RE: [PATCH] infiniband: core: fix information leak to userland

[Hefty, Sean]

> diff --git a/drivers/infiniband/core/ucm.c
> b/drivers/infiniband/core/ucm.c
> index 08f948d..f7256f3 100644
> --- a/drivers/infiniband/core/ucm.c
> +++ b/drivers/infiniband/core/ucm.c
> @@ -629,6 +629,7 @@ static ssize_t ib_ucm_init_qp_attr(struct ib_ucm_file
> *file,
>         if (result)
>                 goto out;
> 
> +       resp.qp_state = 0;
>         ib_copy_qp_attr_to_user(&resp, &qp_attr);

I believe we want ib_copy_qp_attr_to_user() to assign	resp->qp_state = qp_attr->qp_state

> diff --git a/drivers/infiniband/core/ucma.c
> b/drivers/infiniband/core/ucma.c
> index ca12acf..07fd247 100644
> --- a/drivers/infiniband/core/ucma.c
> +++ b/drivers/infiniband/core/ucma.c
> @@ -842,6 +842,7 @@ static ssize_t ucma_init_qp_attr(struct ucma_file
> *file,
>         if (ret)
>                 goto out;
> 
> +       resp.qp_state = 0;
>         ib_copy_qp_attr_to_user(&resp, &qp_attr);
>         if (copy_to_user((void __user *)(unsigned long)cmd.response,
>                          &resp, sizeof(resp)))
> diff --git a/drivers/infiniband/core/uverbs_marshall.c
> b/drivers/infiniband/core/uverbs_marshall.c
> index 5440da0..cceaf33 100644
> --- a/drivers/infiniband/core/uverbs_marshall.c
> +++ b/drivers/infiniband/core/uverbs_marshall.c
> @@ -35,6 +35,7 @@
>  void ib_copy_ah_attr_to_user(struct ib_uverbs_ah_attr *dst, struct
> ib_ah_attr *src)
>  {
> +       memset(&dst->grh, 0, sizeof(dst->grh));

We only need to set dst->grh.reserved = 0.  The other fields are assigned. 

- Sean
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/