diff options
| author | Tomas Bortoli <tomasbortoli@gmail.com> | 2019-07-31 12:19:05 -0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-10-05 13:09:58 +0200 |
| commit | 8630a4d13683095fbf14091d59a20e1ac71fdd6b (patch) | |
| tree | dab68ba0a41e82c15d72042e718faf3102595665 /drivers/media | |
| parent | d47636913bda8255652805eb29b9638e6d9311c1 (diff) | |
| download | linux-stable-8630a4d13683095fbf14091d59a20e1ac71fdd6b.tar.gz linux-stable-8630a4d13683095fbf14091d59a20e1ac71fdd6b.tar.bz2 linux-stable-8630a4d13683095fbf14091d59a20e1ac71fdd6b.zip | |
media: ttusb-dec: Fix info-leak in ttusb_dec_send_command()
[ Upstream commit a10feaf8c464c3f9cfdd3a8a7ce17e1c0d498da1 ]
The function at issue does not always initialize each byte allocated
for 'b' and can therefore leak uninitialized memory to a USB device in
the call to usb_bulk_msg()
Use kzalloc() instead of kmalloc()
Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/usb/ttusb-dec/ttusb_dec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c index 44ca66cb9b8f..f34efa7c61b4 100644 --- a/drivers/media/usb/ttusb-dec/ttusb_dec.c +++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c @@ -329,7 +329,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, dprintk("%s\n", __func__); - b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); + b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); if (!b) return -ENOMEM; |