From: Tomas Bortoli Date: Wed, 31 Jul 2019 15:19:05 +0000 (-0300) Subject: media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() X-Git-Tag: v5.15~5520^2~42 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a10feaf8c464c3f9cfdd3a8a7ce17e1c0d498da1;p=platform%2Fkernel%2Flinux-starfive.git media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() The function at issue does not always initialize each byte allocated for 'b' and can therefore leak uninitialized memory to a USB device in the call to usb_bulk_msg() Use kzalloc() instead of kmalloc() Signed-off-by: Tomas Bortoli Reported-by: syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c index 1d0afa3..3198f96 100644 --- a/drivers/media/usb/ttusb-dec/ttusb_dec.c +++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c @@ -319,7 +319,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, dprintk("%s\n", __func__); - b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); + b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); if (!b) return -ENOMEM;