usb:f_usbnet:Zero out CRC padding

Zero out CRC padding
To preventing leaking of unintialized data

Signed-off-by: Patrick Tjin <pattjin@google.com>
Signed-off-by: a17671 <a17671@motorola.com>
Change-Id: I7e902a9bdf2cbad0df4900101a9797176cb66a9c
Reviewed-on: https://gerrit.mot.com/1287118
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key

diff --git a/drivers/usb/gadget/function/f_usbnet.c b/drivers/usb/gadget/function/f_usbnet.c
index 7c6f0cb120d84493179e807684e4338882fdd28e..86c36f48300d32cda44e3e9ea31538b44365a96a 100644 (file)
--- a/drivers/usb/gadget/function/f_usbnet.c
+++ b/drivers/usb/gadget/function/f_usbnet.c
@@ -347,6 +347,7 @@ static netdev_tx_t usb_ether_xmit(struct sk_buff *skb, struct net_device *dev)
        struct usb_request *req;
        unsigned long flags;
        unsigned len;
+       unsigned pad;
        int rc;
 
        /*usbnet might be disabled before ip link down
@@ -368,16 +369,23 @@ static netdev_tx_t usb_ether_xmit(struct sk_buff *skb, struct net_device *dev)
        }
 
        /* Add 4 bytes CRC */
-       skb->len += 4;
+       pad = 4;
 
        /* ensure that we end with a short packet */
-       len = skb->len;
+       len = skb->len + pad;
        if (!(len & 63) || !(len & 511))
-               len++;
+               pad++;
+
+       /* ensure the added bytes are 0'd out */
+       if (skb_tailroom(skb) < pad) {
+               USBNETDBG(context, "%s: could not add CRC\n", __func__);
+               return 1;
+       }
+       memset(skb_put(skb, pad), 0, pad);
 
        req->context = skb;
        req->buf = skb->data;
-       req->length = len;
+       req->length = skb->len;
 
        rc = usb_ep_queue(context->bulk_in, req, GFP_KERNEL);
        if (rc != 0) {