samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Fix Uninitialized byte sent to FW in wmi_unified_cmd_send

Browse Source 
In wmi_unified_cmd_send, the skb head is pushed by size of WMI_CMD_HDR
and then the commandId is initialized in the header. However 1 byte of
reserved memory in the WMI_CMD_HDR is not initialized and is sent to
the FW as it is and this might lead to exposure of 1 byte of kernel
memory to FW.

Initialize the WMI_CMD_HDR to zero once the skb head is pushed and
then set the commandId in the header.

Change-Id: I89fd5401105cd9c61674a63aac5aa88fb20cc41a
CRs-Fixed: 2257688
This commit is contained in:
Vignesh Viswanathan
2018-06-15 12:42:45 +05:30
committed by nshrivas
parent d460329ba2
commit c352d60731
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
wmi/src/wmi_unified.c
View File

@@ -1387,6 +1387,7 @@ QDF_STATUS wmi_unified_cmd_send(wmi_unified_t wmi_handle, wmi_buf_t buf,
return QDF_STATUS_E_NOMEM;
}
qdf_mem_zero(qdf_nbuf_data(buf), sizeof(WMI_CMD_HDR));
WMI_SET_FIELD(qdf_nbuf_data(buf), WMI_CMD_HDR, COMMANDID, cmd_id);
qdf_atomic_inc(&wmi_handle->pending_cmds);