The driver allocates the transmission buffer using kmalloc(), which means the memory remains uninitialized. Then various headers are filled and, but only the actual CAN frame data payload (of length cfd->len or cf->len) is copied into the buffer, leaving the remaining buffer uninitialized. Fix this information leak, allocate the buffer with kzalloc(). Closes: https://sashiko.dev/#/bug/linux-0a8c0e8a-c623-426a-8db3-f55111f6cd84 Fixes: 26949ac935e3 ("can: gs_usb: add CAN-FD support") Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde --- drivers/net/can/usb/gs_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c index 3b9b2f104d86..15f28833f2de 100644 --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -861,7 +861,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, if (!urb) goto nomem_urb; - hf = kmalloc(dev->hf_size_tx, GFP_ATOMIC); + hf = kzalloc(dev->hf_size_tx, GFP_ATOMIC); if (!hf) goto nomem_hf; -- 2.53.0