kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/infiniband
History
Jason Gunthorpe a6f3e0fa8e RDMA/ionic: Fix kernel stack leak in ionic_create_cq() 
commit faa72102b1 upstream.

struct ionic_cq_resp resp {
    __u32 cqid[2];         // offset 0 - PARTIALLY SET (see below)
    __u8  udma_mask;       // offset 8 - SET (resp.udma_mask = vcq->udma_mask)
    __u8  rsvd[7];         // offset 9 - NEVER SET <- LEAK
};

rsvd[7]: 7 bytes of stack memory leaked unconditionally.

cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices
where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but
udma_count could be 1, meaning cqid[1] might never be written via
ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4
bytes) is also leaked. So potentially 11 bytes leaked.

Cc: stable@vger.kernel.org
Fixes: e8521822c7 ("RDMA/ionic: Register device ops for control path")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://patch.msgid.link/4-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com
Acked-by: Abhijit Gangurde <abhijit.gangurde@amd.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-03-12 07:09:40 -04:00
..
core RDMA/umem: Fix double dma_buf_unpin in failure path 2026-03-04 07:20:50 -05:00
hw RDMA/ionic: Fix kernel stack leak in ionic_create_cq() 2026-03-12 07:09:40 -04:00
sw RDMA/rxe: Fix race condition in QP timer handlers 2026-02-26 14:59:26 -08:00
ulp RDMA/rtrs-clt: For conn rejection use actual err number 2026-03-04 07:20:27 -05:00
Kconfig RDMA/ionic: Add Makefile/Kconfig to kernel build environment 2025-09-11 02:18:36 -04:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00