diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-07-25 13:04:36 -0400 |
---|---|---|
committer | Roland Dreier <roland@purestorage.com> | 2013-07-31 17:12:08 -0400 |
commit | 92b0ca7cb149d20bd97a2ad88d860745045a77dc (patch) | |
tree | c1a9fe35174747307bff2938b2e7471fd3c5821d /drivers/infiniband | |
parent | 281d1a9211986cfdccbefcd6128049a0a0d473b2 (diff) |
IB/mlx5: Fix stack info leak in mlx5_ib_alloc_ucontext()
We don't set "resp.reserved". Since it's at the end of the struct
that means we don't have to copy it to the user.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Eli Cohen <eli@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers/infiniband')
-rw-r--r-- | drivers/infiniband/hw/mlx5/main.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index b1cbf338bcf6..3f831de9a4d8 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c | |||
@@ -619,7 +619,8 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev, | |||
619 | 619 | ||
620 | resp.tot_uuars = req.total_num_uuars; | 620 | resp.tot_uuars = req.total_num_uuars; |
621 | resp.num_ports = dev->mdev.caps.num_ports; | 621 | resp.num_ports = dev->mdev.caps.num_ports; |
622 | err = ib_copy_to_udata(udata, &resp, sizeof(resp)); | 622 | err = ib_copy_to_udata(udata, &resp, |
623 | sizeof(resp) - sizeof(resp.reserved)); | ||
623 | if (err) | 624 | if (err) |
624 | goto out_uars; | 625 | goto out_uars; |
625 | 626 | ||