diff options
| author | Dan Carpenter | 2013-07-25 20:04:36 +0300 |
|---|---|---|
| committer | Roland Dreier | 2013-07-31 14:12:08 -0700 |
| commit | 92b0ca7cb149d20bd97a2ad88d860745045a77dc (patch) | |
| tree | c1a9fe35174747307bff2938b2e7471fd3c5821d /drivers/infiniband | |
| parent | 281d1a9211986cfdccbefcd6128049a0a0d473b2 (diff) | |
IB/mlx5: Fix stack info leak in mlx5_ib_alloc_ucontext()
We don't set "resp.reserved". Since it's at the end of the struct
that means we don't have to copy it to the user.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Eli Cohen <eli@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/hw/mlx5/main.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index b1cbf338bcf6..3f831de9a4d8 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -619,7 +619,8 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev, resp.tot_uuars = req.total_num_uuars; resp.num_ports = dev->mdev.caps.num_ports; - err = ib_copy_to_udata(udata, &resp, sizeof(resp)); + err = ib_copy_to_udata(udata, &resp, + sizeof(resp) - sizeof(resp.reserved)); if (err) goto out_uars; |