Commit 3ab1aff8 authored Dec 06, 2011 by Tim Gardner Committed by Rajiv Andrade Feb 14, 2012

TPM: Zero buffer whole after copying to userspace

Commit 3321c07a correctly clears the TPM
buffer if the user specified read length is >= the TPM buffer length. However,
if the user specified read length is < the TPM buffer length, then part of the
TPM buffer is left uncleared.

Reported-by: Seth Forshee <seth.forshee@canonical.com>
Cc: Debora Velarde <debora@linux.vnet.ibm.com>
Cc: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
Cc: Marcel Selhorst <m.selhorst@sirrix.com>
Cc: tpmdd-devel@lists.sourceforge.net
Cc: stable@vger.kernel.org
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>

parent 968de8e2

drivers/char/tpm/tpm.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1221,12 +1221,13 @@ ssize_t tpm_read(struct file file, char __user buf,
		ret_size = atomic_read(&chip->data_pending);
		atomic_set(&chip->data_pending, 0);
		if (ret_size > 0) { /* relay data */
		ssize_t orig_ret_size = ret_size;
		if (size < ret_size)
		ret_size = size;

		mutex_lock(&chip->buffer_mutex);
		rc = copy_to_user(buf, chip->data_buffer, ret_size);
		memset(chip->data_buffer, 0, ret_size);
		memset(chip->data_buffer, 0, orig_ret_size);
		if (rc)
		ret_size = -EFAULT;

Admin message