Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 60429630 authored by Dan Carpenter's avatar Dan Carpenter Committed by Roland Dreier
Browse files

RDMA/nes: Fix info leaks in nes_create_qp() and nes_create_cq() 



We pass a few bytes of uninitialized stack memory to the user here.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent 3b2f64d0

drivers/infiniband/hw/nes/nes_verbs.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -1384,6 +1384,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd, 




			if (ibpd->uobject) {

			if (ibpd->uobject) {

				uresp.mmap_sq_db_index = nesqp->mmap_sq_db_index;

				uresp.mmap_sq_db_index = nesqp->mmap_sq_db_index;

				uresp.mmap_rq_db_index = 0;

				uresp.actual_sq_size = sq_size;

				uresp.actual_sq_size = sq_size;

				uresp.actual_rq_size = rq_size;

				uresp.actual_rq_size = rq_size;

				uresp.qp_id = nesqp->hwqp.qp_id;

				uresp.qp_id = nesqp->hwqp.qp_id;
@@ -1767,7 +1768,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries, 
		resp.cq_id = nescq->hw_cq.cq_number;

		resp.cq_id = nescq->hw_cq.cq_number;

		resp.cq_size = nescq->hw_cq.cq_size;

		resp.cq_size = nescq->hw_cq.cq_size;

		resp.mmap_db_index = 0;

		resp.mmap_db_index = 0;

		if (ib_copy_to_udata(udata, &resp, sizeof resp)) {

		if (ib_copy_to_udata(udata, &resp, sizeof resp - sizeof resp.reserved)) {

			nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);

			nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);

			kfree(nescq);

			kfree(nescq);

			return ERR_PTR(-EFAULT);

			return ERR_PTR(-EFAULT);