Re: [PATCH libmlx5 3/6] fix buffer overrun copying inline header

[Jarod Wilson <jarod-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>]

On Wed, Jul 27, 2016 at 03:17:24PM -0400, Jarod Wilson wrote:
> At present, the size of eseg->inline_hdr_start is 16 bits, while
> MLX5_ETH_L2_INLINE_HEADER_SIZE is 18, so there are attempts made to copy
> 18 bits into 16 bits of storage. The mlx5_dbg() statement in
> copy_eth_inline_header() suggests that perhaps
> MLX5_ETH_L2_INLINE_HEADER_SIZE should be only 16, not 18. So either that
> needs to be changed, or the inline_hdr_start array needs to be bumped up
> to 3 bytes instead of 2.

Ugh. Now I see what's going on. The copy is actually designed to copy 18
_bytes_, not bits, into inline_hdr_start[2] and inline_hdr[16]. Is there a
particular reason those two aren't just a single array?

-- 
Jarod Wilson
jarod-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html