Re: [PATCH v4 fwctl 0/3] fwctl/bnxt: DMA buffer support for HWRM commands

[Pavan Chebbi]

> And this one raises my eyebrows considering what we talked about before:
>
>  How is dd.bufs[i].len ensured to match the actual transfer size expected
>  by the firmware?
>  If a small dd.bufs[i].len is provided while the HWRM command payload
>  specifies a larger transfer size, could the firmware write past the end
>  of the mapped bounce buffer into adjacent physical memory?
>
> Seems like it needs a comment if it is actually safe somehow, but I
> don't see how it is safe and it seems like Sashiko has hit on a
> critical flaw.

Thanks for the review.
Yes, a valid concern. I may need to do an additional length validation
for dd.bufs[i] based on what is specified inside the cmd payload.
I will be back with v5.

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature