From 9fc3139a3eac36568c3978663f4682f2efe1dd3d Mon Sep 17 00:00:00 2001 From: Patrick Tjin Date: Wed, 26 Dec 2018 16:39:56 +0800 Subject: [PATCH] usb:f_usbnet:Zero out CRC padding Zero out CRC padding To preventing leaking of unintialized data Signed-off-by: Patrick Tjin Signed-off-by: a17671 Change-Id: I7e902a9bdf2cbad0df4900101a9797176cb66a9c Reviewed-on: https://gerrit.mot.com/1287118 SLTApproved: Slta Waiver SME-Granted: SME Approvals Granted Tested-by: Jira Key Reviewed-by: Xiangpo Zhao Submit-Approved: Jira Key --- drivers/usb/gadget/function/f_usbnet.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/usb/gadget/function/f_usbnet.c b/drivers/usb/gadget/function/f_usbnet.c index 7c6f0cb120d8..86c36f48300d 100644 --- a/drivers/usb/gadget/function/f_usbnet.c +++ b/drivers/usb/gadget/function/f_usbnet.c @@ -347,6 +347,7 @@ static netdev_tx_t usb_ether_xmit(struct sk_buff *skb, struct net_device *dev) struct usb_request *req; unsigned long flags; unsigned len; + unsigned pad; int rc; /*usbnet might be disabled before ip link down @@ -368,16 +369,23 @@ static netdev_tx_t usb_ether_xmit(struct sk_buff *skb, struct net_device *dev) } /* Add 4 bytes CRC */ - skb->len += 4; + pad = 4; /* ensure that we end with a short packet */ - len = skb->len; + len = skb->len + pad; if (!(len & 63) || !(len & 511)) - len++; + pad++; + + /* ensure the added bytes are 0'd out */ + if (skb_tailroom(skb) < pad) { + USBNETDBG(context, "%s: could not add CRC\n", __func__); + return 1; + } + memset(skb_put(skb, pad), 0, pad); req->context = skb; req->buf = skb->data; - req->length = len; + req->length = skb->len; rc = usb_ep_queue(context->bulk_in, req, GFP_KERNEL); if (rc != 0) { -- 2.20.1