Commit 74586c6d authored by Jason Gunthorpe's avatar Jason Gunthorpe Committed by Leon Romanovsky
Browse files

RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() 



struct irdma_create_ah_resp {  // 8 bytes, no padding
    __u32 ah_id;               // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx)
    __u8  rsvd[4];             // offset 4 - NEVER SET <- LEAK
};

rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata().

The reserved members of the structure were not zeroed.

Cc: stable@vger.kernel.org
Fixes: b48c24c2 ("RDMA/irdma: Implement device supported verb APIs")
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Link: https://patch.msgid.link/3-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com


Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
parent 117942ca

drivers/infiniband/hw/irdma/verbs.c

+1 −1
Original line number Diff line number Diff line
@@ -5212,7 +5212,7 @@ static int irdma_create_user_ah(struct ib_ah *ibah, 
#define IRDMA_CREATE_AH_MIN_RESP_LEN offsetofend(struct irdma_create_ah_resp, rsvd)

	struct irdma_ah *ah = container_of(ibah, struct irdma_ah, ibah);

	struct irdma_device *iwdev = to_iwdev(ibah->pd->device);

	struct irdma_create_ah_resp uresp;

	struct irdma_create_ah_resp uresp = {};

	struct irdma_ah *parent_ah;

	int err;