From: Greg KH <gregkh@linuxfoundation.org>
To: Henrik Holmberg <pomzm67@gmail.com>
Cc: security@kernel.org, selvin.xavier@broadcom.com,
kalesh-anakkur.purayil@broadcom.com, linux-rdma@vger.kernel.org
Subject: Re: [security] RDMA/bnxt_re: kernel infoleak via uninitialised shpg shared page exposed to userspace
Date: Fri, 8 May 2026 15:51:50 +0200 [thread overview]
Message-ID: <2026050818-divisible-unlocked-e1f7@gregkh> (raw)
In-Reply-To: <CAOOd5ej7=KFT8+JO8D3g=QnnhJR2+V--a+JSKcpuxUt=tyGyZw@mail.gmail.com>
On Fri, May 08, 2026 at 03:45:13PM +0200, Henrik Holmberg wrote:
> Suggested fix (one-line)
> ------------------------
> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -4375,7 +4375,7 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext
> *ctx, struct ib_udata *udata)
>
> uctx->rdev = rdev;
>
> - uctx->shpg = (void *)__get_free_page(GFP_KERNEL);
> + uctx->shpg = (void *)get_zeroed_page(GFP_KERNEL);
> if (!uctx->shpg) {
> rc = -ENOMEM;
> goto fail;
>
Can you just turn this into a real patch that can be applied, so you get
full credit for the fix? The kernel documentation explains how to do
this.
thanks,
greg k-h
next prev parent reply other threads:[~2026-05-08 13:51 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-08 13:45 [security] RDMA/bnxt_re: kernel infoleak via uninitialised shpg shared page exposed to userspace Henrik Holmberg
2026-05-08 13:51 ` Greg KH [this message]
2026-05-08 14:23 ` Henrik Holmberg
2026-05-08 20:24 ` Henrik Holmberg
2026-05-09 4:25 ` Greg KH
2026-05-09 8:40 ` [PATCH] RDMA/bnxt_re: zero shared page before exposing " pomzm67
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026050818-divisible-unlocked-e1f7@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=kalesh-anakkur.purayil@broadcom.com \
--cc=linux-rdma@vger.kernel.org \
--cc=pomzm67@gmail.com \
--cc=security@kernel.org \
--cc=selvin.xavier@broadcom.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox