diff options
| author |   Adit Ranadive <aditr@vmware.com> | 2018-02-15 12:36:46 -0800 |
|---|---|---|
| committer |   Jason Gunthorpe <jgg@mellanox.com> | 2018-02-15 15:31:28 -0700 |
| commit | 1f5a6c47aabc4606f91ad2e6ef71a1ff1924101c (patch) | |
| tree | 32702e16752acbfb40b5cc00df09c1685039cece /drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | |
| parent | RDMA/uverbs: Sanitize user entered port numbers prior to access it (diff) | |
| download | linux-dev-1f5a6c47aabc4606f91ad2e6ef71a1ff1924101c.tar.xz linux-dev-1f5a6c47aabc4606f91ad2e6ef71a1ff1924101c.zip | |
RDMA/vmw_pvrdma: Fix usage of user response structures in ABI file
This ensures that we return the right structures back to userspace.
Otherwise, it looks like the reserved fields in the response structures
in userspace might have uninitialized data in them.
Fixes: 8b10ba783c9d ("RDMA/vmw_pvrdma: Add shared receive queue support")
Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
Suggested-by: Jason Gunthorpe <jgg@mellanox.com>
Reviewed-by: Bryan Tan <bryantan@vmware.com>
Reviewed-by: Aditya Sarwade <asarwade@vmware.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: Adit Ranadive <aditr@vmware.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c')
| -rw-r--r-- | drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c index 16b96616ef7e..a51463cd2f37 100644 --- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c @@ -447,6 +447,7 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev, union pvrdma_cmd_resp rsp; struct pvrdma_cmd_create_pd *cmd = &req.create_pd; struct pvrdma_cmd_create_pd_resp *resp = &rsp.create_pd_resp; + struct pvrdma_alloc_pd_resp pd_resp = {0}; int ret; void *ptr; @@ -475,9 +476,10 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev, pd->privileged = !context; pd->pd_handle = resp->pd_handle; pd->pdn = resp->pd_handle; + pd_resp.pdn = resp->pd_handle; if (context) { - if (ib_copy_to_udata(udata, &pd->pdn, sizeof(__u32))) { + if (ib_copy_to_udata(udata, &pd_resp, sizeof(pd_resp))) { dev_warn(&dev->pdev->dev, "failed to copy back protection domain\n"); pvrdma_dealloc_pd(&pd->ibpd); |