wlan: Avoid possible information leak in send_btc_nlink_msg
In function send_btc_nlink_msg skb alloc is done but the allocated
memory is not initialized. NLMSG_SPACE is used at many places in this
function which does 4 bytes allignment of the buffer. skb_put
adjusts the tail pointer according to this 4 byte allignment results
in padding some extra bytes. Since these bytes are not initialized
it leads to information leak.
To resolve this issue, initialize the skb with zero after alloc skb.
Change-Id: I9d4d2030927c4aedf8c201bf875741b8c800ee7e
CRs-Fixed: 2288807
diff --git a/CORE/SVC/src/btc/wlan_btc_svc.c b/CORE/SVC/src/btc/wlan_btc_svc.c
index f64605d..489544b 100644
--- a/CORE/SVC/src/btc/wlan_btc_svc.c
+++ b/CORE/SVC/src/btc/wlan_btc_svc.c
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2012-2013, 2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2017-2018 The Linux Foundation. All rights reserved.
*
* Previously licensed under the ISC license by Qualcomm Atheros, Inc.
*
@@ -56,12 +56,14 @@
struct nlmsghdr *nlh;
tAniMsgHdr *aniHdr;
tWlanAssocData *assocData;
- skb = alloc_skb(NLMSG_SPACE(WLAN_NL_MAX_PAYLOAD), GFP_KERNEL);
+ uint32_t skb_size = NLMSG_SPACE(WLAN_NL_MAX_PAYLOAD);
+ skb = alloc_skb(skb_size, GFP_KERNEL);
if(skb == NULL) {
VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
"BTC: alloc_skb failed\n");
return;
}
+ vos_mem_zero(skb->data, skb_size);
nlh = (struct nlmsghdr *)skb->data;
nlh->nlmsg_pid = 0; /* from kernel */
nlh->nlmsg_flags = 0;