winverbs: fix memory violation in SRQ code

Problem reported by Shiqing Fan:

"I got a memory violation error in wv_srq.cpp Query() function around
line 202. It seems using uninitialized verbsData.output_size for
memcpy. The verbsData.input_size is initialized in WvPreQueryQp
(wvuverbs.cpp), and it has a similar memcpy in this function too."

wv_uverbs.cpp should initialize the output_size to 0 in all
WvPre* calls.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>

diff --git a/trunk/core/winverbs/user/wv_uverbs.cpp b/trunk/core/winverbs/user/wv_uverbs.cpp
index d7073a16473c89768925e2aca0b10175835af1af..1a315b419d2b930815920132cc90f5a54d427aff 100644 (file)
--- a/trunk/core/winverbs/user/wv_uverbs.cpp
+++ b/trunk/core/winverbs/user/wv_uverbs.cpp
@@ -39,7 +39,7 @@ WvPreOpenCa(const ib_net64_t ca_guid, ci_umv_buf_t *p_umv_buf,
        UNREFERENCED_PARAMETER(ca_guid);\r
        UNREFERENCED_PARAMETER(ph_uvp_ca);\r
 \r
-       p_umv_buf->input_size = 0;\r
+       RtlZeroMemory(p_umv_buf, sizeof(*p_umv_buf));\r
        return IB_SUCCESS;\r
 }\r
 \r
@@ -76,7 +76,7 @@ WvPreAllocatePd(ib_ca_handle_t h_uvp_ca, ci_umv_buf_t *p_umv_buf,
        UNREFERENCED_PARAMETER(h_uvp_ca);\r
        UNREFERENCED_PARAMETER(ph_uvp_pd);\r
 \r
-       p_umv_buf->input_size = 0;\r
+       RtlZeroMemory(p_umv_buf, sizeof(*p_umv_buf));\r
        return IB_SUCCESS;\r
 }\r
 \r
@@ -112,7 +112,7 @@ WvPreCreateAv(const ib_pd_handle_t h_uvp_pd, const ib_av_attr_t *p_addr_vector,
        UNREFERENCED_PARAMETER(p_addr_vector);\r
        UNREFERENCED_PARAMETER(ph_uvp_av);\r
 \r
-       p_umv_buf->input_size = 0;\r
+       RtlZeroMemory(p_umv_buf, sizeof(*p_umv_buf));\r
        return IB_SUCCESS;\r
 }\r
 \r
@@ -148,7 +148,7 @@ WvPreCreateSrq(const ib_pd_handle_t h_uvp_pd, const ib_srq_attr_t* const p_srq_a
        UNREFERENCED_PARAMETER(p_srq_attr);\r
        UNREFERENCED_PARAMETER(ph_uvp_srq);\r
 \r
-       p_umv_buf->input_size = 0;\r
+       RtlZeroMemory(p_umv_buf, sizeof(*p_umv_buf));\r
        return IB_SUCCESS;\r
 }\r
 \r
@@ -170,7 +170,7 @@ WvPreModifySrq(const ib_srq_handle_t h_uvp_srq, const ib_srq_attr_t * const p_sr
        UNREFERENCED_PARAMETER(p_srq_attr);\r
        UNREFERENCED_PARAMETER(srq_attr_mask);\r
 \r
-       p_umv_buf->input_size = 0;\r
+       RtlZeroMemory(p_umv_buf, sizeof(*p_umv_buf));\r
        return IB_SUCCESS;\r
 }\r
 \r
@@ -188,7 +188,7 @@ WvPreQuerySrq(ib_srq_handle_t h_uvp_srq, ci_umv_buf_t *p_umv_buf)
 {\r
        UNREFERENCED_PARAMETER(h_uvp_srq);\r
 \r
-       p_umv_buf->input_size = 0;\r
+       RtlZeroMemory(p_umv_buf, sizeof(*p_umv_buf));\r
        return IB_SUCCESS;\r
 }\r
 \r
@@ -234,7 +234,7 @@ WvPreModifyQp(const ib_qp_handle_t h_uvp_qp, const ib_qp_mod_t *p_modify_attr,
        UNREFERENCED_PARAMETER(h_uvp_qp);\r
        UNREFERENCED_PARAMETER(p_modify_attr);\r
 \r
-       p_umv_buf->input_size = 0;\r
+       RtlZeroMemory(p_umv_buf, sizeof(*p_umv_buf));\r
        return IB_SUCCESS;\r
 }\r
 \r
@@ -252,7 +252,7 @@ WvPreQueryQp(ib_qp_handle_t h_uvp_qp, ci_umv_buf_t *p_umv_buf)
 {\r
        UNREFERENCED_PARAMETER(h_uvp_qp);\r
 \r
-       p_umv_buf->input_size = 0;\r
+       RtlZeroMemory(p_umv_buf, sizeof(*p_umv_buf));\r
        return IB_SUCCESS;\r
 }\r
 \r
@@ -288,7 +288,7 @@ WvPreCreateCq(const ib_ca_handle_t h_uvp_ca, uint32_t* const p_size,
        UNREFERENCED_PARAMETER(p_size);\r
        UNREFERENCED_PARAMETER(ph_uvp_cq);\r
 \r
-       p_umv_buf->input_size = 0;\r
+       RtlZeroMemory(p_umv_buf, sizeof(*p_umv_buf));\r
        return IB_SUCCESS;\r
 }\r
 \r
@@ -310,7 +310,7 @@ WvPreResizeCq(const ib_cq_handle_t h_uvp_cq, uint32_t* const p_size,
        UNREFERENCED_PARAMETER(h_uvp_cq);\r
        UNREFERENCED_PARAMETER(p_size);\r
 \r
-       p_umv_buf->input_size = 0;\r
+       RtlZeroMemory(p_umv_buf, sizeof(*p_umv_buf));\r
        return IB_SUCCESS;\r
 }\r
 \r
@@ -345,7 +345,7 @@ WvPreCreateMw(const ib_pd_handle_t h_uvp_pd, ci_umv_buf_t *p_umv_buf,
        UNREFERENCED_PARAMETER(h_uvp_pd);\r
        UNREFERENCED_PARAMETER(ph_uvp_mw);\r
 \r
-       p_umv_buf->input_size = 0;\r
+       RtlZeroMemory(p_umv_buf, sizeof(*p_umv_buf));\r
        return IB_SUCCESS;\r
 }\r
 \r