Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 246fcdbc authored by Dan Carpenter's avatar Dan Carpenter Committed by Roland Dreier
Browse files

RDMA/cxgb3: Fix stack info leak in iwch_create_cq() 



The "uresp.reserved" field isn't initialized on this path so it could
leak uninitialized stack information to the user.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarSteve Wise <swise@opengridcomputing.com>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent 3b2f64d0

drivers/infiniband/hw/cxgb3/iwch_provider.c

+1 −0
Original line number Diff line number Diff line
@@ -226,6 +226,7 @@ static struct ib_cq *iwch_create_cq(struct ib_device *ibdev, int entries, int ve 
			mm->len = PAGE_ALIGN(((1UL << uresp.size_log2) + 1) *

					     sizeof(struct t3_cqe));

			uresp.memsize = mm->len;

			uresp.reserved = 0;

			resplen = sizeof uresp;

		}

		if (ib_copy_to_udata(udata, &uresp, resplen)) {