[PATCH wireless 0/2] wifi: zero-pad SDIO writes to avoid leaking heap data

[Tristan Madani]

From: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>

Several wireless drivers round up the length passed to
sdio_memcpy_toio() / sdio_writesb() for alignment purposes but do not
clear the padding bytes.  The SDIO controller then reads past the
original buffer into adjacent heap memory, sending stale kernel data to
the wireless device.

Fix brcmfmac (4-byte alignment) and rsi (block alignment) by
zero-filling the gap before the write.

A third patch for rtw88 hits the same class of bug but needs a rebase
and will follow separately.

Tristan Madani (2):
  wifi: brcmfmac: zero-pad SDIO write to 4-byte boundary
  wifi: rsi: zero-pad SDIO TX to block boundary

 drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 +++
 drivers/net/wireless/rsi/rsi_91x_sdio.c                   | 3 +++
 2 files changed, 6 insertions(+)

-- 
2.47.3