Re: [PATCH for-rc] RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message

Selvin Xavier
2019-08-16T04:52:38Z

On Thu, Aug 15, 2019 at 6:37 PM Jason Gunthorpe <jgg@ziepe.ca> wrote:
>
> On Thu, Aug 15, 2019 at 04:44:37AM -0700, Selvin Xavier wrote:
> > @@ -583,7 +584,7 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res,
> > req.eventq_id = cpu_to_le16(srq->eventq_hw_ring_id);
> >
> > rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
> > - (void *)&resp, NULL, 0);
> > + (void *)&resp, sizeof(req), NULL, 0);
>
> I really don't like seeing casts to void * in code. Why can't you
> properly embed the header in the structs??
Is your objection only in casting to void * or you dont like any
casting here? These
structures are directly copied from some auto-generated files.
Embedding struct cmdq_base
to each req structures should be okay, but it involves lot of code
line changes in roce_hsi.h
and we will have to do this activity every time we copy a new req/resp
structure from the
auto generated file. I prefer to change these void * to struct
cmdq_base * and struct creq_base *,
if that is okay with you.
>
> Jason