From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from wtarreau.pck.nerim.net ([62.212.114.60]:36217 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934689AbbEOIPx (ORCPT ); Fri, 15 May 2015 04:15:53 -0400 Message-Id: <20150515080531.982328166@1wt.eu> Date: Fri, 15 May 2015 10:06:10 +0200 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Eli Cohen , Yann Droneaud , Roland Dreier , Ben Hutchings , Willy Tarreau Subject: [ 40/48] IB/core: Avoid leakage from kernel to user space MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 In-Reply-To: <9c2783dfae10ef2d1e9b08bcc1e562c5@local> Sender: stable-owner@vger.kernel.org List-ID: 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ From: Eli Cohen commit 377b513485fd885dea1083a9a5430df65b35e048 upstream. Clear the reserved field of struct ib_uverbs_async_event_desc which is copied to user space. Signed-off-by: Eli Cohen Reviewed-by: Yann Droneaud Signed-off-by: Roland Dreier Signed-off-by: Ben Hutchings Cc: Yann Droneaud (cherry picked from commit 852acc0151014ba9731e2f5f2f3df3b6a8960d40) Signed-off-by: Willy Tarreau --- drivers/infiniband/core/uverbs_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c index aec0fbd..8da0037 100644 --- a/drivers/infiniband/core/uverbs_main.c +++ b/drivers/infiniband/core/uverbs_main.c @@ -433,6 +433,7 @@ static void ib_uverbs_async_handler(struct ib_uverbs_file *file, entry->desc.async.element = element; entry->desc.async.event_type = event; + entry->desc.async.reserved = 0; entry->counter = counter; list_add_tail(&entry->list, &file->async_file->event_list); -- 1.7.12.2.21.g234cd45.dirty