diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-07-29 15:34:29 -0400 |
---|---|---|
committer | Roland Dreier <roland@purestorage.com> | 2013-07-30 13:09:16 -0400 |
commit | 63ea37495714849a5a7986244d9d656e0af14961 (patch) | |
tree | 47b6c6a9e64a02ee0c0ac5f8c0e084ebabd8b9ed /drivers/infiniband/hw/ocrdma | |
parent | 3606b99971b66b57a68c952619b43c12f90d2c70 (diff) |
RDMA/ocrdma: Fix several stack info leaks
A grab bag of places which don't properly initialize stack data. I
removed one place which cleared ".rsvd" because it's not needed now
that I have added a memset() earlier in the function.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers/infiniband/hw/ocrdma')
-rw-r--r-- | drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c index dcfbab177faa..f36630e4b6be 100644 --- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | |||
@@ -242,6 +242,7 @@ struct ib_ucontext *ocrdma_alloc_ucontext(struct ib_device *ibdev, | |||
242 | memset(ctx->ah_tbl.va, 0, map_len); | 242 | memset(ctx->ah_tbl.va, 0, map_len); |
243 | ctx->ah_tbl.len = map_len; | 243 | ctx->ah_tbl.len = map_len; |
244 | 244 | ||
245 | memset(&resp, 0, sizeof(resp)); | ||
245 | resp.ah_tbl_len = ctx->ah_tbl.len; | 246 | resp.ah_tbl_len = ctx->ah_tbl.len; |
246 | resp.ah_tbl_page = ctx->ah_tbl.pa; | 247 | resp.ah_tbl_page = ctx->ah_tbl.pa; |
247 | 248 | ||
@@ -253,7 +254,6 @@ struct ib_ucontext *ocrdma_alloc_ucontext(struct ib_device *ibdev, | |||
253 | resp.wqe_size = dev->attr.wqe_size; | 254 | resp.wqe_size = dev->attr.wqe_size; |
254 | resp.rqe_size = dev->attr.rqe_size; | 255 | resp.rqe_size = dev->attr.rqe_size; |
255 | resp.dpp_wqe_size = dev->attr.wqe_size; | 256 | resp.dpp_wqe_size = dev->attr.wqe_size; |
256 | resp.rsvd = 0; | ||
257 | 257 | ||
258 | memcpy(resp.fw_ver, dev->attr.fw_ver, sizeof(resp.fw_ver)); | 258 | memcpy(resp.fw_ver, dev->attr.fw_ver, sizeof(resp.fw_ver)); |
259 | status = ib_copy_to_udata(udata, &resp, sizeof(resp)); | 259 | status = ib_copy_to_udata(udata, &resp, sizeof(resp)); |
@@ -338,6 +338,7 @@ static int ocrdma_copy_pd_uresp(struct ocrdma_pd *pd, | |||
338 | struct ocrdma_alloc_pd_uresp rsp; | 338 | struct ocrdma_alloc_pd_uresp rsp; |
339 | struct ocrdma_ucontext *uctx = get_ocrdma_ucontext(ib_ctx); | 339 | struct ocrdma_ucontext *uctx = get_ocrdma_ucontext(ib_ctx); |
340 | 340 | ||
341 | memset(&rsp, 0, sizeof(rsp)); | ||
341 | rsp.id = pd->id; | 342 | rsp.id = pd->id; |
342 | rsp.dpp_enabled = pd->dpp_enabled; | 343 | rsp.dpp_enabled = pd->dpp_enabled; |
343 | db_page_addr = pd->dev->nic_info.unmapped_db + | 344 | db_page_addr = pd->dev->nic_info.unmapped_db + |
@@ -692,6 +693,7 @@ static int ocrdma_copy_cq_uresp(struct ocrdma_cq *cq, struct ib_udata *udata, | |||
692 | struct ocrdma_ucontext *uctx; | 693 | struct ocrdma_ucontext *uctx; |
693 | struct ocrdma_create_cq_uresp uresp; | 694 | struct ocrdma_create_cq_uresp uresp; |
694 | 695 | ||
696 | memset(&uresp, 0, sizeof(uresp)); | ||
695 | uresp.cq_id = cq->id; | 697 | uresp.cq_id = cq->id; |
696 | uresp.page_size = cq->len; | 698 | uresp.page_size = cq->len; |
697 | uresp.num_pages = 1; | 699 | uresp.num_pages = 1; |
@@ -1460,6 +1462,7 @@ static int ocrdma_copy_srq_uresp(struct ocrdma_srq *srq, struct ib_udata *udata) | |||
1460 | int status; | 1462 | int status; |
1461 | struct ocrdma_create_srq_uresp uresp; | 1463 | struct ocrdma_create_srq_uresp uresp; |
1462 | 1464 | ||
1465 | memset(&uresp, 0, sizeof(uresp)); | ||
1463 | uresp.rq_dbid = srq->rq.dbid; | 1466 | uresp.rq_dbid = srq->rq.dbid; |
1464 | uresp.num_rq_pages = 1; | 1467 | uresp.num_rq_pages = 1; |
1465 | uresp.rq_page_addr[0] = srq->rq.pa; | 1468 | uresp.rq_page_addr[0] = srq->rq.pa; |