Re: [PATCH] RDMA/mlx5: Restore flow_attr-first layout in leftovers flow rules

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] rdma: embedding struct with flexible array member not at end
--

commit 8e283bb18af02522e075bf4c88abcbec6ff60c4a
Author: Li RongQing <lirongqing@baidu.com>
RDMA/mlx5: Restore flow_attr-first layout in leftovers flow rules

This commit restores the original ordering of members in the leftovers
flow rule structs to fix an out-of-bounds read during flow rule creation.
By moving flow_attr to the front, the layout matches the offset calculations
expected by the flow creation code.

> diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c
> index b155baee0017c..e27826c3087bf 100644
> --- a/drivers/infiniband/hw/mlx5/fs.c
> +++ b/drivers/infiniband/hw/mlx5/fs.c
> @@ -1651,8 +1651,8 @@ static struct mlx5_ib_flow_handler *create_leftovers_rule(struct mlx5_ib_dev *de
>  	struct mlx5_ib_flow_handler *handler = NULL;
>  
>  	static struct {
> -		struct ib_flow_spec_eth eth_flow;
>  		struct ib_flow_attr	flow_attr;
> +		struct ib_flow_spec_eth eth_flow;

[Severity: Low]
Does embedding struct ib_flow_attr at the beginning of this anonymous
structure violate the C standard for flexible array members?

Looking at struct ib_flow_attr, it contains a C99 flexible array member
union ib_flow_spec flows[] at the end. The C standard specifies that a
structure containing a flexible array member should not be embedded within
another structure, particularly as a non-last member.

While this ordering fixes the runtime offset calculation expected by
create_flow_rule(), does placing it before eth_flow trigger modern compiler
warnings like -Wflex-array-member-not-at-end?

>  	} leftovers_wc = { .flow_attr = { .num_of_specs = 1,
>  					  .size = sizeof(leftovers_wc) },
>  			   .eth_flow = {
> @@ -1662,8 +1662,8 @@ static struct mlx5_ib_flow_handler *create_leftovers_rule(struct mlx5_ib_dev *de
>  				   .val = { .dst_mac = { 0x1 } } } };
>  
>  	static struct {
> -		struct ib_flow_spec_eth eth_flow;
>  		struct ib_flow_attr	flow_attr;
> +		struct ib_flow_spec_eth eth_flow;

[Severity: Low]
Similarly, does this second anonymous struct declaration also embed
struct ib_flow_attr and its flexible array member improperly?

>  	} leftovers_uc = { .flow_attr = { .num_of_specs = 1,
>  					  .size = sizeof(leftovers_uc) },
>  			   .eth_flow = {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917111722.1723-1-lirongqing@baidu.com?part=1