IB/qib: Clear eager buffer memory for each new process
authorRalph Campbell <ralph.campbell@qlogic.com>
Thu, 17 Jun 2010 23:13:59 +0000 (23:13 +0000)
committerRoland Dreier <rolandd@cisco.com>
Tue, 6 Jul 2010 21:13:21 +0000 (14:13 -0700)
The eager buffers are not being cleared before being mmapped into a
new user address space.  This is a potential security risk and should
be fixed.  Note that the eager header queue is already being cleared.

Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
drivers/infiniband/hw/qib/qib_init.c

index 25895991dc527922e4210ff6d7629f88bb6789b9..1d4db4b19d76e5518a9a4f219a6cd7279bc7902d 100644 (file)
@@ -1472,6 +1472,9 @@ int qib_setup_eagerbufs(struct qib_ctxtdata *rcd)
                dma_addr_t pa = rcd->rcvegrbuf_phys[chunk];
                unsigned i;
 
+               /* clear for security and sanity on each use */
+               memset(rcd->rcvegrbuf[chunk], 0, size);
+
                for (i = 0; e < egrcnt && i < egrperchunk; e++, i++) {
                        dd->f_put_tid(dd, e + egroff +
                                          (u64 __iomem *)