Re: [PATCH for-rc] RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message

Jason Gunthorpe
2019-08-15T13:07:42Z

On Thu, Aug 15, 2019 at 04:44:37AM -0700, Selvin Xavier wrote:
> @@ -583,7 +584,7 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res,
> req.eventq_id = cpu_to_le16(srq->eventq_hw_ring_id);
>
> rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
> - (void *)&resp, NULL, 0);
> + (void *)&resp, sizeof(req), NULL, 0);

I really don't like seeing casts to void * in code. Why can't you
properly embed the header in the structs??

Jason