From: Haimin Zhang <tcs.kernel@xxxxxxxxx>
The ib_copy_ah_attr_to_user() function only initializes "resp.grh" if
the "resp.is_global" flag is set. Unfortunately, this data is copied to
the user and copying uninitialized stack data to the user is an
information leak. Zero out the whole "resp" struct to be safe.
As a clean up, zero out both "resp" and "qp_attr" in the initializers.
[ This patch has been highly edited from the original that Haimin Zhang
sent, so if there are any complaints please blame Dan Carpenter and
Leon Romanovsky ]
Fixes: 4ba66093bdc6 ("IB/core: Check for global flag when using ah_attr")
Reported-by: TCS Robot <tcs_robot@xxxxxxxxxxx>
Signed-off-by: Haimin Zhang <tcs.kernel@xxxxxxxxx>
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
---
v2: Style changes
drivers/infiniband/core/ucma.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 9d6ac9dff39a..4b90ee14b015 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1214,9 +1214,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
int in_len, int out_len)
{
struct rdma_ucm_init_qp_attr cmd;
- struct ib_uverbs_qp_attr resp;
+ struct ib_uverbs_qp_attr resp = {};
struct ucma_context *ctx;
- struct ib_qp_attr qp_attr;
+ struct ib_qp_attr qp_attr = {};
int ret;
if (out_len < sizeof(resp))
@@ -1232,8 +1232,6 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
if (IS_ERR(ctx))
return PTR_ERR(ctx);
- resp.qp_attr_mask = 0;
- memset(&qp_attr, 0, sizeof qp_attr);
qp_attr.qp_state = cmd.qp_state;
mutex_lock(&ctx->mutex);
ret = rdma_init_qp_attr(ctx->cm_id, &qp_attr, &resp.qp_attr_mask);
--
2.20.1
