[PATCH for-next] RDMA/uverbs: Zero the QP attrs in ib_uverbs_query_qp

[PATCH for-next] RDMA/uverbs: Zero the QP attrs in ib_uverbs_query_qp

[Selvin Xavier]

ib_uverbs_query_qp() allocates qp_attr and qp_init_attr without zeroing
and copies fields such as alt_ah_attr, path_mig_state and sq_draining
to userspace. Drivers are not required to set every field in their
query_qp() callback, so uninitialized kernel heap memory can leak.

Allocate both structures zeroed.

Fixes: 7ccc9a24e012 ("IB/uverbs: Support for query QP from userspace")
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
---
 drivers/infiniband/core/uverbs_cmd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index aca7c6ab55cd..54da98431f40 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1668,8 +1668,8 @@ static int ib_uverbs_query_qp(struct uverbs_attr_bundle *attrs)
 	if (ret)
 		return ret;
 
-	attr = kmalloc_obj(*attr);
-	init_attr = kmalloc_obj(*init_attr);
+	attr = kzalloc_obj(*attr);
+	init_attr = kzalloc_obj(*init_attr);
 	if (!attr || !init_attr) {
 		ret = -ENOMEM;
 		goto out;
-- 
2.39.3

Re: [PATCH for-next] RDMA/uverbs: Zero the QP attrs in ib_uverbs_query_qp

[sashiko-bot]

> ib_uverbs_query_qp() allocates qp_attr and qp_init_attr without zeroing
> and copies fields such as alt_ah_attr, path_mig_state and sq_draining
> to userspace. Drivers are not required to set every field in their
> query_qp() callback, so uninitialized kernel heap memory can leak.
> 
> Allocate both structures zeroed.
> 
> Fixes: 7ccc9a24e012 ("IB/uverbs: Support for query QP from userspace")
> Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104200244.52979-1-selvin.xavier@broadcom.com?part=1