lkml.org 
[lkml]   [2026]   [Apr]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] RDMA/hns: fix out-of-bounds write in IRQ array during configuration
On Sun, Apr 05, 2026 at 04:15:44PM +0800, Junrui Luo wrote:
> hns_roce_hw_v2_get_cfg() writes IRQ vector numbers into hr_dev->irq[]
> using handle->rinfo.num_vectors as the loop bound. num_vectors originates
> from firmware via hclge_query_pf_resource() without validation against
> the array size.
>
> If firmware reports more than 128 MSI-X vectors for RoCE, the loop
> overflows hr_dev->irq[], corrupting adjacent struct members in the
> heap-allocated hns_roce_dev structure.

Is this an actual issue, or just another imagined problem?

Thanks

\
 
 \ /
  Last update: 2026-04-12 14:51    [W:0.066 / U:1.859 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog