]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
authorJason Gunthorpe <jgg@nvidia.com>
Mon, 16 Feb 2026 15:02:49 +0000 (11:02 -0400)
committerLeon Romanovsky <leon@kernel.org>
Tue, 24 Feb 2026 10:03:15 +0000 (05:03 -0500)
commit74586c6da9ea222a61c98394f2fc0a604748438c
tree82f9e7c80ca06b8c8371725e20ba97dd67b53a17
parent117942ca43e2e3c3d121faae530989931b7f67e1
RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()

struct irdma_create_ah_resp {  // 8 bytes, no padding
    __u32 ah_id;               // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx)
    __u8  rsvd[4];             // offset 4 - NEVER SET <- LEAK
};

rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata().

The reserved members of the structure were not zeroed.

Cc: stable@vger.kernel.org
Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://patch.msgid.link/3-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
drivers/infiniband/hw/irdma/verbs.c