IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write()

[platform/kernel/linux-exynos.git] / drivers / infiniband / ulp / srpt / ib_srpt.c

diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index ee578fa..5a5e134 100644 (file)
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -787,13 +787,16 @@ static int srpt_post_recv(struct srpt_device *sdev,
  */
 static int srpt_zerolength_write(struct srpt_rdma_ch *ch)
 {
-       struct ib_send_wr wr, *bad_wr;
+       struct ib_send_wr *bad_wr;
+       struct ib_rdma_wr wr = {
+               .wr = {
+                       .opcode         = IB_WR_RDMA_WRITE,
+                       .wr_cqe         = &ch->zw_cqe,
+                       .send_flags     = IB_SEND_SIGNALED,
+               }
+       };
 
-       memset(&wr, 0, sizeof(wr));
-       wr.opcode = IB_WR_RDMA_WRITE;
-       wr.wr_cqe = &ch->zw_cqe;
-       wr.send_flags = IB_SEND_SIGNALED;
-       return ib_post_send(ch->qp, &wr, &bad_wr);
+       return ib_post_send(ch->qp, &wr.wr, &bad_wr);
 }
 
 static void srpt_zerolength_write_done(struct ib_cq *cq, struct ib_wc *wc)