All of
 help / color / mirror / Atom feed
* [PATCH v2] RDMA/ucma: RDMA/ucma: fix a kernel-infoleak in ucma_init_qp_attr()
@ 2022-02-04 10:00 Dan Carpenter
  2022-02-04 23:55 ` Jason Gunthorpe
  0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2022-02-04 10:00 UTC (permalink / raw)
  To: Jason Gunthorpe, Haimin Zhang
  Cc: Wenpeng Liang, Leon Romanovsky, Weihang Li, YueHaibing,
	Xiaofei Tan, Dasaratharaman Chandramouli, Doug Ledford,
	Sean Hefty, Don Hiatt, Ira Weiny, linux-rdma, security, Greg KH

From: Haimin Zhang <>

The ib_copy_ah_attr_to_user() function only initializes "resp.grh" if
the "resp.is_global" flag is set.  Unfortunately, this data is copied to
the user and copying uninitialized stack data to the user is an
information leak.  Zero out the whole "resp" struct to be safe.

As a clean up, zero out both "resp" and "qp_attr" in the initializers.

[ This patch has been highly edited from the original that Haimin Zhang
  sent, so if there are any complaints please blame Dan Carpenter and
  Leon Romanovsky ]

Fixes: 4ba66093bdc6 ("IB/core: Check for global flag when using ah_attr")
Reported-by: TCS Robot <>
Signed-off-by: Haimin Zhang <>
Signed-off-by: Dan Carpenter <>
v2: Style changes

 drivers/infiniband/core/ucma.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 9d6ac9dff39a..4b90ee14b015 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1214,9 +1214,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
 				 int in_len, int out_len)
 	struct rdma_ucm_init_qp_attr cmd;
-	struct ib_uverbs_qp_attr resp;
+	struct ib_uverbs_qp_attr resp = {};
 	struct ucma_context *ctx;
-	struct ib_qp_attr qp_attr;
+	struct ib_qp_attr qp_attr = {};
 	int ret;
 	if (out_len < sizeof(resp))
@@ -1232,8 +1232,6 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
-	resp.qp_attr_mask = 0;
-	memset(&qp_attr, 0, sizeof qp_attr);
 	qp_attr.qp_state = cmd.qp_state;
 	ret = rdma_init_qp_attr(ctx->cm_id, &qp_attr, &resp.qp_attr_mask);

^ permalink raw reply related	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2022-02-05  9:13 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-04 10:00 [PATCH v2] RDMA/ucma: RDMA/ucma: fix a kernel-infoleak in ucma_init_qp_attr() Dan Carpenter
2022-02-04 23:55 ` Jason Gunthorpe
2022-02-05  9:11   ` Dan Carpenter

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.