Re: [PATCH v2] RDMA/mlx5: Use DEFINE_RAW_FLEX for leftovers flow attributes

[sashiko-bot@kernel.org]

> From: Li RongQing <lirongqing@baidu.com>
> 
> Commit e91fb8b9d0ed ("RDMA/mlx5: Avoid flexible array warning") split
> the leftovers_specs[] array into two separate structs to silence the
> sparse "array of flexible structures" warning, but in doing so reversed
> the member order: eth_flow was placed before flow_attr.
> 
> _create_flow_rule() locates the flow specs with:
> 
>     ib_flow = (void *)flow_attr + sizeof(*flow_attr);
> 
> which expects the spec data to immediately follow the ib_flow_attr.
> With the reversed order, flow_attr is the last member, so ib_flow
> points past the end of the struct and the num_of_specs = 1 loop reads
> out-of-bounds memory (whatever static data follows in the .data
> section), producing incorrect flow rules or a crash.
> 
> Rebuild the leftovers attributes with DEFINE_RAW_FLEX(), which declares
> an on-stack struct ib_flow_attr with a properly sized trailing flows[]
> array.  The ETH spec lives in flows[0].eth at exactly the offset
> _create_flow_rule() expects, so no layout-dependent composite struct is
> needed.  This also avoids embedding a structure that contains a flexible
> array member as a non-last member, which would trigger
> -Wflex-array-member-not-at-end once the warning is enabled.
> 
> Fixes: e91fb8b9d0ed ("RDMA/mlx5: Avoid flexible array warning")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918092337.2338-1-lirongqing@baidu.com?part=1