Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6ad1fddd authored by Jeff Hugo's avatar Jeff Hugo
Browse files

soc: qcom: glink_smd_xprt: Plug information leaks 



The close and close ack commands sent over the wire in the control channel
have reserved fields, which are left uninitialized.  This leads to an
unintentional information leak.

Zero initialize these reserved fields before sending the commands over the
wire to plug the leak.

Change-Id: I533a1bd2a7946a17e76806f6c589ea00a993c6e9
Signed-off-by: default avatarJeffrey Hugo <jhugo@codeaurora.org>
parent 58d6bfbe

drivers/soc/qcom/glink_smd_xprt.c

+2 −0
Original line number Diff line number Diff line
@@ -1131,6 +1131,7 @@ static int tx_cmd_ch_close(struct glink_transport_if *if_ptr, uint32_t lcid) 
		SMDXPRT_INFO("%s TX CLOSE lcid %u\n", __func__, lcid);

		cmd.cmd = CMD_CLOSE;

		cmd.id = lcid;

		cmd.reserved = 0;

		mutex_lock(&einfo->smd_lock);

		while (smd_write_avail(einfo->smd_ch) < sizeof(cmd))

			msleep(20);
@@ -1238,6 +1239,7 @@ static void tx_cmd_ch_remote_close_ack(struct glink_transport_if *if_ptr, 
		SMDXPRT_INFO("%s TX CLOSE ACK rcid %u\n", __func__, rcid);

		cmd.cmd = CMD_CLOSE_ACK;

		cmd.id = rcid;

		cmd.reserved = 0;

		mutex_lock(&einfo->smd_lock);

		while (smd_write_avail(einfo->smd_ch) < sizeof(cmd))

			msleep(20);