Skip to content

Commit

Permalink
IB/mlx5: Fix stack info leak in mlx5_ib_alloc_ucontext()
Browse files Browse the repository at this point in the history
We don't set "resp.reserved".  Since it's at the end of the struct
that means we don't have to copy it to the user.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Eli Cohen <eli@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
  • Loading branch information
Dan Carpenter authored and Roland Dreier committed Jul 31, 2013
1 parent 281d1a9 commit 92b0ca7
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/infiniband/hw/mlx5/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -619,7 +619,8 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,

resp.tot_uuars = req.total_num_uuars;
resp.num_ports = dev->mdev.caps.num_ports;
err = ib_copy_to_udata(udata, &resp, sizeof(resp));
err = ib_copy_to_udata(udata, &resp,
sizeof(resp) - sizeof(resp.reserved));
if (err)
goto out_uars;

Expand Down

0 comments on commit 92b0ca7

Please sign in to comment.