From: Tristan Madani rsi_sdio_host_intf_write_pkt() rounds the packet length up to the SDIO block size and passes the larger length to rsi_sdio_write_register_multiple(). When the packet is not block-aligned, the SDIO controller reads past the original data into adjacent heap memory, leaking stale kernel data to the wireless device. Zero-fill the padding before the SDIO write. Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- drivers/net/wireless/rsi/rsi_91x_sdio.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c index bfa386b820d89..8bfb08306d03c 100644 --- a/drivers/net/wireless/rsi/rsi_91x_sdio.c +++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c @@ -772,6 +772,9 @@ static int rsi_sdio_host_intf_write_pkt(struct rsi_hw *adapter, address = (num_blocks * block_size | (queueno << 12)); length = num_blocks * block_size; + if (length > len) + memset((u8 *)pkt + len, 0, length - len); + status = rsi_sdio_write_register_multiple(adapter, address, (u8 *)pkt, -- 2.47.3