array-bounds]
1940 | crq->IU_length = cpu_to_be16(cmd->rsp.len);
| ^~
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c:1875:13: note: while referencing 'msg_hi'

 1875 |         u64 msg_hi = 0;
      |             ^~~~~~

Exposed by commit

4ba545781e20 ("Makefile: Enable -Warray-bounds")

Probably introduced by commit

88a678bbc34c ("ibmvscsis: Initial commit of IBM VSCSI Tgt Driver")

I applied the following hack for now:

From: Stephen Rothwell <[email protected]>
Date: Tue, 25 Jan 2022 14:18:36 +1100
Subject: [PATCH] scsi: hack for building with -Warray-bounds

Signed-off-by Stephen Rothwell <[email protected]>

---
 drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +2 -2

index 61f06f6885a5..89fcf98c61c3 100644
@@ -1872,11 +1872,11 @@ static void srp_snd_msg_failed(struct scsi_info *vscsi, long rc)
  */
 static void ibmvscsis_send_messages(struct scsi_info *vscsi)
 {
-	u64 msg_hi = 0;
+	u64 msg_hi[2] = { };
 	/* note do not attempt to access the IU_data_ptr with this pointer
 	 * it is not valid
 	 */
-	struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi;
+	struct viosrp_crq *crq = (struct viosrp_crq *)msg_hi;
 	struct ibmvscsis_cmd *cmd, *nxt;
 	long rc = ADAPT_SUCCESS;
 	bool retry = false;

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c static void ibmvscsis_send_messages(struct scsi_info *vscsi) · line 1946

Quoted 8 lines

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +1 -1

@@ -1940,7 +1940,7 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
 					crq->IU_length = cpu_to_be16(cmd->rsp.len);
 
 					rc = h_send_crq(vscsi->dma_dev->unit_address,
-							be64_to_cpu(msg_hi),
+							be64_to_cpu(msg_hi[0]),
 							be64_to_cpu(cmd->rsp.tag));
 
 					dev_dbg(&vscsi->dev, "send_messages: cmd %p, tag 0x%llx, rc %ld\n",  

This looks correct to me. struct viosrp_crq is 16 bytes wide. The only suggestion I might make would be either avoid the bare '2':

	u64 msg_hi[sizeof(struct viosrp_crq) / sizeof(u64)] = { };

or adjust struct viosrp_crq so the casting isn't needed at all:

truct viosrp_crq {
	union {
		u64 hi;
		struct {
		        u8 valid;               /* used by RPA */
		        u8 format;              /* SCSI vs out-of-band */
		        u8 reserved;
		        u8 status;              /* non-scsi failure? (e.g. DMA failure) */
		        __be16 timeout;         /* in seconds */
		        __be16 IU_length;       /* in bytes */
		};
	};
        __be64 IU_data_ptr;     /* the TCE for transferring data */
};

Quoted 8 lines

	struct viosrp_crq crq = { };
	...
 			rc = h_send_crq(vscsi->dma_dev->unit_address,
					be64_to_cpu(crq.hi),
					be64_to_cpu(cmd->rsp.tag));

Has there been any progress on this?

Commit 88a678bbc34c mentioned above was merged in v4.8-rc1.