.32 patches

3 files changed, 90 insertions, 0 deletions

diff --git a/queue-2.6.32/series b/queue-2.6.32/series
index a640124..c47dcfc 100644
--- a/queue-2.6.32/series
+++ b/queue-2.6.32/series
@@ -32,3 +32,5 @@ wireless-reset-beacon_found-while-updating-regulatory.patch
 usb-pl2303-correctly-handle-baudrates-above-115200.patch
 asix-add-ax88772b-usb-id.patch
 hvc_console-improve-tty-console-put_chars-handling.patch
+tpm-call-tpm_transmit-with-correct-size.patch
+tpm-zero-buffer-after-copying-to-userspace.patch
diff --git a/queue-2.6.32/tpm-call-tpm_transmit-with-correct-size.patch b/queue-2.6.32/tpm-call-tpm_transmit-with-correct-size.patch
new file mode 100644
index 0000000..125e91e
--- /dev/null
+++ b/queue-2.6.32/tpm-call-tpm_transmit-with-correct-size.patch
@@ -0,0 +1,43 @@
+From 6b07d30aca7e52f2881b8c8c20c8a2cd28e8b3d3 Mon Sep 17 00:00:00 2001
+From: Peter Huewe <huewe.external.infineon@googlemail.com>
+Date: Thu, 15 Sep 2011 14:37:43 -0300
+Subject: TPM: Call tpm_transmit with correct size
+
+From: Peter Huewe <huewe.external.infineon@googlemail.com>
+
+commit 6b07d30aca7e52f2881b8c8c20c8a2cd28e8b3d3 upstream.
+
+This patch changes the call of tpm_transmit by supplying the size of the
+userspace buffer instead of TPM_BUFSIZE.
+
+This got assigned CVE-2011-1161.
+
+[The first hunk didn't make sense given one could expect
+ way less data than TPM_BUFSIZE, so added tpm_transmit boundary
+ check over bufsiz instead
+ The last parameter of tpm_transmit() reflects the amount
+ of data expected from the device, and not the buffer size
+ being supplied to it. It isn't ideal to parse it directly,
+ so we just set it to the maximum the input buffer can handle
+ and let the userspace API to do such job.]
+
+Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -374,6 +374,9 @@ static ssize_t tpm_transmit(struct tpm_c
+ 	u32 count, ordinal;
+ 	unsigned long stop;
+ 
++	if (bufsiz > TPM_BUFSIZE)
++		bufsiz = TPM_BUFSIZE;
++
+ 	count = be32_to_cpu(*((__be32 *) (buf + 2)));
+ 	ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
+ 	if (count == 0)
diff --git a/queue-2.6.32/tpm-zero-buffer-after-copying-to-userspace.patch b/queue-2.6.32/tpm-zero-buffer-after-copying-to-userspace.patch
new file mode 100644
index 0000000..c8f7156
--- /dev/null
+++ b/queue-2.6.32/tpm-zero-buffer-after-copying-to-userspace.patch
@@ -0,0 +1,45 @@
+From 3321c07ae5068568cd61ac9f4ba749006a7185c9 Mon Sep 17 00:00:00 2001
+From: Peter Huewe <huewe.external.infineon@googlemail.com>
+Date: Thu, 15 Sep 2011 14:47:42 -0300
+Subject: TPM: Zero buffer after copying to userspace
+
+From: Peter Huewe <huewe.external.infineon@googlemail.com>
+
+commit 3321c07ae5068568cd61ac9f4ba749006a7185c9 upstream.
+
+Since the buffer might contain security related data it might be a good idea to
+zero the buffer after we have copied it to userspace.
+
+This got assigned CVE-2011-1162.
+
+Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -1044,6 +1044,7 @@ ssize_t tpm_read(struct file *file, char
+ {
+ 	struct tpm_chip *chip = file->private_data;
+ 	ssize_t ret_size;
++	int rc;
+ 
+ 	del_singleshot_timer_sync(&chip->user_read_timer);
+ 	flush_scheduled_work();
+@@ -1054,8 +1055,11 @@ ssize_t tpm_read(struct file *file, char
+ 			ret_size = size;
+ 
+ 		mutex_lock(&chip->buffer_mutex);
+-		if (copy_to_user(buf, chip->data_buffer, ret_size))
++		rc = copy_to_user(buf, chip->data_buffer, ret_size);
++		memset(chip->data_buffer, 0, ret_size);
++		if (rc)
+ 			ret_size = -EFAULT;
++
+ 		mutex_unlock(&chip->buffer_mutex);
+ 	}
+