Commit d942e43b authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.selinuxproject.org/~jmorris/linux-security

* 'for-linus' of git://git.selinuxproject.org/~jmorris/linux-security:
  TPM: Zero buffer after copying to userspace
  TPM: Call tpm_transmit with correct size
  TPM: tpm_nsc: Fix a double free of pdev in cleanup_nsc
  TPM: TCG_ATMEL should depend on HAS_IOPORT
parents e369fde1 3321c07a
...@@ -43,6 +43,7 @@ config TCG_NSC ...@@ -43,6 +43,7 @@ config TCG_NSC
config TCG_ATMEL config TCG_ATMEL
tristate "Atmel TPM Interface" tristate "Atmel TPM Interface"
depends on PPC64 || HAS_IOPORT
---help--- ---help---
If you have a TPM security chip from Atmel say Yes and it If you have a TPM security chip from Atmel say Yes and it
will be accessible from within Linux. To compile this driver will be accessible from within Linux. To compile this driver
......
...@@ -383,6 +383,9 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf, ...@@ -383,6 +383,9 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
u32 count, ordinal; u32 count, ordinal;
unsigned long stop; unsigned long stop;
if (bufsiz > TPM_BUFSIZE)
bufsiz = TPM_BUFSIZE;
count = be32_to_cpu(*((__be32 *) (buf + 2))); count = be32_to_cpu(*((__be32 *) (buf + 2)));
ordinal = be32_to_cpu(*((__be32 *) (buf + 6))); ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
if (count == 0) if (count == 0)
...@@ -1102,6 +1105,7 @@ ssize_t tpm_read(struct file *file, char __user *buf, ...@@ -1102,6 +1105,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
{ {
struct tpm_chip *chip = file->private_data; struct tpm_chip *chip = file->private_data;
ssize_t ret_size; ssize_t ret_size;
int rc;
del_singleshot_timer_sync(&chip->user_read_timer); del_singleshot_timer_sync(&chip->user_read_timer);
flush_work_sync(&chip->work); flush_work_sync(&chip->work);
...@@ -1112,8 +1116,11 @@ ssize_t tpm_read(struct file *file, char __user *buf, ...@@ -1112,8 +1116,11 @@ ssize_t tpm_read(struct file *file, char __user *buf,
ret_size = size; ret_size = size;
mutex_lock(&chip->buffer_mutex); mutex_lock(&chip->buffer_mutex);
if (copy_to_user(buf, chip->data_buffer, ret_size)) rc = copy_to_user(buf, chip->data_buffer, ret_size);
memset(chip->data_buffer, 0, ret_size);
if (rc)
ret_size = -EFAULT; ret_size = -EFAULT;
mutex_unlock(&chip->buffer_mutex); mutex_unlock(&chip->buffer_mutex);
} }
......
...@@ -396,8 +396,6 @@ static void __exit cleanup_nsc(void) ...@@ -396,8 +396,6 @@ static void __exit cleanup_nsc(void)
if (pdev) { if (pdev) {
tpm_nsc_remove(&pdev->dev); tpm_nsc_remove(&pdev->dev);
platform_device_unregister(pdev); platform_device_unregister(pdev);
kfree(pdev);
pdev = NULL;
} }
platform_driver_unregister(&nsc_drv); platform_driver_unregister(&nsc_drv);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment