Messages in this thread |  | | Date | Sun, 12 Apr 2026 15:50:05 +0300 | | From | Leon Romanovsky <> | | Subject | Re: [PATCH] RDMA/hns: fix out-of-bounds write in IRQ array during configuration |
| |
On Sun, Apr 05, 2026 at 04:15:44PM +0800, Junrui Luo wrote: > hns_roce_hw_v2_get_cfg() writes IRQ vector numbers into hr_dev->irq[] > using handle->rinfo.num_vectors as the loop bound. num_vectors originates > from firmware via hclge_query_pf_resource() without validation against > the array size. > > If firmware reports more than 128 MSI-X vectors for RoCE, the loop > overflows hr_dev->irq[], corrupting adjacent struct members in the > heap-allocated hns_roce_dev structure.
Is this an actual issue, or just another imagined problem?
Thanks
|  |