[PATCH] RDMA/mlx5: Restore flow_attr-first layout in leftovers flow rules

[lirongqing <lirongqing@baidu.com>]

From: Li RongQing <lirongqing@baidu.com>

Commit e91fb8b9d0ed ("RDMA/mlx5: Avoid flexible array warning") split
the leftovers_specs[] array into two separate structs to silence the
"array of flexible structures" sparse warning, but in doing so
reversed the member order: eth_flow was placed before flow_attr.

_create_flow_rule() locates the flow specs with:

    ib_flow = (void *)flow_attr + sizeof(*flow_attr);

which expects the spec data to immediately follow the ib_flow_attr.
With the reversed order, flow_attr is the last member, so ib_flow
points past the end of the struct and the num_of_specs = 1 loop reads
out-of-bounds memory (whatever static data follows in the .data
section), producing incorrect flow rules or a crash.

Restore flow_attr as the first member so the eth_flow spec again sits
at the offset _create_flow_rule() expects.  The two structs are no
longer arrays, so the "array of flexible structures" warning does not
re-occur.

Fixes: e91fb8b9d0ed ("RDMA/mlx5: Avoid flexible array warning")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/infiniband/hw/mlx5/fs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c
index 98cdc5c..034ab55 100644
--- a/drivers/infiniband/hw/mlx5/fs.c
+++ b/drivers/infiniband/hw/mlx5/fs.c
@@ -1651,8 +1651,8 @@ static struct mlx5_ib_flow_handler *create_leftovers_rule(struct mlx5_ib_dev *de
 	struct mlx5_ib_flow_handler *handler = NULL;
 
 	static struct {
-		struct ib_flow_spec_eth eth_flow;
 		struct ib_flow_attr	flow_attr;
+		struct ib_flow_spec_eth eth_flow;
 	} leftovers_wc = { .flow_attr = { .num_of_specs = 1,
 					  .size = sizeof(leftovers_wc) },
 			   .eth_flow = {
@@ -1662,8 +1662,8 @@ static struct mlx5_ib_flow_handler *create_leftovers_rule(struct mlx5_ib_dev *de
 				   .val = { .dst_mac = { 0x1 } } } };
 
 	static struct {
-		struct ib_flow_spec_eth eth_flow;
 		struct ib_flow_attr	flow_attr;
+		struct ib_flow_spec_eth eth_flow;
 	} leftovers_uc = { .flow_attr = { .num_of_specs = 1,
 					  .size = sizeof(leftovers_uc) },
 			   .eth_flow = {
-- 
2.9.4