Skip to contentSkip to conversation

RDMA/cxgb3: information leak in send_abort()

PATCH In review Dan Carpenter 2 participants 2 messages May 26, 2014 – May 27, 2014

Subsystems (2)
Kernel janitors InfiniBand
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 RDMA/cxgb3: information leak in send_abort()

The cpl_abort_req struct has several reserved members which need to be cleared to avoid disclosing kernel information. I have added a memset() so now it matches the cxgb4 version of this function.

Signed-off-by Dan Carpenter <[email protected]>
drivers/infiniband/hw/cxgb3/iwch_cm.c +1 -0
index 095bb04..cb78b1e 100644
@@ -418,6 +418,7 @@ static int send_abort(struct iwch_ep *ep, struct sk_buff *skb, gfp_t gfp)
 	skb->priority = CPL_PRIORITY_DATA;
 	set_arp_failure_handler(skb, abort_arp_failure);
 	req = (struct cpl_abort_req *) skb_put(skb, sizeof(*req));
+	memset(req, 0, sizeof(*req));
 	req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_HOST_ABORT_CON_REQ));
 	req->wr.wr_lo = htonl(V_WR_TID(ep->hwtid));
 	OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_ABORT_REQ, ep->hwtid));