* [PATCH 2/6] tpm/tpm_ppi: Check return value of acpi_get_name
2013-11-02 17:24 ` [PATCH 1/6] tpm/tpm_ppi: Do not compare strcmp(a,b) == -1 Peter Huewe
@ 2013-11-02 17:24 ` Peter Huewe
2013-11-02 17:24 ` [PATCH 3/6] tpm/tpm_i2c_stm_st33: Check return code of get_burstcount Peter Huewe
1 sibling, 0 replies; 3+ messages in thread
From: Peter Huewe @ 2013-11-02 17:24 UTC (permalink / raw)
To: james.l.morris, tpmdd-devel, adlai
Cc: linux-kernel, Peter Huewe, stable, Peter Huewe
From: Peter Huewe <PeterHuewe@gmx.de>
If
status = acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer);
fails for whatever reason and does not return AE_OK
if (strstr(buffer.pointer, context) != NULL) {
does dereference a null pointer.
-> Check the return value and return the status to the caller
Found by coverity
Cc: stable@vger.kernel.org
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
---
drivers/char/tpm/tpm_ppi.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
index 18c5810..6ac9d27 100644
--- a/drivers/char/tpm/tpm_ppi.c
+++ b/drivers/char/tpm/tpm_ppi.c
@@ -30,6 +30,9 @@ static acpi_status ppi_callback(acpi_handle handle, u32 level, void *context,
acpi_status status;
struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
status = acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer);
+ if (ACPI_FAILURE(status))
+ return status;
+
if (strstr(buffer.pointer, context) != NULL) {
*return_value = handle;
kfree(buffer.pointer);
--
1.7.5.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH 3/6] tpm/tpm_i2c_stm_st33: Check return code of get_burstcount
2013-11-02 17:24 ` [PATCH 1/6] tpm/tpm_ppi: Do not compare strcmp(a,b) == -1 Peter Huewe
2013-11-02 17:24 ` [PATCH 2/6] tpm/tpm_ppi: Check return value of acpi_get_name Peter Huewe
@ 2013-11-02 17:24 ` Peter Huewe
1 sibling, 0 replies; 3+ messages in thread
From: Peter Huewe @ 2013-11-02 17:24 UTC (permalink / raw)
To: james.l.morris, tpmdd-devel, adlai
Cc: linux-kernel, Peter Huewe, stable, Peter Huewe
From: Peter Huewe <PeterHuewe@gmx.de>
The 'get_burstcount' function can in some circumstances 'return -EBUSY' which
in tpm_stm_i2c_send is stored in an 'u32 burstcnt'
thus converting the signed value into an unsigned value, resulting
in 'burstcnt' being huge.
Changing the type to u32 only does not solve the problem as the signed
value is converted to an unsigned in I2C_WRITE_DATA, resulting in the
same effect.
Thus
-> Change type of burstcnt to u32 (the return type of get_burstcount)
-> Add a check for the return value of 'get_burstcount' and propagate a
potential error.
This makes also sense in the 'I2C_READ_DATA' case, where the there is no
signed/unsigned conversion.
found by coverity
Cc: stable@vger.kernel.org
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
---
drivers/char/tpm/tpm_i2c_stm_st33.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/drivers/char/tpm/tpm_i2c_stm_st33.c b/drivers/char/tpm/tpm_i2c_stm_st33.c
index a0d6ceb5..cf68403 100644
--- a/drivers/char/tpm/tpm_i2c_stm_st33.c
+++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
@@ -410,6 +410,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
&chip->vendor.read_queue)
== 0) {
burstcnt = get_burstcount(chip);
+ if (burstcnt < 0)
+ return burstcnt;
len = min_t(int, burstcnt, count - size);
I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
size += len;
@@ -451,7 +453,8 @@ static irqreturn_t tpm_ioserirq_handler(int irq, void *dev_id)
static int tpm_stm_i2c_send(struct tpm_chip *chip, unsigned char *buf,
size_t len)
{
- u32 status, burstcnt = 0, i, size;
+ u32 status, i, size;
+ int burstcnt = 0;
int ret;
u8 data;
struct i2c_client *client;
@@ -482,6 +485,8 @@ static int tpm_stm_i2c_send(struct tpm_chip *chip, unsigned char *buf,
for (i = 0; i < len - 1;) {
burstcnt = get_burstcount(chip);
+ if (burstcnt < 0)
+ return burstcnt;
size = min_t(int, len - i - 1, burstcnt);
ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf, size);
if (ret < 0)
--
1.7.5.4
^ permalink raw reply related [flat|nested] 3+ messages in thread