Re: [PATCH 1/3] RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access

On Thu, Mar 01, 2018 at 04:23:15PM -0600, Steve Wise wrote:

...

I don't get it..

Since when did ib_post_send() start requiring a ib_rdma_wr?

IB_WR_RDMA_WRITE == 0, so even missing that is 'OK' but ugly.

What is the actual bug here?

The WRs are now split up, so struct ib_send_wr doesn't encompass the full size of all the possible WRs. See ib_rdma_wr, for example, which includes ib_send_wr. So the bug is the drain code is posting a WRITE wr, but not including the entire struct ib_rdma_wr.

Oh.. yes, I forgot about that patch. Thanks, OK.

Jason