diff mbox

[libmlx5,3/6] fix buffer overrun copying inline header

Message ID 1469647047-7544-4-git-send-email-jarod@redhat.com (mailing list archive)
State Not Applicable
Headers show

Commit Message

Jarod Wilson July 27, 2016, 7:17 p.m. UTC
At present, the size of eseg->inline_hdr_start is 16 bits, while
MLX5_ETH_L2_INLINE_HEADER_SIZE is 18, so there are attempts made to copy
18 bits into 16 bits of storage. The mlx5_dbg() statement in
copy_eth_inline_header() suggests that perhaps
MLX5_ETH_L2_INLINE_HEADER_SIZE should be only 16, not 18. So either that
needs to be changed, or the inline_hdr_start array needs to be bumped up
to 3 bytes instead of 2.

CC: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Jarod Wilson <jarod@redhat.com>
---
 src/wqe.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Jarod Wilson July 27, 2016, 9:26 p.m. UTC | #1
On Wed, Jul 27, 2016 at 03:17:24PM -0400, Jarod Wilson wrote:
> At present, the size of eseg->inline_hdr_start is 16 bits, while
> MLX5_ETH_L2_INLINE_HEADER_SIZE is 18, so there are attempts made to copy
> 18 bits into 16 bits of storage. The mlx5_dbg() statement in
> copy_eth_inline_header() suggests that perhaps
> MLX5_ETH_L2_INLINE_HEADER_SIZE should be only 16, not 18. So either that
> needs to be changed, or the inline_hdr_start array needs to be bumped up
> to 3 bytes instead of 2.

Ugh. Now I see what's going on. The copy is actually designed to copy 18
_bytes_, not bits, into inline_hdr_start[2] and inline_hdr[16]. Is there a
particular reason those two aren't just a single array?
Jarod Wilson July 28, 2016, 1:29 a.m. UTC | #2
On Wed, Jul 27, 2016 at 05:26:10PM -0400, Jarod Wilson wrote:
> On Wed, Jul 27, 2016 at 03:17:24PM -0400, Jarod Wilson wrote:
> > At present, the size of eseg->inline_hdr_start is 16 bits, while
> > MLX5_ETH_L2_INLINE_HEADER_SIZE is 18, so there are attempts made to copy
> > 18 bits into 16 bits of storage. The mlx5_dbg() statement in
> > copy_eth_inline_header() suggests that perhaps
> > MLX5_ETH_L2_INLINE_HEADER_SIZE should be only 16, not 18. So either that
> > needs to be changed, or the inline_hdr_start array needs to be bumped up
> > to 3 bytes instead of 2.
> 
> Ugh. Now I see what's going on. The copy is actually designed to copy 18
> _bytes_, not bits, into inline_hdr_start[2] and inline_hdr[16]. Is there a
> particular reason those two aren't just a single array?

Drop this one. I've got a new patch together that just merges the two.
I've looked over the code, and can't see anything that actually uses
inline_hdr separate from inline_hdr_start.
diff mbox

Patch

diff --git a/src/wqe.h b/src/wqe.h
index c2622d5..c0e176d 100644
--- a/src/wqe.h
+++ b/src/wqe.h
@@ -77,7 +77,7 @@  struct mlx5_eqe_qp_srq {
 };
 
 enum {
-	MLX5_ETH_L2_INLINE_HEADER_SIZE	= 18,
+	MLX5_ETH_L2_INLINE_HEADER_SIZE	= 16,
 };
 
 enum {