Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e4514cbd authored by Dan Carpenter's avatar Dan Carpenter Committed by Roland Dreier
Browse files

RDMA/cxgb3: Fix information leak in send_abort() 



The cpl_abort_req struct has several reserved members which need to be
cleared to avoid disclosing kernel information.  I have added a memset()
so now it matches the cxgb4 version of this function.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarSteve Wise <swise@opengridcomputing.com>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent d6d211db

drivers/infiniband/hw/cxgb3/iwch_cm.c

+1 −0
Original line number Diff line number Diff line
@@ -418,6 +418,7 @@ static int send_abort(struct iwch_ep *ep, struct sk_buff *skb, gfp_t gfp) 
	skb->priority = CPL_PRIORITY_DATA;

	set_arp_failure_handler(skb, abort_arp_failure);

	req = (struct cpl_abort_req *) skb_put(skb, sizeof(*req));

	memset(req, 0, sizeof(*req));

	req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_HOST_ABORT_CON_REQ));

	req->wr.wr_lo = htonl(V_WR_TID(ep->hwtid));

	OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_ABORT_REQ, ep->hwtid));