Re: [PATCH libmlx5 3/6] fix buffer overrun copying inline header

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, Jul 27, 2016 at 03:17:24PM -0400, Jarod Wilson wrote:
> At present, the size of eseg->inline_hdr_start is 16 bits, while
> MLX5_ETH_L2_INLINE_HEADER_SIZE is 18, so there are attempts made to copy
> 18 bits into 16 bits of storage. The mlx5_dbg() statement in
> copy_eth_inline_header() suggests that perhaps
> MLX5_ETH_L2_INLINE_HEADER_SIZE should be only 16, not 18. So either that
> needs to be changed, or the inline_hdr_start array needs to be bumped up
> to 3 bytes instead of 2.

Ugh. Now I see what's going on. The copy is actually designed to copy 18
_bytes_, not bits, into inline_hdr_start[2] and inline_hdr[16]. Is there a
particular reason those two aren't just a single array?

-- 
Jarod Wilson
jarod@xxxxxxxxxx

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Photo]     [Yosemite News]     [Yosemite Photos]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux