-Wstringop-overread in drivers/scsi/pm8001/pm8001_hwi.c

[nathanchance]

After LLVM commit 86f2e71cb8d1 ("[Clang][Sema] Add -Wstringop-overread warning for source buffer overreads (#183004)", 2026-06-22), there is an instance of -Wstringop-overread in drivers/scsi/pm8001/pm8001_hwi.c visible under two different conditions.

The first is in kernels prior to commit 239d87327dcd ("fortify: Hide run-time copy size from value range tracking") (i.e., 6.12 and earlier) when CONFIG_FORTIFY_SOURCE is enabled.

drivers/scsi/pm8001/pm8001_hwi.c:3212:2: warning: 'memcpy' reading 20 bytes from a region of size 0 [-Wstringop-overread]
 3212 |         memcpy(phy->frame_rcvd, ((u8 *)&pPayload->sata_fis - 4),
      |         ^
include/linux/fortify-string.h:678:26: note: expanded from macro 'memcpy'
  678 | #define memcpy(p, q, s)  __fortify_memcpy_chk(p, q, s,                  \
      |                          ^
include/linux/fortify-string.h:633:2: note: expanded from macro '__fortify_memcpy_chk'
  633 |         __underlying_##op(p, q, __fortify_size);                        \
      |         ^
<scratch space>:90:1: note: expanded from here
   90 | __underlying_memcpy
      | ^
include/linux/fortify-string.h:114:29: note: expanded from macro '__underlying_memcpy'
  114 | #define __underlying_memcpy     __builtin_memcpy
      |                                 ^
1 warning generated.

This is not visible after the aforementioned change because the frontend cannot see the size of the structure anymore.

The second is architectures that define memcpy as __builtin_memcpy when CONFIG_FORTIFY_SOURCE is unset, such as i386 and sparc, which can still be seen in mainline.

drivers/scsi/pm8001/pm8001_hwi.c:3211:2: error: 'memcpy' reading 20 bytes from a region of size 0 [-Werror,-Wstringop-overread]
 3211 |         memcpy(phy->frame_rcvd, ((u8 *)&pPayload->sata_fis - 4),
      |         ^
arch/x86/include/asm/string_32.h:147:25: note: expanded from macro 'memcpy'
  147 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
      |                         ^
1 error generated.

drivers/scsi/pm8001/pm8001_hwi.c:3211:2: error: 'memcpy' reading 20 bytes from a region of size 0 [-Werror,-Wstringop-overread]
 3211 |         memcpy(phy->frame_rcvd, ((u8 *)&pPayload->sata_fis - 4),
      |         ^
arch/sparc/include/asm/string.h:15:25: note: expanded from macro 'memcpy'
   15 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
      |                         ^
1 error generated.

Not sure if there is any way to silence this outside of the __diag infrastructure or $(call cc-disable-warning, stringop-overread).

Cc @kees

[nathanchance]

Bart Van Assche sent a patch to address this: https://lore.kernel.org/31963d53810f42970447e78ef46030ab13d2e91f.1788198434.git.bvanassche@acm.org/