mirror of
https://github.com/torvalds/linux.git
synced 2026-03-08 04:44:45 +01:00
faa72102b1
struct ionic_cq_resp resp {
__u32 cqid[2]; // offset 0 - PARTIALLY SET (see below)
__u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask)
__u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK
};
rsvd[7]: 7 bytes of stack memory leaked unconditionally.
cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices
where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but
udma_count could be 1, meaning cqid[1] might never be written via
ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4
bytes) is also leaked. So potentially 11 bytes leaked.
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| ionic_admin.c | ||
| ionic_controlpath.c | ||
| ionic_datapath.c | ||
| ionic_fw.h | ||
| ionic_hw_stats.c | ||
| ionic_ibdev.c | ||
| ionic_ibdev.h | ||
| ionic_lif_cfg.c | ||
| ionic_lif_cfg.h | ||
| ionic_pgtbl.c | ||
| ionic_queue.c | ||
| ionic_queue.h | ||
| ionic_res.h | ||
| Kconfig | ||
| Makefile | ||