diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-05-27 00:04:44 +0300 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2014-08-26 14:12:20 +0200 |
| commit | 5f55b99739d4a2b339aab0e4f3ef9091f0c86b15 (patch) | |
| tree | 8b5b63991c8fbc83d430aea43a0cbe5f1aaf449d /drivers/infiniband | |
| parent | 465a844d10e4f4ba2f6bf0a2f4833d65ea08097c (diff) | |
| download | lwn-5f55b99739d4a2b339aab0e4f3ef9091f0c86b15.tar.gz lwn-5f55b99739d4a2b339aab0e4f3ef9091f0c86b15.zip | |
RDMA/cxgb3: Fix information leak in send_abort()
commit e4514cbd972786af67dd6c442c072685387e22a2 upstream.
The cpl_abort_req struct has several reserved members which need to be
cleared to avoid disclosing kernel information. I have added a memset()
so now it matches the cxgb4 version of this function.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/hw/cxgb3/iwch_cm.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c index 095bb046e2c8..cb78b1e9bcd9 100644 --- a/drivers/infiniband/hw/cxgb3/iwch_cm.c +++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c @@ -418,6 +418,7 @@ static int send_abort(struct iwch_ep *ep, struct sk_buff *skb, gfp_t gfp) skb->priority = CPL_PRIORITY_DATA; set_arp_failure_handler(skb, abort_arp_failure); req = (struct cpl_abort_req *) skb_put(skb, sizeof(*req)); + memset(req, 0, sizeof(*req)); req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_HOST_ABORT_CON_REQ)); req->wr.wr_lo = htonl(V_WR_TID(ep->hwtid)); OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_ABORT_REQ, ep->hwtid)); |