Skip to content

Commit

Permalink
Merge branch 'for-linus' of git://git.selinuxproject.org/~jmorris/lin…
Browse files Browse the repository at this point in the history
…ux-security

* 'for-linus' of git://git.selinuxproject.org/~jmorris/linux-security:
  TPM: Zero buffer after copying to userspace
  TPM: Call tpm_transmit with correct size
  TPM: tpm_nsc: Fix a double free of pdev in cleanup_nsc
  TPM: TCG_ATMEL should depend on HAS_IOPORT
  • Loading branch information
Linus Torvalds committed Sep 23, 2011
2 parents e369fde + 3321c07 commit d942e43
Show file tree
Hide file tree
Showing 3 changed files with 9 additions and 3 deletions.
1 change: 1 addition & 0 deletions drivers/char/tpm/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ config TCG_NSC

config TCG_ATMEL
tristate "Atmel TPM Interface"
depends on PPC64 || HAS_IOPORT
---help---
If you have a TPM security chip from Atmel say Yes and it
will be accessible from within Linux. To compile this driver
Expand Down
9 changes: 8 additions & 1 deletion drivers/char/tpm/tpm.c
Original file line number Diff line number Diff line change
Expand Up @@ -383,6 +383,9 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
u32 count, ordinal;
unsigned long stop;

if (bufsiz > TPM_BUFSIZE)
bufsiz = TPM_BUFSIZE;

count = be32_to_cpu(*((__be32 *) (buf + 2)));
ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
if (count == 0)
Expand Down Expand Up @@ -1102,6 +1105,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
{
struct tpm_chip *chip = file->private_data;
ssize_t ret_size;
int rc;

del_singleshot_timer_sync(&chip->user_read_timer);
flush_work_sync(&chip->work);
Expand All @@ -1112,8 +1116,11 @@ ssize_t tpm_read(struct file *file, char __user *buf,
ret_size = size;

mutex_lock(&chip->buffer_mutex);
if (copy_to_user(buf, chip->data_buffer, ret_size))
rc = copy_to_user(buf, chip->data_buffer, ret_size);
memset(chip->data_buffer, 0, ret_size);
if (rc)
ret_size = -EFAULT;

mutex_unlock(&chip->buffer_mutex);
}

Expand Down
2 changes: 0 additions & 2 deletions drivers/char/tpm/tpm_nsc.c
Original file line number Diff line number Diff line change
Expand Up @@ -396,8 +396,6 @@ static void __exit cleanup_nsc(void)
if (pdev) {
tpm_nsc_remove(&pdev->dev);
platform_device_unregister(pdev);
kfree(pdev);
pdev = NULL;
}

platform_driver_unregister(&nsc_drv);
Expand Down

0 comments on commit d942e43

Please sign in to comment.