IB: vmw_pvrdma: info leak in pvrdma_alloc_ucontext()
Subsystems (3)
PATCH 1/1 IB: vmw_pvrdma: info leak in pvrdma_alloc_ucontext()
We need to clear out the ->reserved member so we don't disclose uninitialized stack information.
---
There are a bunch of ways to fix this... I just the most mindless one because I can never guess what IB prefers. Feel free to fix it however you feel is appropriate and give me a Reported-by tag.
drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +1 -0
@@ -339,6 +339,7 @@ struct ib_ucontext *pvrdma_alloc_ucontext(struct ib_device *ibdev, context->ctx_handle = resp->ctx_handle;/* copy back to user */ +memset (&uresp,0 ,sizeof (uresp)); uresp.qp_tab_size = vdev->dsr->caps.max_qp; ret =ib_copy_to_udata (udata, &uresp,sizeof (uresp));if (ret) {
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 16 lines · Dan Carpenter
We need to clear out the ->reserved member so we don't disclose uninitialized stack information.
Fixes 29c8d9eba550 ("IB: Add vmw_pvrdma driver")Signed-off-by Dan Carpenter <[email protected]>---
There are a bunch of ways to fix this... I just the most mindless one because I can never guess what IB prefers. Feel free to fix it however you feel is appropriate and give me a Reported-by tag.drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +0
-0
drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c struct ib_ucontext *pvrdma_alloc_ucontext(struct ib_device *ibdev, · line 345
Quoted 7 lines
drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +1
-0@@ -339,6 +339,7 @@ struct ib_ucontext *pvrdma_alloc_ucontext(struct ib_device *ibdev, context->ctx_handle = resp->ctx_handle;/* copy back to user */ +memset (&uresp,0 ,sizeof (uresp)); uresp.qp_tab_size = vdev->dsr->caps.max_qp; ret =ib_copy_to_udata (udata, &uresp,sizeof (uresp));if (ret) {
Thanks Dan! I'll add this to the other fixes to be sent out.
- Adit