queue-5.10/ata-sata_sx4-fix-pdc20621_get_from_dimm-on-64-bit.patch

   1 From 1fb98dfdf9eafab85dcd2ac75786bc68fb17992e Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Tue, 26 Mar 2024 15:53:37 +0100
   4 Subject: ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
   5
   6 From: Arnd Bergmann <arnd@arndb.de>
   7
   8 [ Upstream commit 52f80bb181a9a1530ade30bc18991900bbb9697f ]
   9
  10 gcc warns about a memcpy() with overlapping pointers because of an
  11 incorrect size calculation:
  12
  13 In file included from include/linux/string.h:369,
  14                  from drivers/ata/sata_sx4.c:66:
  15 In function 'memcpy_fromio',
  16     inlined from 'pdc20621_get_from_dimm.constprop' at drivers/ata/sata_sx4.c:962:2:
  17 include/linux/fortify-string.h:97:33: error: '__builtin_memcpy' accessing 4294934464 bytes at offsets 0 and [16, 16400] overlaps 6442385281 bytes at offset -2147450817 [-Werror=restrict]
  18    97 | #define __underlying_memcpy     __builtin_memcpy
  19       |                                 ^
  20 include/linux/fortify-string.h:620:9: note: in expansion of macro '__underlying_memcpy'
  21   620 |         __underlying_##op(p, q, __fortify_size);                        \
  22       |         ^~~~~~~~~~~~~
  23 include/linux/fortify-string.h:665:26: note: in expansion of macro '__fortify_memcpy_chk'
  24   665 | #define memcpy(p, q, s)  __fortify_memcpy_chk(p, q, s,                  \
  25       |                          ^~~~~~~~~~~~~~~~~~~~
  26 include/asm-generic/io.h:1184:9: note: in expansion of macro 'memcpy'
  27  1184 |         memcpy(buffer, __io_virt(addr), size);
  28       |         ^~~~~~
  29
  30 The problem here is the overflow of an unsigned 32-bit number to a
  31 negative that gets converted into a signed 'long', keeping a large
  32 positive number.
  33
  34 Replace the complex calculation with a more readable min() variant
  35 that avoids the warning.
  36
  37 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
  38 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
  39 Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
  40 Signed-off-by: Sasha Levin <sashal@kernel.org>
  41 ---
  42  drivers/ata/sata_sx4.c | 6 ++----
  43  1 file changed, 2 insertions(+), 4 deletions(-)
  44
  45 diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
  46 index 4c01190a5e370..c95685f693a68 100644
  47 --- a/drivers/ata/sata_sx4.c
  48 +++ b/drivers/ata/sata_sx4.c
  49 @@ -1004,8 +1004,7 @@ static void pdc20621_get_from_dimm(struct ata_host *host, void *psource,
  50
  51         offset -= (idx * window_size);
  52         idx++;
  53 -       dist = ((long) (window_size - (offset + size))) >= 0 ? size :
  54 -               (long) (window_size - offset);
  55 +       dist = min(size, window_size - offset);
  56         memcpy_fromio(psource, dimm_mmio + offset / 4, dist);
  57
  58         psource += dist;
  59 @@ -1053,8 +1052,7 @@ static void pdc20621_put_to_dimm(struct ata_host *host, void *psource,
  60         readl(mmio + PDC_DIMM_WINDOW_CTLR);
  61         offset -= (idx * window_size);
  62         idx++;
  63 -       dist = ((long)(s32)(window_size - (offset + size))) >= 0 ? size :
  64 -               (long) (window_size - offset);
  65 +       dist = min(size, window_size - offset);
  66         memcpy_toio(dimm_mmio + offset / 4, psource, dist);
  67         writel(0x01, mmio + PDC_GENERAL_CTLR);
  68         readl(mmio + PDC_GENERAL_CTLR);
  69 --
  70 2.43.0
  71