On Sun, Jul 01, 2018 at 03:31:54PM +0300, Leon Romanovsky wrote:
> From: Leon Romanovsky <leonro@xxxxxxxxxxxx>
>
> The conversion from offsetof() calculations to sizeof()
> wrongly behaved for missed exact size and in scenario with
> more than one flow.
>
> In such scenario we got "create flow failed, flow 10: 8 bytes
> left from uverb cmd" error, which is wrong because the size of
> kern_spec is exactly 8 bytes, and we were not supposed to fail.
>
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.12
> Fixes: 4fae7f170416 ("RDMA/uverbs: Fix slab-out-of-bounds in ib_uverbs_ex_create_flow")
> Reported-by: Ran Rozenstein <ranro@xxxxxxxxxxxx>
> Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxxxx>
> ---
> drivers/infiniband/core/uverbs_cmd.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Applied to for-rc, thanks
Jason
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
