| From faa72102b178c7ae6c6afea23879e7c84fc59b4e Mon Sep 17 00:00:00 2001 |
| From: Jason Gunthorpe <jgg@nvidia.com> |
| Date: Mon, 16 Feb 2026 11:02:50 -0400 |
| Subject: RDMA/ionic: Fix kernel stack leak in ionic_create_cq() |
| |
| From: Jason Gunthorpe <jgg@nvidia.com> |
| |
| commit faa72102b178c7ae6c6afea23879e7c84fc59b4e upstream. |
| |
| struct ionic_cq_resp resp { |
| __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below) |
| __u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask) |
| __u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK |
| }; |
| |
| rsvd[7]: 7 bytes of stack memory leaked unconditionally. |
| |
| cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices |
| where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but |
| udma_count could be 1, meaning cqid[1] might never be written via |
| ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4 |
| bytes) is also leaked. So potentially 11 bytes leaked. |
| |
| Cc: stable@vger.kernel.org |
| Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") |
| Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> |
| Link: https://patch.msgid.link/4-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com |
| Acked-by: Abhijit Gangurde <abhijit.gangurde@amd.com> |
| Signed-off-by: Leon Romanovsky <leon@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/infiniband/hw/ionic/ionic_controlpath.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/infiniband/hw/ionic/ionic_controlpath.c |
| +++ b/drivers/infiniband/hw/ionic/ionic_controlpath.c |
| @@ -1218,7 +1218,7 @@ int ionic_create_cq(struct ib_cq *ibcq, |
| rdma_udata_to_drv_context(udata, struct ionic_ctx, ibctx); |
| struct ionic_vcq *vcq = to_ionic_vcq(ibcq); |
| struct ionic_tbl_buf buf = {}; |
| - struct ionic_cq_resp resp; |
| + struct ionic_cq_resp resp = {}; |
| struct ionic_cq_req req; |
| int udma_idx = 0, rc; |
| |
