summaryrefslogtreecommitdiff
path: root/drivers/char
diff options
context:
space:
mode:
authorJosh Zimmerman <joshz@google.com>2016-10-28 00:50:09 +0300
committerJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>2016-11-28 02:31:30 +0300
commit26a137e31ffe6fbfdb008554a8d9b3d55bd5c86e (patch)
treed219a64c584e644ae910aa2979d13fe95a43afbe /drivers/char
parentca6d45802201c2680af040579af7697049149e38 (diff)
downloadlinux-26a137e31ffe6fbfdb008554a8d9b3d55bd5c86e.tar.xz
tpm_tis: Check return values from get_burstcount.
If the TPM we're connecting to uses a static burst count, it will report a burst count of zero throughout the response read. However, get_burstcount assumes that a response of zero indicates that the TPM is not ready to receive more data. In this case, it returns a negative error code, which is passed on to tpm_tis_{write,read}_bytes as a u16, causing them to read/write far too many bytes. This patch checks for negative return codes and bails out from recv_data and tpm_tis_send_data. Cc: stable@vger.kernel.org Fixes: 1107d065fdf1 (tpm_tis: Introduce intermediate layer for TPM access) Signed-off-by: Josh Zimmerman <joshz@google.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Diffstat (limited to 'drivers/char')
-rw-r--r--drivers/char/tpm/tpm_tis_core.c15
1 files changed, 13 insertions, 2 deletions
diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
index 73f4c4bbc4df..2d1e451fb1b3 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -187,7 +187,12 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
&priv->read_queue, true);
if (rc < 0)
return rc;
- burstcnt = min_t(int, get_burstcount(chip), count - size);
+ burstcnt = get_burstcount(chip);
+ if (burstcnt < 0) {
+ dev_err(&chip->dev, "Unable to read burstcount\n");
+ return burstcnt;
+ }
+ burstcnt = min_t(int, burstcnt, count - size);
rc = tpm_tis_read_bytes(priv, TPM_DATA_FIFO(priv->locality),
burstcnt, buf + size);
@@ -276,7 +281,13 @@ static int tpm_tis_send_data(struct tpm_chip *chip, u8 *buf, size_t len)
}
while (count < len - 1) {
- burstcnt = min_t(int, get_burstcount(chip), len - count - 1);
+ burstcnt = get_burstcount(chip);
+ if (burstcnt < 0) {
+ dev_err(&chip->dev, "Unable to read burstcount\n");
+ rc = burstcnt;
+ goto out_err;
+ }
+ burstcnt = min_t(int, burstcnt, len - count - 1);
rc = tpm_tis_write_bytes(priv, TPM_DATA_FIFO(priv->locality),
burstcnt, buf + count);
if (rc < 0)