Skip to content

Commit 74586c6

Browse files
jgunthorperleon
authored andcommitted
RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
struct irdma_create_ah_resp { // 8 bytes, no padding __u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx) __u8 rsvd[4]; // offset 4 - NEVER SET <- LEAK }; rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata(). The reserved members of the structure were not zeroed. Cc: stable@vger.kernel.org Fixes: b48c24c ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://patch.msgid.link/3-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
1 parent 117942c commit 74586c6

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

drivers/infiniband/hw/irdma/verbs.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5212,7 +5212,7 @@ static int irdma_create_user_ah(struct ib_ah *ibah,
52125212
#define IRDMA_CREATE_AH_MIN_RESP_LEN offsetofend(struct irdma_create_ah_resp, rsvd)
52135213
struct irdma_ah *ah = container_of(ibah, struct irdma_ah, ibah);
52145214
struct irdma_device *iwdev = to_iwdev(ibah->pd->device);
5215-
struct irdma_create_ah_resp uresp;
5215+
struct irdma_create_ah_resp uresp = {};
52165216
struct irdma_ah *parent_ah;
52175217
int err;
52185218

0 commit comments

Comments
 (0)