Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3ab1aff8 authored by Tim Gardner's avatar Tim Gardner Committed by Rajiv Andrade
Browse files

TPM: Zero buffer whole after copying to userspace 



Commit 3321c07a correctly clears the TPM
buffer if the user specified read length is >= the TPM buffer length. However,
if the user specified read length is < the TPM buffer length, then part of the
TPM buffer is left uncleared.

Reported-by: default avatarSeth Forshee <seth.forshee@canonical.com>
Cc: Debora Velarde <debora@linux.vnet.ibm.com>
Cc: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
Cc: Marcel Selhorst <m.selhorst@sirrix.com>
Cc: tpmdd-devel@lists.sourceforge.net
Cc: stable@vger.kernel.org
Signed-off-by: default avatarTim Gardner <tim.gardner@canonical.com>
Signed-off-by: default avatarRajiv Andrade <srajiv@linux.vnet.ibm.com>
parent 968de8e2

drivers/char/tpm/tpm.c

+2 −1
Original line number Diff line number Diff line
@@ -1221,12 +1221,13 @@ ssize_t tpm_read(struct file *file, char __user *buf, 
	ret_size = atomic_read(&chip->data_pending);

	atomic_set(&chip->data_pending, 0);

	if (ret_size > 0) {	/* relay data */

		ssize_t orig_ret_size = ret_size;

		if (size < ret_size)

			ret_size = size;



		mutex_lock(&chip->buffer_mutex);

		rc = copy_to_user(buf, chip->data_buffer, ret_size);

		memset(chip->data_buffer, 0, ret_size);

		memset(chip->data_buffer, 0, orig_ret_size);

		if (rc)

			ret_size = -EFAULT;