From patchwork Wed Jul 27 15:20:23 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [hardy,CVE,1/1] char/tpm: Fix unitialized usage of data buffer Date: Wed, 27 Jul 2011 05:20:23 -0000 From: Andy Whitcroft X-Patchwork-Id: 107105 Message-Id: <1311780024-21737-2-git-send-email-apw@canonical.com> To: kernel-team@lists.ubuntu.com From: Peter Huewe This patch fixes information leakage to the userspace by initializing the data buffer to zero. Reported-by: Peter Huewe Signed-off-by: Peter Huewe Signed-off-by: Marcel Selhorst [ Also removed the silly "* sizeof(u8)". If that isn't 1, we have way deeper problems than a simple multiplication can fix. - Linus ] Signed-off-by: Linus Torvalds (backported from commit 1309d7afbed112f0e8e90be9af975550caa0076b) CVE-2011-1160 BugLink: http://bugs.launchpad.net/bugs/816546 Signed-off-by: Andy Whitcroft --- drivers/char/tpm/tpm.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c index c88424a..14ad745 100644 --- a/drivers/char/tpm/tpm.c +++ b/drivers/char/tpm/tpm.c @@ -922,7 +922,7 @@ int tpm_open(struct inode *inode, struct file *file) spin_unlock(&driver_lock); - chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL); + chip->data_buffer = kzalloc(TPM_BUFSIZE, GFP_KERNEL); if (chip->data_buffer == NULL) { chip->num_opens--; put_device(chip->dev);