aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/infiniband
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2013-07-29 15:34:29 -0400
committerRoland Dreier <roland@purestorage.com>2013-07-30 13:09:16 -0400
commit63ea37495714849a5a7986244d9d656e0af14961 (patch)
tree47b6c6a9e64a02ee0c0ac5f8c0e084ebabd8b9ed /drivers/infiniband
parent3606b99971b66b57a68c952619b43c12f90d2c70 (diff)
RDMA/ocrdma: Fix several stack info leaks
A grab bag of places which don't properly initialize stack data. I removed one place which cleared ".rsvd" because it's not needed now that I have added a memset() earlier in the function. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers/infiniband')
-rw-r--r--drivers/infiniband/hw/ocrdma/ocrdma_verbs.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index dcfbab177faa..f36630e4b6be 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -242,6 +242,7 @@ struct ib_ucontext *ocrdma_alloc_ucontext(struct ib_device *ibdev,
242 memset(ctx->ah_tbl.va, 0, map_len); 242 memset(ctx->ah_tbl.va, 0, map_len);
243 ctx->ah_tbl.len = map_len; 243 ctx->ah_tbl.len = map_len;
244 244
245 memset(&resp, 0, sizeof(resp));
245 resp.ah_tbl_len = ctx->ah_tbl.len; 246 resp.ah_tbl_len = ctx->ah_tbl.len;
246 resp.ah_tbl_page = ctx->ah_tbl.pa; 247 resp.ah_tbl_page = ctx->ah_tbl.pa;
247 248
@@ -253,7 +254,6 @@ struct ib_ucontext *ocrdma_alloc_ucontext(struct ib_device *ibdev,
253 resp.wqe_size = dev->attr.wqe_size; 254 resp.wqe_size = dev->attr.wqe_size;
254 resp.rqe_size = dev->attr.rqe_size; 255 resp.rqe_size = dev->attr.rqe_size;
255 resp.dpp_wqe_size = dev->attr.wqe_size; 256 resp.dpp_wqe_size = dev->attr.wqe_size;
256 resp.rsvd = 0;
257 257
258 memcpy(resp.fw_ver, dev->attr.fw_ver, sizeof(resp.fw_ver)); 258 memcpy(resp.fw_ver, dev->attr.fw_ver, sizeof(resp.fw_ver));
259 status = ib_copy_to_udata(udata, &resp, sizeof(resp)); 259 status = ib_copy_to_udata(udata, &resp, sizeof(resp));
@@ -338,6 +338,7 @@ static int ocrdma_copy_pd_uresp(struct ocrdma_pd *pd,
338 struct ocrdma_alloc_pd_uresp rsp; 338 struct ocrdma_alloc_pd_uresp rsp;
339 struct ocrdma_ucontext *uctx = get_ocrdma_ucontext(ib_ctx); 339 struct ocrdma_ucontext *uctx = get_ocrdma_ucontext(ib_ctx);
340 340
341 memset(&rsp, 0, sizeof(rsp));
341 rsp.id = pd->id; 342 rsp.id = pd->id;
342 rsp.dpp_enabled = pd->dpp_enabled; 343 rsp.dpp_enabled = pd->dpp_enabled;
343 db_page_addr = pd->dev->nic_info.unmapped_db + 344 db_page_addr = pd->dev->nic_info.unmapped_db +
@@ -692,6 +693,7 @@ static int ocrdma_copy_cq_uresp(struct ocrdma_cq *cq, struct ib_udata *udata,
692 struct ocrdma_ucontext *uctx; 693 struct ocrdma_ucontext *uctx;
693 struct ocrdma_create_cq_uresp uresp; 694 struct ocrdma_create_cq_uresp uresp;
694 695
696 memset(&uresp, 0, sizeof(uresp));
695 uresp.cq_id = cq->id; 697 uresp.cq_id = cq->id;
696 uresp.page_size = cq->len; 698 uresp.page_size = cq->len;
697 uresp.num_pages = 1; 699 uresp.num_pages = 1;
@@ -1460,6 +1462,7 @@ static int ocrdma_copy_srq_uresp(struct ocrdma_srq *srq, struct ib_udata *udata)
1460 int status; 1462 int status;
1461 struct ocrdma_create_srq_uresp uresp; 1463 struct ocrdma_create_srq_uresp uresp;
1462 1464
1465 memset(&uresp, 0, sizeof(uresp));
1463 uresp.rq_dbid = srq->rq.dbid; 1466 uresp.rq_dbid = srq->rq.dbid;
1464 uresp.num_rq_pages = 1; 1467 uresp.num_rq_pages = 1;
1465 uresp.rq_page_addr[0] = srq->rq.pa; 1468 uresp.rq_page_addr[0] = srq->rq.pa;