[PATCH wireless 1/2] wifi: brcmfmac: zero-pad SDIO write to 4-byte boundary

[PATCH wireless 1/2] wifi: brcmfmac: zero-pad SDIO write to 4-byte boundary

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

brcmf_sdiod_skbuff_write() rounds skb->len up to the next 4-byte
boundary and passes the larger size to sdio_memcpy_toio().  The 1-3
extra bytes come from heap memory past skb->data, leaking stale kernel
data to the wireless device.

Zero-fill the padding before the SDIO write.

Fixes: 8f13c87ccc49 ("brcmfmac: Split brcmf_sdiod_buffrw function up.")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
index 71c2f99cdb711..c6dd4148a44ce 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -323,6 +323,9 @@ static int brcmf_sdiod_skbuff_write(struct brcmf_sdio_dev *sdiodev,
 	req_sz = skb->len + 3;
 	req_sz &= (uint)~3;
 
+	if (req_sz > skb->len)
+		memset(skb->data + skb->len, 0, req_sz - skb->len);
+
 	err = sdio_memcpy_toio(func, addr, ((u8 *)(skb->data)), req_sz);
 
 	if (err == -ENOMEDIUM)
-- 
2.47.3

[PATCH wireless 2/2] wifi: rsi: zero-pad SDIO TX to block boundary

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

rsi_sdio_host_intf_write_pkt() rounds the packet length up to the SDIO
block size and passes the larger length to
rsi_sdio_write_register_multiple().  When the packet is not
block-aligned, the SDIO controller reads past the original data into
adjacent heap memory, leaking stale kernel data to the wireless device.

Zero-fill the padding before the SDIO write.

Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/rsi/rsi_91x_sdio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
index bfa386b820d89..8bfb08306d03c 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -772,6 +772,9 @@ static int rsi_sdio_host_intf_write_pkt(struct rsi_hw *adapter,
 	address = (num_blocks * block_size | (queueno << 12));
 	length  = num_blocks * block_size;
 
+	if (length > len)
+		memset((u8 *)pkt + len, 0, length - len);
+
 	status = rsi_sdio_write_register_multiple(adapter,
 						  address,
 						  (u8 *)pkt,
-- 
2.47.3